@ai-dossier/sched 0.46.0 → 0.47.0

package/dist/batch-dispatch.js

@@ -12,7 +12,8 @@
  * at batch-phase granularity instead of per-issue-phase granularity:
  *
  * ```
- * ready → executing(member i/N) ⟲ → validating → reviewing → shipping
+ * ready → executing(serial: member i/N ⟲ | parallel: members ∥ + ordered landing)
+ *   → validating → reviewing → shipping
  *   → awaiting-merge → merged → deployed → reported → done
  * failure rails (RFC F.2/F.8/F.9):
  *   executing → dissolving  (a member self-reports blocked, RFC F.1)
@@ -98,6 +99,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.memberBranchFor = memberBranchFor;
 exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
+exports.memberDispatchModeFor = memberDispatchModeFor;
 exports.runBatchTick = runBatchTick;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -197,7 +199,9 @@ function handleDeadDispatchApiError(deps, batchId, logFile, offset, now, options
         return false;
     deps.store.withLock((s) => {
         let n = (0, dispatch_health_1.recordDispatchApiError)((event, unitId, extra) => journalEvent(deps, event, unitId, extra), s, unit(batchId), apiError);
-        if (options.release ?? true)
+        if (options.releaseWith)
+            n = options.releaseWith(n);
+        else if (options.release ?? true)
             n = releaseSlot(n, batchId, now);
         return { state: n, result: undefined };
     });
@@ -789,13 +793,9 @@ landed) {
         });
         return;
     }
-    // Route through `runTeardown` for the same guarantees `teardownBatch`
-    // gets: pool returns are verify-first idempotent and refuse to claim
-    // success unless the pool's own self-check reports the entry `warm`;
-    // cold removes post-verify the path is gone and unlisted. Nulls first —
-    // clear the fields BEFORE the exec so a crash mid-teardown doesn't retry
-    // into a half-cleaned tree (the re-derived path is deterministic if a
-    // leftover does survive).
+    // Nulls first — clear the fields BEFORE the exec so a crash mid-teardown
+    // doesn't retry into a half-cleaned tree (the re-derived path is
+    // deterministic if a leftover does survive).
     deps.store.withLock((s) => {
         const b = (0, state_1.findBatch)(s, batchId);
         if (!b)
@@ -805,7 +805,29 @@ landed) {
             result: undefined,
         };
     });
-    const t = (0, teardown_1.runTeardown)(deps.exec, deps.repoDir, { worktree, poolClaimed: batch.member_pool_claimed === true, branch }, deps.fsExists);
+    teardownMemberTree(deps, batchId, { worktree, branch, poolClaimed: batch.member_pool_claimed === true }, landed);
+}
+/**
+ * The exec half of a member teardown, shared by the serial rail
+ * (`teardownMemberWorktree`, which first clears the batch's member fields) and
+ * the parallel rail (#809: `evictParallelMember`, `advanceParallelBatch`,
+ * `teardownParallelRuns`). See
+ * `teardownMemberWorktree` for the landed/evicted branch policy.
+ */
+function teardownMemberTree(deps, batchId, tree, landed) {
+    const { worktree, branch } = tree;
+    if (branch !== null && !attribution_1.SAFE_REF_RE.test(branch)) {
+        journalEvent(deps, 'teardown-failed', unit(batchId), {
+            cleanup: 'failed-invalid-branch-name',
+            detail: branch,
+        });
+        return;
+    }
+    // Route through `runTeardown` for the same guarantees `teardownBatch`
+    // gets: pool returns are verify-first idempotent and refuse to claim
+    // success unless the pool's own self-check reports the entry `warm`;
+    // cold removes post-verify the path is gone and unlisted.
+    const t = (0, teardown_1.runTeardown)(deps.exec, deps.repoDir, { worktree, poolClaimed: tree.poolClaimed, branch }, deps.fsExists);
     const treeCleared = !t.cleanup.startsWith('failed');
     let branchCleanup = 'skipped';
     if (branch !== null && treeCleared) {
@@ -858,9 +880,10 @@ function blockLandingFailure(deps, config, batch, reason, now, result) {
     blockBatchForOperator(deps, config, batch.id, { reason }, now, result);
 }
 /**
- * Spawn one batch member's member-cycle agent (#677) into the slot a prior
- * member (or batch-setup) just released — each member in its OWN worktree
- * off the integration branch, dispatched serially as before. Prepared by
+ * Spawn one SERIAL batch member's member-cycle agent (#677) into the slot a
+ * prior member (or batch-setup) just released — each member in its OWN
+ * worktree off the integration branch. Parallel batches (#809) spawn through
+ * `spawnParallelMembers` instead, one slot per member. Prepared by
  * {@link prepareMemberWorktree} at the spawn site (outside the lock); this
  * function only patches state and spawns.
  */
@@ -902,6 +925,42 @@ function advanceMemberToValidated(state, memberIssue, now) {
     return next;
 }
 function spawnMember(deps, dispatch, state, slot, batchId, now, result, member) {
+    const batch = (0, state_1.findBatch)(state, batchId);
+    const memberIssue = batch?.members[(batch?.executing_member ?? 0) - 1];
+    if (batch && memberIssue === undefined) {
+        journalEvent(deps, 'unit-failed', unit(batchId), {
+            reason: 'no-member',
+            detail: `spawnMember: executing_member ${batch.executing_member} has no member issue`,
+        });
+        return releaseSlot(state, batchId, now);
+    }
+    const spawned = spawnMemberAgent(deps, dispatch, state, slot, batchId, now, result, {
+        index: batch?.executing_member ?? 0,
+        issue: memberIssue ?? 0,
+        member,
+        unitId: unit(batchId),
+        release: (s) => releaseSlot(s, batchId, now),
+    });
+    if (!spawned.ok)
+        return spawned.state;
+    // #677: persist the member's worktree context — a takeover redispatch or a
+    // `sched resume --batch` recheck after an engine restart must land in the
+    // SAME worktree/branch this prompt names, not re-derive (or worse,
+    // re-create) it.
+    return (0, state_1.patchBatch)(spawned.state, batchId, {
+        member_branch: member.branch,
+        member_worktree: member.worktree,
+        member_pool_claimed: member.poolClaimed,
+    }, now);
+}
+/**
+ * Spawn ONE member's member-cycle agent into `slot` — the shared core of the
+ * serial rail (`spawnMember`, the batch's own slot) and the parallel rail
+ * (`spawnParallelMembers`, #809: the member's own `batch:<id>#<issue>` slot).
+ * Patches the slot and the member's queue entry; the caller persists its own
+ * member context. On failure the slot is released through `target.release`.
+ */
+function spawnMemberAgent(deps, dispatch, state, slot, batchId, now, result, target) {
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.worktree === null || batch.branch === null) {
         // A leaked `assigned` slot with `pid: null` is invisible to `dead`
@@ -911,16 +970,9 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
             reason: 'no-worktree',
             detail: 'spawnMember: batch has no worktree/branch — batch-setup has not landed',
         });
-        return releaseSlot(state, batchId, now);
-    }
-    const memberIssue = batch.members[batch.executing_member - 1];
-    if (memberIssue === undefined) {
-        journalEvent(deps, 'unit-failed', unit(batchId), {
-            reason: 'no-member',
-            detail: `spawnMember: executing_member ${batch.executing_member} has no member issue`,
-        });
-        return releaseSlot(state, batchId, now);
+        return { ok: false, state: target.release(state) };
     }
+    const memberIssue = target.issue;
     const withStatus = advanceMemberToInWork(state, memberIssue, now);
     const memberEntry = (0, state_1.findEntry)(withStatus, memberIssue);
     // #771: a `review=full` member dispatches at `strong` minimum (within this
@@ -932,8 +984,8 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
     // #677: the prompt carries THIS member's own worktree and the integration
     // branch it was cut from — `member-cycle`'s `worktree`/`integration_branch`
     // inputs. The shared batch worktree is no longer a member surface at all.
-    const prompt = (0, dispatch_1.buildMemberPrompt)(dispatch.memberPrompt, memberIssue, batchId, member.worktree, batch.branch, review);
-    const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, batch.executing_member, memberIssue);
+    const prompt = (0, dispatch_1.buildMemberPrompt)(dispatch.memberPrompt, memberIssue, batchId, target.member.worktree, batch.branch, review);
+    const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, target.index, memberIssue);
     // #629: captured BEFORE spawning, mirroring `engine.ts`'s own
     // `spawnAndRecord` — the log is per-role and append-mode, so the size at
     // this instant is exactly where THIS dispatch's own output starts. Fences
@@ -949,8 +1001,8 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
             reason: 'spawn-error',
             detail: `member #${memberIssue} spawn failed: ${err.message}`,
         });
-        result.failed.push(unit(batchId));
-        return releaseSlot(withStatus, batchId, now);
+        result.failed.push(target.unitId);
+        return { ok: false, state: target.release(withStatus) };
     }
     const patch = {
         pid,
@@ -963,18 +1015,9 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
         spawned_at: now.toISOString(),
         log_offset_at_spawn: logOffset,
     };
-    let next = slot.status === 'assigned' || slot.status === 'recovering'
+    const next = slot.status === 'assigned' || slot.status === 'recovering'
         ? (0, state_1.transitionSlot)(withStatus, slot.id, 'running', patch, now)
         : withStatus;
-    // #677: persist the member's worktree context — a takeover redispatch or a
-    // `sched resume --batch` recheck after an engine restart must land in the
-    // SAME worktree/branch this prompt names, not re-derive (or worse,
-    // re-create) it.
-    next = (0, state_1.patchBatch)(next, batchId, {
-        member_branch: member.branch,
-        member_worktree: member.worktree,
-        member_pool_claimed: member.poolClaimed,
-    }, now);
     deps.journal.append((0, journal_1.unitEvent)('spawned', unit(batchId), {
         pid,
         tier,
@@ -983,11 +1026,11 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
         issue: memberIssue,
         ...(0, dispatch_1.journalCmdModelFields)(spawnSpec),
         log: logFile,
-        worktree: member.worktree,
-        detail: `member ${batch.executing_member}/${batch.members.length}`,
+        worktree: target.member.worktree,
+        detail: `member ${target.index}/${batch.members.length}${batch.member_dispatch === 'parallel' ? ' (parallel)' : ''}`,
     }), now);
-    result.spawned.push(unit(batchId));
-    return next;
+    result.spawned.push(target.unitId);
+    return { ok: true, state: next };
 }
 /**
  * First claim of a `ready` batch: assign it a slot, run batch-setup (real
@@ -1054,7 +1097,38 @@ function claimAndSetup(deps, config, dispatch, batchId, now, result) {
             pool_claimed: setup.poolClaimed ? 'true' : 'false',
         },
     });
-    deps.journal.append((0, journal_1.unitEvent)('batch-setup-done', unit(batchId), { detail: setup.worktree }), now);
+    // #809: decided ONCE, here, and persisted — a batch never changes mode mid-run.
+    const mode = memberDispatchModeFor(deps.store.load(), batch, config);
+    deps.journal.append((0, journal_1.unitEvent)('batch-setup-done', unit(batchId), {
+        detail: `${setup.worktree} (members: ${mode})`,
+    }), now);
+    if (mode === 'parallel') {
+        // Parallel members each claim their OWN slot (`batch:<id>#<issue>`), so
+        // the setup slot is released here and the members' worktrees are prepared
+        // by `spawnParallelMembers` (outside the lock, per member).
+        deps.store.withLock((s) => {
+            const b = (0, state_1.findBatch)(s, batchId);
+            if (!b || b.status !== 'ready') {
+                journalEvent(deps, 'unit-failed', unit(batchId), {
+                    reason: 'batch-left-ready-during-setup',
+                    detail: `worktree ${setup.worktree} created but batch is now '${b?.status ?? 'gone'}' — orphaned, manual cleanup required`,
+                });
+                return { state: releaseSlot(s, batchId, now), result: undefined };
+            }
+            let next = (0, state_1.patchBatch)(s, batchId, {
+                branch: setup.branch,
+                worktree: setup.worktree,
+                run_id: setup.runId,
+                pool_claimed: setup.poolClaimed,
+                member_dispatch: 'parallel',
+                member_runs: [],
+            }, now);
+            next = (0, state_1.transitionBatch)(next, batchId, 'executing', { executing_member: 0 }, now);
+            return { state: releaseSlot(next, batchId, now), result: undefined };
+        });
+        spawnParallelMembers(deps, config, dispatch, batchId, now, result);
+        return;
+    }
     // #677: prepare member 1's OWN worktree before claiming the spawn — real
     // git/network work, so OUTSIDE the store lock (the same contract
     // `runBatchSetup` just followed). All-or-nothing: a failed prep posts the
@@ -1114,6 +1188,7 @@ function claimAndSetup(deps, config, dispatch, batchId, now, result) {
             worktree: setup.worktree,
             run_id: setup.runId,
             pool_claimed: setup.poolClaimed,
+            member_dispatch: 'serial',
         }, now);
         next = (0, state_1.transitionBatch)(next, batchId, 'executing', { executing_member: 1 }, now);
         const slot = slotFor(next, batchId);
@@ -1369,14 +1444,20 @@ function runValidate(deps, config, dispatch, batchId, now, result) {
                 return { state: s, result: false };
             if (b.executing_member < b.members.length) {
                 return {
-                    state: (0, state_1.transitionBatch)(s, batchId, 'executing', { executing_member: b.executing_member + 1 }, now),
+                    state: (0, state_1.transitionBatch)(s, batchId, 'executing', 
+                    // #809: a parallel batch spawns every run-less member itself.
+                    isParallelBatch(b) ? {} : { executing_member: b.executing_member + 1 }, now),
                     result: true,
                 };
             }
             return { state: (0, state_1.transitionBatch)(s, batchId, 'reviewing', {}, now), result: undefined };
         });
         if (admitted) {
-            spawnMemberContinuation(deps, config, dispatch, batchId, now, result);
+            const b = (0, state_1.findBatch)(deps.store.load(), batchId);
+            if (b && isParallelBatch(b))
+                spawnParallelMembers(deps, config, dispatch, batchId, now, result);
+            else
+                spawnMemberContinuation(deps, config, dispatch, batchId, now, result);
             return;
         }
         spawnTailAgent(deps, config, dispatch, batchId, now, result);
@@ -1487,7 +1568,7 @@ function evictOffender(deps, config, batchId, offender, attribution, now, result
                 return { state: s, result: undefined };
             if (b.executing_member < b.members.length) {
                 return {
-                    state: (0, state_1.transitionBatch)(s, batchId, 'executing', { executing_member: b.executing_member + 1 }, now),
+                    state: (0, state_1.transitionBatch)(s, batchId, 'executing', isParallelBatch(b) ? {} : { executing_member: b.executing_member + 1 }, now),
                     result: undefined,
                 };
             }
@@ -1535,6 +1616,15 @@ function journalAdvanceSkipped(deps, batchId, memberIssue, currentMember, claim)
     });
 }
 function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, currentMember, memberIssue, now, result) {
+    // #809: a parallel batch reaches this serial rail only through `sched resume
+    // --batch` resolving its gate-inconclusive member — hand back to the
+    // parallel rail instead of advancing a serial member pointer.
+    const current = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (current && isParallelBatch(current)) {
+        settleParallelResume(deps, batchId, memberIssue, now);
+        advanceParallelBatch(deps, config, dispatch, batchId, now, result);
+        return;
+    }
     const isLast = currentMember >= memberCount;
     if (isLast) {
         const claim = claimMemberResolution(deps, batchId, currentMember, now, () => ({
@@ -1639,7 +1729,41 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
     // the fallback for a batch dispatched before member worktrees existed (its
     // members' commits landed directly on the integration branch).
     const worktree = batch.member_worktree ?? batch.worktree;
+    const verdict = evaluateIncrementalGate(deps, batchId, worktree, memberIssue, now);
+    if (verdict.kind === 'pass')
+        return false;
+    if (verdict.kind === 'failed') {
+        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, { reason: verdict.reason, detail: verdict.detail }, now, result);
+        return true;
+    }
+    deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+    // #677: F.11's block semantics are "the member's commit stays on the
+    // branch, nothing requeued/reverted" — under member worktrees that is
+    // true only if the member LANDS before the batch blocks. The block means
+    // the gate could not reach a verdict, not that the work is bad, so the
+    // verified member joins the integration branch and is there for an
+    // operator (or the #686 out-of-band reconcile) to act on. A landing
+    // failure blocks the batch with its own reason — same operator outcome.
+    const landed = landMemberBranch(deps, batchId, now);
+    if (!landed.ok) {
+        blockLandingFailure(deps, config, batch, landed.reason, now, result);
+        return true;
+    }
+    blockBatchForOperator(deps, config, batchId, { reason: verdict.reason, milestonePhase: 'batch-review' }, now, result);
+    return true;
+}
+/**
+ * Run the incremental gate's capabilities against one member worktree and
+ * reach a verdict — journaling, gate logs and `member_gates` included, but NO
+ * state action: serial (`runIncrementalGate`) and parallel
+ * (`reconcileParallelMemberSlot`, #809) members act on the verdict
+ * differently. See `runIncrementalGate`'s doc for the policy.
+ */
+function evaluateIncrementalGate(deps, batchId, worktree, memberIssue, now) {
     const runCapability = deps.runCapability;
+    if (!runCapability)
+        return { kind: 'pass' };
     const gateResults = ['typecheck.run', 'test.focused'].map((id) => ({
         id,
         ...runCapability(worktree, id),
@@ -1680,13 +1804,10 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
         // trap (#594's shape — absence reading as a verdict). Silence must never
         // be mistaken for a pass.
         //
-        // #632: confirmed this fires once per member, not once per tick.
-        // `runIncrementalGate` is called only from the `isMemberComplete` branch
-        // of `reconcileMemberSlot`, and both of that branch's callees
-        // (`completeMemberGate`, `evictMemberAndContinue`) advance
-        // `batch.executing_member` before returning — so the very next tick
-        // reads a DIFFERENT `memberIssue` from `batch.members[executing_member -
-        // 1]`, and this gate never runs twice against the same member.
+        // #632: confirmed this fires once per member, not once per tick: the
+        // gate runs only on a member dispatch's verified completion, and both
+        // rails resolve that member (serial: the pointer advances; parallel:
+        // the run leaves `running` and its slot is released) before returning.
         journalEvent(deps, 'gate-skipped', unit(batchId), {
             issue: memberIssue,
             reason: `gate-skipped:${skipped.id}`,
@@ -1734,15 +1855,13 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
         recordMemberGate(deps, batchId, memberIssue, decisiveGate, now);
     }
     if (earnedFailure) {
-        const reason = `incremental-gate-failed:${earnedFailure.id}`;
         writeGateLog(deps, batchId, earnedFailure.id, memberIssue, earnedFailure.outputTail);
         const excerpt = gateDetailExcerpt(earnedFailure.outputTail, earnedFailure.reason);
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, {
-            reason,
+        return {
+            kind: 'failed',
+            reason: `incremental-gate-failed:${earnedFailure.id}`,
             detail: withExcerpt(`cap run ${earnedFailure.id} reported task-failed with failing-test evidence after member review done`, excerpt),
-        }, now, result);
-        return true;
+        };
     }
     const inconclusive = gateInconclusive ?? unevidencedFailure;
     if (inconclusive) {
@@ -1758,23 +1877,9 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
             reason,
             detail: withExcerpt(`cap run ${inconclusive.id} ${describeInconclusive(inconclusive)} after member review done`, excerpt),
         });
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-        // #677: F.11's block semantics are "the member's commit stays on the
-        // branch, nothing requeued/reverted" — under member worktrees that is
-        // true only if the member LANDS before the batch blocks. The block means
-        // the gate could not reach a verdict, not that the work is bad, so the
-        // verified member joins the integration branch and is there for an
-        // operator (or the #686 out-of-band reconcile) to act on. A landing
-        // failure blocks the batch with its own reason — same operator outcome.
-        const landed = landMemberBranch(deps, batchId, now);
-        if (!landed.ok) {
-            blockLandingFailure(deps, config, batch, landed.reason, now, result);
-            return true;
-        }
-        blockBatchForOperator(deps, config, batchId, { reason, milestonePhase: 'batch-review' }, now, result);
-        return true;
+        return { kind: 'inconclusive', reason, capability: inconclusive.id };
     }
-    return false;
+    return { kind: 'pass' };
 }
 /**
  * The member is verifiably done — self-reported complete AND (when checked)
@@ -1988,7 +2093,9 @@ function resumeBlockedGate(deps, config, dispatch, batchId, now) {
  * instead), so unlike `engine.ts`'s per-unit log, a member's log file is
  * always one-shot and reading from offset 0 is always correct.
  */
-function recordMemberRunLog(deps, dispatch, state, batchId, batch, memberIssue, slot, now) {
+function recordMemberRunLog(deps, dispatch, state, batchId, 
+/** 1-based member index — names the per-member log file (serial: `executing_member`; parallel: `MemberRun.index`). */
+memberIndex, memberIssue, slot, now) {
     if (slot.status !== 'running' || slot.spawned_at === null) {
         journalEvent(deps, 'run-log-skipped', unit(batchId), {
             issue: memberIssue,
@@ -2002,7 +2109,7 @@ function recordMemberRunLog(deps, dispatch, state, batchId, batch, memberIssue,
     const memberEntry = (0, state_1.findEntry)(state, memberIssue);
     const tier = memberEntry ? (0, dispatch_1.memberDispatchTier)(memberEntry) : 'mid';
     const { cmd, model } = (0, dispatch_1.resolveTierSpawn)(dispatch, tier, memberIssue);
-    const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, batch.executing_member, memberIssue);
+    const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, memberIndex, memberIssue);
     // #629: fenced to THIS dispatch's slice (`log_offset_at_spawn`, stamped by
     // `spawnMember`/`spawnMemberContinuation` at spawn time) rather than a
     // fixed byte-0 read. Before #629 a member log never outlived one attempt
@@ -2070,14 +2177,12 @@ function terminalMilestoneForDispatch(deps, memberIssue, slot) {
     }
     return latest;
 }
-function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result) {
-    const state0 = deps.store.load();
-    const batch = (0, state_1.findBatch)(state0, batchId);
-    if (!batch)
-        return;
-    const memberIssue = batch.members[batch.executing_member - 1];
-    if (memberIssue === undefined)
-        return;
+/**
+ * Read one member dispatch's fate: the fenced terminal milestone (#575/#605/
+ * #622) plus liveness, journaling a stale terminal milestone once per
+ * dispatch (#610). Pure reading — the caller acts on the result.
+ */
+function readMemberDispatch(deps, batchId, memberIssue, slot, now) {
     const dead = slot.pid !== null && !deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined);
     // #622: the milestone this DISPATCH's fate should be read from — the last
     // TERMINAL one it posted, not merely the newest one on the issue.
@@ -2096,7 +2201,7 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     // poll) this degrades to the previous latest-only behaviour.
     const milestone = terminalMilestoneForDispatch(deps, memberIssue, slot);
     if (milestone === undefined)
-        return; // unreachable — pause this batch's decisions
+        return { kind: 'unreachable' }; // pause this batch's decisions
     // #575 / #605: fence to THIS member dispatch's `spawned_at` — a member
     // re-added to a fresh batch run after a PREVIOUS batch already posted a
     // terminal `mode=slot` milestone (pilot re-run, requeue-with-context, and
@@ -2135,7 +2240,61 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
             result: undefined,
         }));
     }
-    if ((0, groundtruth_1.isMemberComplete)(milestone, slot.spawned_at)) {
+    if ((0, groundtruth_1.isMemberComplete)(milestone, slot.spawned_at))
+        return { kind: 'complete' };
+    return {
+        kind: 'pending',
+        milestone,
+        dead,
+        blockedNow: (0, groundtruth_1.isMemberBlocked)(milestone, slot.spawned_at),
+    };
+}
+/**
+ * The eviction a blocked-or-dead member dispatch earns (shared by both rails).
+ * #605: only a milestone THIS dispatch posted may name the reason. A dead
+ * agent whose issue carries only a stale `blocked` milestone is an unverified
+ * exit, not a re-run of the previous run's block — reporting the old
+ * `reason=` here is what made the journal misdirect, naming a precondition
+ * that had already been fixed on a run where it no longer applied.
+ * #804: `memberBlockedReason` also names a `review partial` hand-back.
+ */
+function memberFailureFor(read, lastTool) {
+    const rawReason = read.blockedNow && read.milestone ? (0, groundtruth_1.memberBlockedReason)(read.milestone) : undefined;
+    const reason = typeof rawReason === 'string' && rawReason.length > 0
+        ? sanitizeUntrustedText(rawReason)
+        : read.dead
+            ? 'agent-exited-unverified'
+            : 'member-blocked';
+    return {
+        reason,
+        // This rail covers a self-reported block AND a member that simply died, so the
+        // detail must follow the RESOLVED reason — `member blocked` on an
+        // `agent-exited-unverified` eviction contradicts the reason on its own journal line.
+        detail: reason === 'agent-exited-unverified'
+            ? 'member agent exited without posting a terminal milestone'
+            : 'member blocked',
+        // #591: attributes an unverified member exit to a concrete cause (e.g.
+        // `Monitor`) without opening the transcript. Gated on the RESOLVED reason, not
+        // `dead` — a member can be simultaneously `dead` AND carry a milestone-posted
+        // `reason` (it posted `blocked` and then exited), and that real block has no
+        // log-derived cause to attribute; only `agent-exited-unverified` does.
+        extraKv: reason === 'agent-exited-unverified' && lastTool !== null
+            ? { last_tool: lastTool }
+            : undefined,
+    };
+}
+function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result) {
+    const state0 = deps.store.load();
+    const batch = (0, state_1.findBatch)(state0, batchId);
+    if (!batch)
+        return;
+    const memberIssue = batch.members[batch.executing_member - 1];
+    if (memberIssue === undefined)
+        return;
+    const read = readMemberDispatch(deps, batchId, memberIssue, slot, now);
+    if (read.kind === 'unreachable')
+        return;
+    if (read.kind === 'complete') {
         deps.journal.append((0, journal_1.unitEvent)('external-advance', unit(batchId), {
             issue: memberIssue,
             detail: 'member review done',
@@ -2143,7 +2302,7 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // The member's own agent process is done regardless of what the
         // incremental gate below decides — record its telemetry once here (#564)
         // rather than at each of this branch's two later exit points.
-        recordMemberRunLog(deps, dispatch, state0, batchId, batch, memberIssue, slot, now);
+        recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now);
         // Incremental gate (#523 AC2, revised #583) — see `runIncrementalGate`'s
         // own doc comment for the three-way policy. A `true` return means the
         // gate already decided the member's fate (evicted or blocked) and
@@ -2155,9 +2314,8 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result);
         return;
     }
-    const blockedNow = (0, groundtruth_1.isMemberBlocked)(milestone, slot.spawned_at);
-    if (dead &&
-        !blockedNow &&
+    if (read.dead &&
+        !read.blockedNow &&
         handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, batch.executing_member, memberIssue), slot.log_offset_at_spawn ?? 0, now)) {
         // #629: a confirmed provider API error is not a real member failure —
         // evicting the member for an account-wide spend wall would silently
@@ -2166,20 +2324,8 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // place, keeping its position.
         return;
     }
-    if (blockedNow || dead) {
-        // #605: only a milestone THIS dispatch posted may name the reason. A dead
-        // agent whose issue carries only a stale `blocked` milestone is an
-        // unverified exit, not a re-run of the previous run's block — reporting
-        // the old `reason=` here is what made the journal misdirect, naming a
-        // precondition that had already been fixed on a run where it no longer
-        // applied.
-        const rawReason = blockedNow ? milestone?.keys.reason : undefined;
-        const reason = typeof rawReason === 'string' && rawReason.length > 0
-            ? sanitizeUntrustedText(rawReason)
-            : dead
-                ? 'agent-exited-unverified'
-                : 'member-blocked';
-        const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, batch, memberIssue, slot, now);
+    if (read.blockedNow || read.dead) {
+        const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now);
         deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
         // A member that never went green (RFC F.1) evicts DIRECTLY — no aggregate
         // suite has run yet, so there is nothing for `attributing`/`evicting` (the
@@ -2189,23 +2335,7 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // attributing → evicting` is not even a legal edge from mid-`executing`
         // (BATCH_TRANSITIONS has no `executing → evicting`) — this stays entirely
         // within `executing`/`dissolving`, both of which ARE legal from here.
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, {
-            reason,
-            // This rail covers a self-reported block AND a member that simply died, so the
-            // detail must follow the RESOLVED reason — `member blocked` on an
-            // `agent-exited-unverified` eviction contradicts the reason on its own journal line.
-            detail: reason === 'agent-exited-unverified'
-                ? 'member agent exited without posting a terminal milestone'
-                : 'member blocked',
-            // #591: attributes an unverified member exit to a concrete cause (e.g.
-            // `Monitor`) without opening the transcript. Gated on the RESOLVED reason, not
-            // `dead` — a member can be simultaneously `dead` AND carry a milestone-posted
-            // `reason` (it posted `blocked` and then exited), and that real block has no
-            // log-derived cause to attribute; only `agent-exited-unverified` does.
-            extraKv: reason === 'agent-exited-unverified' && lastTool !== null
-                ? { last_tool: lastTool }
-                : undefined,
-        }, now, result);
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, memberFailureFor(read, lastTool), now, result);
     }
 }
 /**
@@ -3006,7 +3136,9 @@ function teardownBatch(deps, batchId) {
     const terminal = (0, state_1.findBatch)(deps.store.load(), batchId);
     const lastMemberLanded = terminal?.ranges.some((r) => r.issue === terminal.members[terminal.executing_member - 1]) ===
         true;
+    const serialTree = terminal?.member_worktree ?? null;
     teardownMemberWorktree(deps, batchId, deps.now(), lastMemberLanded);
+    teardownParallelRuns(deps, batchId, serialTree);
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.worktree === null)
@@ -3030,6 +3162,615 @@ function teardownBatch(deps, batchId) {
         worktree: batch.worktree,
     });
 }
+// --- Parallel member dispatch (#809) ---
+/**
+ * How a batch should dispatch its members (#809) — decided once, at the
+ * `ready → executing` claim, and persisted on `BatchEntry.member_dispatch`.
+ *
+ * Serial when the operator set `member_parallelism: 1`, or the batch itself
+ * says its members are not independent: an eviction group (members that must
+ * revert together — e.g. one built on another's API) or a member whose `deps`
+ * names another member (it must see that member's landed work before it is
+ * cut). Parallel otherwise — the batch-cycle skill's and prep dossier's
+ * design (RFC-0001 §J.3: each member works off the integration branch and
+ * sees no one else's changes until the parent lands them).
+ */
+/** @internal exported for tests. */
+function memberDispatchModeFor(state, batch, config) {
+    if (config.member_parallelism === 1)
+        return 'serial';
+    if (batch.eviction_groups.some((group) => group.length > 1))
+        return 'serial';
+    const members = new Set(batch.members);
+    for (const issue of batch.members) {
+        if ((0, state_1.findEntry)(state, issue)?.deps.some((dep) => members.has(dep)))
+            return 'serial';
+    }
+    return 'parallel';
+}
+/** Whether `batch` runs the parallel member rail — `null` (pre-#809, or not yet claimed) is serial. */
+function isParallelBatch(batch) {
+    return batch.member_dispatch === 'parallel';
+}
+/** At most this many members of one batch run at once (#809) — `max_slots` when unset. */
+function memberParallelism(config) {
+    // Both are validated ≥ 1 at config load (`member_parallelism`, `max_slots`).
+    return config.member_parallelism ?? config.max_slots;
+}
+/** The teardown target of a member run (or a freshly prepared member tree). */
+function runTree(r) {
+    return 'pool_claimed' in r
+        ? { worktree: r.worktree, branch: r.branch, poolClaimed: r.pool_claimed }
+        : { worktree: r.worktree, branch: r.branch, poolClaimed: r.poolClaimed };
+}
+/**
+ * Record that a run's tree is gone. Written AFTER the teardown, so a crash in
+ * between re-runs the (idempotent) teardown from `teardownParallelRuns`
+ * instead of leaking the tree.
+ */
+function markTornDown(deps, batchId, issue, now) {
+    deps.store.withLock((s) => ({
+        state: patchRun(s, batchId, issue, { torn_down: true }, now),
+        result: undefined,
+    }));
+}
+/** Merge `patch` into member `issue`'s run record (no-op when it has none). */
+function patchRun(state, batchId, issue, patch, now) {
+    const batch = (0, state_1.findBatch)(state, batchId);
+    if (!batch || !batch.member_runs.some((r) => r.issue === issue))
+        return state;
+    return (0, state_1.patchBatch)(state, batchId, { member_runs: batch.member_runs.map((r) => (r.issue === issue ? { ...r, ...patch } : r)) }, now);
+}
+/** Insert or replace member `run.issue`'s run record. */
+function upsertRun(state, batchId, run, now) {
+    const batch = (0, state_1.findBatch)(state, batchId);
+    if (!batch)
+        return state;
+    const others = batch.member_runs.filter((r) => r.issue !== run.issue);
+    return (0, state_1.patchBatch)(state, batchId, { member_runs: [...others, run].sort((a, b) => a.index - b.index) }, now);
+}
+/**
+ * Whether `issue` is still an active member of `batch` — not evicted, and its
+ * queue entry (when it has one) still a live slot-mode entry of THIS batch. An
+ * evicted member's entry is requeued `mode: 'full', batch: null`, so both
+ * checks agree; the entry check also covers a member stopped or abandoned out
+ * from under the batch.
+ */
+function memberStillInBatch(state, batch, issue) {
+    if (batch.evictions.some((e) => e.issue === issue))
+        return false;
+    const entry = (0, state_1.findEntry)(state, issue);
+    if (entry === undefined)
+        return true;
+    return (entry.mode === 'slot' && entry.batch === batch.id && !types_1.TERMINAL_ISSUE_STATUSES.has(entry.status));
+}
+/** Whether member `issue`'s own slot currently holds a live agent. */
+function hasLiveMemberSlot(state, batchId, issue) {
+    const slot = (0, state_1.slotForBatchMember)(state, batchId, issue);
+    return slot !== undefined && types_1.LIVE_SLOT_STATUSES.has(slot.status);
+}
+/**
+ * The next member to (re)spawn: first a run still `running` that holds no slot
+ * (an api-error hold released it, its spawn threw, or the engine restarted) —
+ * respawned in place, in its own worktree — then the first member in order
+ * that has no run yet.
+ */
+function nextParallelCandidate(state, batch, attempted) {
+    for (const run of batch.member_runs) {
+        if (run.status === 'running' &&
+            !attempted.has(run.issue) &&
+            (0, state_1.slotForBatchMember)(state, batch.id, run.issue) === undefined &&
+            memberStillInBatch(state, batch, run.issue)) {
+            return { issue: run.issue, index: run.index, run };
+        }
+    }
+    for (const [i, issue] of batch.members.entries()) {
+        if (attempted.has(issue) || batch.member_runs.some((r) => r.issue === issue))
+            continue;
+        if (!memberStillInBatch(state, batch, issue))
+            continue;
+        return { issue, index: i + 1 };
+    }
+    return undefined;
+}
+/**
+ * Fill the batch's member concurrency: spawn members into their OWN slots
+ * (`batch:<id>#<issue>`) while fewer than `member_parallelism` run and the
+ * scheduler has free capacity. Each gets its own worktree off the integration
+ * branch (`prepareMemberWorktree`, outside the lock) — the integration branch
+ * does not move until members land, so concurrent members are all cut from the
+ * same base. A member whose worktree cannot be prepared is evicted (requeued
+ * full-cycle, which does its own setup) rather than retried every tick in
+ * front of the members behind it.
+ */
+function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
+    const limit = memberParallelism(config);
+    const fsExists = deps.fsExists ?? ((p) => fs.existsSync(p));
+    const attempted = new Set();
+    // Bounded by the member count: every iteration marks one member attempted.
+    for (;;) {
+        const state = deps.store.load();
+        const batch = (0, state_1.findBatch)(state, batchId);
+        if (!batch || batch.status !== 'executing' || !isParallelBatch(batch))
+            return;
+        const live = batch.member_runs.filter((r) => hasLiveMemberSlot(state, batchId, r.issue)).length;
+        if (live >= limit || (0, scheduler_1.freeCapacity)(state, config) === 0)
+            return;
+        const next = nextParallelCandidate(state, batch, attempted);
+        if (next === undefined)
+            return;
+        attempted.add(next.issue);
+        let member;
+        const reusable = next.run !== undefined &&
+            fsExists(next.run.worktree) &&
+            (next.run.pool_claimed ||
+                (0, teardown_1.isSafeWorktree)(path.resolve(deps.exec('git', ['rev-parse', '--show-toplevel'], deps.repoDir) ?? deps.repoDir), next.run.worktree));
+        if (next.run !== undefined && reusable) {
+            member = {
+                branch: next.run.branch,
+                worktree: next.run.worktree,
+                poolClaimed: next.run.pool_claimed,
+            };
+        }
+        else {
+            // The serial-member fields describe no member of a parallel batch —
+            // blank them so the reuse branch re-derives THIS member's branch/path.
+            const prep = prepareMemberWorktree(deps, { ...batch, member_branch: null, member_worktree: null, member_pool_claimed: false }, next.index, next.issue, now);
+            if (!prep.ok) {
+                evictMemberDirectly(deps, config, batchId, next.issue, {
+                    reason: `member-worktree-prep-failed:${prep.reason}`,
+                    detail: `member worktree prep failed: ${prep.reason} (member ${next.index} #${next.issue}, branch ${memberBranchFor(batchId, next.index, next.issue)})`,
+                }, now);
+                result.failed.push((0, state_1.batchMemberUnit)(batchId, next.issue));
+                continue;
+            }
+            member = prep;
+        }
+        const recorded = deps.store.withLock((s) => {
+            const b = (0, state_1.findBatch)(s, batchId);
+            if (!b || b.status !== 'executing' || (0, state_1.slotForBatchMember)(s, batchId, next.issue)) {
+                return { state: s, result: false };
+            }
+            // The run is recorded whether or not a slot is free and the spawn
+            // succeeds: its worktree exists either way, and a `running` run with no
+            // slot is exactly what a later pass respawns in place.
+            let n = upsertRun(s, batchId, {
+                issue: next.issue,
+                index: next.index,
+                branch: member.branch,
+                worktree: member.worktree,
+                pool_claimed: member.poolClaimed,
+                status: 'running',
+                gate_inconclusive: null,
+                torn_down: false,
+            }, now);
+            if ((0, scheduler_1.freeCapacity)(n, config) === 0)
+                return { state: n, result: true };
+            const memberUnit = (0, state_1.batchMemberUnit)(batchId, next.issue);
+            const assigned = (0, scheduler_1.assignToIdleSlot)(n, memberUnit, 'member', now, 'cycle');
+            const slot = assigned.state.slots.find((x) => x.id === assigned.slotId);
+            if (!slot)
+                return { state: n, result: true };
+            n = spawnMemberAgent(deps, dispatch, assigned.state, slot, batchId, now, result, {
+                index: next.index,
+                issue: next.issue,
+                member,
+                unitId: memberUnit,
+                release: (st) => (0, state_1.releaseBatchMemberSlot)(st, batchId, next.issue, now),
+            }).state;
+            n = (0, state_1.patchBatch)(n, batchId, { executing_member: Math.max(b.executing_member, next.index) }, now);
+            return { state: n, result: true };
+        });
+        if (!recorded && next.run === undefined) {
+            // The batch left `executing` (stopped/abandoned/dissolved) while the
+            // tree was being prepared outside the lock — nothing records it, so
+            // give it back now rather than leak a worktree/pool claim.
+            journalEvent(deps, 'unit-failed', unit(batchId), {
+                issue: next.issue,
+                reason: 'member-worktree-orphaned',
+                detail: `batch left executing while member ${next.index}'s tree ${member.worktree} was prepared — tearing it down`,
+            });
+            teardownMemberTree(deps, batchId, runTree(member), false);
+        }
+    }
+}
+/**
+ * Evict one parallel member directly (RFC F.1 — its commits never landed) and
+ * tear its worktree down; the pushed member branch is KEPT on origin (the
+ * evicted work's only recoverable copy, as in serial mode). A dissolve this
+ * tips over is torn down by `teardownBatch`, which covers every live run.
+ */
+function evictParallelMember(deps, config, batchId, run, failure, now, result) {
+    const { dissolved, duplicate } = evictMemberDirectly(deps, config, batchId, run.issue, failure, now);
+    if (duplicate)
+        return;
+    result.failed.push(dissolved ? unit(batchId) : (0, state_1.batchMemberUnit)(batchId, run.issue));
+    if (dissolved)
+        return;
+    deps.store.withLock((s) => ({
+        state: patchRun(s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now),
+        result: undefined,
+    }));
+    teardownMemberTree(deps, batchId, runTree(run), false);
+    markTornDown(deps, batchId, run.issue, now);
+}
+/**
+ * Reconcile one parallel member's slot — the parallel twin of
+ * `reconcileMemberSlot`: the same fenced milestone read, the same incremental
+ * gate (in the member's OWN worktree), the same eviction rail. A verified
+ * member does NOT land here: landing is ordered (`advanceParallelBatch`), so
+ * it only leaves `running` and gives its slot back.
+ */
+function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot, now, result) {
+    const state0 = deps.store.load();
+    const read = readMemberDispatch(deps, batchId, run.issue, slot, now);
+    if (read.kind === 'unreachable')
+        return;
+    const memberUnit = (0, state_1.batchMemberUnit)(batchId, run.issue);
+    const release = (s) => (0, state_1.releaseBatchMemberSlot)(s, batchId, run.issue, now);
+    if (read.kind === 'complete') {
+        // Its slot is about to be released and its tree rebased/force-pushed at
+        // landing: an agent still running after `review done` would keep writing
+        // into that tree with its pid no longer tracked anywhere (so neither a
+        // dissolve nor `sched stop --batch` could stop it). Its work is done —
+        // stop it first.
+        if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        }
+        journalEvent(deps, 'external-advance', unit(batchId), {
+            issue: run.issue,
+            detail: 'member review done',
+        });
+        recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now);
+        const verdict = evaluateIncrementalGate(deps, batchId, run.worktree, run.issue, now);
+        if (verdict.kind === 'failed') {
+            deps.store.withLock((s) => ({ state: release(s), result: undefined }));
+            evictParallelMember(deps, config, batchId, run, { reason: verdict.reason, detail: verdict.detail }, now, result);
+            return;
+        }
+        deps.store.withLock((s) => ({
+            // #629: a verified member completion is proof dispatch is healthy.
+            state: patchRun((0, dispatch_health_1.resetDispatchApiErrorStreak)(release(s)), batchId, run.issue, {
+                status: 'verified',
+                gate_inconclusive: verdict.kind === 'inconclusive' ? verdict.capability : null,
+            }, now),
+            result: undefined,
+        }));
+        result.completed.push(memberUnit);
+        return;
+    }
+    if (read.dead &&
+        !read.blockedNow &&
+        handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, run.index, run.issue), slot.log_offset_at_spawn ?? 0, now, { releaseWith: release })) {
+        // #629: not a member failure — the run stays `running` with no slot, and
+        // `spawnParallelMembers` (pause-gated) respawns it in place.
+        return;
+    }
+    if (read.blockedNow || read.dead) {
+        const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now);
+        deps.store.withLock((s) => ({ state: release(s), result: undefined }));
+        evictParallelMember(deps, config, batchId, run, memberFailureFor(read, lastTool), now, result);
+    }
+}
+/**
+ * Land one verified parallel member onto the integration branch (#809): rebase
+ * its commits onto the integration TIP in its own worktree (earlier members may
+ * have landed since it was cut), refresh the pushed member branch, then
+ * `merge --ff-only` + push in the batch worktree — the same linear,
+ * `(#<issue>)`-trailed history serial landing produces, so `memberRanges`
+ * attribution and per-member commits are unchanged.
+ *
+ * `conflict` — the member's diff does not apply on top of the members landed
+ * before it (the rebase is aborted, leaving its pushed branch untouched); the
+ * caller evicts it, batch-integrate's eviction verdict. `failed` — a mechanical
+ * step failed after a clean rebase; the caller blocks the batch, like serial.
+ */
+function landParallelRun(deps, batch, run, now) {
+    const fail = (reason, detail) => {
+        journalEvent(deps, 'landing-failed', unit(batch.id), { issue: run.issue, reason, detail });
+        return { kind: 'failed', reason };
+    };
+    if (batch.worktree === null || batch.branch === null) {
+        return fail('no-integration-branch', 'batch has no integration worktree/branch');
+    }
+    // Defense in depth (CWE-88): persisted refs reach git argv below.
+    if (!attribution_1.SAFE_REF_RE.test(run.branch) || !attribution_1.SAFE_REF_RE.test(batch.branch)) {
+        return fail('invalid-branch-name', `persisted member/integration branch failed SAFE_REF_RE: ${run.branch} → ${batch.branch}`);
+    }
+    // The rebase rewrites whatever is checked out in `run.worktree` — confirm
+    // it is this member's own tree, present, on this member's branch first.
+    if (!(deps.fsExists ?? ((p) => fs.existsSync(p)))(run.worktree)) {
+        return fail('member-worktree-missing', `member worktree ${run.worktree} is gone from disk`);
+    }
+    if (!run.pool_claimed) {
+        const root = deps.exec('git', ['rev-parse', '--show-toplevel'], deps.repoDir) ?? deps.repoDir;
+        if (!(0, teardown_1.isSafeWorktree)(path.resolve(root), run.worktree)) {
+            return fail('unsafe-member-worktree', `member worktree ${run.worktree} is outside the repo's worktree roots`);
+        }
+    }
+    // A rebase an engine crash left half-done would make the next one fail
+    // ("rebase already in progress") and read as a conflict — clear it first
+    // (a no-op failure when none is in progress).
+    deps.exec('git', ['rebase', '--abort'], run.worktree);
+    const head = deps.exec('git', ['symbolic-ref', '--short', 'HEAD'], run.worktree)?.trim();
+    if (head !== run.branch) {
+        return fail('member-worktree-off-branch', `member worktree ${run.worktree} has ${head ?? 'no branch'} checked out, expected ${run.branch} — not rebasing someone else's checkout`);
+    }
+    // The force-push below must never overwrite work pushed to the member
+    // branch that is not part of what was verified here. Read origin's tip NOW
+    // (a bare `--force-with-lease` would trust `origin/<branch>`, which any fetch
+    // in the shared repo refreshes) and require it to be an ancestor of the
+    // verified local branch (the member may not have pushed its last commit);
+    // the lease then pins exactly that tip.
+    const verified = deps
+        .exec('git', ['rev-parse', `refs/heads/${run.branch}`], run.worktree)
+        ?.trim();
+    const remoteLine = deps.exec('git', ['ls-remote', 'origin', `refs/heads/${run.branch}`], run.worktree);
+    if (!verified || !groundtruth_1.GIT_OID_RE.test(verified) || remoteLine === null) {
+        return fail('member-branch-unresolved', `could not resolve ${run.branch} locally and on origin before landing`);
+    }
+    const remoteTip = remoteLine.trim().split(/\s+/)[0] ?? '';
+    if (remoteTip !== '' &&
+        (!groundtruth_1.GIT_OID_RE.test(remoteTip) ||
+            deps.exec('git', ['merge-base', '--is-ancestor', remoteTip, verified], run.worktree) === null)) {
+        return fail('member-branch-diverged', `origin/${run.branch} (${remoteTip.slice(0, 12)}) holds commits the verified ${verified.slice(0, 12)} does not — something was pushed after verification; blocking rather than overwriting it`);
+    }
+    // `--autostash`: a stray uncommitted file in the member tree is not the
+    // member's deliverable and must not read as a conflict.
+    if (deps.exec('git', ['rebase', '--autostash', batch.branch], run.worktree) === null) {
+        // Only a rebase stopped on unmerged paths is a CONFLICT (eviction); any
+        // other failure is mechanical and blocks like the other landing steps.
+        const unmerged = (deps.exec('git', ['diff', '--name-only', '--diff-filter=U'], run.worktree) ?? '')
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0);
+        deps.exec('git', ['rebase', '--abort'], run.worktree);
+        if (unmerged.length === 0) {
+            return fail('member-rebase-failed', `git rebase of ${run.branch} onto ${batch.branch} failed with no conflicting paths — blocking for an operator`);
+        }
+        const detail = `${run.branch} does not rebase cleanly onto ${batch.branch} — conflicting with members landed before it in: ${unmerged.slice(0, 10).join(', ')}; evicted with its pushed branch intact`;
+        journalEvent(deps, 'landing-failed', unit(batch.id), {
+            issue: run.issue,
+            reason: 'landing-conflict',
+            detail,
+        });
+        return { kind: 'conflict', detail };
+    }
+    if (deps.exec('git', [
+        'push',
+        `--force-with-lease=refs/heads/${run.branch}:${remoteTip}`,
+        'origin',
+        '--',
+        run.branch,
+    ], run.worktree) === null) {
+        return fail('member-push-failed', `rebased ${run.branch} onto ${batch.branch} but could not push it (origin moved since ${remoteTip.slice(0, 12) || 'absent'}, or the push failed) — blocking so nothing pushed after verification is overwritten`);
+    }
+    if (deps.exec('git', ['merge', '--ff-only', run.branch], batch.worktree) === null) {
+        return fail('landing-merge-failed', `git merge --ff-only ${run.branch} into ${batch.branch} failed right after a clean rebase — blocking for an operator`);
+    }
+    if (deps.exec('git', ['push', 'origin', '--', batch.branch], batch.worktree) === null) {
+        return fail('landing-push-failed', `landed ${run.branch} on ${batch.branch} locally but the push failed — blocking so origin stays the durable copy`);
+    }
+    deps.journal.append((0, journal_1.unitEvent)('member-landed', unit(batch.id), {
+        issue: run.issue,
+        detail: `${run.branch} rebased onto and fast-forwarded into ${batch.branch} (member ${run.index}, parallel)`,
+    }), now);
+    return { kind: 'landed' };
+}
+/**
+ * Walk members IN ORDER: skip every resolved one (landed, evicted, or no longer
+ * in the batch); the first unresolved one is either landable (`verified`) or
+ * something the walk must wait for (not yet spawned, or still running) — later
+ * members never land ahead of it, so the integration branch always holds a
+ * member-order prefix.
+ */
+function nextLandingStep(state, batch) {
+    for (const issue of batch.members) {
+        const run = batch.member_runs.find((r) => r.issue === issue);
+        if (run?.status === 'landed' || run?.status === 'evicted')
+            continue;
+        if (!memberStillInBatch(state, batch, issue))
+            continue;
+        if (run === undefined || run.status === 'running')
+            return { kind: 'wait' };
+        return { kind: 'land', run };
+    }
+    return { kind: 'done' };
+}
+/**
+ * Land every landable member in order, then — once every member is resolved —
+ * either block on a gate-inconclusive member (serial parity: it landed, the
+ * batch blocks for `sched resume --batch`) or move to `validating` and run the
+ * aggregate suite once.
+ */
+function advanceParallelBatch(deps, config, dispatch, batchId, now, result) {
+    // Bounded: every iteration lands or evicts one member.
+    for (;;) {
+        const state = deps.store.load();
+        const batch = (0, state_1.findBatch)(state, batchId);
+        if (!batch || batch.status !== 'executing' || !isParallelBatch(batch))
+            return;
+        const step = nextLandingStep(state, batch);
+        if (step.kind === 'wait')
+            return;
+        if (step.kind === 'done') {
+            finalizeParallelMembers(deps, config, dispatch, batchId, now, result);
+            return;
+        }
+        const { run } = step;
+        const landed = landParallelRun(deps, batch, run, now);
+        if (landed.kind === 'conflict') {
+            evictParallelMember(deps, config, batchId, run, { reason: 'landing-conflict', detail: landed.detail }, now, result);
+            continue;
+        }
+        if (landed.kind === 'failed') {
+            stopRunningMembers(deps, batchId, now);
+            blockBatchForOperator(deps, config, batchId, { reason: landed.reason }, now, result);
+            return;
+        }
+        // `git log` outside the lock (same invariant as `completeMemberGate`).
+        const ranges = (0, attribution_1.memberRanges)(boundaryCommits(deps, batch));
+        deps.store.withLock((s) => {
+            let n = (0, state_1.patchBatch)(s, batchId, { ranges }, now);
+            n = advanceMemberToValidated(n, run.issue, now);
+            n = patchRun(n, batchId, run.issue, { status: 'landed' }, now);
+            return { state: n, result: undefined };
+        });
+        // A gate-inconclusive member keeps its tree for `sched resume --batch`'s
+        // recheck; everyone else's is done serving.
+        if (run.gate_inconclusive === null) {
+            teardownMemberTree(deps, batchId, runTree(run), true);
+            markTornDown(deps, batchId, run.issue, now);
+        }
+    }
+}
+/** Every member is resolved — block on a gate-inconclusive one, or validate. */
+function finalizeParallelMembers(deps, config, dispatch, batchId, now, result) {
+    const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (!batch)
+        return;
+    const blockedOn = batch.member_runs.find((r) => r.status === 'landed' && r.gate_inconclusive !== null);
+    if (blockedOn !== undefined) {
+        // Point the serial "current member" fields at it: `sched resume --batch`
+        // (`resumeBlockedGate`) rechecks `member_worktree` and completes/evicts
+        // `members[executing_member - 1]`, then hands back via
+        // `advanceMemberOrValidate` → `settleParallelResume`.
+        deps.store.withLock((s) => ({
+            state: (0, state_1.patchBatch)(s, batchId, {
+                executing_member: blockedOn.index,
+                member_branch: blockedOn.branch,
+                member_worktree: blockedOn.worktree,
+                member_pool_claimed: blockedOn.pool_claimed,
+            }, now),
+            result: undefined,
+        }));
+        blockBatchForOperator(deps, config, batchId, {
+            reason: `gate-inconclusive:${blockedOn.gate_inconclusive}`,
+            milestonePhase: 'batch-review',
+        }, now, result);
+        return;
+    }
+    const claimed = deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        if (!b || b.status !== 'executing')
+            return { state: s, result: false };
+        return {
+            state: (0, state_1.transitionBatch)(s, batchId, 'validating', { executing_member: b.members.length }, now),
+            result: true,
+        };
+    });
+    if (claimed)
+        runValidate(deps, config, dispatch, batchId, now, result);
+}
+/**
+ * `sched resume --batch` resolved the gate-inconclusive member of a parallel
+ * batch (completed or evicted it through the serial rail): record that on its
+ * run so the landing walk treats it as resolved, then continue the parallel
+ * rail from where it blocked.
+ */
+function settleParallelResume(deps, batchId, memberIssue, now) {
+    deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        if (!b)
+            return { state: s, result: undefined };
+        const evicted = b.evictions.some((e) => e.issue === memberIssue);
+        return {
+            state: patchRun(s, batchId, memberIssue, {
+                gate_inconclusive: null,
+                // The serial rail's `teardownMemberWorktree` removed its tree.
+                torn_down: true,
+                ...(evicted ? { status: 'evicted' } : {}),
+            }, now),
+            result: undefined,
+        };
+    });
+}
+/**
+ * One tick of a parallel batch in `executing`: reconcile every member slot,
+ * land what can land in order, then fill free member concurrency (unless the
+ * scheduler is paused — a spawn is a provider dispatch).
+ */
+function reconcileParallelBatch(deps, config, dispatch, batchId, now, result, paused) {
+    const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (!batch)
+        return;
+    for (const { issue } of batch.member_runs) {
+        // Fresh per member: an earlier member's eviction may have dissolved the
+        // batch (killing and releasing every other member) in this same pass.
+        const state = deps.store.load();
+        const fresh = (0, state_1.findBatch)(state, batchId);
+        if (!fresh || fresh.status !== 'executing')
+            return;
+        const run = fresh.member_runs.find((r) => r.issue === issue);
+        if (run?.status !== 'running')
+            continue;
+        const slot = (0, state_1.slotForBatchMember)(state, batchId, issue);
+        if (slot && (slot.status === 'running' || slot.status === 'assigned')) {
+            reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot, now, result);
+        }
+    }
+    advanceParallelBatch(deps, config, dispatch, batchId, now, result);
+    if (!paused)
+        spawnParallelMembers(deps, config, dispatch, batchId, now, result);
+}
+/**
+ * #809: stop and tear down every parallel member whose tree is not yet torn
+ * down — a dissolve can land while other members are mid-run (their agents are
+ * killed: their entries were just requeued full-cycle, so a live member agent
+ * would be working a unit nothing tracks any more), `sched stop`/`abandon`
+ * make a batch terminal without a teardown, and a crash between a run's
+ * resolution and its teardown leaves `torn_down: false` behind. Teardown is
+ * idempotent, so re-running it is always safe. `alreadyTornDown` names the
+ * serial-field tree `teardownMemberWorktree` just handled (a gate-inconclusive
+ * member of a blocked parallel batch).
+ */
+function teardownParallelRuns(deps, batchId, alreadyTornDown) {
+    const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (!batch)
+        return;
+    const now = deps.now();
+    for (const run of batch.member_runs) {
+        if (run.torn_down)
+            continue;
+        stopMemberAgent(deps, batchId, run.issue, now);
+        const landed = run.status === 'landed';
+        deps.store.withLock((s) => ({
+            state: patchRun(s, batchId, run.issue, { status: landed ? 'landed' : 'evicted', gate_inconclusive: null }, now),
+            result: undefined,
+        }));
+        if (run.worktree !== alreadyTornDown) {
+            teardownMemberTree(deps, batchId, runTree(run), landed);
+        }
+        markTornDown(deps, batchId, run.issue, now);
+    }
+}
+/** Kill a parallel member's live agent (pid-start checked) and release its slot. */
+function stopMemberAgent(deps, batchId, issue, now) {
+    const slot = (0, state_1.slotForBatchMember)(deps.store.load(), batchId, issue);
+    if (slot === undefined)
+        return;
+    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+    }
+    deps.store.withLock((s) => ({
+        state: (0, state_1.releaseBatchMemberSlot)(s, batchId, issue, now),
+        result: undefined,
+    }));
+}
+/**
+ * Stop every running member of a parallel batch that is about to BLOCK (a
+ * landing failure, a reconcile error): nothing reconciles a blocked batch's
+ * member slots, so a still-running agent would hold capacity and keep working
+ * a unit an operator is about to abandon/requeue. Trees are kept for the
+ * operator; `teardownBatch` removes them when the batch ends.
+ */
+function stopRunningMembers(deps, batchId, now) {
+    const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
+    for (const run of batch?.member_runs ?? []) {
+        if (run.status === 'running')
+            stopMemberAgent(deps, batchId, run.issue, now);
+    }
+}
 // --- Entry point ---
 /**
  * One batch reconcile+refill pass. Called from `engine.ts`'s `tick()` after
@@ -3092,11 +3833,12 @@ function runBatchTick(deps, config, dispatch) {
             const fresh = (0, state_1.findBatch)(current, batch.id);
             const dissolvable = fresh !== undefined && (0, state_1.allowedBatchTransitions)(fresh.status).includes('dissolving');
             if (dissolvable) {
-                const liveSlot = slotFor(current, batch.id);
-                if (liveSlot !== undefined &&
-                    liveSlot.pid !== null &&
-                    deps.spawnDeps.isAlive(liveSlot.pid, liveSlot.pid_start ?? undefined)) {
-                    deps.spawnDeps.kill(liveSlot.pid, liveSlot.pid_start ?? undefined);
+                // #809: a parallel batch holds one slot per running member too.
+                for (const liveSlot of (0, state_1.slotsForBatch)(current, batch.id)) {
+                    if (liveSlot.pid !== null &&
+                        deps.spawnDeps.isAlive(liveSlot.pid, liveSlot.pid_start ?? undefined)) {
+                        deps.spawnDeps.kill(liveSlot.pid, liveSlot.pid_start ?? undefined);
+                    }
                 }
                 const outcome = (0, recovery_1.dissolveBatch)(current, batch.id, { strategy: 'full', reason: `dispatch-profile-missing:${batch.dispatch_profile}` }, recoveryDeps(deps, config, fresh, now));
                 deps.store.withLock((s) => ({
@@ -3125,6 +3867,13 @@ function runBatchTick(deps, config, dispatch) {
     };
     const containFailure = (batchId, err) => {
         const detail = `${err.name}: ${err.message}`;
+        // #809: a blocked batch's member slots are never reconciled — stop the agents too.
+        try {
+            stopRunningMembers(deps, batchId, now);
+        }
+        catch {
+            // best-effort: the block below must still land
+        }
         // A corrupt unit must not turn into a project-wide scheduler outage.
         // Keep the failed batch inspectable, release its slot, and continue.
         deps.store.withLock((state) => {
@@ -3133,7 +3882,7 @@ function runBatchTick(deps, config, dispatch) {
                 return { state, result: undefined };
             }
             const blocked = (0, state_1.transitionBatch)(state, batchId, 'blocked', { blocked_reason: 'reconcile-error' }, now);
-            return { state: (0, state_1.releaseBatchSlot)(blocked, batchId, now), result: undefined };
+            return { state: (0, state_1.releaseAllBatchSlots)(blocked, batchId, now), result: undefined };
         });
         journalEvent(deps, 'unit-failed', unit(batchId), { reason: 'reconcile-error', detail });
         result.failed.push(unit(batchId));
@@ -3185,6 +3934,8 @@ function runBatchTick(deps, config, dispatch) {
     }
     for (const batch of deps.store.load().batches) {
         const slot = slotFor(deps.store.load(), batch.id);
+        // #809: a terminal batch may also leak parallel member slots.
+        const heldSlots = (0, state_1.slotsForBatch)(deps.store.load(), batch.id);
         // #609: a TERMINAL batch (`done`/`dissolved`) still holding a slot matches
         // none of the status arms below and would fall through their `continue`,
         // so nothing ever looks at that slot again — not even the orphaned-pid
@@ -3196,15 +3947,29 @@ function runBatchTick(deps, config, dispatch) {
         // files that already carry a leaked slot, which is the only way an
         // operator gets those three hours of held capacity back.
         if (types_1.TERMINAL_BATCH_STATUSES.has(batch.status)) {
-            if (slot) {
+            // #809: `sched stop`/`abandon` end a batch without a teardown — give
+            // back every member tree (and stop any agent still running in one).
+            if (batch.member_runs.some((r) => !r.torn_down)) {
+                try {
+                    teardownParallelRuns(deps, batch.id, null);
+                }
+                catch (err) {
+                    journalEvent(deps, 'teardown-failed', unit(batch.id), {
+                        detail: `member teardown: ${err.message}`,
+                    });
+                }
+            }
+            if (heldSlots.length > 0) {
                 deps.store.withLock((s) => ({
-                    state: (0, state_1.releaseBatchSlot)(s, batch.id, now),
+                    state: (0, state_1.releaseAllBatchSlots)(s, batch.id, now),
                     result: undefined,
                 }));
-                journalEvent(deps, 'slot-released', unit(batch.id), {
-                    slot: slot.id,
-                    detail: `terminal batch (${batch.status}) held slot ${slot.id}`,
-                });
+                for (const held of heldSlots) {
+                    journalEvent(deps, 'slot-released', unit(batch.id), {
+                        slot: held.id,
+                        detail: `terminal batch (${batch.status}) held slot ${held.id}${held.unit === unit(batch.id) ? '' : ` (${held.unit})`}`,
+                    });
+                }
             }
             continue;
         }
@@ -3216,6 +3981,12 @@ function runBatchTick(deps, config, dispatch) {
             const batchDispatch = dispatchFor(batch);
             if (batchDispatch === null)
                 continue;
+            // #809: a parallel batch's members hold their OWN slots — its whole
+            // `executing` phase is one arm.
+            if (batch.status === 'executing' && isParallelBatch(batch)) {
+                reconcileParallelBatch(deps, config, batchDispatch, batch.id, now, result, paused);
+                continue;
+            }
             if (slot && (slot.status === 'running' || slot.status === 'assigned')) {
                 if (batch.status === 'executing') {
                     reconcileMemberSlot(deps, config, batchDispatch, batch.id, slot, now, result);