@ai-dossier/sched 0.46.1 → 0.48.0

package/dist/batch-dispatch.js

@@ -12,7 +12,8 @@
  * at batch-phase granularity instead of per-issue-phase granularity:
  *
  * ```
- * ready → executing(member i/N) ⟲ → validating → reviewing → shipping
+ * ready → executing(serial: member i/N ⟲ | parallel: members ∥ + ordered landing)
+ *   → validating → reviewing → shipping
  *   → awaiting-merge → merged → deployed → reported → done
  * failure rails (RFC F.2/F.8/F.9):
  *   executing → dissolving  (a member self-reports blocked, RFC F.1)
@@ -98,6 +99,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.memberBranchFor = memberBranchFor;
 exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
+exports.memberDispatchModeFor = memberDispatchModeFor;
 exports.runBatchTick = runBatchTick;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -140,8 +142,11 @@ function unit(batchId) {
  */
 function sanitizeUntrustedText(value) {
     return (value
+        // C0 + DEL + C1 (incl. the single-byte CSI \u009B) and the bidi
+        // overrides/isolates (#810: the reason now also renders in `sched status`'s
+        // Parked members rows).
         // biome-ignore lint/suspicious/noControlCharactersInRegex: flattening control characters is the point
-        .replace(/[\u0000-\u001F\u007F]/g, ' ')
+        .replace(/[\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069]/g, ' ')
         .slice(0, 200));
 }
 /**
@@ -197,7 +202,9 @@ function handleDeadDispatchApiError(deps, batchId, logFile, offset, now, options
         return false;
     deps.store.withLock((s) => {
         let n = (0, dispatch_health_1.recordDispatchApiError)((event, unitId, extra) => journalEvent(deps, event, unitId, extra), s, unit(batchId), apiError);
-        if (options.release ?? true)
+        if (options.releaseWith)
+            n = options.releaseWith(n);
+        else if (options.release ?? true)
             n = releaseSlot(n, batchId, now);
         return { state: n, result: undefined };
     });
@@ -347,6 +354,31 @@ function applyBatchAndIssues(fresh, computed, batchId, issues, membersBeforeReco
     });
     return { ...fresh, batches, entries };
 }
+/**
+ * #810: land a `dissolveBatch` outcome — the one tail every dissolve caller
+ * shares. Re-applies the batch plus every entry the dissolve touched
+ * (requeued AND parked — a parked entry left out here would silently revert
+ * to its pre-dissolve status). A dissolved batch is torn down; a dissolve
+ * REFUSED over validated members (`outcome.blocked`) keeps its worktree for
+ * the operator, but its member agents are stopped and its slots released —
+ * nothing reconciles a blocked batch's member slots.
+ */
+function applyDissolveOutcome(deps, batchId, outcome, now, membersBeforeRecovery) {
+    deps.store.withLock((s) => ({
+        state: applyBatchAndIssues(s, outcome.state, batchId, [...outcome.requeued, ...outcome.parked], membersBeforeRecovery),
+        result: undefined,
+    }));
+    if (outcome.blocked) {
+        stopAndReleaseBlocked(deps, batchId, now);
+        return;
+    }
+    teardownBatch(deps, batchId);
+}
+/** Stop every live agent of a batch that just blocked, and release all its slots (#810). */
+function stopAndReleaseBlocked(deps, batchId, now) {
+    stopRunningMembers(deps, batchId, now);
+    deps.store.withLock((s) => ({ state: (0, state_1.releaseAllBatchSlots)(s, batchId, now), result: undefined }));
+}
 /**
  * Run the aggregate suite, treating a THROWING runner as a red suite with no
  * failing tests — `recovery.ts`'s own internal `runSuite` wrapper already
@@ -761,8 +793,9 @@ function landMemberBranch(deps, batchId, now) {
  * dangling pool entry — the corrupted-entry state `worktree-pool status`
  * reports), cold trees are removed. The member branch is deleted locally —
  * `-d` after a landing (fully merged into the integration branch), `-D` on
- * the eviction path (its commits never landed; the requeue carries the work
- * forward). The REMOTE member branch is deleted only on the landed path, and
+ * the eviction path (its commits never landed; since #810 the parked entry
+ * records the branch and an operator requeue continues from the REMOTE copy).
+ * The REMOTE member branch is deleted only on the landed path, and
  * deliberately KEPT on eviction — the pushed sha is the evicted work's only
  * recoverable copy.
  *
@@ -789,13 +822,9 @@ landed) {
         });
         return;
     }
-    // Route through `runTeardown` for the same guarantees `teardownBatch`
-    // gets: pool returns are verify-first idempotent and refuse to claim
-    // success unless the pool's own self-check reports the entry `warm`;
-    // cold removes post-verify the path is gone and unlisted. Nulls first —
-    // clear the fields BEFORE the exec so a crash mid-teardown doesn't retry
-    // into a half-cleaned tree (the re-derived path is deterministic if a
-    // leftover does survive).
+    // Nulls first — clear the fields BEFORE the exec so a crash mid-teardown
+    // doesn't retry into a half-cleaned tree (the re-derived path is
+    // deterministic if a leftover does survive).
     deps.store.withLock((s) => {
         const b = (0, state_1.findBatch)(s, batchId);
         if (!b)
@@ -805,7 +834,29 @@ landed) {
             result: undefined,
         };
     });
-    const t = (0, teardown_1.runTeardown)(deps.exec, deps.repoDir, { worktree, poolClaimed: batch.member_pool_claimed === true, branch }, deps.fsExists);
+    teardownMemberTree(deps, batchId, { worktree, branch, poolClaimed: batch.member_pool_claimed === true }, landed);
+}
+/**
+ * The exec half of a member teardown, shared by the serial rail
+ * (`teardownMemberWorktree`, which first clears the batch's member fields) and
+ * the parallel rail (#809: `evictParallelMember`, `advanceParallelBatch`,
+ * `teardownParallelRuns`). See
+ * `teardownMemberWorktree` for the landed/evicted branch policy.
+ */
+function teardownMemberTree(deps, batchId, tree, landed) {
+    const { worktree, branch } = tree;
+    if (branch !== null && !attribution_1.SAFE_REF_RE.test(branch)) {
+        journalEvent(deps, 'teardown-failed', unit(batchId), {
+            cleanup: 'failed-invalid-branch-name',
+            detail: branch,
+        });
+        return;
+    }
+    // Route through `runTeardown` for the same guarantees `teardownBatch`
+    // gets: pool returns are verify-first idempotent and refuse to claim
+    // success unless the pool's own self-check reports the entry `warm`;
+    // cold removes post-verify the path is gone and unlisted.
+    const t = (0, teardown_1.runTeardown)(deps.exec, deps.repoDir, { worktree, poolClaimed: tree.poolClaimed, branch }, deps.fsExists);
     const treeCleared = !t.cleanup.startsWith('failed');
     let branchCleanup = 'skipped';
     if (branch !== null && treeCleared) {
@@ -858,9 +909,10 @@ function blockLandingFailure(deps, config, batch, reason, now, result) {
     blockBatchForOperator(deps, config, batch.id, { reason }, now, result);
 }
 /**
- * Spawn one batch member's member-cycle agent (#677) into the slot a prior
- * member (or batch-setup) just released — each member in its OWN worktree
- * off the integration branch, dispatched serially as before. Prepared by
+ * Spawn one SERIAL batch member's member-cycle agent (#677) into the slot a
+ * prior member (or batch-setup) just released — each member in its OWN
+ * worktree off the integration branch. Parallel batches (#809) spawn through
+ * `spawnParallelMembers` instead, one slot per member. Prepared by
  * {@link prepareMemberWorktree} at the spawn site (outside the lock); this
  * function only patches state and spawns.
  */
@@ -902,6 +954,42 @@ function advanceMemberToValidated(state, memberIssue, now) {
     return next;
 }
 function spawnMember(deps, dispatch, state, slot, batchId, now, result, member) {
+    const batch = (0, state_1.findBatch)(state, batchId);
+    const memberIssue = batch?.members[(batch?.executing_member ?? 0) - 1];
+    if (batch && memberIssue === undefined) {
+        journalEvent(deps, 'unit-failed', unit(batchId), {
+            reason: 'no-member',
+            detail: `spawnMember: executing_member ${batch.executing_member} has no member issue`,
+        });
+        return releaseSlot(state, batchId, now);
+    }
+    const spawned = spawnMemberAgent(deps, dispatch, state, slot, batchId, now, result, {
+        index: batch?.executing_member ?? 0,
+        issue: memberIssue ?? 0,
+        member,
+        unitId: unit(batchId),
+        release: (s) => releaseSlot(s, batchId, now),
+    });
+    if (!spawned.ok)
+        return spawned.state;
+    // #677: persist the member's worktree context — a takeover redispatch or a
+    // `sched resume --batch` recheck after an engine restart must land in the
+    // SAME worktree/branch this prompt names, not re-derive (or worse,
+    // re-create) it.
+    return (0, state_1.patchBatch)(spawned.state, batchId, {
+        member_branch: member.branch,
+        member_worktree: member.worktree,
+        member_pool_claimed: member.poolClaimed,
+    }, now);
+}
+/**
+ * Spawn ONE member's member-cycle agent into `slot` — the shared core of the
+ * serial rail (`spawnMember`, the batch's own slot) and the parallel rail
+ * (`spawnParallelMembers`, #809: the member's own `batch:<id>#<issue>` slot).
+ * Patches the slot and the member's queue entry; the caller persists its own
+ * member context. On failure the slot is released through `target.release`.
+ */
+function spawnMemberAgent(deps, dispatch, state, slot, batchId, now, result, target) {
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.worktree === null || batch.branch === null) {
         // A leaked `assigned` slot with `pid: null` is invisible to `dead`
@@ -911,16 +999,9 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
             reason: 'no-worktree',
             detail: 'spawnMember: batch has no worktree/branch — batch-setup has not landed',
         });
-        return releaseSlot(state, batchId, now);
-    }
-    const memberIssue = batch.members[batch.executing_member - 1];
-    if (memberIssue === undefined) {
-        journalEvent(deps, 'unit-failed', unit(batchId), {
-            reason: 'no-member',
-            detail: `spawnMember: executing_member ${batch.executing_member} has no member issue`,
-        });
-        return releaseSlot(state, batchId, now);
+        return { ok: false, state: target.release(state) };
     }
+    const memberIssue = target.issue;
     const withStatus = advanceMemberToInWork(state, memberIssue, now);
     const memberEntry = (0, state_1.findEntry)(withStatus, memberIssue);
     // #771: a `review=full` member dispatches at `strong` minimum (within this
@@ -932,8 +1013,8 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
     // #677: the prompt carries THIS member's own worktree and the integration
     // branch it was cut from — `member-cycle`'s `worktree`/`integration_branch`
     // inputs. The shared batch worktree is no longer a member surface at all.
-    const prompt = (0, dispatch_1.buildMemberPrompt)(dispatch.memberPrompt, memberIssue, batchId, member.worktree, batch.branch, review);
-    const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, batch.executing_member, memberIssue);
+    const prompt = (0, dispatch_1.buildMemberPrompt)(dispatch.memberPrompt, memberIssue, batchId, target.member.worktree, batch.branch, review);
+    const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, target.index, memberIssue);
     // #629: captured BEFORE spawning, mirroring `engine.ts`'s own
     // `spawnAndRecord` — the log is per-role and append-mode, so the size at
     // this instant is exactly where THIS dispatch's own output starts. Fences
@@ -949,8 +1030,8 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
             reason: 'spawn-error',
             detail: `member #${memberIssue} spawn failed: ${err.message}`,
         });
-        result.failed.push(unit(batchId));
-        return releaseSlot(withStatus, batchId, now);
+        result.failed.push(target.unitId);
+        return { ok: false, state: target.release(withStatus) };
     }
     const patch = {
         pid,
@@ -963,18 +1044,9 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
         spawned_at: now.toISOString(),
         log_offset_at_spawn: logOffset,
     };
-    let next = slot.status === 'assigned' || slot.status === 'recovering'
+    const next = slot.status === 'assigned' || slot.status === 'recovering'
         ? (0, state_1.transitionSlot)(withStatus, slot.id, 'running', patch, now)
         : withStatus;
-    // #677: persist the member's worktree context — a takeover redispatch or a
-    // `sched resume --batch` recheck after an engine restart must land in the
-    // SAME worktree/branch this prompt names, not re-derive (or worse,
-    // re-create) it.
-    next = (0, state_1.patchBatch)(next, batchId, {
-        member_branch: member.branch,
-        member_worktree: member.worktree,
-        member_pool_claimed: member.poolClaimed,
-    }, now);
     deps.journal.append((0, journal_1.unitEvent)('spawned', unit(batchId), {
         pid,
         tier,
@@ -983,11 +1055,11 @@ function spawnMember(deps, dispatch, state, slot, batchId, now, result, member)
         issue: memberIssue,
         ...(0, dispatch_1.journalCmdModelFields)(spawnSpec),
         log: logFile,
-        worktree: member.worktree,
-        detail: `member ${batch.executing_member}/${batch.members.length}`,
+        worktree: target.member.worktree,
+        detail: `member ${target.index}/${batch.members.length}${batch.member_dispatch === 'parallel' ? ' (parallel)' : ''}`,
     }), now);
-    result.spawned.push(unit(batchId));
-    return next;
+    result.spawned.push(target.unitId);
+    return { ok: true, state: next };
 }
 /**
  * First claim of a `ready` batch: assign it a slot, run batch-setup (real
@@ -1054,7 +1126,38 @@ function claimAndSetup(deps, config, dispatch, batchId, now, result) {
             pool_claimed: setup.poolClaimed ? 'true' : 'false',
         },
     });
-    deps.journal.append((0, journal_1.unitEvent)('batch-setup-done', unit(batchId), { detail: setup.worktree }), now);
+    // #809: decided ONCE, here, and persisted — a batch never changes mode mid-run.
+    const mode = memberDispatchModeFor(deps.store.load(), batch, config);
+    deps.journal.append((0, journal_1.unitEvent)('batch-setup-done', unit(batchId), {
+        detail: `${setup.worktree} (members: ${mode})`,
+    }), now);
+    if (mode === 'parallel') {
+        // Parallel members each claim their OWN slot (`batch:<id>#<issue>`), so
+        // the setup slot is released here and the members' worktrees are prepared
+        // by `spawnParallelMembers` (outside the lock, per member).
+        deps.store.withLock((s) => {
+            const b = (0, state_1.findBatch)(s, batchId);
+            if (!b || b.status !== 'ready') {
+                journalEvent(deps, 'unit-failed', unit(batchId), {
+                    reason: 'batch-left-ready-during-setup',
+                    detail: `worktree ${setup.worktree} created but batch is now '${b?.status ?? 'gone'}' — orphaned, manual cleanup required`,
+                });
+                return { state: releaseSlot(s, batchId, now), result: undefined };
+            }
+            let next = (0, state_1.patchBatch)(s, batchId, {
+                branch: setup.branch,
+                worktree: setup.worktree,
+                run_id: setup.runId,
+                pool_claimed: setup.poolClaimed,
+                member_dispatch: 'parallel',
+                member_runs: [],
+            }, now);
+            next = (0, state_1.transitionBatch)(next, batchId, 'executing', { executing_member: 0 }, now);
+            return { state: releaseSlot(next, batchId, now), result: undefined };
+        });
+        spawnParallelMembers(deps, config, dispatch, batchId, now, result);
+        return;
+    }
     // #677: prepare member 1's OWN worktree before claiming the spawn — real
     // git/network work, so OUTSIDE the store lock (the same contract
     // `runBatchSetup` just followed). All-or-nothing: a failed prep posts the
@@ -1114,6 +1217,7 @@ function claimAndSetup(deps, config, dispatch, batchId, now, result) {
             worktree: setup.worktree,
             run_id: setup.runId,
             pool_claimed: setup.poolClaimed,
+            member_dispatch: 'serial',
         }, now);
         next = (0, state_1.transitionBatch)(next, batchId, 'executing', { executing_member: 1 }, now);
         const slot = slotFor(next, batchId);
@@ -1369,14 +1473,20 @@ function runValidate(deps, config, dispatch, batchId, now, result) {
                 return { state: s, result: false };
             if (b.executing_member < b.members.length) {
                 return {
-                    state: (0, state_1.transitionBatch)(s, batchId, 'executing', { executing_member: b.executing_member + 1 }, now),
+                    state: (0, state_1.transitionBatch)(s, batchId, 'executing', 
+                    // #809: a parallel batch spawns every run-less member itself.
+                    isParallelBatch(b) ? {} : { executing_member: b.executing_member + 1 }, now),
                     result: true,
                 };
             }
             return { state: (0, state_1.transitionBatch)(s, batchId, 'reviewing', {}, now), result: undefined };
         });
         if (admitted) {
-            spawnMemberContinuation(deps, config, dispatch, batchId, now, result);
+            const b = (0, state_1.findBatch)(deps.store.load(), batchId);
+            if (b && isParallelBatch(b))
+                spawnParallelMembers(deps, config, dispatch, batchId, now, result);
+            else
+                spawnMemberContinuation(deps, config, dispatch, batchId, now, result);
             return;
         }
         spawnTailAgent(deps, config, dispatch, batchId, now, result);
@@ -1407,11 +1517,7 @@ function runValidate(deps, config, dispatch, batchId, now, result) {
     const { state: attributed, outcome } = (0, recovery_1.beginAttribution)(state, batchId, { failing: suite.failing, footprints: memberFootprints(deps, batch) }, rDeps);
     if (outcome.offenders.length === 0) {
         const dissolve = (0, recovery_1.dissolveBatch)(attributed, batchId, { strategy: 'full', reason: 'unattributable-suite-failure' }, rDeps);
-        deps.store.withLock((s) => ({
-            state: applyBatchAndIssues(s, dissolve.state, batchId, dissolve.requeued, batch.members),
-            result: undefined,
-        }));
-        teardownBatch(deps, batchId);
+        applyDissolveOutcome(deps, batchId, dissolve, now, batch.members);
         result.blocked.push(...dissolve.requeued);
         result.failed.push(unit(batchId));
         return;
@@ -1473,10 +1579,14 @@ function evictOffender(deps, config, batchId, offender, attribution, now, result
     const rDeps = recoveryDeps(deps, config, batch, now);
     const outcome = (0, recovery_1.evictMembers)(state, batchId, { issues: [offender], reason: 'suite-red-after-fix', attribution, ranges: batch.ranges }, rDeps);
     deps.store.withLock((s) => ({
-        state: applyBatchAndIssues(s, outcome.state, batchId, outcome.requeued, batch.members),
+        state: applyBatchAndIssues(s, outcome.state, batchId, [...outcome.requeued, ...(outcome.dissolve?.parked ?? [])], batch.members),
         result: undefined,
     }));
-    if (outcome.dissolved) {
+    // #810: `dissolve.blocked` — a full dissolve refused over validated
+    // members; the batch is blocked for an operator, not validating.
+    if (outcome.dissolved || outcome.dissolve?.blocked === true) {
+        if (outcome.dissolve?.blocked === true)
+            stopAndReleaseBlocked(deps, batchId, now);
         result.failed.push(unit(batchId));
         return;
     }
@@ -1487,7 +1597,7 @@ function evictOffender(deps, config, batchId, offender, attribution, now, result
                 return { state: s, result: undefined };
             if (b.executing_member < b.members.length) {
                 return {
-                    state: (0, state_1.transitionBatch)(s, batchId, 'executing', { executing_member: b.executing_member + 1 }, now),
+                    state: (0, state_1.transitionBatch)(s, batchId, 'executing', isParallelBatch(b) ? {} : { executing_member: b.executing_member + 1 }, now),
                     result: undefined,
                 };
             }
@@ -1535,6 +1645,15 @@ function journalAdvanceSkipped(deps, batchId, memberIssue, currentMember, claim)
     });
 }
 function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, currentMember, memberIssue, now, result) {
+    // #809: a parallel batch reaches this serial rail only through `sched resume
+    // --batch` resolving its gate-inconclusive member — hand back to the
+    // parallel rail instead of advancing a serial member pointer.
+    const current = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (current && isParallelBatch(current)) {
+        settleParallelResume(deps, batchId, memberIssue, now);
+        advanceParallelBatch(deps, config, dispatch, batchId, now, result);
+        return;
+    }
     const isLast = currentMember >= memberCount;
     if (isLast) {
         const claim = claimMemberResolution(deps, batchId, currentMember, now, () => ({
@@ -1585,10 +1704,10 @@ function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, c
  * both always read state fresh.
  */
 function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, failure, now, result) {
-    const { dissolved, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now);
+    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now);
     if (duplicate)
         return;
-    if (dissolved) {
+    if (batchEnded) {
         result.failed.push(unit(batchId));
         return;
     }
@@ -1639,7 +1758,41 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
     // the fallback for a batch dispatched before member worktrees existed (its
     // members' commits landed directly on the integration branch).
     const worktree = batch.member_worktree ?? batch.worktree;
+    const verdict = evaluateIncrementalGate(deps, batchId, worktree, memberIssue, now);
+    if (verdict.kind === 'pass')
+        return false;
+    if (verdict.kind === 'failed') {
+        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, { reason: verdict.reason, detail: verdict.detail }, now, result);
+        return true;
+    }
+    deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+    // #677: F.11's block semantics are "the member's commit stays on the
+    // branch, nothing requeued/reverted" — under member worktrees that is
+    // true only if the member LANDS before the batch blocks. The block means
+    // the gate could not reach a verdict, not that the work is bad, so the
+    // verified member joins the integration branch and is there for an
+    // operator (or the #686 out-of-band reconcile) to act on. A landing
+    // failure blocks the batch with its own reason — same operator outcome.
+    const landed = landMemberBranch(deps, batchId, now);
+    if (!landed.ok) {
+        blockLandingFailure(deps, config, batch, landed.reason, now, result);
+        return true;
+    }
+    blockBatchForOperator(deps, config, batchId, { reason: verdict.reason, milestonePhase: 'batch-review' }, now, result);
+    return true;
+}
+/**
+ * Run the incremental gate's capabilities against one member worktree and
+ * reach a verdict — journaling, gate logs and `member_gates` included, but NO
+ * state action: serial (`runIncrementalGate`) and parallel
+ * (`reconcileParallelMemberSlot`, #809) members act on the verdict
+ * differently. See `runIncrementalGate`'s doc for the policy.
+ */
+function evaluateIncrementalGate(deps, batchId, worktree, memberIssue, now) {
     const runCapability = deps.runCapability;
+    if (!runCapability)
+        return { kind: 'pass' };
     const gateResults = ['typecheck.run', 'test.focused'].map((id) => ({
         id,
         ...runCapability(worktree, id),
@@ -1680,13 +1833,10 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
         // trap (#594's shape — absence reading as a verdict). Silence must never
         // be mistaken for a pass.
         //
-        // #632: confirmed this fires once per member, not once per tick.
-        // `runIncrementalGate` is called only from the `isMemberComplete` branch
-        // of `reconcileMemberSlot`, and both of that branch's callees
-        // (`completeMemberGate`, `evictMemberAndContinue`) advance
-        // `batch.executing_member` before returning — so the very next tick
-        // reads a DIFFERENT `memberIssue` from `batch.members[executing_member -
-        // 1]`, and this gate never runs twice against the same member.
+        // #632: confirmed this fires once per member, not once per tick: the
+        // gate runs only on a member dispatch's verified completion, and both
+        // rails resolve that member (serial: the pointer advances; parallel:
+        // the run leaves `running` and its slot is released) before returning.
         journalEvent(deps, 'gate-skipped', unit(batchId), {
             issue: memberIssue,
             reason: `gate-skipped:${skipped.id}`,
@@ -1734,15 +1884,13 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
         recordMemberGate(deps, batchId, memberIssue, decisiveGate, now);
     }
     if (earnedFailure) {
-        const reason = `incremental-gate-failed:${earnedFailure.id}`;
         writeGateLog(deps, batchId, earnedFailure.id, memberIssue, earnedFailure.outputTail);
         const excerpt = gateDetailExcerpt(earnedFailure.outputTail, earnedFailure.reason);
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, {
-            reason,
+        return {
+            kind: 'failed',
+            reason: `incremental-gate-failed:${earnedFailure.id}`,
             detail: withExcerpt(`cap run ${earnedFailure.id} reported task-failed with failing-test evidence after member review done`, excerpt),
-        }, now, result);
-        return true;
+        };
     }
     const inconclusive = gateInconclusive ?? unevidencedFailure;
     if (inconclusive) {
@@ -1758,23 +1906,9 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
             reason,
             detail: withExcerpt(`cap run ${inconclusive.id} ${describeInconclusive(inconclusive)} after member review done`, excerpt),
         });
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-        // #677: F.11's block semantics are "the member's commit stays on the
-        // branch, nothing requeued/reverted" — under member worktrees that is
-        // true only if the member LANDS before the batch blocks. The block means
-        // the gate could not reach a verdict, not that the work is bad, so the
-        // verified member joins the integration branch and is there for an
-        // operator (or the #686 out-of-band reconcile) to act on. A landing
-        // failure blocks the batch with its own reason — same operator outcome.
-        const landed = landMemberBranch(deps, batchId, now);
-        if (!landed.ok) {
-            blockLandingFailure(deps, config, batch, landed.reason, now, result);
-            return true;
-        }
-        blockBatchForOperator(deps, config, batchId, { reason, milestonePhase: 'batch-review' }, now, result);
-        return true;
+        return { kind: 'inconclusive', reason, capability: inconclusive.id };
     }
-    return false;
+    return { kind: 'pass' };
 }
 /**
  * The member is verifiably done — self-reported complete AND (when checked)
@@ -1984,11 +2118,13 @@ function resumeBlockedGate(deps, config, dispatch, batchId, now) {
  * Exactly-once per dispatch, mirroring `recordDispatchRunLog`'s own
  * invariant: called from both of `reconcileMemberSlot`'s exit branches
  * (member complete, member blocked/dead) — a batch never redispatches the
- * same member slot (eviction requeues it as an independent full-cycle run
- * instead), so unlike `engine.ts`'s per-unit log, a member's log file is
+ * same member slot (an evicted member is parked, #810, and any later
+ * full-cycle run is an independent unit), so unlike `engine.ts`'s per-unit log, a member's log file is
  * always one-shot and reading from offset 0 is always correct.
  */
-function recordMemberRunLog(deps, dispatch, state, batchId, batch, memberIssue, slot, now) {
+function recordMemberRunLog(deps, dispatch, state, batchId, 
+/** 1-based member index — names the per-member log file (serial: `executing_member`; parallel: `MemberRun.index`). */
+memberIndex, memberIssue, slot, now) {
     if (slot.status !== 'running' || slot.spawned_at === null) {
         journalEvent(deps, 'run-log-skipped', unit(batchId), {
             issue: memberIssue,
@@ -2002,7 +2138,7 @@ function recordMemberRunLog(deps, dispatch, state, batchId, batch, memberIssue,
     const memberEntry = (0, state_1.findEntry)(state, memberIssue);
     const tier = memberEntry ? (0, dispatch_1.memberDispatchTier)(memberEntry) : 'mid';
     const { cmd, model } = (0, dispatch_1.resolveTierSpawn)(dispatch, tier, memberIssue);
-    const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, batch.executing_member, memberIssue);
+    const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, memberIndex, memberIssue);
     // #629: fenced to THIS dispatch's slice (`log_offset_at_spawn`, stamped by
     // `spawnMember`/`spawnMemberContinuation` at spawn time) rather than a
     // fixed byte-0 read. Before #629 a member log never outlived one attempt
@@ -2070,14 +2206,12 @@ function terminalMilestoneForDispatch(deps, memberIssue, slot) {
     }
     return latest;
 }
-function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result) {
-    const state0 = deps.store.load();
-    const batch = (0, state_1.findBatch)(state0, batchId);
-    if (!batch)
-        return;
-    const memberIssue = batch.members[batch.executing_member - 1];
-    if (memberIssue === undefined)
-        return;
+/**
+ * Read one member dispatch's fate: the fenced terminal milestone (#575/#605/
+ * #622) plus liveness, journaling a stale terminal milestone once per
+ * dispatch (#610). Pure reading — the caller acts on the result.
+ */
+function readMemberDispatch(deps, batchId, memberIssue, slot, now) {
     const dead = slot.pid !== null && !deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined);
     // #622: the milestone this DISPATCH's fate should be read from — the last
     // TERMINAL one it posted, not merely the newest one on the issue.
@@ -2096,7 +2230,7 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     // poll) this degrades to the previous latest-only behaviour.
     const milestone = terminalMilestoneForDispatch(deps, memberIssue, slot);
     if (milestone === undefined)
-        return; // unreachable — pause this batch's decisions
+        return { kind: 'unreachable' }; // pause this batch's decisions
     // #575 / #605: fence to THIS member dispatch's `spawned_at` — a member
     // re-added to a fresh batch run after a PREVIOUS batch already posted a
     // terminal `mode=slot` milestone (pilot re-run, requeue-with-context, and
@@ -2135,7 +2269,65 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
             result: undefined,
         }));
     }
-    if ((0, groundtruth_1.isMemberComplete)(milestone, slot.spawned_at)) {
+    if ((0, groundtruth_1.isMemberComplete)(milestone, slot.spawned_at))
+        return { kind: 'complete' };
+    return {
+        kind: 'pending',
+        milestone,
+        dead,
+        blockedNow: (0, groundtruth_1.isMemberBlocked)(milestone, slot.spawned_at),
+    };
+}
+/**
+ * The eviction a blocked-or-dead member dispatch earns (shared by both rails).
+ * #605: only a milestone THIS dispatch posted may name the reason. A dead
+ * agent whose issue carries only a stale `blocked` milestone is an unverified
+ * exit, not a re-run of the previous run's block — reporting the old
+ * `reason=` here is what made the journal misdirect, naming a precondition
+ * that had already been fixed on a run where it no longer applied.
+ * #804: `memberBlockedReason` also names a `review partial` hand-back.
+ */
+function memberFailureFor(read, lastTool) {
+    const rawReason = read.blockedNow && read.milestone ? (0, groundtruth_1.memberBlockedReason)(read.milestone) : undefined;
+    const reason = typeof rawReason === 'string' && rawReason.length > 0
+        ? sanitizeUntrustedText(rawReason)
+        : read.dead
+            ? 'agent-exited-unverified'
+            : 'member-blocked';
+    return {
+        reason,
+        // #810: a block THIS dispatch posted is the member's own hand-back — parked
+        // `handed-back`, never counted toward the dissolve threshold. A member that
+        // died without one is an engine-decided eviction (`agent-exited-unverified`).
+        kind: read.blockedNow ? 'handed-back' : 'evicted',
+        // This rail covers a self-reported block AND a member that simply died, so the
+        // detail must follow the RESOLVED reason — `member blocked` on an
+        // `agent-exited-unverified` eviction contradicts the reason on its own journal line.
+        detail: reason === 'agent-exited-unverified'
+            ? 'member agent exited without posting a terminal milestone'
+            : 'member blocked',
+        // #591: attributes an unverified member exit to a concrete cause (e.g.
+        // `Monitor`) without opening the transcript. Gated on the RESOLVED reason, not
+        // `dead` — a member can be simultaneously `dead` AND carry a milestone-posted
+        // `reason` (it posted `blocked` and then exited), and that real block has no
+        // log-derived cause to attribute; only `agent-exited-unverified` does.
+        extraKv: reason === 'agent-exited-unverified' && lastTool !== null
+            ? { last_tool: lastTool }
+            : undefined,
+    };
+}
+function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result) {
+    const state0 = deps.store.load();
+    const batch = (0, state_1.findBatch)(state0, batchId);
+    if (!batch)
+        return;
+    const memberIssue = batch.members[batch.executing_member - 1];
+    if (memberIssue === undefined)
+        return;
+    const read = readMemberDispatch(deps, batchId, memberIssue, slot, now);
+    if (read.kind === 'unreachable')
+        return;
+    if (read.kind === 'complete') {
         deps.journal.append((0, journal_1.unitEvent)('external-advance', unit(batchId), {
             issue: memberIssue,
             detail: 'member review done',
@@ -2143,7 +2335,7 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // The member's own agent process is done regardless of what the
         // incremental gate below decides — record its telemetry once here (#564)
         // rather than at each of this branch's two later exit points.
-        recordMemberRunLog(deps, dispatch, state0, batchId, batch, memberIssue, slot, now);
+        recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now);
         // Incremental gate (#523 AC2, revised #583) — see `runIncrementalGate`'s
         // own doc comment for the three-way policy. A `true` return means the
         // gate already decided the member's fate (evicted or blocked) and
@@ -2155,9 +2347,8 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result);
         return;
     }
-    const blockedNow = (0, groundtruth_1.isMemberBlocked)(milestone, slot.spawned_at);
-    if (dead &&
-        !blockedNow &&
+    if (read.dead &&
+        !read.blockedNow &&
         handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, batch.executing_member, memberIssue), slot.log_offset_at_spawn ?? 0, now)) {
         // #629: a confirmed provider API error is not a real member failure —
         // evicting the member for an account-wide spend wall would silently
@@ -2166,21 +2357,8 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // place, keeping its position.
         return;
     }
-    if (blockedNow || dead) {
-        // #605: only a milestone THIS dispatch posted may name the reason. A dead
-        // agent whose issue carries only a stale `blocked` milestone is an
-        // unverified exit, not a re-run of the previous run's block — reporting
-        // the old `reason=` here is what made the journal misdirect, naming a
-        // precondition that had already been fixed on a run where it no longer
-        // applied.
-        // #804: `memberBlockedReason` also names a `review partial` hand-back.
-        const rawReason = blockedNow && milestone ? (0, groundtruth_1.memberBlockedReason)(milestone) : undefined;
-        const reason = typeof rawReason === 'string' && rawReason.length > 0
-            ? sanitizeUntrustedText(rawReason)
-            : dead
-                ? 'agent-exited-unverified'
-                : 'member-blocked';
-        const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, batch, memberIssue, slot, now);
+    if (read.blockedNow || read.dead) {
+        const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now);
         deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
         // A member that never went green (RFC F.1) evicts DIRECTLY — no aggregate
         // suite has run yet, so there is nothing for `attributing`/`evicting` (the
@@ -2190,78 +2368,88 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // attributing → evicting` is not even a legal edge from mid-`executing`
         // (BATCH_TRANSITIONS has no `executing → evicting`) — this stays entirely
         // within `executing`/`dissolving`, both of which ARE legal from here.
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, {
-            reason,
-            // This rail covers a self-reported block AND a member that simply died, so the
-            // detail must follow the RESOLVED reason — `member blocked` on an
-            // `agent-exited-unverified` eviction contradicts the reason on its own journal line.
-            detail: reason === 'agent-exited-unverified'
-                ? 'member agent exited without posting a terminal milestone'
-                : 'member blocked',
-            // #591: attributes an unverified member exit to a concrete cause (e.g.
-            // `Monitor`) without opening the transcript. Gated on the RESOLVED reason, not
-            // `dead` — a member can be simultaneously `dead` AND carry a milestone-posted
-            // `reason` (it posted `blocked` and then exited), and that real block has no
-            // log-derived cause to attribute; only `agent-exited-unverified` does.
-            extraKv: reason === 'agent-exited-unverified' && lastTool !== null
-                ? { last_tool: lastTool }
-                : undefined,
-        }, now, result);
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, memberFailureFor(read, lastTool), now, result);
     }
 }
 /**
- * Requeue a member full-cycle, record the eviction, and dissolve if this tips
- * the batch past its `dissolve_policy` threshold (#563; RFC F.1/F.8) — WITHOUT
- * going through `recovery.ts`'s `evictMembers` (which needs
- * `attributing`/`evicting` status and a commit range to revert; a member
- * evicted here has neither). Returns whether the batch dissolved.
+ * Park a member that left the batch before landing, record the exit, and
+ * dissolve if this tips the batch past its `dissolve_policy` threshold (#563;
+ * RFC F.1/F.8) — WITHOUT going through `recovery.ts`'s `evictMembers` (which
+ * needs `attributing`/`evicting` status and a commit range to revert; a
+ * member evicted here has neither). Returns whether the batch dissolved.
+ *
+ * #810 — the member is PARKED, never auto-requeued:
+ * - `failure.kind === 'handed-back'` (the member posted its own `blocked` /
+ *   `review partial` milestone) → entry `handed-back`, record
+ *   `kind: 'handed-back'`, journal `member-handed-back`. A hand-back is a
+ *   valued outcome, not a batch failure: it never counts toward the dissolve
+ *   threshold.
+ * - otherwise (unverified exit, gate task-failed, landing conflict, worktree
+ *   prep) → entry `evicted`, journal `unit-failed`, counted.
+ * Either way the member branch is recorded on the record and the entry's
+ * `failure_evidence`, and the batch's dispatch profile on the entry — so an
+ * operator's `sched requeue` continues the work from that branch on the same
+ * provider. The pre-#810 rail requeued `mode: 'full', dispatch_profile: null`
+ * from the base branch, discarding the member's commits and its profile.
+ *
+ * #810: when the threshold trips while members are already VALIDATED (landed
+ * on the integration branch), the batch does not dissolve — dissolving would
+ * requeue validated work from scratch. It journals `dissolve-suppressed` and
+ * continues with the remaining members; its validated members still ship.
  *
  * A member already in `evictions[]` is a NO-OP here, not merely a skipped
- * record (#595 AC1): the requeue must not run a second time either. It would
- * overwrite the first eviction's `failure_evidence` — leaving `evictions[]`
- * and the queue entry disagreeing about why the member was evicted — and, if
- * the member has since been re-dispatched full-cycle, would take the
- * `executing → evicted → requeued` rail and kill that live run.
+ * record (#595 AC1): the park must not run a second time either.
  *
- * Returns `{ dissolved, duplicate }`: `dissolved` is whether this eviction tipped the batch
- * past its threshold and the batch is gone; `duplicate: true` means another resolution had
- * already claimed this member's eviction, and the caller must journal nothing and advance
- * nothing on top of it (#613 — that is exactly how a record ends up naming the member the
- * batch already advanced past).
+ * Returns `{ batchEnded, duplicate }`: `batchEnded` is whether this exit ended
+ * the batch's run — it dissolved, or (a `full` dissolve refused over validated
+ * members, #810) it blocked for an operator; either way the caller must not
+ * advance it. `duplicate: true` means another resolution had already claimed
+ * this member's exit, and the caller must journal nothing and advance nothing
+ * on top of it (#613). A dissolve interrupted between pass 1 and pass 2 is not
+ * retried by a re-entry: the re-entry takes the duplicate path (pre-existing,
+ * #595/#613) and the batch continues.
  */
 function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
     const { reason } = failure;
+    const kind = failure.kind ?? 'evicted';
     const dissolvePolicy = (0, types_1.resolveDissolvePolicy)(config.dissolve_policy);
-    // Pass 1 (pure — requeue + record the eviction): safe to run entirely
-    // inside the lock, unlike `dissolveBatch` below, which shells out
+    // Pass 1 (pure — park + record the exit): safe to run entirely inside the
+    // lock, unlike `dissolveBatch` below, which shells out
     // (`deps.exec`/`postMilestone`) and so must NOT hold the lock while it runs.
-    const { triggered, duplicate, prior } = deps.store.withLock((s) => {
+    const { triggered, duplicate, prior, branch, validated } = deps.store.withLock((s) => {
         const b = (0, state_1.findBatch)(s, batchId);
         if (!b) {
-            return { state: s, result: { triggered: false, duplicate: false, prior: undefined } };
+            return {
+                state: s,
+                result: {
+                    triggered: false,
+                    duplicate: false,
+                    prior: undefined,
+                    branch: null,
+                    validated: [],
+                },
+            };
         }
         const priorRecord = b.evictions.find((e) => e.issue === memberIssue);
         if (priorRecord) {
             // A duplicate never re-evaluates the dissolve threshold: the resolution that WROTE
             // this record already did, under this same lock. (#595: a duplicate must not count
-            // twice; #613: it must not act on the batch at all.) Note this also means a dissolve
-            // interrupted between pass 1 and pass 2 is not retried here — re-entering
-            // `dissolveBatch` on an already-terminal batch throws `IllegalTransitionError`.
+            // twice; #613: it must not act on the batch at all.)
             return {
                 state: s,
-                result: { triggered: false, duplicate: true, prior: priorRecord },
+                result: {
+                    triggered: false,
+                    duplicate: true,
+                    prior: priorRecord,
+                    branch: null,
+                    validated: [],
+                },
             };
         }
-        const evidence = {
-            batch: batchId,
-            reason,
-            failing_tests: [],
-            attribution: 'none',
-            reverted_commits: [],
-            at: now.toISOString(),
-        };
-        const requeueResult = (0, state_1.requeueMember)(s, memberIssue, { mode: 'full', batch: null }, reason, now, { failure_evidence: evidence });
-        let next = requeueResult.state;
+        const memberBranch = (0, state_1.recordedMemberBranch)(b, memberIssue);
+        let next = (0, state_1.parkMember)(s, memberIssue, kind, reason, now, {
+            failure_evidence: (0, state_1.memberExitEvidence)(batchId, reason, memberBranch, now),
+        }).state;
         // `appendEvictions` stays the state-level backstop even though the
         // duplicate is already short-circuited above — it is the one append path.
         const { evictions, duplicate: duplicateRecords } = (0, state_1.appendEvictions)(b, [
@@ -2271,6 +2459,8 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
                 attribution: 'none',
                 reverted_commits: [],
                 group: [],
+                kind,
+                branch: memberBranch,
                 at: now.toISOString(),
             },
         ]);
@@ -2282,6 +2472,8 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
                 triggered: updated !== undefined && (0, recovery_1.checkDissolveTrigger)(updated, dissolvePolicy),
                 duplicate: duplicateRecords.length > 0,
                 prior: undefined,
+                branch: memberBranch,
+                validated: updated !== undefined ? (0, state_1.validatedMembersOf)(next, updated) : [],
             },
         };
     });
@@ -2290,41 +2482,45 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
             issue: memberIssue,
             detail: (0, state_1.duplicateEvictionDetail)(memberIssue, reason, prior),
         });
-        // Another resolution already claimed this member's eviction record — the
+        // Another resolution already claimed this member's exit record — the
         // caller must not journal its own `unit-failed`/advance the batch again
-        // on top of that one (#613: that is exactly how a record ends up naming
-        // the member the batch already advanced past).
-        return { dissolved: false, duplicate: true };
+        // on top of that one (#613).
+        return { batchEnded: false, duplicate: true };
     }
     // This call owns the member's resolution, so it owns recording WHY — before pass 2 below
-    // can dissolve, tear the worktree down, or be killed mid-shell-out and leave the eviction
-    // record on disk with no journal line naming its cause (#613). The caller's extras go
-    // first so the authoritative keys always win: `extraKv` is a wide Record, and a future
-    // caller passing `reason`/`detail`/`issue` must not be able to rewrite the record's own
-    // identity.
-    journalEvent(deps, 'unit-failed', unit(batchId), {
+    // can dissolve, tear the worktree down, or be killed mid-shell-out and leave the record
+    // on disk with no journal line naming its cause (#613). The caller's extras go first so
+    // the authoritative keys always win.
+    journalEvent(deps, kind === 'handed-back' ? 'member-handed-back' : 'unit-failed', unit(batchId), {
         ...(failure.extraKv ?? {}),
         issue: memberIssue,
         reason,
-        detail: failure.detail,
+        detail: `${failure.detail} — parked ${kind}` +
+            (branch !== null ? ` (work on ${branch})` : '') +
+            `; remedy: sched requeue --issue ${memberIssue}`,
     });
     if (!triggered)
-        return { dissolved: false, duplicate: false };
+        return { batchEnded: false, duplicate: false };
+    if (validated.length > 0) {
+        // #810: never dissolve over validated work — it stays landed and ships
+        // with the batch; the members that failed are parked, not requeued.
+        journalEvent(deps, 'dissolve-suppressed', unit(batchId), {
+            issue: memberIssue,
+            detail: `eviction threshold reached, but member(s) ${validated.join(',')} are validated on the integration branch — keeping them and continuing with the remaining members instead of dissolving`,
+        });
+        return { batchEnded: false, duplicate: false };
+    }
     // Pass 2 (outside the lock — dissolveBatch shells out): re-load fresh
     // (pass 1's write already landed), dissolve, then re-apply just this
     // batch's + the requeued members' state under a fresh lock.
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch)
-        return { dissolved: false, duplicate: false };
+        return { batchEnded: false, duplicate: false };
     const rDeps = recoveryDeps(deps, config, batch, now);
     const outcome = (0, recovery_1.dissolveBatch)(state, batchId, { strategy: 'full', reason: 'eviction-threshold' }, rDeps);
-    deps.store.withLock((s) => ({
-        state: applyBatchAndIssues(s, outcome.state, batchId, outcome.requeued),
-        result: undefined,
-    }));
-    teardownBatch(deps, batchId);
-    return { dissolved: true, duplicate: false };
+    applyDissolveOutcome(deps, batchId, outcome, now);
+    return { batchEnded: true, duplicate: false };
 }
 function reconcileFixSlot(deps, config, batchId, slot, now, result) {
     if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined))
@@ -2596,8 +2792,8 @@ const MEMBER_RECONCILE_CHAIN = {
  * Whether every SURVIVING member of `batch` was actually dispatched — i.e. no
  * surviving member is still sitting in a pre-dispatch status (`queued`,
  * `classified`, `batched`, `waiting`). Surviving = a `batch.members` issue
- * that is still a slot-mode entry, not evicted (its work was reverted and it
- * requeued full-cycle), and not already preserved (shipped/terminal through
+ * that is still a slot-mode entry, not evicted / handed back (parked, #810),
+ * and not already preserved (shipped/terminal through
  * another rail).
  *
  * This is the safety rail behind AC1: a member that never ran has NO work on
@@ -2615,8 +2811,14 @@ function everySurvivingMemberDispatched(state, batch) {
         const entry = (0, state_1.findEntry)(state, issue);
         if (!entry)
             continue;
-        if (entry.mode !== 'slot' || evicted.has(issue) || (0, state_1.isPreservedMember)(entry))
+        // #810: a PARKED member (evicted / handed back) left the batch before
+        // landing — not a survivor, whether or not it has an `evictions[]` record.
+        if (entry.mode !== 'slot' ||
+            evicted.has(issue) ||
+            (0, state_1.isPreservedMember)(entry) ||
+            state_1.PARKED_MEMBER_STATUSES.has(entry.status)) {
             continue;
+        }
         // Pre-dispatch statuses: queued/classified/batched/waiting. `in-work` is
         // stamped at SPAWN (`spawnMember`), `committed`/`validated` at verified
         // completion — everything the entry can reach afterwards means the
@@ -3007,7 +3209,9 @@ function teardownBatch(deps, batchId) {
     const terminal = (0, state_1.findBatch)(deps.store.load(), batchId);
     const lastMemberLanded = terminal?.ranges.some((r) => r.issue === terminal.members[terminal.executing_member - 1]) ===
         true;
+    const serialTree = terminal?.member_worktree ?? null;
     teardownMemberWorktree(deps, batchId, deps.now(), lastMemberLanded);
+    teardownParallelRuns(deps, batchId, serialTree);
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.worktree === null)
@@ -3031,6 +3235,618 @@ function teardownBatch(deps, batchId) {
         worktree: batch.worktree,
     });
 }
+// --- Parallel member dispatch (#809) ---
+/**
+ * How a batch should dispatch its members (#809) — decided once, at the
+ * `ready → executing` claim, and persisted on `BatchEntry.member_dispatch`.
+ *
+ * Serial when the operator set `member_parallelism: 1`, or the batch itself
+ * says its members are not independent: an eviction group (members that must
+ * revert together — e.g. one built on another's API) or a member whose `deps`
+ * names another member (it must see that member's landed work before it is
+ * cut). Parallel otherwise — the batch-cycle skill's and prep dossier's
+ * design (RFC-0001 §J.3: each member works off the integration branch and
+ * sees no one else's changes until the parent lands them).
+ */
+/** @internal exported for tests. */
+function memberDispatchModeFor(state, batch, config) {
+    if (config.member_parallelism === 1)
+        return 'serial';
+    if (batch.eviction_groups.some((group) => group.length > 1))
+        return 'serial';
+    const members = new Set(batch.members);
+    for (const issue of batch.members) {
+        if ((0, state_1.findEntry)(state, issue)?.deps.some((dep) => members.has(dep)))
+            return 'serial';
+    }
+    return 'parallel';
+}
+/** Whether `batch` runs the parallel member rail — `null` (pre-#809, or not yet claimed) is serial. */
+function isParallelBatch(batch) {
+    return batch.member_dispatch === 'parallel';
+}
+/** At most this many members of one batch run at once (#809) — `max_slots` when unset. */
+function memberParallelism(config) {
+    // Both are validated ≥ 1 at config load (`member_parallelism`, `max_slots`).
+    return config.member_parallelism ?? config.max_slots;
+}
+/** The teardown target of a member run (or a freshly prepared member tree). */
+function runTree(r) {
+    return 'pool_claimed' in r
+        ? { worktree: r.worktree, branch: r.branch, poolClaimed: r.pool_claimed }
+        : { worktree: r.worktree, branch: r.branch, poolClaimed: r.poolClaimed };
+}
+/**
+ * Record that a run's tree is gone. Written AFTER the teardown, so a crash in
+ * between re-runs the (idempotent) teardown from `teardownParallelRuns`
+ * instead of leaking the tree.
+ */
+function markTornDown(deps, batchId, issue, now) {
+    deps.store.withLock((s) => ({
+        state: patchRun(s, batchId, issue, { torn_down: true }, now),
+        result: undefined,
+    }));
+}
+/** Merge `patch` into member `issue`'s run record (no-op when it has none). */
+function patchRun(state, batchId, issue, patch, now) {
+    const batch = (0, state_1.findBatch)(state, batchId);
+    if (!batch || !batch.member_runs.some((r) => r.issue === issue))
+        return state;
+    return (0, state_1.patchBatch)(state, batchId, { member_runs: batch.member_runs.map((r) => (r.issue === issue ? { ...r, ...patch } : r)) }, now);
+}
+/** Insert or replace member `run.issue`'s run record. */
+function upsertRun(state, batchId, run, now) {
+    const batch = (0, state_1.findBatch)(state, batchId);
+    if (!batch)
+        return state;
+    const others = batch.member_runs.filter((r) => r.issue !== run.issue);
+    return (0, state_1.patchBatch)(state, batchId, { member_runs: [...others, run].sort((a, b) => a.index - b.index) }, now);
+}
+/**
+ * Whether `issue` is still an active member of `batch` — not evicted / handed back
+ * (its `evictions[]` record — a #810 parked entry keeps `mode: 'slot'` and its
+ * batch, so the record is what takes it out), and its queue entry (when it has
+ * one) still a live slot-mode entry of THIS batch — which also covers a member
+ * stopped, abandoned or operator-requeued out from under the batch.
+ */
+function memberStillInBatch(state, batch, issue) {
+    if (batch.evictions.some((e) => e.issue === issue))
+        return false;
+    const entry = (0, state_1.findEntry)(state, issue);
+    if (entry === undefined)
+        return true;
+    return (entry.mode === 'slot' &&
+        entry.batch === batch.id &&
+        !types_1.TERMINAL_ISSUE_STATUSES.has(entry.status) &&
+        !state_1.PARKED_MEMBER_STATUSES.has(entry.status));
+}
+/** Whether member `issue`'s own slot currently holds a live agent. */
+function hasLiveMemberSlot(state, batchId, issue) {
+    const slot = (0, state_1.slotForBatchMember)(state, batchId, issue);
+    return slot !== undefined && types_1.LIVE_SLOT_STATUSES.has(slot.status);
+}
+/**
+ * The next member to (re)spawn: first a run still `running` that holds no slot
+ * (an api-error hold released it, its spawn threw, or the engine restarted) —
+ * respawned in place, in its own worktree — then the first member in order
+ * that has no run yet.
+ */
+function nextParallelCandidate(state, batch, attempted) {
+    for (const run of batch.member_runs) {
+        if (run.status === 'running' &&
+            !attempted.has(run.issue) &&
+            (0, state_1.slotForBatchMember)(state, batch.id, run.issue) === undefined &&
+            memberStillInBatch(state, batch, run.issue)) {
+            return { issue: run.issue, index: run.index, run };
+        }
+    }
+    for (const [i, issue] of batch.members.entries()) {
+        if (attempted.has(issue) || batch.member_runs.some((r) => r.issue === issue))
+            continue;
+        if (!memberStillInBatch(state, batch, issue))
+            continue;
+        return { issue, index: i + 1 };
+    }
+    return undefined;
+}
+/**
+ * Fill the batch's member concurrency: spawn members into their OWN slots
+ * (`batch:<id>#<issue>`) while fewer than `member_parallelism` run and the
+ * scheduler has free capacity. Each gets its own worktree off the integration
+ * branch (`prepareMemberWorktree`, outside the lock) — the integration branch
+ * does not move until members land, so concurrent members are all cut from the
+ * same base. A member whose worktree cannot be prepared is evicted (parked, #810 —
+ * an operator's `sched requeue` runs it full-cycle, which does its own setup)
+ * rather than retried every tick in front of the members behind it.
+ */
+function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
+    const limit = memberParallelism(config);
+    const fsExists = deps.fsExists ?? ((p) => fs.existsSync(p));
+    const attempted = new Set();
+    // Bounded by the member count: every iteration marks one member attempted.
+    for (;;) {
+        const state = deps.store.load();
+        const batch = (0, state_1.findBatch)(state, batchId);
+        if (!batch || batch.status !== 'executing' || !isParallelBatch(batch))
+            return;
+        const live = batch.member_runs.filter((r) => hasLiveMemberSlot(state, batchId, r.issue)).length;
+        if (live >= limit || (0, scheduler_1.freeCapacity)(state, config) === 0)
+            return;
+        const next = nextParallelCandidate(state, batch, attempted);
+        if (next === undefined)
+            return;
+        attempted.add(next.issue);
+        let member;
+        const reusable = next.run !== undefined &&
+            fsExists(next.run.worktree) &&
+            (next.run.pool_claimed ||
+                (0, teardown_1.isSafeWorktree)(path.resolve(deps.exec('git', ['rev-parse', '--show-toplevel'], deps.repoDir) ?? deps.repoDir), next.run.worktree));
+        if (next.run !== undefined && reusable) {
+            member = {
+                branch: next.run.branch,
+                worktree: next.run.worktree,
+                poolClaimed: next.run.pool_claimed,
+            };
+        }
+        else {
+            // The serial-member fields describe no member of a parallel batch —
+            // blank them so the reuse branch re-derives THIS member's branch/path.
+            const prep = prepareMemberWorktree(deps, { ...batch, member_branch: null, member_worktree: null, member_pool_claimed: false }, next.index, next.issue, now);
+            if (!prep.ok) {
+                evictMemberDirectly(deps, config, batchId, next.issue, {
+                    reason: `member-worktree-prep-failed:${prep.reason}`,
+                    detail: `member worktree prep failed: ${prep.reason} (member ${next.index} #${next.issue}, branch ${memberBranchFor(batchId, next.index, next.issue)})`,
+                }, now);
+                result.failed.push((0, state_1.batchMemberUnit)(batchId, next.issue));
+                continue;
+            }
+            member = prep;
+        }
+        const recorded = deps.store.withLock((s) => {
+            const b = (0, state_1.findBatch)(s, batchId);
+            if (!b || b.status !== 'executing' || (0, state_1.slotForBatchMember)(s, batchId, next.issue)) {
+                return { state: s, result: false };
+            }
+            // The run is recorded whether or not a slot is free and the spawn
+            // succeeds: its worktree exists either way, and a `running` run with no
+            // slot is exactly what a later pass respawns in place.
+            let n = upsertRun(s, batchId, {
+                issue: next.issue,
+                index: next.index,
+                branch: member.branch,
+                worktree: member.worktree,
+                pool_claimed: member.poolClaimed,
+                status: 'running',
+                gate_inconclusive: null,
+                torn_down: false,
+            }, now);
+            if ((0, scheduler_1.freeCapacity)(n, config) === 0)
+                return { state: n, result: true };
+            const memberUnit = (0, state_1.batchMemberUnit)(batchId, next.issue);
+            const assigned = (0, scheduler_1.assignToIdleSlot)(n, memberUnit, 'member', now, 'cycle');
+            const slot = assigned.state.slots.find((x) => x.id === assigned.slotId);
+            if (!slot)
+                return { state: n, result: true };
+            n = spawnMemberAgent(deps, dispatch, assigned.state, slot, batchId, now, result, {
+                index: next.index,
+                issue: next.issue,
+                member,
+                unitId: memberUnit,
+                release: (st) => (0, state_1.releaseBatchMemberSlot)(st, batchId, next.issue, now),
+            }).state;
+            n = (0, state_1.patchBatch)(n, batchId, { executing_member: Math.max(b.executing_member, next.index) }, now);
+            return { state: n, result: true };
+        });
+        if (!recorded && next.run === undefined) {
+            // The batch left `executing` (stopped/abandoned/dissolved) while the
+            // tree was being prepared outside the lock — nothing records it, so
+            // give it back now rather than leak a worktree/pool claim.
+            journalEvent(deps, 'unit-failed', unit(batchId), {
+                issue: next.issue,
+                reason: 'member-worktree-orphaned',
+                detail: `batch left executing while member ${next.index}'s tree ${member.worktree} was prepared — tearing it down`,
+            });
+            teardownMemberTree(deps, batchId, runTree(member), false);
+        }
+    }
+}
+/**
+ * Evict one parallel member directly (RFC F.1 — its commits never landed) and
+ * tear its worktree down; the pushed member branch is KEPT on origin (the
+ * evicted work's only recoverable copy, as in serial mode). A dissolve this
+ * tips over is torn down by `teardownBatch`, which covers every live run.
+ */
+function evictParallelMember(deps, config, batchId, run, failure, now, result) {
+    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, run.issue, failure, now);
+    if (duplicate)
+        return;
+    result.failed.push(batchEnded ? unit(batchId) : (0, state_1.batchMemberUnit)(batchId, run.issue));
+    if (batchEnded)
+        return;
+    deps.store.withLock((s) => ({
+        state: patchRun(s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now),
+        result: undefined,
+    }));
+    teardownMemberTree(deps, batchId, runTree(run), false);
+    markTornDown(deps, batchId, run.issue, now);
+}
+/**
+ * Reconcile one parallel member's slot — the parallel twin of
+ * `reconcileMemberSlot`: the same fenced milestone read, the same incremental
+ * gate (in the member's OWN worktree), the same eviction rail. A verified
+ * member does NOT land here: landing is ordered (`advanceParallelBatch`), so
+ * it only leaves `running` and gives its slot back.
+ */
+function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot, now, result) {
+    const state0 = deps.store.load();
+    const read = readMemberDispatch(deps, batchId, run.issue, slot, now);
+    if (read.kind === 'unreachable')
+        return;
+    const memberUnit = (0, state_1.batchMemberUnit)(batchId, run.issue);
+    const release = (s) => (0, state_1.releaseBatchMemberSlot)(s, batchId, run.issue, now);
+    if (read.kind === 'complete') {
+        // Its slot is about to be released and its tree rebased/force-pushed at
+        // landing: an agent still running after `review done` would keep writing
+        // into that tree with its pid no longer tracked anywhere (so neither a
+        // dissolve nor `sched stop --batch` could stop it). Its work is done —
+        // stop it first.
+        if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        }
+        journalEvent(deps, 'external-advance', unit(batchId), {
+            issue: run.issue,
+            detail: 'member review done',
+        });
+        recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now);
+        const verdict = evaluateIncrementalGate(deps, batchId, run.worktree, run.issue, now);
+        if (verdict.kind === 'failed') {
+            deps.store.withLock((s) => ({ state: release(s), result: undefined }));
+            evictParallelMember(deps, config, batchId, run, { reason: verdict.reason, detail: verdict.detail }, now, result);
+            return;
+        }
+        deps.store.withLock((s) => ({
+            // #629: a verified member completion is proof dispatch is healthy.
+            state: patchRun((0, dispatch_health_1.resetDispatchApiErrorStreak)(release(s)), batchId, run.issue, {
+                status: 'verified',
+                gate_inconclusive: verdict.kind === 'inconclusive' ? verdict.capability : null,
+            }, now),
+            result: undefined,
+        }));
+        result.completed.push(memberUnit);
+        return;
+    }
+    if (read.dead &&
+        !read.blockedNow &&
+        handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, run.index, run.issue), slot.log_offset_at_spawn ?? 0, now, { releaseWith: release })) {
+        // #629: not a member failure — the run stays `running` with no slot, and
+        // `spawnParallelMembers` (pause-gated) respawns it in place.
+        return;
+    }
+    if (read.blockedNow || read.dead) {
+        const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now);
+        deps.store.withLock((s) => ({ state: release(s), result: undefined }));
+        evictParallelMember(deps, config, batchId, run, memberFailureFor(read, lastTool), now, result);
+    }
+}
+/**
+ * Land one verified parallel member onto the integration branch (#809): rebase
+ * its commits onto the integration TIP in its own worktree (earlier members may
+ * have landed since it was cut), refresh the pushed member branch, then
+ * `merge --ff-only` + push in the batch worktree — the same linear,
+ * `(#<issue>)`-trailed history serial landing produces, so `memberRanges`
+ * attribution and per-member commits are unchanged.
+ *
+ * `conflict` — the member's diff does not apply on top of the members landed
+ * before it (the rebase is aborted, leaving its pushed branch untouched); the
+ * caller evicts it, batch-integrate's eviction verdict. `failed` — a mechanical
+ * step failed after a clean rebase; the caller blocks the batch, like serial.
+ */
+function landParallelRun(deps, batch, run, now) {
+    const fail = (reason, detail) => {
+        journalEvent(deps, 'landing-failed', unit(batch.id), { issue: run.issue, reason, detail });
+        return { kind: 'failed', reason };
+    };
+    if (batch.worktree === null || batch.branch === null) {
+        return fail('no-integration-branch', 'batch has no integration worktree/branch');
+    }
+    // Defense in depth (CWE-88): persisted refs reach git argv below.
+    if (!attribution_1.SAFE_REF_RE.test(run.branch) || !attribution_1.SAFE_REF_RE.test(batch.branch)) {
+        return fail('invalid-branch-name', `persisted member/integration branch failed SAFE_REF_RE: ${run.branch} → ${batch.branch}`);
+    }
+    // The rebase rewrites whatever is checked out in `run.worktree` — confirm
+    // it is this member's own tree, present, on this member's branch first.
+    if (!(deps.fsExists ?? ((p) => fs.existsSync(p)))(run.worktree)) {
+        return fail('member-worktree-missing', `member worktree ${run.worktree} is gone from disk`);
+    }
+    if (!run.pool_claimed) {
+        const root = deps.exec('git', ['rev-parse', '--show-toplevel'], deps.repoDir) ?? deps.repoDir;
+        if (!(0, teardown_1.isSafeWorktree)(path.resolve(root), run.worktree)) {
+            return fail('unsafe-member-worktree', `member worktree ${run.worktree} is outside the repo's worktree roots`);
+        }
+    }
+    // A rebase an engine crash left half-done would make the next one fail
+    // ("rebase already in progress") and read as a conflict — clear it first
+    // (a no-op failure when none is in progress).
+    deps.exec('git', ['rebase', '--abort'], run.worktree);
+    const head = deps.exec('git', ['symbolic-ref', '--short', 'HEAD'], run.worktree)?.trim();
+    if (head !== run.branch) {
+        return fail('member-worktree-off-branch', `member worktree ${run.worktree} has ${head ?? 'no branch'} checked out, expected ${run.branch} — not rebasing someone else's checkout`);
+    }
+    // The force-push below must never overwrite work pushed to the member
+    // branch that is not part of what was verified here. Read origin's tip NOW
+    // (a bare `--force-with-lease` would trust `origin/<branch>`, which any fetch
+    // in the shared repo refreshes) and require it to be an ancestor of the
+    // verified local branch (the member may not have pushed its last commit);
+    // the lease then pins exactly that tip.
+    const verified = deps
+        .exec('git', ['rev-parse', `refs/heads/${run.branch}`], run.worktree)
+        ?.trim();
+    const remoteLine = deps.exec('git', ['ls-remote', 'origin', `refs/heads/${run.branch}`], run.worktree);
+    if (!verified || !groundtruth_1.GIT_OID_RE.test(verified) || remoteLine === null) {
+        return fail('member-branch-unresolved', `could not resolve ${run.branch} locally and on origin before landing`);
+    }
+    const remoteTip = remoteLine.trim().split(/\s+/)[0] ?? '';
+    if (remoteTip !== '' &&
+        (!groundtruth_1.GIT_OID_RE.test(remoteTip) ||
+            deps.exec('git', ['merge-base', '--is-ancestor', remoteTip, verified], run.worktree) === null)) {
+        return fail('member-branch-diverged', `origin/${run.branch} (${remoteTip.slice(0, 12)}) holds commits the verified ${verified.slice(0, 12)} does not — something was pushed after verification; blocking rather than overwriting it`);
+    }
+    // `--autostash`: a stray uncommitted file in the member tree is not the
+    // member's deliverable and must not read as a conflict.
+    if (deps.exec('git', ['rebase', '--autostash', batch.branch], run.worktree) === null) {
+        // Only a rebase stopped on unmerged paths is a CONFLICT (eviction); any
+        // other failure is mechanical and blocks like the other landing steps.
+        const unmerged = (deps.exec('git', ['diff', '--name-only', '--diff-filter=U'], run.worktree) ?? '')
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0);
+        deps.exec('git', ['rebase', '--abort'], run.worktree);
+        if (unmerged.length === 0) {
+            return fail('member-rebase-failed', `git rebase of ${run.branch} onto ${batch.branch} failed with no conflicting paths — blocking for an operator`);
+        }
+        const detail = `${run.branch} does not rebase cleanly onto ${batch.branch} — conflicting with members landed before it in: ${unmerged.slice(0, 10).join(', ')}; evicted with its pushed branch intact`;
+        journalEvent(deps, 'landing-failed', unit(batch.id), {
+            issue: run.issue,
+            reason: 'landing-conflict',
+            detail,
+        });
+        return { kind: 'conflict', detail };
+    }
+    if (deps.exec('git', [
+        'push',
+        `--force-with-lease=refs/heads/${run.branch}:${remoteTip}`,
+        'origin',
+        '--',
+        run.branch,
+    ], run.worktree) === null) {
+        return fail('member-push-failed', `rebased ${run.branch} onto ${batch.branch} but could not push it (origin moved since ${remoteTip.slice(0, 12) || 'absent'}, or the push failed) — blocking so nothing pushed after verification is overwritten`);
+    }
+    if (deps.exec('git', ['merge', '--ff-only', run.branch], batch.worktree) === null) {
+        return fail('landing-merge-failed', `git merge --ff-only ${run.branch} into ${batch.branch} failed right after a clean rebase — blocking for an operator`);
+    }
+    if (deps.exec('git', ['push', 'origin', '--', batch.branch], batch.worktree) === null) {
+        return fail('landing-push-failed', `landed ${run.branch} on ${batch.branch} locally but the push failed — blocking so origin stays the durable copy`);
+    }
+    deps.journal.append((0, journal_1.unitEvent)('member-landed', unit(batch.id), {
+        issue: run.issue,
+        detail: `${run.branch} rebased onto and fast-forwarded into ${batch.branch} (member ${run.index}, parallel)`,
+    }), now);
+    return { kind: 'landed' };
+}
+/**
+ * Walk members IN ORDER: skip every resolved one (landed, evicted, or no longer
+ * in the batch); the first unresolved one is either landable (`verified`) or
+ * something the walk must wait for (not yet spawned, or still running) — later
+ * members never land ahead of it, so the integration branch always holds a
+ * member-order prefix.
+ */
+function nextLandingStep(state, batch) {
+    for (const issue of batch.members) {
+        const run = batch.member_runs.find((r) => r.issue === issue);
+        if (run?.status === 'landed' || run?.status === 'evicted')
+            continue;
+        if (!memberStillInBatch(state, batch, issue))
+            continue;
+        if (run === undefined || run.status === 'running')
+            return { kind: 'wait' };
+        return { kind: 'land', run };
+    }
+    return { kind: 'done' };
+}
+/**
+ * Land every landable member in order, then — once every member is resolved —
+ * either block on a gate-inconclusive member (serial parity: it landed, the
+ * batch blocks for `sched resume --batch`) or move to `validating` and run the
+ * aggregate suite once.
+ */
+function advanceParallelBatch(deps, config, dispatch, batchId, now, result) {
+    // Bounded: every iteration lands or evicts one member.
+    for (;;) {
+        const state = deps.store.load();
+        const batch = (0, state_1.findBatch)(state, batchId);
+        if (!batch || batch.status !== 'executing' || !isParallelBatch(batch))
+            return;
+        const step = nextLandingStep(state, batch);
+        if (step.kind === 'wait')
+            return;
+        if (step.kind === 'done') {
+            finalizeParallelMembers(deps, config, dispatch, batchId, now, result);
+            return;
+        }
+        const { run } = step;
+        const landed = landParallelRun(deps, batch, run, now);
+        if (landed.kind === 'conflict') {
+            evictParallelMember(deps, config, batchId, run, { reason: 'landing-conflict', detail: landed.detail }, now, result);
+            continue;
+        }
+        if (landed.kind === 'failed') {
+            stopRunningMembers(deps, batchId, now);
+            blockBatchForOperator(deps, config, batchId, { reason: landed.reason }, now, result);
+            return;
+        }
+        // `git log` outside the lock (same invariant as `completeMemberGate`).
+        const ranges = (0, attribution_1.memberRanges)(boundaryCommits(deps, batch));
+        deps.store.withLock((s) => {
+            let n = (0, state_1.patchBatch)(s, batchId, { ranges }, now);
+            n = advanceMemberToValidated(n, run.issue, now);
+            n = patchRun(n, batchId, run.issue, { status: 'landed' }, now);
+            return { state: n, result: undefined };
+        });
+        // A gate-inconclusive member keeps its tree for `sched resume --batch`'s
+        // recheck; everyone else's is done serving.
+        if (run.gate_inconclusive === null) {
+            teardownMemberTree(deps, batchId, runTree(run), true);
+            markTornDown(deps, batchId, run.issue, now);
+        }
+    }
+}
+/** Every member is resolved — block on a gate-inconclusive one, or validate. */
+function finalizeParallelMembers(deps, config, dispatch, batchId, now, result) {
+    const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (!batch)
+        return;
+    const blockedOn = batch.member_runs.find((r) => r.status === 'landed' && r.gate_inconclusive !== null);
+    if (blockedOn !== undefined) {
+        // Point the serial "current member" fields at it: `sched resume --batch`
+        // (`resumeBlockedGate`) rechecks `member_worktree` and completes/evicts
+        // `members[executing_member - 1]`, then hands back via
+        // `advanceMemberOrValidate` → `settleParallelResume`.
+        deps.store.withLock((s) => ({
+            state: (0, state_1.patchBatch)(s, batchId, {
+                executing_member: blockedOn.index,
+                member_branch: blockedOn.branch,
+                member_worktree: blockedOn.worktree,
+                member_pool_claimed: blockedOn.pool_claimed,
+            }, now),
+            result: undefined,
+        }));
+        blockBatchForOperator(deps, config, batchId, {
+            reason: `gate-inconclusive:${blockedOn.gate_inconclusive}`,
+            milestonePhase: 'batch-review',
+        }, now, result);
+        return;
+    }
+    const claimed = deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        if (!b || b.status !== 'executing')
+            return { state: s, result: false };
+        return {
+            state: (0, state_1.transitionBatch)(s, batchId, 'validating', { executing_member: b.members.length }, now),
+            result: true,
+        };
+    });
+    if (claimed)
+        runValidate(deps, config, dispatch, batchId, now, result);
+}
+/**
+ * `sched resume --batch` resolved the gate-inconclusive member of a parallel
+ * batch (completed or evicted it through the serial rail): record that on its
+ * run so the landing walk treats it as resolved, then continue the parallel
+ * rail from where it blocked.
+ */
+function settleParallelResume(deps, batchId, memberIssue, now) {
+    deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        if (!b)
+            return { state: s, result: undefined };
+        const evicted = b.evictions.some((e) => e.issue === memberIssue);
+        return {
+            state: patchRun(s, batchId, memberIssue, {
+                gate_inconclusive: null,
+                // The serial rail's `teardownMemberWorktree` removed its tree.
+                torn_down: true,
+                ...(evicted ? { status: 'evicted' } : {}),
+            }, now),
+            result: undefined,
+        };
+    });
+}
+/**
+ * One tick of a parallel batch in `executing`: reconcile every member slot,
+ * land what can land in order, then fill free member concurrency (unless the
+ * scheduler is paused — a spawn is a provider dispatch).
+ */
+function reconcileParallelBatch(deps, config, dispatch, batchId, now, result, paused) {
+    const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (!batch)
+        return;
+    for (const { issue } of batch.member_runs) {
+        // Fresh per member: an earlier member's eviction may have dissolved the
+        // batch (killing and releasing every other member) in this same pass.
+        const state = deps.store.load();
+        const fresh = (0, state_1.findBatch)(state, batchId);
+        if (!fresh || fresh.status !== 'executing')
+            return;
+        const run = fresh.member_runs.find((r) => r.issue === issue);
+        if (run?.status !== 'running')
+            continue;
+        const slot = (0, state_1.slotForBatchMember)(state, batchId, issue);
+        if (slot && (slot.status === 'running' || slot.status === 'assigned')) {
+            reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot, now, result);
+        }
+    }
+    advanceParallelBatch(deps, config, dispatch, batchId, now, result);
+    if (!paused)
+        spawnParallelMembers(deps, config, dispatch, batchId, now, result);
+}
+/**
+ * #809: stop and tear down every parallel member whose tree is not yet torn
+ * down — a dissolve can land while other members are mid-run (their agents are
+ * killed: their entries were just parked or requeued, so a live member agent
+ * would be working a unit nothing tracks any more), `sched stop`/`abandon`
+ * make a batch terminal without a teardown, and a crash between a run's
+ * resolution and its teardown leaves `torn_down: false` behind. Teardown is
+ * idempotent, so re-running it is always safe. `alreadyTornDown` names the
+ * serial-field tree `teardownMemberWorktree` just handled (a gate-inconclusive
+ * member of a blocked parallel batch).
+ */
+function teardownParallelRuns(deps, batchId, alreadyTornDown) {
+    const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (!batch)
+        return;
+    const now = deps.now();
+    for (const run of batch.member_runs) {
+        if (run.torn_down)
+            continue;
+        stopMemberAgent(deps, batchId, run.issue, now);
+        const landed = run.status === 'landed';
+        deps.store.withLock((s) => ({
+            state: patchRun(s, batchId, run.issue, { status: landed ? 'landed' : 'evicted', gate_inconclusive: null }, now),
+            result: undefined,
+        }));
+        if (run.worktree !== alreadyTornDown) {
+            teardownMemberTree(deps, batchId, runTree(run), landed);
+        }
+        markTornDown(deps, batchId, run.issue, now);
+    }
+}
+/** Kill a parallel member's live agent (pid-start checked) and release its slot. */
+function stopMemberAgent(deps, batchId, issue, now) {
+    const slot = (0, state_1.slotForBatchMember)(deps.store.load(), batchId, issue);
+    if (slot === undefined)
+        return;
+    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+    }
+    deps.store.withLock((s) => ({
+        state: (0, state_1.releaseBatchMemberSlot)(s, batchId, issue, now),
+        result: undefined,
+    }));
+}
+/**
+ * Stop every running member of a parallel batch that is about to BLOCK (a
+ * landing failure, a reconcile error): nothing reconciles a blocked batch's
+ * member slots, so a still-running agent would hold capacity and keep working
+ * a unit an operator is about to abandon/requeue. Trees are kept for the
+ * operator; `teardownBatch` removes them when the batch ends.
+ */
+function stopRunningMembers(deps, batchId, now) {
+    const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
+    for (const run of batch?.member_runs ?? []) {
+        if (run.status === 'running')
+            stopMemberAgent(deps, batchId, run.issue, now);
+    }
+}
 // --- Entry point ---
 /**
  * One batch reconcile+refill pass. Called from `engine.ts`'s `tick()` after
@@ -3059,7 +3875,8 @@ function runBatchTick(deps, config, dispatch) {
     // - pre-merge (`dissolving` is a legal edge): DISSOLVE with reason
     //   `dispatch-profile-missing:<name>` — loud, deterministic, one-shot, and
     //   the members requeue as full-cycle units on the config default, which is
-    //   a coherent recovery rather than a mislabelled continuation.
+    //   a coherent recovery rather than a mislabelled continuation (#810: in-flight
+    //   members park on the default; validated members block the batch instead).
     // - post-merge (PR parked/merged — the product already shipped): dissolving
     //   would discard a landed PR's bookkeeping, so the remaining dispatch (the
     //   report agent) runs on the default and journals
@@ -3093,18 +3910,20 @@ function runBatchTick(deps, config, dispatch) {
             const fresh = (0, state_1.findBatch)(current, batch.id);
             const dissolvable = fresh !== undefined && (0, state_1.allowedBatchTransitions)(fresh.status).includes('dissolving');
             if (dissolvable) {
-                const liveSlot = slotFor(current, batch.id);
-                if (liveSlot !== undefined &&
-                    liveSlot.pid !== null &&
-                    deps.spawnDeps.isAlive(liveSlot.pid, liveSlot.pid_start ?? undefined)) {
-                    deps.spawnDeps.kill(liveSlot.pid, liveSlot.pid_start ?? undefined);
+                // #809: a parallel batch holds one slot per running member too.
+                for (const liveSlot of (0, state_1.slotsForBatch)(current, batch.id)) {
+                    if (liveSlot.pid !== null &&
+                        deps.spawnDeps.isAlive(liveSlot.pid, liveSlot.pid_start ?? undefined)) {
+                        deps.spawnDeps.kill(liveSlot.pid, liveSlot.pid_start ?? undefined);
+                    }
                 }
-                const outcome = (0, recovery_1.dissolveBatch)(current, batch.id, { strategy: 'full', reason: `dispatch-profile-missing:${batch.dispatch_profile}` }, recoveryDeps(deps, config, fresh, now));
-                deps.store.withLock((s) => ({
-                    state: applyBatchAndIssues(s, outcome.state, batch.id, outcome.requeued),
-                    result: undefined,
-                }));
-                teardownBatch(deps, batch.id);
+                const outcome = (0, recovery_1.dissolveBatch)(current, batch.id, {
+                    strategy: 'full',
+                    reason: `dispatch-profile-missing:${batch.dispatch_profile}`,
+                    // #810: the profile is what is broken — requeue on the default.
+                    carryDispatchProfile: false,
+                }, recoveryDeps(deps, config, fresh, now));
+                applyDissolveOutcome(deps, batch.id, outcome, now);
                 result.failed.push(unit(batch.id));
                 // Resolution failed: clean up any batch/member worktrees, then skip
                 // this batch for the rest of the pass. No further arm can claim it.
@@ -3126,6 +3945,13 @@ function runBatchTick(deps, config, dispatch) {
     };
     const containFailure = (batchId, err) => {
         const detail = `${err.name}: ${err.message}`;
+        // #809: a blocked batch's member slots are never reconciled — stop the agents too.
+        try {
+            stopRunningMembers(deps, batchId, now);
+        }
+        catch {
+            // best-effort: the block below must still land
+        }
         // A corrupt unit must not turn into a project-wide scheduler outage.
         // Keep the failed batch inspectable, release its slot, and continue.
         deps.store.withLock((state) => {
@@ -3134,7 +3960,7 @@ function runBatchTick(deps, config, dispatch) {
                 return { state, result: undefined };
             }
             const blocked = (0, state_1.transitionBatch)(state, batchId, 'blocked', { blocked_reason: 'reconcile-error' }, now);
-            return { state: (0, state_1.releaseBatchSlot)(blocked, batchId, now), result: undefined };
+            return { state: (0, state_1.releaseAllBatchSlots)(blocked, batchId, now), result: undefined };
         });
         journalEvent(deps, 'unit-failed', unit(batchId), { reason: 'reconcile-error', detail });
         result.failed.push(unit(batchId));
@@ -3186,6 +4012,8 @@ function runBatchTick(deps, config, dispatch) {
     }
     for (const batch of deps.store.load().batches) {
         const slot = slotFor(deps.store.load(), batch.id);
+        // #809: a terminal batch may also leak parallel member slots.
+        const heldSlots = (0, state_1.slotsForBatch)(deps.store.load(), batch.id);
         // #609: a TERMINAL batch (`done`/`dissolved`) still holding a slot matches
         // none of the status arms below and would fall through their `continue`,
         // so nothing ever looks at that slot again — not even the orphaned-pid
@@ -3197,15 +4025,29 @@ function runBatchTick(deps, config, dispatch) {
         // files that already carry a leaked slot, which is the only way an
         // operator gets those three hours of held capacity back.
         if (types_1.TERMINAL_BATCH_STATUSES.has(batch.status)) {
-            if (slot) {
+            // #809: `sched stop`/`abandon` end a batch without a teardown — give
+            // back every member tree (and stop any agent still running in one).
+            if (batch.member_runs.some((r) => !r.torn_down)) {
+                try {
+                    teardownParallelRuns(deps, batch.id, null);
+                }
+                catch (err) {
+                    journalEvent(deps, 'teardown-failed', unit(batch.id), {
+                        detail: `member teardown: ${err.message}`,
+                    });
+                }
+            }
+            if (heldSlots.length > 0) {
                 deps.store.withLock((s) => ({
-                    state: (0, state_1.releaseBatchSlot)(s, batch.id, now),
+                    state: (0, state_1.releaseAllBatchSlots)(s, batch.id, now),
                     result: undefined,
                 }));
-                journalEvent(deps, 'slot-released', unit(batch.id), {
-                    slot: slot.id,
-                    detail: `terminal batch (${batch.status}) held slot ${slot.id}`,
-                });
+                for (const held of heldSlots) {
+                    journalEvent(deps, 'slot-released', unit(batch.id), {
+                        slot: held.id,
+                        detail: `terminal batch (${batch.status}) held slot ${held.id}${held.unit === unit(batch.id) ? '' : ` (${held.unit})`}`,
+                    });
+                }
             }
             continue;
         }
@@ -3217,6 +4059,12 @@ function runBatchTick(deps, config, dispatch) {
             const batchDispatch = dispatchFor(batch);
             if (batchDispatch === null)
                 continue;
+            // #809: a parallel batch's members hold their OWN slots — its whole
+            // `executing` phase is one arm.
+            if (batch.status === 'executing' && isParallelBatch(batch)) {
+                reconcileParallelBatch(deps, config, batchDispatch, batch.id, now, result, paused);
+                continue;
+            }
             if (slot && (slot.status === 'running' || slot.status === 'assigned')) {
                 if (batch.status === 'executing') {
                     reconcileMemberSlot(deps, config, batchDispatch, batch.id, slot, now, result);