@ai-dossier/sched 0.47.0 → 0.48.1

package/dist/batch-dispatch.js

@@ -142,8 +142,11 @@ function unit(batchId) {
  */
 function sanitizeUntrustedText(value) {
     return (value
+        // C0 + DEL + C1 (incl. the single-byte CSI \u009B) and the bidi
+        // overrides/isolates (#810: the reason now also renders in `sched status`'s
+        // Parked members rows).
         // biome-ignore lint/suspicious/noControlCharactersInRegex: flattening control characters is the point
-        .replace(/[\u0000-\u001F\u007F]/g, ' ')
+        .replace(/[\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069]/g, ' ')
         .slice(0, 200));
 }
 /**
@@ -351,6 +354,31 @@ function applyBatchAndIssues(fresh, computed, batchId, issues, membersBeforeReco
     });
     return { ...fresh, batches, entries };
 }
+/**
+ * #810: land a `dissolveBatch` outcome — the one tail every dissolve caller
+ * shares. Re-applies the batch plus every entry the dissolve touched
+ * (requeued AND parked — a parked entry left out here would silently revert
+ * to its pre-dissolve status). A dissolved batch is torn down; a dissolve
+ * REFUSED over validated members (`outcome.blocked`) keeps its worktree for
+ * the operator, but its member agents are stopped and its slots released —
+ * nothing reconciles a blocked batch's member slots.
+ */
+function applyDissolveOutcome(deps, batchId, outcome, now, membersBeforeRecovery) {
+    deps.store.withLock((s) => ({
+        state: applyBatchAndIssues(s, outcome.state, batchId, [...outcome.requeued, ...outcome.parked], membersBeforeRecovery),
+        result: undefined,
+    }));
+    if (outcome.blocked) {
+        stopAndReleaseBlocked(deps, batchId, now);
+        return;
+    }
+    teardownBatch(deps, batchId);
+}
+/** Stop every live agent of a batch that just blocked, and release all its slots (#810). */
+function stopAndReleaseBlocked(deps, batchId, now) {
+    stopRunningMembers(deps, batchId, now);
+    deps.store.withLock((s) => ({ state: (0, state_1.releaseAllBatchSlots)(s, batchId, now), result: undefined }));
+}
 /**
  * Run the aggregate suite, treating a THROWING runner as a red suite with no
  * failing tests — `recovery.ts`'s own internal `runSuite` wrapper already
@@ -765,8 +793,9 @@ function landMemberBranch(deps, batchId, now) {
  * dangling pool entry — the corrupted-entry state `worktree-pool status`
  * reports), cold trees are removed. The member branch is deleted locally —
  * `-d` after a landing (fully merged into the integration branch), `-D` on
- * the eviction path (its commits never landed; the requeue carries the work
- * forward). The REMOTE member branch is deleted only on the landed path, and
+ * the eviction path (its commits never landed; since #810 the parked entry
+ * records the branch and an operator requeue continues from the REMOTE copy).
+ * The REMOTE member branch is deleted only on the landed path, and
  * deliberately KEPT on eviction — the pushed sha is the evicted work's only
  * recoverable copy.
  *
@@ -1488,11 +1517,7 @@ function runValidate(deps, config, dispatch, batchId, now, result) {
     const { state: attributed, outcome } = (0, recovery_1.beginAttribution)(state, batchId, { failing: suite.failing, footprints: memberFootprints(deps, batch) }, rDeps);
     if (outcome.offenders.length === 0) {
         const dissolve = (0, recovery_1.dissolveBatch)(attributed, batchId, { strategy: 'full', reason: 'unattributable-suite-failure' }, rDeps);
-        deps.store.withLock((s) => ({
-            state: applyBatchAndIssues(s, dissolve.state, batchId, dissolve.requeued, batch.members),
-            result: undefined,
-        }));
-        teardownBatch(deps, batchId);
+        applyDissolveOutcome(deps, batchId, dissolve, now, batch.members);
         result.blocked.push(...dissolve.requeued);
         result.failed.push(unit(batchId));
         return;
@@ -1554,10 +1579,14 @@ function evictOffender(deps, config, batchId, offender, attribution, now, result
     const rDeps = recoveryDeps(deps, config, batch, now);
     const outcome = (0, recovery_1.evictMembers)(state, batchId, { issues: [offender], reason: 'suite-red-after-fix', attribution, ranges: batch.ranges }, rDeps);
     deps.store.withLock((s) => ({
-        state: applyBatchAndIssues(s, outcome.state, batchId, outcome.requeued, batch.members),
+        state: applyBatchAndIssues(s, outcome.state, batchId, [...outcome.requeued, ...(outcome.dissolve?.parked ?? [])], batch.members),
         result: undefined,
     }));
-    if (outcome.dissolved) {
+    // #810: `dissolve.blocked` — a full dissolve refused over validated
+    // members; the batch is blocked for an operator, not validating.
+    if (outcome.dissolved || outcome.dissolve?.blocked === true) {
+        if (outcome.dissolve?.blocked === true)
+            stopAndReleaseBlocked(deps, batchId, now);
         result.failed.push(unit(batchId));
         return;
     }
@@ -1675,10 +1704,10 @@ function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, c
  * both always read state fresh.
  */
 function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, failure, now, result) {
-    const { dissolved, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now);
+    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now);
     if (duplicate)
         return;
-    if (dissolved) {
+    if (batchEnded) {
         result.failed.push(unit(batchId));
         return;
     }
@@ -2089,8 +2118,8 @@ function resumeBlockedGate(deps, config, dispatch, batchId, now) {
  * Exactly-once per dispatch, mirroring `recordDispatchRunLog`'s own
  * invariant: called from both of `reconcileMemberSlot`'s exit branches
  * (member complete, member blocked/dead) — a batch never redispatches the
- * same member slot (eviction requeues it as an independent full-cycle run
- * instead), so unlike `engine.ts`'s per-unit log, a member's log file is
+ * same member slot (an evicted member is parked, #810, and any later
+ * full-cycle run is an independent unit), so unlike `engine.ts`'s per-unit log, a member's log file is
  * always one-shot and reading from offset 0 is always correct.
  */
 function recordMemberRunLog(deps, dispatch, state, batchId, 
@@ -2267,6 +2296,10 @@ function memberFailureFor(read, lastTool) {
             : 'member-blocked';
     return {
         reason,
+        // #810: a block THIS dispatch posted is the member's own hand-back — parked
+        // `handed-back`, never counted toward the dissolve threshold. A member that
+        // died without one is an engine-decided eviction (`agent-exited-unverified`).
+        kind: read.blockedNow ? 'handed-back' : 'evicted',
         // This rail covers a self-reported block AND a member that simply died, so the
         // detail must follow the RESOLVED reason — `member blocked` on an
         // `agent-exited-unverified` eviction contradicts the reason on its own journal line.
@@ -2339,58 +2372,84 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     }
 }
 /**
- * Requeue a member full-cycle, record the eviction, and dissolve if this tips
- * the batch past its `dissolve_policy` threshold (#563; RFC F.1/F.8) — WITHOUT
- * going through `recovery.ts`'s `evictMembers` (which needs
- * `attributing`/`evicting` status and a commit range to revert; a member
- * evicted here has neither). Returns whether the batch dissolved.
+ * Park a member that left the batch before landing, record the exit, and
+ * dissolve if this tips the batch past its `dissolve_policy` threshold (#563;
+ * RFC F.1/F.8) — WITHOUT going through `recovery.ts`'s `evictMembers` (which
+ * needs `attributing`/`evicting` status and a commit range to revert; a
+ * member evicted here has neither). Returns whether the batch dissolved.
+ *
+ * #810 — the member is PARKED, never auto-requeued:
+ * - `failure.kind === 'handed-back'` (the member posted its own `blocked` /
+ *   `review partial` milestone) → entry `handed-back`, record
+ *   `kind: 'handed-back'`, journal `member-handed-back`. A hand-back is a
+ *   valued outcome, not a batch failure: it never counts toward the dissolve
+ *   threshold.
+ * - otherwise (unverified exit, gate task-failed, landing conflict, worktree
+ *   prep) → entry `evicted`, journal `unit-failed`, counted.
+ * Either way the member branch is recorded on the record and the entry's
+ * `failure_evidence`, and the batch's dispatch profile on the entry — so an
+ * operator's `sched requeue` continues the work from that branch on the same
+ * provider. The pre-#810 rail requeued `mode: 'full', dispatch_profile: null`
+ * from the base branch, discarding the member's commits and its profile.
+ *
+ * #810: when the threshold trips while members are already VALIDATED (landed
+ * on the integration branch), the batch does not dissolve — dissolving would
+ * requeue validated work from scratch. It journals `dissolve-suppressed` and
+ * continues with the remaining members; its validated members still ship.
  *
  * A member already in `evictions[]` is a NO-OP here, not merely a skipped
- * record (#595 AC1): the requeue must not run a second time either. It would
- * overwrite the first eviction's `failure_evidence` — leaving `evictions[]`
- * and the queue entry disagreeing about why the member was evicted — and, if
- * the member has since been re-dispatched full-cycle, would take the
- * `executing → evicted → requeued` rail and kill that live run.
+ * record (#595 AC1): the park must not run a second time either.
  *
- * Returns `{ dissolved, duplicate }`: `dissolved` is whether this eviction tipped the batch
- * past its threshold and the batch is gone; `duplicate: true` means another resolution had
- * already claimed this member's eviction, and the caller must journal nothing and advance
- * nothing on top of it (#613 — that is exactly how a record ends up naming the member the
- * batch already advanced past).
+ * Returns `{ batchEnded, duplicate }`: `batchEnded` is whether this exit ended
+ * the batch's run — it dissolved, or (a `full` dissolve refused over validated
+ * members, #810) it blocked for an operator; either way the caller must not
+ * advance it. `duplicate: true` means another resolution had already claimed
+ * this member's exit, and the caller must journal nothing and advance nothing
+ * on top of it (#613). A dissolve interrupted between pass 1 and pass 2 is not
+ * retried by a re-entry: the re-entry takes the duplicate path (pre-existing,
+ * #595/#613) and the batch continues.
  */
 function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
     const { reason } = failure;
+    const kind = failure.kind ?? 'evicted';
     const dissolvePolicy = (0, types_1.resolveDissolvePolicy)(config.dissolve_policy);
-    // Pass 1 (pure — requeue + record the eviction): safe to run entirely
-    // inside the lock, unlike `dissolveBatch` below, which shells out
+    // Pass 1 (pure — park + record the exit): safe to run entirely inside the
+    // lock, unlike `dissolveBatch` below, which shells out
     // (`deps.exec`/`postMilestone`) and so must NOT hold the lock while it runs.
-    const { triggered, duplicate, prior } = deps.store.withLock((s) => {
+    const { triggered, duplicate, prior, branch, validated } = deps.store.withLock((s) => {
         const b = (0, state_1.findBatch)(s, batchId);
         if (!b) {
-            return { state: s, result: { triggered: false, duplicate: false, prior: undefined } };
+            return {
+                state: s,
+                result: {
+                    triggered: false,
+                    duplicate: false,
+                    prior: undefined,
+                    branch: null,
+                    validated: [],
+                },
+            };
         }
         const priorRecord = b.evictions.find((e) => e.issue === memberIssue);
         if (priorRecord) {
             // A duplicate never re-evaluates the dissolve threshold: the resolution that WROTE
             // this record already did, under this same lock. (#595: a duplicate must not count
-            // twice; #613: it must not act on the batch at all.) Note this also means a dissolve
-            // interrupted between pass 1 and pass 2 is not retried here — re-entering
-            // `dissolveBatch` on an already-terminal batch throws `IllegalTransitionError`.
+            // twice; #613: it must not act on the batch at all.)
             return {
                 state: s,
-                result: { triggered: false, duplicate: true, prior: priorRecord },
+                result: {
+                    triggered: false,
+                    duplicate: true,
+                    prior: priorRecord,
+                    branch: null,
+                    validated: [],
+                },
             };
         }
-        const evidence = {
-            batch: batchId,
-            reason,
-            failing_tests: [],
-            attribution: 'none',
-            reverted_commits: [],
-            at: now.toISOString(),
-        };
-        const requeueResult = (0, state_1.requeueMember)(s, memberIssue, { mode: 'full', batch: null }, reason, now, { failure_evidence: evidence });
-        let next = requeueResult.state;
+        const memberBranch = (0, state_1.recordedMemberBranch)(b, memberIssue);
+        let next = (0, state_1.parkMember)(s, memberIssue, kind, reason, now, {
+            failure_evidence: (0, state_1.memberExitEvidence)(batchId, reason, memberBranch, now),
+        }).state;
         // `appendEvictions` stays the state-level backstop even though the
         // duplicate is already short-circuited above — it is the one append path.
         const { evictions, duplicate: duplicateRecords } = (0, state_1.appendEvictions)(b, [
@@ -2400,6 +2459,8 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
                 attribution: 'none',
                 reverted_commits: [],
                 group: [],
+                kind,
+                branch: memberBranch,
                 at: now.toISOString(),
             },
         ]);
@@ -2411,6 +2472,8 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
                 triggered: updated !== undefined && (0, recovery_1.checkDissolveTrigger)(updated, dissolvePolicy),
                 duplicate: duplicateRecords.length > 0,
                 prior: undefined,
+                branch: memberBranch,
+                validated: updated !== undefined ? (0, state_1.validatedMembersOf)(next, updated) : [],
             },
         };
     });
@@ -2419,41 +2482,45 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
             issue: memberIssue,
             detail: (0, state_1.duplicateEvictionDetail)(memberIssue, reason, prior),
         });
-        // Another resolution already claimed this member's eviction record — the
+        // Another resolution already claimed this member's exit record — the
         // caller must not journal its own `unit-failed`/advance the batch again
-        // on top of that one (#613: that is exactly how a record ends up naming
-        // the member the batch already advanced past).
-        return { dissolved: false, duplicate: true };
+        // on top of that one (#613).
+        return { batchEnded: false, duplicate: true };
     }
     // This call owns the member's resolution, so it owns recording WHY — before pass 2 below
-    // can dissolve, tear the worktree down, or be killed mid-shell-out and leave the eviction
-    // record on disk with no journal line naming its cause (#613). The caller's extras go
-    // first so the authoritative keys always win: `extraKv` is a wide Record, and a future
-    // caller passing `reason`/`detail`/`issue` must not be able to rewrite the record's own
-    // identity.
-    journalEvent(deps, 'unit-failed', unit(batchId), {
+    // can dissolve, tear the worktree down, or be killed mid-shell-out and leave the record
+    // on disk with no journal line naming its cause (#613). The caller's extras go first so
+    // the authoritative keys always win.
+    journalEvent(deps, kind === 'handed-back' ? 'member-handed-back' : 'unit-failed', unit(batchId), {
         ...(failure.extraKv ?? {}),
         issue: memberIssue,
         reason,
-        detail: failure.detail,
+        detail: `${failure.detail} — parked ${kind}` +
+            (branch !== null ? ` (work on ${branch})` : '') +
+            `; remedy: sched requeue --issue ${memberIssue}`,
     });
     if (!triggered)
-        return { dissolved: false, duplicate: false };
+        return { batchEnded: false, duplicate: false };
+    if (validated.length > 0) {
+        // #810: never dissolve over validated work — it stays landed and ships
+        // with the batch; the members that failed are parked, not requeued.
+        journalEvent(deps, 'dissolve-suppressed', unit(batchId), {
+            issue: memberIssue,
+            detail: `eviction threshold reached, but member(s) ${validated.join(',')} are validated on the integration branch — keeping them and continuing with the remaining members instead of dissolving`,
+        });
+        return { batchEnded: false, duplicate: false };
+    }
     // Pass 2 (outside the lock — dissolveBatch shells out): re-load fresh
     // (pass 1's write already landed), dissolve, then re-apply just this
     // batch's + the requeued members' state under a fresh lock.
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch)
-        return { dissolved: false, duplicate: false };
+        return { batchEnded: false, duplicate: false };
     const rDeps = recoveryDeps(deps, config, batch, now);
     const outcome = (0, recovery_1.dissolveBatch)(state, batchId, { strategy: 'full', reason: 'eviction-threshold' }, rDeps);
-    deps.store.withLock((s) => ({
-        state: applyBatchAndIssues(s, outcome.state, batchId, outcome.requeued),
-        result: undefined,
-    }));
-    teardownBatch(deps, batchId);
-    return { dissolved: true, duplicate: false };
+    applyDissolveOutcome(deps, batchId, outcome, now);
+    return { batchEnded: true, duplicate: false };
 }
 function reconcileFixSlot(deps, config, batchId, slot, now, result) {
     if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined))
@@ -2725,8 +2792,8 @@ const MEMBER_RECONCILE_CHAIN = {
  * Whether every SURVIVING member of `batch` was actually dispatched — i.e. no
  * surviving member is still sitting in a pre-dispatch status (`queued`,
  * `classified`, `batched`, `waiting`). Surviving = a `batch.members` issue
- * that is still a slot-mode entry, not evicted (its work was reverted and it
- * requeued full-cycle), and not already preserved (shipped/terminal through
+ * that is still a slot-mode entry, not evicted / handed back (parked, #810),
+ * and not already preserved (shipped/terminal through
  * another rail).
  *
  * This is the safety rail behind AC1: a member that never ran has NO work on
@@ -2744,8 +2811,14 @@ function everySurvivingMemberDispatched(state, batch) {
         const entry = (0, state_1.findEntry)(state, issue);
         if (!entry)
             continue;
-        if (entry.mode !== 'slot' || evicted.has(issue) || (0, state_1.isPreservedMember)(entry))
+        // #810: a PARKED member (evicted / handed back) left the batch before
+        // landing — not a survivor, whether or not it has an `evictions[]` record.
+        if (entry.mode !== 'slot' ||
+            evicted.has(issue) ||
+            (0, state_1.isPreservedMember)(entry) ||
+            state_1.PARKED_MEMBER_STATUSES.has(entry.status)) {
             continue;
+        }
         // Pre-dispatch statuses: queued/classified/batched/waiting. `in-work` is
         // stamped at SPAWN (`spawnMember`), `committed`/`validated` at verified
         // completion — everything the entry can reach afterwards means the
@@ -2951,6 +3024,72 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
         }
     }
 }
+/**
+ * #791: once a `done` batch's kept worktree (left in place by the
+ * `members-closed` branch above) is DEFINITIVELY gone — the path no longer
+ * exists on disk, or the pool itself now reports it back as a warm spare —
+ * clear the ledger's `worktree`/`pool_claimed` (and, separately,
+ * `member_worktree`/`member_pool_claimed`) fields so `sched status`'s
+ * `kept-worktree` warning does not persist after the operator's cleanup
+ * already happened. Ledger-only, by construction: this function reads
+ * `fsExists` and `worktree-pool status --json` (both read-only) and never
+ * builds a `git worktree remove` / `worktree-pool return` argv — the actual
+ * removal stays entirely the operator's call, exactly like the warning
+ * itself. Bounded the same way the warning's own candidate scan is: only
+ * `done` batches carrying a kept worktree are considered, which in practice
+ * is a small set.
+ */
+function reconcileKeptWorktrees(deps, now) {
+    const state = deps.store.load();
+    const fsExists = deps.fsExists ?? ((p) => fs.existsSync(p));
+    const candidates = state.batches.filter((b) => b.status === 'done' && (b.worktree !== null || b.member_worktree !== null));
+    if (candidates.length === 0)
+        return;
+    const needsPoolCheck = candidates.some((b) => (b.worktree !== null && b.pool_claimed) ||
+        (b.member_worktree !== null && b.member_pool_claimed));
+    // One pool query per TICK, not per candidate — `worktree-pool status` is a
+    // real subprocess (`npx ...`), and this reconcile is meant to be cheap.
+    const poolStatusJson = needsPoolCheck
+        ? deps.exec(teardown_1.POOL_BIN, [...teardown_1.POOL_ARGS_PREFIX, 'status', '--json'], deps.repoDir)
+        : null;
+    const goneOrReturned = (worktree, poolClaimed) => {
+        if (!fsExists(worktree))
+            return true;
+        if (poolClaimed && poolStatusJson !== null) {
+            return (0, teardown_1.poolEntryFor)(poolStatusJson, worktree) === 'warm';
+        }
+        return false;
+    };
+    for (const batch of candidates) {
+        const clears = {};
+        const clearedFields = [];
+        if (batch.worktree !== null && goneOrReturned(batch.worktree, batch.pool_claimed)) {
+            clears.worktree = null;
+            clears.pool_claimed = false;
+            clearedFields.push('worktree', 'pool_claimed');
+        }
+        if (batch.member_worktree !== null &&
+            goneOrReturned(batch.member_worktree, batch.member_pool_claimed)) {
+            clears.member_worktree = null;
+            clears.member_pool_claimed = false;
+            clearedFields.push('member_worktree', 'member_pool_claimed');
+        }
+        if (clearedFields.length === 0)
+            continue;
+        deps.store.withLock((s) => {
+            const b = (0, state_1.findBatch)(s, batch.id);
+            // Re-check under the lock: another tick, or an operator command, may
+            // have already moved this batch or cleared the fields itself.
+            if (!b || b.status !== 'done')
+                return { state: s, result: undefined };
+            return { state: (0, state_1.patchBatch)(s, batch.id, clears, now, false), result: undefined };
+        });
+        journalEvent(deps, 'kept-worktree-cleared', unit(batch.id), {
+            cleared: clearedFields.join(','),
+            detail: `kept-worktree ledger field(s) cleared on definitive evidence (${clearedFields.join(', ')}) — path gone or pool reports it returned; no removal command was run`,
+        });
+    }
+}
 function anchorTickContext(deps) {
     const reader = (0, groundtruth_1.issueCloseReader)(deps.groundTruth);
     if (reader === undefined || deps.anchorRepo === undefined)
@@ -3230,11 +3369,11 @@ function upsertRun(state, batchId, run, now) {
     return (0, state_1.patchBatch)(state, batchId, { member_runs: [...others, run].sort((a, b) => a.index - b.index) }, now);
 }
 /**
- * Whether `issue` is still an active member of `batch` — not evicted, and its
- * queue entry (when it has one) still a live slot-mode entry of THIS batch. An
- * evicted member's entry is requeued `mode: 'full', batch: null`, so both
- * checks agree; the entry check also covers a member stopped or abandoned out
- * from under the batch.
+ * Whether `issue` is still an active member of `batch` — not evicted / handed back
+ * (its `evictions[]` record — a #810 parked entry keeps `mode: 'slot'` and its
+ * batch, so the record is what takes it out), and its queue entry (when it has
+ * one) still a live slot-mode entry of THIS batch — which also covers a member
+ * stopped, abandoned or operator-requeued out from under the batch.
  */
 function memberStillInBatch(state, batch, issue) {
     if (batch.evictions.some((e) => e.issue === issue))
@@ -3242,7 +3381,10 @@ function memberStillInBatch(state, batch, issue) {
     const entry = (0, state_1.findEntry)(state, issue);
     if (entry === undefined)
         return true;
-    return (entry.mode === 'slot' && entry.batch === batch.id && !types_1.TERMINAL_ISSUE_STATUSES.has(entry.status));
+    return (entry.mode === 'slot' &&
+        entry.batch === batch.id &&
+        !types_1.TERMINAL_ISSUE_STATUSES.has(entry.status) &&
+        !state_1.PARKED_MEMBER_STATUSES.has(entry.status));
 }
 /** Whether member `issue`'s own slot currently holds a live agent. */
 function hasLiveMemberSlot(state, batchId, issue) {
@@ -3279,9 +3421,9 @@ function nextParallelCandidate(state, batch, attempted) {
  * scheduler has free capacity. Each gets its own worktree off the integration
  * branch (`prepareMemberWorktree`, outside the lock) — the integration branch
  * does not move until members land, so concurrent members are all cut from the
- * same base. A member whose worktree cannot be prepared is evicted (requeued
- * full-cycle, which does its own setup) rather than retried every tick in
- * front of the members behind it.
+ * same base. A member whose worktree cannot be prepared is evicted (parked, #810 —
+ * an operator's `sched requeue` runs it full-cycle, which does its own setup)
+ * rather than retried every tick in front of the members behind it.
  */
 function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
     const limit = memberParallelism(config);
@@ -3381,11 +3523,11 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
  * tips over is torn down by `teardownBatch`, which covers every live run.
  */
 function evictParallelMember(deps, config, batchId, run, failure, now, result) {
-    const { dissolved, duplicate } = evictMemberDirectly(deps, config, batchId, run.issue, failure, now);
+    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, run.issue, failure, now);
     if (duplicate)
         return;
-    result.failed.push(dissolved ? unit(batchId) : (0, state_1.batchMemberUnit)(batchId, run.issue));
-    if (dissolved)
+    result.failed.push(batchEnded ? unit(batchId) : (0, state_1.batchMemberUnit)(batchId, run.issue));
+    if (batchEnded)
         return;
     deps.store.withLock((s) => ({
         state: patchRun(s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now),
@@ -3716,7 +3858,7 @@ function reconcileParallelBatch(deps, config, dispatch, batchId, now, result, pa
 /**
  * #809: stop and tear down every parallel member whose tree is not yet torn
  * down — a dissolve can land while other members are mid-run (their agents are
- * killed: their entries were just requeued full-cycle, so a live member agent
+ * killed: their entries were just parked or requeued, so a live member agent
  * would be working a unit nothing tracks any more), `sched stop`/`abandon`
  * make a batch terminal without a teardown, and a crash between a run's
  * resolution and its teardown leaves `torn_down: false` behind. Teardown is
@@ -3799,7 +3941,8 @@ function runBatchTick(deps, config, dispatch) {
     // - pre-merge (`dissolving` is a legal edge): DISSOLVE with reason
     //   `dispatch-profile-missing:<name>` — loud, deterministic, one-shot, and
     //   the members requeue as full-cycle units on the config default, which is
-    //   a coherent recovery rather than a mislabelled continuation.
+    //   a coherent recovery rather than a mislabelled continuation (#810: in-flight
+    //   members park on the default; validated members block the batch instead).
     // - post-merge (PR parked/merged — the product already shipped): dissolving
     //   would discard a landed PR's bookkeeping, so the remaining dispatch (the
     //   report agent) runs on the default and journals
@@ -3840,12 +3983,13 @@ function runBatchTick(deps, config, dispatch) {
                         deps.spawnDeps.kill(liveSlot.pid, liveSlot.pid_start ?? undefined);
                     }
                 }
-                const outcome = (0, recovery_1.dissolveBatch)(current, batch.id, { strategy: 'full', reason: `dispatch-profile-missing:${batch.dispatch_profile}` }, recoveryDeps(deps, config, fresh, now));
-                deps.store.withLock((s) => ({
-                    state: applyBatchAndIssues(s, outcome.state, batch.id, outcome.requeued),
-                    result: undefined,
-                }));
-                teardownBatch(deps, batch.id);
+                const outcome = (0, recovery_1.dissolveBatch)(current, batch.id, {
+                    strategy: 'full',
+                    reason: `dispatch-profile-missing:${batch.dispatch_profile}`,
+                    // #810: the profile is what is broken — requeue on the default.
+                    carryDispatchProfile: false,
+                }, recoveryDeps(deps, config, fresh, now));
+                applyDissolveOutcome(deps, batch.id, outcome, now);
                 result.failed.push(unit(batch.id));
                 // Resolution failed: clean up any batch/member worktrees, then skip
                 // this batch for the rest of the pass. No further arm can claim it.
@@ -4062,6 +4206,7 @@ function runBatchTick(deps, config, dispatch) {
     const anchorCtx = anchorTickContext(deps);
     reconcileStaleBlockedBatches(deps, now, result, anchorCtx);
     reconcileAnchorClosure(deps, now, anchorCtx);
+    reconcileKeptWorktrees(deps, now);
     return result;
 }
 //# sourceMappingURL=batch-dispatch.js.map