@ai-dossier/sched 0.49.0 → 0.51.0

package/dist/batch-dispatch.js

@@ -96,9 +96,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_BATCH_AGENT_RESPAWNS = void 0;
 exports.memberBranchFor = memberBranchFor;
+exports.tailMembersRefusal = tailMembersRefusal;
 exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
+exports.reconcileStaleBlockedBatches = reconcileStaleBlockedBatches;
 exports.memberDispatchModeFor = memberDispatchModeFor;
 exports.runBatchTick = runBatchTick;
 const fs = __importStar(require("node:fs"));
@@ -1308,6 +1311,50 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
     }
     claimAndSpawn(deps, config, batchId, 'member', now, (nextState, slot) => spawnMember(deps, dispatch, nextState, slot, batchId, now, result, member));
 }
+/**
+ * #832: why the tail must NOT be dispatched over `landed`, or null when it may.
+ * The deterministic half of the check the tail agent itself makes before
+ * integrating (the members it is told about and the members it derives from
+ * the integration branch's boundary commits must agree) — made here for free
+ * instead of by a strong-tier agent that then exits `members-mismatch`.
+ * `batch.ranges` is the recorded boundary attribution (recomputed at every
+ * landing); when it is empty nothing was attributed, so there is nothing to
+ * cross-check. Invariant this relies on: `ranges` names only landed members —
+ * every exit path that reverts a member also drops its range
+ * (`recovery.ts`'s partial dissolve); a path that re-derived `ranges` from
+ * `git log` after a revert would make this refuse a healthy batch.
+ */
+function tailMembersRefusal(batch, landed) {
+    if (landed.length === 0)
+        return 'no-landed-members';
+    if (batch.ranges.length === 0)
+        return null;
+    const attributed = new Set(batch.ranges.map((r) => r.issue));
+    const missing = landed.filter((issue) => !attributed.has(issue));
+    if (missing.length > 0)
+        return `members-mismatch:no-boundary-commit-${missing.join(',')}`;
+    // The tail derives members from the boundary commits too, and refuses when
+    // the two lists disagree in EITHER direction (review-issue Aggregate Step 1).
+    const landedSet = new Set(landed);
+    const unlanded = [...attributed].filter((issue) => !landedSet.has(issue));
+    return unlanded.length > 0
+        ? `members-mismatch:unlanded-boundary-commit-${unlanded.join(',')}`
+        : null;
+}
+/**
+ * #832: the one pre-dispatch verdict for a tail — checked before a slot is
+ * claimed and again under the claim's lock. A tail whose respawns are spent
+ * (a crash landed between counting the exit that spent them and blocking the
+ * batch) is refused, as is a members mismatch. Only a batch in a tail phase
+ * is judged; anything else is not the tail's to refuse.
+ */
+function tailDispatchRefusal(state, batch) {
+    if (batch.status !== 'reviewing' && batch.status !== 'shipping')
+        return null;
+    if (agentRespawnsSpent(batch, 'tail'))
+        return 'respawn-cap:tail';
+    return tailMembersRefusal(batch, (0, state_1.validatedMembersOf)(state, batch));
+}
 /**
  * Tail/report/fix dispatches (this function, `spawnReportAgent`,
  * `reconcileFixSlot`) are NOT recorded live to `runs.jsonl` — only member
@@ -1316,11 +1363,27 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
  * the only way to see their cost today, reconstructed from the raw log
  * after the fact. Wiring in live recording for these later means repeating
  * `spawnMember`'s own #564 fix first: none of these three spawn functions'
- * patches stamp `SlotEntry.spawned_at` either, so a `recordXRunLog` guarded
+ * patches stamped `SlotEntry.spawned_at` either, so a `recordXRunLog` guarded
  * on `spawned_at !== null` (mirroring `recordMemberRunLog`) would silently
- * no-op forever, exactly like the original bug.
+ * no-op forever, exactly like the original bug. #832 made the tail and report
+ * spawns stamp it (their hand-back fence needs it); the fix agent still does
+ * not.
  */
 function spawnTailAgent(deps, config, dispatch, batchId, now, result) {
+    // #832: the tail runs over the LANDED members only — never `batch.members`,
+    // which still lists a member that was stopped, handed back, evicted or
+    // parked. A refusal blocks the batch before any agent is spawned (and
+    // before a slot is claimed — `blockBatchForOperator` posts a milestone, an
+    // exec that must not run under the store lock).
+    const before = deps.store.load();
+    const pending = (0, state_1.findBatch)(before, batchId);
+    if (pending) {
+        const refusal = tailDispatchRefusal(before, pending);
+        if (refusal !== null) {
+            blockBatchForOperator(deps, config, batchId, { reason: refusal, milestonePhase: 'batch-review' }, now, result);
+            return;
+        }
+    }
     claimAndSpawn(deps, config, batchId, 'reviewing', now, (state, slot) => {
         const batch = (0, state_1.findBatch)(state, batchId);
         if (!batch || batch.worktree === null || batch.anchor === null) {
@@ -1330,9 +1393,20 @@ function spawnTailAgent(deps, config, dispatch, batchId, now, result) {
             });
             return releaseSlot(state, batchId, now);
         }
+        const landed = (0, state_1.validatedMembersOf)(state, batch);
+        const lateRefusal = tailDispatchRefusal(state, batch);
+        if (lateRefusal !== null) {
+            // The state changed between the pre-check and the lock (a concurrent
+            // stop/park) — release, and the next tick's pre-check (reading the same
+            // persisted state) blocks the batch with this reason.
+            journalEvent(deps, 'slot-released', unit(batchId), {
+                detail: `tail not dispatched: ${lateRefusal} (state changed before the claim; the next tick blocks the batch)`,
+            });
+            return releaseSlot(state, batchId, now);
+        }
         const spawnSpec = (0, dispatch_1.resolveTierSpawn)(dispatch, 'strong', batch.anchor);
         const cmd = spawnSpec.cmd;
-        const prompt = (0, dispatch_1.buildBatchTailPrompt)(dispatch.batchTailPrompt, batchId, batch.anchor, batch.members, batch.worktree);
+        const prompt = (0, dispatch_1.buildBatchTailPrompt)(dispatch.batchTailPrompt, batchId, batch.anchor, landed, batch.worktree);
         const logFile = (0, dispatch_1.batchTailLogPath)(deps.store.runsDir, batchId);
         // #629: fences `handleDeadDispatchApiError`'s classification to this
         // dispatch's slice — see `spawnMember`'s identical comment.
@@ -1355,6 +1429,14 @@ function spawnTailAgent(deps, config, dispatch, batchId, now, result) {
             phase: 'reviewing',
             last_progress_at: now.toISOString(),
             log_offset_at_spawn: logOffset,
+            // #832: the fence `reconcileTailSlot` reads — without it a
+            // `batch-review blocked` left on the anchor by an EARLIER dispatch
+            // (or a previous batch on the same anchor, #605) would block this one.
+            // The fence tolerates `DISPATCH_FENCE_TOLERANCE_MS` (60s) of clock skew,
+            // so a blocked milestone posted less than a minute before this spawn
+            // still counts — only a resume that re-dispatches the tail that fast
+            // could trip it.
+            spawned_at: now.toISOString(),
         };
         const next = slot.status === 'assigned' ? (0, state_1.transitionSlot)(state, slot.id, 'running', patch, now) : state;
         deps.journal.append((0, journal_1.unitEvent)('spawned', unit(batchId), {
@@ -1369,6 +1451,13 @@ function spawnTailAgent(deps, config, dispatch, batchId, now, result) {
     });
 }
 function spawnReportAgent(deps, config, dispatch, batchId, now, result) {
+    // #832: respawns already spent (a crash landed between counting the exit
+    // that spent them and closing the batch) — close it now, never spawn.
+    const pending = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (pending && pending.status === 'deployed' && agentRespawnsSpent(pending, 'report')) {
+        closeWithoutReport(deps, batchId, 'respawn-cap:report', now, result);
+        return;
+    }
     claimAndSpawn(deps, config, batchId, 'report', now, (state, slot) => {
         const batch = (0, state_1.findBatch)(state, batchId);
         if (!batch || batch.anchor === null) {
@@ -1405,6 +1494,8 @@ function spawnReportAgent(deps, config, dispatch, batchId, now, result) {
             phase: 'report',
             last_progress_at: now.toISOString(),
             log_offset_at_spawn: logOffset,
+            // #832: the fence `reconcileReportSlot`'s hand-back check reads.
+            spawned_at: now.toISOString(),
         };
         const next = slot.status === 'assigned'
             ? (0, state_1.transitionSlot)(state, slot.id, 'running', patchState, now)
@@ -2564,7 +2655,98 @@ function reconcileFixSlot(deps, config, batchId, slot, now, result) {
     }
     evictOffender(deps, config, batchId, offenderRecord.issue, 'overlap', now, result);
 }
-function reconcileTailSlot(deps, batchId, slot, now, result) {
+/**
+ * #832: how many times one tail-work phase's agent (`tail` or `report`) is
+ * RESPAWNED after exiting unverified — the first dispatch plus this many
+ * respawns; the next unverified exit ends the phase instead. The #629 class:
+ * the tick loop's "same wedge" arm respawns a dead tail/report agent on its
+ * own, so without a cap an agent that exits without a verdict is
+ * redispatched forever (b-20260924-04: the strong-tier tail four times,
+ * ~375k tokens, stopped only by hand).
+ */
+exports.MAX_BATCH_AGENT_RESPAWNS = 2;
+/** #832: whether `batch` has already spent its respawns for `phase`. */
+function agentRespawnsSpent(batch, phase) {
+    return (batch.agent_exits !== null &&
+        batch.agent_exits.phase === phase &&
+        batch.agent_exits.count > exports.MAX_BATCH_AGENT_RESPAWNS);
+}
+/**
+ * #832: count one unverified exit of `phase`'s agent, release its slot, and
+ * journal the exit with its position against the cap — one lock, so the count
+ * and the release cannot come apart. Returns `'capped'` when this exit spent
+ * the phase's last respawn (the caller ends the phase), else `'respawn'`.
+ * The count is per phase — another phase's exits start it over — and verified
+ * progress clears it (`clearAgentExits`).
+ */
+function releaseAndCountAgentExit(deps, batchId, phase, failed, now) {
+    const count = deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        const prior = b?.agent_exits;
+        const next = prior && prior.phase === phase ? prior.count + 1 : 1;
+        let n = releaseSlot(s, batchId, now);
+        if (b)
+            n = (0, state_1.patchBatch)(n, batchId, { agent_exits: { phase, count: next } }, now);
+        return { state: n, result: next };
+    });
+    journalEvent(deps, failed.event, unit(batchId), {
+        ...failed.extra,
+        detail: `${String(failed.extra.detail ?? 'unverified exit')} ${count}/${exports.MAX_BATCH_AGENT_RESPAWNS + 1} (log: ${failed.log})`,
+    });
+    return count > exports.MAX_BATCH_AGENT_RESPAWNS ? 'capped' : 'respawn';
+}
+/** #832: verified progress in a tail-work phase — the respawn count starts over. */
+function clearAgentExits(s, batchId, now) {
+    const b = (0, state_1.findBatch)(s, batchId);
+    return b && b.agent_exits !== null ? (0, state_1.patchBatch)(s, batchId, { agent_exits: null }, now) : s;
+}
+/**
+ * #832: the tail posted its own `batch-review`/`batch-ship blocked` — release
+ * its slot and block the batch with that reason in ONE lock (no milestone to
+ * post: the agent's is already the anchor's record, so no exec runs under the
+ * lock), so a crash can never leave the slot released with the batch still
+ * `reviewing` for the wedge arm to respawn. The agent decided; respawning it
+ * would only get the same answer again.
+ */
+function blockOnTailHandBack(deps, config, batch, reason, now, result) {
+    const rDeps = recoveryDeps(deps, config, batch, now);
+    deps.store.withLock((s) => {
+        const released = releaseSlot(s, batch.id, now);
+        const b = (0, state_1.findBatch)(released, batch.id);
+        if (!b || types_1.TERMINAL_BATCH_STATUSES.has(b.status) || b.status === 'blocked') {
+            return { state: released, result: undefined };
+        }
+        const blocked = (0, recovery_1.blockBatch)(released, batch.id, { reason, milestonePhase: 'batch-review', milestoneAlreadyPosted: true }, rDeps);
+        return { state: blocked.state, result: undefined };
+    });
+    result.failed.push(unit(batch.id));
+}
+/**
+ * #832: close a MERGED batch whose report agent spent its respawns, without
+ * its report. The report is the batch's summary, not its work — the PR is
+ * merged and deployed — so the batch goes `deployed → reported → done` and
+ * is torn down like any finished batch. Blocking it instead would not stop
+ * anything: `reconcileStaleBlockedBatches` walks a blocked batch with a
+ * merged PR straight back to `deployed`, and the report agent would respawn.
+ */
+function closeWithoutReport(deps, batchId, why, now, result) {
+    const closed = deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        if (!b || b.status !== 'deployed')
+            return { state: s, result: false };
+        let n = (0, state_1.transitionBatch)(s, batchId, 'reported', { agent_exits: null }, now);
+        n = (0, state_1.transitionBatch)(n, batchId, 'done', {}, now);
+        return { state: n, result: true };
+    });
+    if (!closed)
+        return;
+    journalEvent(deps, 'report-failed', unit(batchId), {
+        detail: `${why} — batch closed without its report (the PR is merged); post the batch report by hand if one is wanted`,
+    });
+    result.failed.push(unit(batchId));
+    teardownBatch(deps, batchId);
+}
+function reconcileTailSlot(deps, config, batchId, slot, now, result) {
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.anchor === null)
@@ -2579,10 +2761,28 @@ function reconcileTailSlot(deps, batchId, slot, now, result) {
             const b = (0, state_1.findBatch)(s, batchId);
             if (!b || b.status !== 'reviewing')
                 return { state: s, result: undefined };
-            return { state: (0, state_1.transitionBatch)(s, batchId, 'shipping', {}, now), result: undefined };
+            const n = clearAgentExits(s, batchId, now);
+            return { state: (0, state_1.transitionBatch)(n, batchId, 'shipping', {}, now), result: undefined };
         });
         return;
     }
+    // #832: the tail handed back (`batch-review`/`batch-ship blocked`, e.g.
+    // `members-mismatch`) — block the batch with its reason, never respawn.
+    // Checked before liveness: the agent is done deciding whether or not its
+    // process has exited yet, and the block releases its slot. Only for a slot
+    // that recorded its dispatch time: a tail spawned before #832 stamped
+    // `spawned_at` has no fence, and an unfenced read would let an older
+    // `blocked` milestone on the anchor block this dispatch — that exit falls
+    // through to the (capped) unverified path instead.
+    const handedBack = slot.spawned_at === null
+        ? null
+        : (0, groundtruth_1.batchPhaseBlockedReason)(milestone, ['batch-review', 'batch-ship'], slot.spawned_at);
+    if (handedBack !== null) {
+        if (slot.pid !== null && !dead)
+            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        blockOnTailHandBack(deps, config, batch, `tail-blocked:${handedBack}`, now, result);
+        return;
+    }
     if ((0, groundtruth_1.isBatchTailParked)(milestone)) {
         const pr = (0, groundtruth_1.prOfMilestone)(milestone);
         journalEvent(deps, 'pr-parked', unit(batchId), { pr: pr ?? undefined });
@@ -2594,6 +2794,7 @@ function reconcileTailSlot(deps, batchId, slot, now, result) {
             const b = (0, state_1.findBatch)(n, batchId);
             if (!b)
                 return { state: n, result: undefined };
+            n = clearAgentExits(n, batchId, now);
             n = b.status === 'reviewing' ? (0, state_1.transitionBatch)(n, batchId, 'shipping', {}, now) : n;
             n = (0, state_1.transitionBatch)(n, batchId, 'awaiting-merge', { pr }, now);
             return { state: n, result: undefined };
@@ -2609,12 +2810,20 @@ function reconcileTailSlot(deps, batchId, slot, now, result) {
         if (handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchTailLogPath)(deps.store.runsDir, batchId), slot.log_offset_at_spawn ?? 0, now)) {
             return;
         }
-        deps.journal.append((0, journal_1.unitEvent)('unit-failed', unit(batchId), { reason: 'tail-agent-exited-unverified' }), now);
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        // #832: counted — once the respawns are spent the batch blocks instead.
+        const outcome = releaseAndCountAgentExit(deps, batchId, 'tail', {
+            event: 'unit-failed',
+            extra: { reason: 'tail-agent-exited-unverified' },
+            log: (0, dispatch_1.batchTailLogPath)(deps.store.runsDir, batchId),
+        }, now);
+        if (outcome === 'capped') {
+            blockBatchForOperator(deps, config, batchId, { reason: 'respawn-cap:tail', milestonePhase: 'batch-review' }, now, result);
+            return;
+        }
         result.failed.push(unit(batchId));
     }
 }
-function reconcileReportSlot(deps, batchId, slot, now, result) {
+function reconcileReportSlot(deps, config, batchId, slot, now, result) {
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.anchor === null)
@@ -2629,7 +2838,7 @@ function reconcileReportSlot(deps, batchId, slot, now, result) {
             // #629: a verified report completion is proof dispatch is healthy —
             // reset the confirmed-failure streak, mirroring the per-issue path's
             // own verified-complete branch.
-            let n = (0, dispatch_health_1.resetDispatchApiErrorStreak)(releaseSlot(s, batchId, now));
+            let n = clearAgentExits((0, dispatch_health_1.resetDispatchApiErrorStreak)(releaseSlot(s, batchId, now)), batchId, now);
             const b = (0, state_1.findBatch)(n, batchId);
             if (!b || b.status !== 'deployed')
                 return { state: n, result: undefined };
@@ -2649,24 +2858,57 @@ function reconcileReportSlot(deps, batchId, slot, now, result) {
         if (handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchReportLogPath)(deps.store.runsDir, batchId), slot.log_offset_at_spawn ?? 0, now)) {
             return;
         }
-        deps.journal.append((0, journal_1.unitEvent)('report-failed', unit(batchId), { detail: 'unverified exit' }), now);
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        // #832: counted — once the respawns are spent the merged batch closes
+        // without its report (see `closeWithoutReport` for why not a block).
+        const outcome = releaseAndCountAgentExit(deps, batchId, 'report', {
+            event: 'report-failed',
+            extra: { detail: 'unverified exit' },
+            log: (0, dispatch_1.batchReportLogPath)(deps.store.runsDir, batchId),
+        }, now);
+        if (outcome === 'capped')
+            closeWithoutReport(deps, batchId, 'respawn-cap:report', now, result);
     }
 }
 // --- PR watch for `awaiting-merge` batches (mirrors `pollParkedPrs`/`reconcileParked`) ---
 /**
- * Reset a batch's `pr-watch-failed` dedup marker (#630/#633). A no-op when no
- * streak is recorded, so it is safe to call on every non-`awaiting-merge`
- * batch every tick.
+ * Clear one `<prefix>_reason`/`_since`/`_ticks` batch dedup marker — a no-op
+ * when no streak is recorded (`currentReason === null`), so every caller is
+ * safe to invoke unconditionally, every tick, on a batch that may or may not
+ * have an open streak. Shared by `pr-watch-failed` (#630/#633),
+ * `anchor-close-failed` (#768) and `pr-detect-ambiguous` (#789) — each
+ * family previously carried its own copy of this exact body (#789 review).
  */
-function clearPrWatchFailed(deps, batch, now) {
-    if (batch.pr_watch_failed_reason === null)
+function clearBatchDedupMarker(deps, batch, currentReason, clearedFields, now) {
+    if (currentReason === null)
         return;
     deps.store.withLock((s) => ({
-        state: (0, state_1.patchBatch)(s, batch.id, state_1.CLEARED_PR_WATCH_FIELDS, now, false),
+        state: (0, state_1.patchBatch)(s, batch.id, clearedFields, now, false),
         result: undefined,
     }));
 }
+/**
+ * Advance one `<prefix>_reason`/`_since`/`_ticks` batch dedup marker by one
+ * tick and decide whether THIS tick should journal — the streak's first tick,
+ * or every `JOURNAL_DEDUP_REANNOUNCE_TICKS` after, never every tick
+ * (#610/#630/#632/#768/#789's shared shape). Pure — the caller still owns
+ * building its own journal payload (each family logs different extra fields)
+ * and the `deps.store.withLock` persistence write; this only computes
+ * `since`/`ticks`/whether to announce.
+ */
+function advanceBatchDedupStreak(priorReason, priorSince, priorTicks, reason, now) {
+    const isNewStreak = priorReason !== reason || priorSince === null;
+    const ticks = isNewStreak ? 1 : priorTicks + 1;
+    const since = isNewStreak || priorSince === null ? now.toISOString() : priorSince;
+    return { since, ticks, announce: isNewStreak || ticks % types_1.JOURNAL_DEDUP_REANNOUNCE_TICKS === 0 };
+}
+/**
+ * Reset a batch's `pr-watch-failed` dedup marker (#630/#633). A no-op when no
+ * streak is recorded, so it is safe to call on every non-`awaiting-merge`
+ * batch every tick.
+ */
+function clearPrWatchFailed(deps, batch, now) {
+    clearBatchDedupMarker(deps, batch, batch.pr_watch_failed_reason, state_1.CLEARED_PR_WATCH_FIELDS, now);
+}
 function reconcilePrWatch(deps, now, result) {
     const state = deps.store.load();
     for (const batch of state.batches) {
@@ -2715,9 +2957,6 @@ function reconcilePrWatch(deps, now, result) {
         }
         if (truth.blocked || truth.mergeable === 'CONFLICTING') {
             const reason = truth.blocked ? 'auto-merge-blocked' : 'pr-conflicting';
-            const isNewStreak = batch.pr_watch_failed_reason !== reason;
-            const ticks = isNewStreak ? 1 : batch.pr_watch_failed_ticks + 1;
-            const since = isNewStreak ? now.toISOString() : batch.pr_watch_failed_since;
             // #630: journal on the streak's first tick, then again only every
             // `JOURNAL_DEDUP_REANNOUNCE_TICKS` — never every tick — mirrors #610's
             // `stale_milestone_ignored_for` dedup for the "distinct condition"
@@ -2729,7 +2968,8 @@ function reconcilePrWatch(deps, now, result) {
             // of its own); `since` is the streak's onset, and is what makes the
             // duration legible — `ticks_persisted` is a tick count against an
             // operator-tunable `reconcile_interval_ms`, not a fixed wall-clock.
-            if (isNewStreak || ticks % types_1.JOURNAL_DEDUP_REANNOUNCE_TICKS === 0) {
+            const { since, ticks, announce } = advanceBatchDedupStreak(batch.pr_watch_failed_reason, batch.pr_watch_failed_since, batch.pr_watch_failed_ticks, reason, now);
+            if (announce) {
                 journalEvent(deps, 'pr-watch-failed', unit(batch.id), {
                     reason,
                     pr,
@@ -2872,6 +3112,51 @@ function branchMergedIntoBase(deps, batch) {
     const baseTip = deps.exec('git', ['rev-parse', base], deps.repoDir);
     return branchTip !== null && baseTip !== null && branchTip.trim() !== '' && branchTip !== baseTip;
 }
+/**
+ * The ambiguity condition stopped qualifying (the branch resolved to zero or
+ * exactly one candidate), or the batch left `blocked` some other way (this
+ * reconcile's own success, `sched resume --batch`, `sched abandon`, or the
+ * batch aging out of the reconcile window): end any `pr-detect-ambiguous`
+ * streak, so a future ambiguity episode — even a re-block of the SAME batch
+ * with the SAME candidates — journals its own first line instead of silently
+ * continuing a streak from a previous `blocked` stretch (#789 review). A
+ * no-op (no write) when no streak is recorded.
+ */
+function clearPrDetectAmbiguous(deps, batch, now) {
+    clearBatchDedupMarker(deps, batch, batch.pr_detect_ambiguous_reason, state_1.CLEARED_PR_DETECT_AMBIGUOUS_FIELDS, now);
+}
+/**
+ * #789: more than one MERGED PR matches `batch.branch` — positive evidence
+ * only, so the caller records nothing. Journal it on the streak's first tick
+ * and every `JOURNAL_DEDUP_REANNOUNCE_TICKS` after — never every tick — the
+ * same dedup shape `recordAnchorCloseFailed`/`reconcilePrWatch` use.
+ */
+function recordPrDetectAmbiguous(deps, batch, matches, now) {
+    const { since, ticks, announce } = advanceBatchDedupStreak(batch.pr_detect_ambiguous_reason, batch.pr_detect_ambiguous_since, batch.pr_detect_ambiguous_ticks, state_1.PR_DETECT_AMBIGUOUS_REASON, now);
+    if (announce) {
+        journalEvent(deps, 'pr-detect-ambiguous', unit(batch.id), {
+            reason: state_1.PR_DETECT_AMBIGUOUS_REASON,
+            branch: batch.branch ?? undefined,
+            matches: matches.join(','),
+            at: now.toISOString(),
+            since,
+            ticks_persisted: ticks,
+            // #789 review: neither "record it explicitly" (no command exists) nor
+            // "close the extras" (a MERGED PR cannot be closed, so it never leaves
+            // `gh pr list --state merged`) was ever an actionable remedy — state
+            // what actually resolves it instead. #824 tracks the missing verb.
+            detail: `${matches.length} MERGED PRs match head=${batch.branch ?? '?'} (#${matches.join(', #')}) — refusing to guess which is ours; nothing recorded. The batch still reconciles via commits-in-base/members-closed evidence if either holds; otherwise inspect and \`sched abandon --batch ${batch.id}\`, or use \`sched attach-pr\` once #824 ships it`,
+        });
+    }
+    deps.store.withLock((s) => ({
+        state: (0, state_1.patchBatch)(s, batch.id, {
+            pr_detect_ambiguous_reason: state_1.PR_DETECT_AMBIGUOUS_REASON,
+            pr_detect_ambiguous_since: since,
+            pr_detect_ambiguous_ticks: ticks,
+        }, now, false),
+        result: undefined,
+    }));
+}
 /**
  * #686: reconcile a `blocked` batch whose work demonstrably shipped anyway.
  * `reconcilePrWatch` above only watches `awaiting-merge` batches, and
@@ -2884,21 +3169,28 @@ function branchMergedIntoBase(deps, batch) {
  * (engine.ts) under the same principle: ground truth beats the ledger, for
  * ANY stale verdict — the blocked_reason is deliberately not examined.
  *
- * Evidence (either suffices, cheapest first): the batch PR is MERGED with a
- * real timestamp (a merged batch PR contains the whole batch branch), or the
- * batch branch has fully landed in the base branch. A survivability guard
- * applies to BOTH paths (see `everySurvivingMemberDispatched`) — a batch with
- * a surviving member that was never dispatched is not reconcilable.
+ * Evidence (cheapest first): the batch PR is MERGED with a real timestamp (a
+ * merged batch PR contains the whole batch branch) — including one
+ * `batch.pr` never recorded at all (#789): when `pr === null`, before falling
+ * through to the weaker branch/members evidence below, look for exactly one
+ * MERGED PR whose head is the batch branch (`imboard#4255`, a hand-opened PR
+ * the ledger never saw). Positive evidence only — zero candidates changes
+ * nothing, more than one is `ambiguous` and journaled rather than guessed —
+ * or the batch branch has fully landed in the base branch. A survivability
+ * guard applies to every path (see `everySurvivingMemberDispatched`) — a
+ * batch with a surviving member that was never dispatched is not
+ * reconcilable.
  *
  * On reconcile the batch joins the SAME rail a normally-merged batch takes:
  * `blocked → merged → deployed` (the `blocked → merged` edge exists for
  * exactly this caller), surviving members walked to `done` along legal
- * edges, and — when `batch.pr` is set — the ordinary `deployed` machinery
- * dispatches the report agent next tick, with teardown after `batch-report
- * done`. With `pr === null` no report agent can be prompted (it names the
- * PR), so the same lock continues `deployed → reported → done` and the
- * worktree is torn down here instead; the journal line says why no report
- * agent was dispatched rather than leaving the gap silent.
+ * edges, and — when the batch now carries a PR (recorded before or detected
+ * here) — the ordinary `deployed` machinery dispatches the report agent next
+ * tick, with teardown after `batch-report done`. With no PR at all no report
+ * agent can be prompted (it names the PR), so the same lock continues
+ * `deployed → reported → done` and the worktree is torn down here instead;
+ * the journal line says why no report agent was dispatched rather than
+ * leaving the gap silent.
  *
  * Bounded by construction: only `blocked` batches within the window are
  * examined, the PR check is one `gh` call, git runs only when PR evidence
@@ -2910,19 +3202,48 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
     const state = deps.store.load();
     const nowMs = now.getTime();
     for (const batch of state.batches) {
-        if (batch.status !== 'blocked')
+        if (batch.status !== 'blocked') {
+            // #789 review: the marker is scoped to ONE `blocked` stretch, exactly
+            // like `pr_watch_failed_*`'s own `awaiting-merge` scoping (#633) — the
+            // batch left `blocked` (this reconcile's own success below, `sched
+            // resume --batch`, or `sched abandon`), so a LATER re-block — even of
+            // the SAME batch with the SAME candidate PRs — must journal a fresh
+            // first line, never silently continue a stale streak from before.
+            clearPrDetectAmbiguous(deps, batch, now);
             continue;
+        }
         if (nowMs - Date.parse(batch.updated_at) >= STALE_BLOCKED_RECONCILE_WINDOW_MS)
             continue;
         if (!everySurvivingMemberDispatched(state, batch))
             continue;
         let evidence = null;
+        // #789 review: one outer variable for the whole lookup outcome (rather
+        // than three separate booleans/values re-deriving pieces of it) — the
+        // resolution block below reads `lookup.kind` directly instead of a
+        // parallel flag that has to be kept in sync with it by hand.
+        let lookup;
         if (batch.pr !== null) {
             const truth = deps.groundTruth.prState(batch.pr);
             if (truth !== undefined && truth.state === 'MERGED' && truth.mergedAt !== null) {
                 evidence = { kind: 'pr-merged', pr: batch.pr, mergedAt: truth.mergedAt };
             }
         }
+        else if (batch.branch !== null) {
+            // #789: batch.pr was never recorded — a hand-opened or manually
+            // recovered PR the ledger never saw (the imboard#4255 shape). Look for
+            // exactly one MERGED PR whose head is the batch branch before falling
+            // through to the weaker branch/members evidence below. Positive
+            // evidence only: `undefined` (unreachable) touches nothing, and
+            // `ambiguous` (more than one candidate) is journaled, never guessed.
+            lookup = deps.groundTruth.mergedPrForBranch?.(batch.branch, batch.base_branch, batch.created_at);
+            if (lookup?.kind === 'found') {
+                evidence = { kind: 'pr-merged', pr: lookup.pr, mergedAt: lookup.mergedAt };
+            }
+        }
+        // Set only when THIS tick's automatic lookup found the PR — never when
+        // `batch.pr` was already recorded (that PR is reported via `evidence.pr`
+        // as before, and there is nothing new to persist).
+        const detectedPr = lookup?.kind === 'found' ? lookup.pr : null;
         if (evidence === null && branchMergedIntoBase(deps, batch)) {
             evidence = { kind: 'commits-in-base' };
         }
@@ -2940,12 +3261,20 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
             }).kind === 'closable') {
             evidence = { kind: 'members-closed' };
         }
+        // #789: resolve the ambiguity streak exactly once per tick. An ambiguous
+        // lookup records only when the batch ISN'T reconciling by other evidence
+        // this same tick; any evidence at all (including a `found`/`none` lookup
+        // result) clears a stale or same-tick streak — reconciling via ANY
+        // evidence means the batch is leaving `blocked`, so a same-tick ambiguity
+        // is moot too.
+        if (lookup?.kind === 'ambiguous' && evidence === null) {
+            recordPrDetectAmbiguous(deps, batch, lookup.matches, now);
+        }
+        else if (evidence !== null || lookup?.kind === 'found' || lookup?.kind === 'none') {
+            clearPrDetectAmbiguous(deps, batch, now);
+        }
         if (evidence === null)
             continue;
-        // A members-closed reconcile has no merged batch PR for a report agent to
-        // report on, whatever `batch.pr` recorded — finish the rail inline, as
-        // for `pr === null`.
-        const finishInline = batch.pr === null || evidence.kind === 'members-closed';
         // ...but never tear its worktree down: the members shipped OUTSIDE the
         // batch branch, so the blocked integration worktree may hold an
         // operator's unpushed repair work. It is left in place, inert, and the
@@ -2955,6 +3284,12 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
         const failedAt = batch.updated_at;
         let reconciled = false;
         let unwalkable = [];
+        // #789 review: what the lock ACTUALLY applied, not what the outer
+        // snapshot predicted — re-derived from `b` (read under the lock) below,
+        // since `batch.pr` could in principle have changed between the snapshot
+        // above and the lock acquiring (e.g. a future `sched attach-pr`, #824).
+        let effectivePr = null;
+        let prWasRecorded = false;
         deps.store.withLock((s) => {
             const b = (0, state_1.findBatch)(s, batch.id);
             // Re-check under the lock: `sched resume --batch` (a passing recheck)
@@ -2962,7 +3297,19 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
             // snapshot this pass started from.
             if (!b || b.status !== 'blocked')
                 return { state: s, result: undefined };
-            let n = (0, state_1.transitionBatch)(s, batch.id, 'merged', {}, now);
+            // #789: record the auto-detected PR as part of the SAME transition that
+            // leaves `blocked` — a batch whose ledger never had one now does. Only
+            // when `b.pr` is STILL null under the lock — never overwrite a PR
+            // something else recorded between the snapshot and here.
+            prWasRecorded = detectedPr !== null && b.pr === null;
+            effectivePr = prWasRecorded ? detectedPr : b.pr;
+            let n = (0, state_1.transitionBatch)(s, batch.id, 'merged', {
+                // The ambiguity streak (this tick's own, or a stale one) is moot
+                // the instant the batch reconciles by any evidence — fold the
+                // clear into this same transition instead of a separate lock write.
+                ...state_1.CLEARED_PR_DETECT_AMBIGUOUS_FIELDS,
+                ...(prWasRecorded ? { pr: detectedPr } : {}),
+            }, now);
             n = (0, state_1.transitionBatch)(n, batch.id, 'deployed', {}, now);
             unwalkable = [];
             for (const issue of b.members) {
@@ -2986,7 +3333,11 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
                     entry = (0, state_1.findEntry)(n, issue);
                 }
             }
-            if (finishInline) {
+            // The batch now carries a PR — recorded before, recorded just above,
+            // or still null — only when one exists does the ordinary `deployed`
+            // machinery have anything to hand the report agent. A members-closed
+            // reconcile has no merged batch PR to report on regardless.
+            if (effectivePr === null || evidence.kind === 'members-closed') {
                 // No (merged) PR → no report agent is possible (its prompt names the
                 // PR). Finish the terminal rail and let teardown run below.
                 n = (0, state_1.transitionBatch)(n, batch.id, 'reported', {}, now);
@@ -2997,14 +3348,19 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
         });
         if (!reconciled)
             continue;
+        const finishInline = effectivePr === null || evidence.kind === 'members-closed';
         journalEvent(deps, 'stale-failure-reconciled', unit(batch.id), {
-            pr: batch.pr ?? undefined,
+            pr: effectivePr ?? undefined,
             reason: blockedReason,
             failedAt,
             evidence: evidence.kind,
             ...(evidence.kind === 'pr-merged' ? { mergedAt: evidence.mergedAt } : {}),
+            ...(prWasRecorded ? { pr_detected: true } : {}),
             detail: (evidence.kind === 'pr-merged'
-                ? `PR #${evidence.pr} is MERGED — ledger reconciled blocked (${blockedReason}) to the merged rail (blocked at ${failedAt}); report and teardown will now dispatch`
+                ? (prWasRecorded
+                    ? `batch.pr was never recorded — detected PR #${evidence.pr} MERGED with head=${batch.branch} (gh pr list --state merged), recorded batch.pr=${evidence.pr}`
+                    : `PR #${evidence.pr} is MERGED`) +
+                    ` — ledger reconciled blocked (${blockedReason}) to the merged rail (blocked at ${failedAt}); report and teardown will now dispatch`
                 : evidence.kind === 'members-closed'
                     ? `every member issue is CLOSED as completed on GitHub with no failure trail — ledger reconciled blocked (${blockedReason}) to shipped (blocked at ${failedAt})`
                     : `every member commit is an ancestor of ${batch.base_branch} — ledger reconciled blocked (${blockedReason}) to shipped (blocked at ${failedAt})`) +
@@ -3221,12 +3577,7 @@ function recordAnchorClosed(deps, batchId, now) {
  * stale streak's count. A no-op (no write) when no streak is recorded.
  */
 function clearAnchorCloseFailed(deps, batch, now) {
-    if (batch.anchor_close_failed_reason === null)
-        return;
-    deps.store.withLock((s) => ({
-        state: (0, state_1.patchBatch)(s, batch.id, state_1.CLEARED_ANCHOR_CLOSE_FAILED_FIELDS, now, false),
-        result: undefined,
-    }));
+    clearBatchDedupMarker(deps, batch, batch.anchor_close_failed_reason, state_1.CLEARED_ANCHOR_CLOSE_FAILED_FIELDS, now);
 }
 /**
  * A close that qualified but failed: journal it on the streak's first tick and
@@ -3234,11 +3585,8 @@ function clearAnchorCloseFailed(deps, batch, now) {
  * exactly `reconcilePrWatch`'s `pr-watch-failed` dedup.
  */
 function recordAnchorCloseFailed(deps, batch, outcome, shipped, now) {
-    const priorSince = batch.anchor_close_failed_since;
-    const isNewStreak = batch.anchor_close_failed_reason !== outcome || priorSince === null;
-    const ticks = isNewStreak ? 1 : batch.anchor_close_failed_ticks + 1;
-    const since = isNewStreak || priorSince === null ? now.toISOString() : priorSince;
-    if (isNewStreak || ticks % types_1.JOURNAL_DEDUP_REANNOUNCE_TICKS === 0) {
+    const { since, ticks, announce } = advanceBatchDedupStreak(batch.anchor_close_failed_reason, batch.anchor_close_failed_since, batch.anchor_close_failed_ticks, outcome, now);
+    if (announce) {
         journalEvent(deps, 'anchor-close-failed', unit(batch.id), {
             issue: batch.anchor ?? undefined,
             reason: outcome,
@@ -4025,7 +4373,7 @@ function runBatchTick(deps, config, dispatch) {
             if (!fresh || types_1.TERMINAL_BATCH_STATUSES.has(fresh.status) || fresh.status === 'blocked') {
                 return { state, result: undefined };
             }
-            const blocked = (0, state_1.transitionBatch)(state, batchId, 'blocked', { blocked_reason: 'reconcile-error' }, now);
+            const blocked = (0, state_1.transitionBatch)(state, batchId, 'blocked', { blocked_reason: 'reconcile-error', agent_exits: null }, now);
             return { state: (0, state_1.releaseAllBatchSlots)(blocked, batchId, now), result: undefined };
         });
         journalEvent(deps, 'unit-failed', unit(batchId), { reason: 'reconcile-error', detail });
@@ -4139,10 +4487,10 @@ function runBatchTick(deps, config, dispatch) {
                     reconcileFixSlot(deps, config, batch.id, slot, now, result);
                 }
                 else if (batch.status === 'reviewing' || batch.status === 'shipping') {
-                    reconcileTailSlot(deps, batch.id, slot, now, result);
+                    reconcileTailSlot(deps, config, batch.id, slot, now, result);
                 }
                 else if (batch.status === 'deployed') {
-                    reconcileReportSlot(deps, batch.id, slot, now, result);
+                    reconcileReportSlot(deps, config, batch.id, slot, now, result);
                 }
                 continue;
             }