@ai-dossier/sched 0.50.0 → 0.51.0

package/README.md

@@ -31,7 +31,7 @@ ai-dossier sched start --once     # a single reconcile+refill tick (cron-style)
 ai-dossier sched status           # queue (+pr/cleanup), engine lease, slots, batches, blocked/failed; --anchors adds the ledger anchor sweep (#768) plus orphaned anchors no longer in state.batches (#790)
 ai-dossier sched pause            # prevent every new agent process; live units keep running
 ai-dossier sched resume
-ai-dossier sched stop --issue 42  # terminate one full-cycle agent and record it stopped (no recovery)
+ai-dossier sched stop --issue 42  # terminate one full-cycle agent (or stop a parked batch member, #832) and record it stopped (no recovery)
 ai-dossier sched stop --batch b1  # terminate every batch agent (incl. parallel members) and stop unfinished members
 ai-dossier sched abandon --issue 42 --reason "operator abort"
 ai-dossier sched abandon --batch b1   # dissolve; every unshipped member — parked and validated ones included — requeues as full-cycle
@@ -53,8 +53,10 @@ directory directly, reconstructing costs from the raw dispatch logs rather than
 `pause` prevents every new agent process, including escalation and same-tier recovery
 takeovers; it does not terminate agents that are already running. `stop --issue <n>` is the
 single-command stop path: it PID-start-safely terminates that issue's live agent, releases its
-slot, and records a terminal `stopped` outcome that will not recover or escalate. An active
-slot-mode member must instead be stopped through `stop --batch <id>`, which terminates every agent
+slot, and records a terminal `stopped` outcome that will not recover or escalate. A slot-mode
+member still in a live batch (pending, in work, or validated) must instead be stopped through
+`stop --batch <id>` — a parked (`handed-back`/`evicted`) member can be stopped on its own (#832) —
+which terminates every agent
 the batch holds (its own slot plus one per running parallel member, `batch:<id>#<issue>`) and atomically stops the batch and its unfinished members. `abandon` only records failure
 and releases the slot; it intentionally does not terminate its process.
 
@@ -247,7 +249,9 @@ where every mechanical supervision decision is code, not remembered prose:
    `reconcileRecovering`, held in `recovering` until `sched resume`) and every batch
    respawn wedge in `runBatchTick` (tail, member continuation, fix, report, and the
    `ready` → `claimAndSetup` claim — `runValidate`'s local suite run is unaffected) stop
-   respawning into the wall, which previously ignored `paused` entirely. `dispatch-
+   respawning into the wall, which previously ignored `paused` entirely. (Unverified
+   tail/report exits that are NOT API errors are capped separately since #832 —
+   `respawn-cap:tail`, or a merged batch closed without its report.) `dispatch-
    health.ts` is its own module (not `engine.ts`) specifically so it is shared by BOTH
    dispatch paths without `engine.ts` and `batch-dispatch.ts` importing each other.
    Batch dispatch logs (per-role, append-mode) are fenced to `log_offset_at_spawn`,
@@ -1011,6 +1015,51 @@ Dissolve never throws validated work away:
 State schema 1.24.0: `IssueStatus` gains `handed-back`; `EvictionRecord` gains optional
 `kind`/`branch`, `FailureEvidence` optional `branch`.
 
+### The tail runs over landed members; a tail verdict is final (#832)
+
+- **Landed members only.** The tail (aggregate review + integrate/ship) is dispatched with
+  `{members}` = the batch's validated members (`validatedMembersOf`), never the raw
+  `batch.members`, which still lists members that were stopped, handed back, evicted,
+  parked or requeued. Before claiming a slot the engine makes the tail's own two-way check
+  for free (`tailMembersRefusal`): no landed members blocks `no-landed-members`; when
+  `batch.ranges` records boundary commits, a landed member with none blocks
+  `members-mismatch:no-boundary-commit-<n>`, and a boundary commit for a member that did
+  not land blocks `members-mismatch:unlanded-boundary-commit-<n>`. No tail agent is spent.
+- **`sched stop --issue` on a parked member.** A `handed-back`/`evicted` member of a live
+  batch can be stopped on its own (the operator's cleanup after a hand-back). It moves to
+  `stopped` and keeps its exit record, so it stays out of the landed set. A member still in
+  the batch (pending, in work, or validated) is still refused: use `sched stop --batch`.
+- **A blocked tail blocks the batch.** A `batch-review` or `batch-ship` `status=blocked`
+  milestone posted by THIS tail dispatch (fenced by the slot's `spawned_at`, which tail and
+  report spawns now stamp; a slot from an older engine with no `spawned_at` skips this
+  check and falls to the capped path below) releases the slot and blocks the batch
+  `tail-blocked:<reason>` once, in one lock. It is never read as an unverified exit to
+  respawn. The agent's milestone is already on the anchor, so the engine posts none. The
+  reason is reduced to a slug.
+- **Per-phase respawn cap.** `BatchEntry.agent_exits` (`{ phase: 'tail'|'report', count }`,
+  schema 1.26.0) counts unverified exits of the phase's agent; each is journaled with its
+  position (`unverified exit 2/3 (log: …)`). #629 API-error exits are not counted: they
+  have their own pause. After `MAX_BATCH_AGENT_RESPAWNS` (2) respawns, the next unverified
+  exit ends the phase:
+  - **tail** → the batch blocks `respawn-cap:tail`;
+  - **report** → the batch (whose PR is already merged and deployed) closes
+    `deployed → reported → done` without its report, journaling `report-failed
+    respawn-cap:report — batch closed without its report`. A block would not hold there:
+    `reconcileStaleBlockedBatches` walks a blocked batch with a merged PR straight back to
+    `deployed`, and the report agent would respawn.
+
+  Verified progress (review done, park, report done) clears the count, and so does blocking
+  the batch. A spawn that finds the count already spent (a crash between the count and the
+  block) refuses instead of spawning. Before #832, b-20260924-04's tail was respawned four
+  times at the strong tier (~375k tokens) until an operator stopped the batch.
+- **Clearing these blocks.** `no-landed-members`, `members-mismatch:*`, `tail-blocked:*` and
+  `respawn-cap:tail` have no `sched resume --batch` recheck. `sched status` names the
+  evidence (the anchor's blocked milestone, or the tail log) and the exits: fix the cause
+  on the integration branch and open its PR by hand (`gh pr create --head <branch> --base
+  <base>`; once it merges, `reconcileStaleBlockedBatches` settles the batch), or `sched
+  abandon --batch <id>` (requeues the landed members full-cycle; for `no-landed-members`
+  there is nothing to lose).
+
 ## API surface
 
 ```ts
@@ -1183,6 +1232,9 @@ import {
   isMemberComplete, isMemberBlocked, // member milestone predicates (member-trail gated: mode=slot or batch=<id>, #677)
   isBatchTailParked,     // batch-ship awaiting-merge + pr= — the batch park signal
   isBatchPhaseDone,      // <phase> done on the anchor (batch-review/batch-report)
+  batchPhaseBlockedReason, // #832: slugged reason of a `<phase> blocked` anchor milestone posted by THIS dispatch; null otherwise
+  MAX_BATCH_AGENT_RESPAWNS, // #832: tail/report respawns after unverified exits before the phase ends (2)
+  type BatchAgentExits, type BatchAgentPhase, // #832: BatchEntry.agent_exits ({ phase: 'tail'|'report', count })
   batchOfUnit,           // batch:<id> → <id>; null for issue units or malformed ids
 } from '@ai-dossier/sched';
 ```
@@ -1314,7 +1366,7 @@ after-the-fact recovery, not a missing-data bug.
   queue data.
 - **Schema**: state/config files from #460 (schema 1.0.0), #464 (1.1.0), #468 (1.2.0),
   #472 (1.3.0), #500 (1.4.0), #505 (1.5.0), #504 (1.6.0), #523 (1.7.0) and #524 (1.8.0)
-  load and migrate to the current schema (1.25.0 — 1.24.0 was #810: no backfill,
+  load and migrate to the current schema (1.26.0 — 1.24.0 was #810: no backfill,
   `kind`/`branch` optional, absent = an `evicted` record with no branch) automatically
   (slot `branch`/`last_head`/`pid_start`, slot `role` (inferred from the
   unit's queue entry, with the persisted `phase` as a fallback — #500), entry
@@ -1333,6 +1385,8 @@ after-the-fact recovery, not a missing-data bug.
   `IssueStatus` gains `handed-back`, `EvictionRecord`/`FailureEvidence` gain optional
   `kind`/`branch` — #810, schema 1.24.0; batch `pr_detect_ambiguous_reason`/`_since`/`_ticks`
   backfill to `null`/`null`/`0` — #789, schema 1.25.0).
+  Schema 1.26.0 (#832): `BatchEntry` gains `agent_exits` (the per-phase tail/report
+  respawn counter); `null` is backfilled on load.
 - **`max_slots`** bounds live units (`assigned | running | recovering`); dependency
   edges gate readiness — an issue with an unmerged dependency, and a batch behind an
   unmerged batch, are never runnable.

package/dist/batch-dispatch.d.ts

@@ -172,6 +172,20 @@ export interface MemberFailure {
  * scheduler lands it there.
  */
 export declare function memberBranchFor(batchId: string, memberIndex: number, issue: number): string;
+/**
+ * #832: why the tail must NOT be dispatched over `landed`, or null when it may.
+ * The deterministic half of the check the tail agent itself makes before
+ * integrating (the members it is told about and the members it derives from
+ * the integration branch's boundary commits must agree) — made here for free
+ * instead of by a strong-tier agent that then exits `members-mismatch`.
+ * `batch.ranges` is the recorded boundary attribution (recomputed at every
+ * landing); when it is empty nothing was attributed, so there is nothing to
+ * cross-check. Invariant this relies on: `ranges` names only landed members —
+ * every exit path that reverts a member also drops its range
+ * (`recovery.ts`'s partial dissolve); a path that re-derived `ranges` from
+ * `git log` after a revert would make this refuse a healthy batch.
+ */
+export declare function tailMembersRefusal(batch: BatchEntry, landed: readonly number[]): string | null;
 /**
  * Evict the current member and either dissolve, or continue the batch via
  * `advanceMemberOrValidate` — the shared tail of both member-failure rails
@@ -238,6 +252,16 @@ export declare function resumeBlockedGate(deps: BatchDispatchDeps, config: Sched
     blockedBy?: 'inconclusive' | 'unevidenced-failure';
     detail?: string;
 };
+/**
+ * #832: how many times one tail-work phase's agent (`tail` or `report`) is
+ * RESPAWNED after exiting unverified — the first dispatch plus this many
+ * respawns; the next unverified exit ends the phase instead. The #629 class:
+ * the tick loop's "same wedge" arm respawns a dead tail/report agent on its
+ * own, so without a cap an agent that exits without a verdict is
+ * redispatched forever (b-20260924-04: the strong-tier tail four times,
+ * ~375k tokens, stopped only by hand).
+ */
+export declare const MAX_BATCH_AGENT_RESPAWNS = 2;
 /**
  * #686: reconcile a `blocked` batch whose work demonstrably shipped anyway.
  * `reconcilePrWatch` above only watches `awaiting-merge` batches, and

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAEL,KAAK,WAAW,EAYjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAWtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAgCpB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAklBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAi4CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AA2TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAwiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CA+LN;AA4ED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AA+QD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAozBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgSjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAYjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAgCpB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAklBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAk4BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAa9F;AAikBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AA2TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAslBD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAsnB1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CA+LN;AA4ED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AA+QD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAozBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgSjB"}

package/dist/batch-dispatch.js

@@ -96,7 +96,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_BATCH_AGENT_RESPAWNS = void 0;
 exports.memberBranchFor = memberBranchFor;
+exports.tailMembersRefusal = tailMembersRefusal;
 exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
 exports.reconcileStaleBlockedBatches = reconcileStaleBlockedBatches;
@@ -1309,6 +1311,50 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
     }
     claimAndSpawn(deps, config, batchId, 'member', now, (nextState, slot) => spawnMember(deps, dispatch, nextState, slot, batchId, now, result, member));
 }
+/**
+ * #832: why the tail must NOT be dispatched over `landed`, or null when it may.
+ * The deterministic half of the check the tail agent itself makes before
+ * integrating (the members it is told about and the members it derives from
+ * the integration branch's boundary commits must agree) — made here for free
+ * instead of by a strong-tier agent that then exits `members-mismatch`.
+ * `batch.ranges` is the recorded boundary attribution (recomputed at every
+ * landing); when it is empty nothing was attributed, so there is nothing to
+ * cross-check. Invariant this relies on: `ranges` names only landed members —
+ * every exit path that reverts a member also drops its range
+ * (`recovery.ts`'s partial dissolve); a path that re-derived `ranges` from
+ * `git log` after a revert would make this refuse a healthy batch.
+ */
+function tailMembersRefusal(batch, landed) {
+    if (landed.length === 0)
+        return 'no-landed-members';
+    if (batch.ranges.length === 0)
+        return null;
+    const attributed = new Set(batch.ranges.map((r) => r.issue));
+    const missing = landed.filter((issue) => !attributed.has(issue));
+    if (missing.length > 0)
+        return `members-mismatch:no-boundary-commit-${missing.join(',')}`;
+    // The tail derives members from the boundary commits too, and refuses when
+    // the two lists disagree in EITHER direction (review-issue Aggregate Step 1).
+    const landedSet = new Set(landed);
+    const unlanded = [...attributed].filter((issue) => !landedSet.has(issue));
+    return unlanded.length > 0
+        ? `members-mismatch:unlanded-boundary-commit-${unlanded.join(',')}`
+        : null;
+}
+/**
+ * #832: the one pre-dispatch verdict for a tail — checked before a slot is
+ * claimed and again under the claim's lock. A tail whose respawns are spent
+ * (a crash landed between counting the exit that spent them and blocking the
+ * batch) is refused, as is a members mismatch. Only a batch in a tail phase
+ * is judged; anything else is not the tail's to refuse.
+ */
+function tailDispatchRefusal(state, batch) {
+    if (batch.status !== 'reviewing' && batch.status !== 'shipping')
+        return null;
+    if (agentRespawnsSpent(batch, 'tail'))
+        return 'respawn-cap:tail';
+    return tailMembersRefusal(batch, (0, state_1.validatedMembersOf)(state, batch));
+}
 /**
  * Tail/report/fix dispatches (this function, `spawnReportAgent`,
  * `reconcileFixSlot`) are NOT recorded live to `runs.jsonl` — only member
@@ -1317,11 +1363,27 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
  * the only way to see their cost today, reconstructed from the raw log
  * after the fact. Wiring in live recording for these later means repeating
  * `spawnMember`'s own #564 fix first: none of these three spawn functions'
- * patches stamp `SlotEntry.spawned_at` either, so a `recordXRunLog` guarded
+ * patches stamped `SlotEntry.spawned_at` either, so a `recordXRunLog` guarded
  * on `spawned_at !== null` (mirroring `recordMemberRunLog`) would silently
- * no-op forever, exactly like the original bug.
+ * no-op forever, exactly like the original bug. #832 made the tail and report
+ * spawns stamp it (their hand-back fence needs it); the fix agent still does
+ * not.
  */
 function spawnTailAgent(deps, config, dispatch, batchId, now, result) {
+    // #832: the tail runs over the LANDED members only — never `batch.members`,
+    // which still lists a member that was stopped, handed back, evicted or
+    // parked. A refusal blocks the batch before any agent is spawned (and
+    // before a slot is claimed — `blockBatchForOperator` posts a milestone, an
+    // exec that must not run under the store lock).
+    const before = deps.store.load();
+    const pending = (0, state_1.findBatch)(before, batchId);
+    if (pending) {
+        const refusal = tailDispatchRefusal(before, pending);
+        if (refusal !== null) {
+            blockBatchForOperator(deps, config, batchId, { reason: refusal, milestonePhase: 'batch-review' }, now, result);
+            return;
+        }
+    }
     claimAndSpawn(deps, config, batchId, 'reviewing', now, (state, slot) => {
         const batch = (0, state_1.findBatch)(state, batchId);
         if (!batch || batch.worktree === null || batch.anchor === null) {
@@ -1331,9 +1393,20 @@ function spawnTailAgent(deps, config, dispatch, batchId, now, result) {
             });
             return releaseSlot(state, batchId, now);
         }
+        const landed = (0, state_1.validatedMembersOf)(state, batch);
+        const lateRefusal = tailDispatchRefusal(state, batch);
+        if (lateRefusal !== null) {
+            // The state changed between the pre-check and the lock (a concurrent
+            // stop/park) — release, and the next tick's pre-check (reading the same
+            // persisted state) blocks the batch with this reason.
+            journalEvent(deps, 'slot-released', unit(batchId), {
+                detail: `tail not dispatched: ${lateRefusal} (state changed before the claim; the next tick blocks the batch)`,
+            });
+            return releaseSlot(state, batchId, now);
+        }
         const spawnSpec = (0, dispatch_1.resolveTierSpawn)(dispatch, 'strong', batch.anchor);
         const cmd = spawnSpec.cmd;
-        const prompt = (0, dispatch_1.buildBatchTailPrompt)(dispatch.batchTailPrompt, batchId, batch.anchor, batch.members, batch.worktree);
+        const prompt = (0, dispatch_1.buildBatchTailPrompt)(dispatch.batchTailPrompt, batchId, batch.anchor, landed, batch.worktree);
         const logFile = (0, dispatch_1.batchTailLogPath)(deps.store.runsDir, batchId);
         // #629: fences `handleDeadDispatchApiError`'s classification to this
         // dispatch's slice — see `spawnMember`'s identical comment.
@@ -1356,6 +1429,14 @@ function spawnTailAgent(deps, config, dispatch, batchId, now, result) {
             phase: 'reviewing',
             last_progress_at: now.toISOString(),
             log_offset_at_spawn: logOffset,
+            // #832: the fence `reconcileTailSlot` reads — without it a
+            // `batch-review blocked` left on the anchor by an EARLIER dispatch
+            // (or a previous batch on the same anchor, #605) would block this one.
+            // The fence tolerates `DISPATCH_FENCE_TOLERANCE_MS` (60s) of clock skew,
+            // so a blocked milestone posted less than a minute before this spawn
+            // still counts — only a resume that re-dispatches the tail that fast
+            // could trip it.
+            spawned_at: now.toISOString(),
         };
         const next = slot.status === 'assigned' ? (0, state_1.transitionSlot)(state, slot.id, 'running', patch, now) : state;
         deps.journal.append((0, journal_1.unitEvent)('spawned', unit(batchId), {
@@ -1370,6 +1451,13 @@ function spawnTailAgent(deps, config, dispatch, batchId, now, result) {
     });
 }
 function spawnReportAgent(deps, config, dispatch, batchId, now, result) {
+    // #832: respawns already spent (a crash landed between counting the exit
+    // that spent them and closing the batch) — close it now, never spawn.
+    const pending = (0, state_1.findBatch)(deps.store.load(), batchId);
+    if (pending && pending.status === 'deployed' && agentRespawnsSpent(pending, 'report')) {
+        closeWithoutReport(deps, batchId, 'respawn-cap:report', now, result);
+        return;
+    }
     claimAndSpawn(deps, config, batchId, 'report', now, (state, slot) => {
         const batch = (0, state_1.findBatch)(state, batchId);
         if (!batch || batch.anchor === null) {
@@ -1406,6 +1494,8 @@ function spawnReportAgent(deps, config, dispatch, batchId, now, result) {
             phase: 'report',
             last_progress_at: now.toISOString(),
             log_offset_at_spawn: logOffset,
+            // #832: the fence `reconcileReportSlot`'s hand-back check reads.
+            spawned_at: now.toISOString(),
         };
         const next = slot.status === 'assigned'
             ? (0, state_1.transitionSlot)(state, slot.id, 'running', patchState, now)
@@ -2565,7 +2655,98 @@ function reconcileFixSlot(deps, config, batchId, slot, now, result) {
     }
     evictOffender(deps, config, batchId, offenderRecord.issue, 'overlap', now, result);
 }
-function reconcileTailSlot(deps, batchId, slot, now, result) {
+/**
+ * #832: how many times one tail-work phase's agent (`tail` or `report`) is
+ * RESPAWNED after exiting unverified — the first dispatch plus this many
+ * respawns; the next unverified exit ends the phase instead. The #629 class:
+ * the tick loop's "same wedge" arm respawns a dead tail/report agent on its
+ * own, so without a cap an agent that exits without a verdict is
+ * redispatched forever (b-20260924-04: the strong-tier tail four times,
+ * ~375k tokens, stopped only by hand).
+ */
+exports.MAX_BATCH_AGENT_RESPAWNS = 2;
+/** #832: whether `batch` has already spent its respawns for `phase`. */
+function agentRespawnsSpent(batch, phase) {
+    return (batch.agent_exits !== null &&
+        batch.agent_exits.phase === phase &&
+        batch.agent_exits.count > exports.MAX_BATCH_AGENT_RESPAWNS);
+}
+/**
+ * #832: count one unverified exit of `phase`'s agent, release its slot, and
+ * journal the exit with its position against the cap — one lock, so the count
+ * and the release cannot come apart. Returns `'capped'` when this exit spent
+ * the phase's last respawn (the caller ends the phase), else `'respawn'`.
+ * The count is per phase — another phase's exits start it over — and verified
+ * progress clears it (`clearAgentExits`).
+ */
+function releaseAndCountAgentExit(deps, batchId, phase, failed, now) {
+    const count = deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        const prior = b?.agent_exits;
+        const next = prior && prior.phase === phase ? prior.count + 1 : 1;
+        let n = releaseSlot(s, batchId, now);
+        if (b)
+            n = (0, state_1.patchBatch)(n, batchId, { agent_exits: { phase, count: next } }, now);
+        return { state: n, result: next };
+    });
+    journalEvent(deps, failed.event, unit(batchId), {
+        ...failed.extra,
+        detail: `${String(failed.extra.detail ?? 'unverified exit')} ${count}/${exports.MAX_BATCH_AGENT_RESPAWNS + 1} (log: ${failed.log})`,
+    });
+    return count > exports.MAX_BATCH_AGENT_RESPAWNS ? 'capped' : 'respawn';
+}
+/** #832: verified progress in a tail-work phase — the respawn count starts over. */
+function clearAgentExits(s, batchId, now) {
+    const b = (0, state_1.findBatch)(s, batchId);
+    return b && b.agent_exits !== null ? (0, state_1.patchBatch)(s, batchId, { agent_exits: null }, now) : s;
+}
+/**
+ * #832: the tail posted its own `batch-review`/`batch-ship blocked` — release
+ * its slot and block the batch with that reason in ONE lock (no milestone to
+ * post: the agent's is already the anchor's record, so no exec runs under the
+ * lock), so a crash can never leave the slot released with the batch still
+ * `reviewing` for the wedge arm to respawn. The agent decided; respawning it
+ * would only get the same answer again.
+ */
+function blockOnTailHandBack(deps, config, batch, reason, now, result) {
+    const rDeps = recoveryDeps(deps, config, batch, now);
+    deps.store.withLock((s) => {
+        const released = releaseSlot(s, batch.id, now);
+        const b = (0, state_1.findBatch)(released, batch.id);
+        if (!b || types_1.TERMINAL_BATCH_STATUSES.has(b.status) || b.status === 'blocked') {
+            return { state: released, result: undefined };
+        }
+        const blocked = (0, recovery_1.blockBatch)(released, batch.id, { reason, milestonePhase: 'batch-review', milestoneAlreadyPosted: true }, rDeps);
+        return { state: blocked.state, result: undefined };
+    });
+    result.failed.push(unit(batch.id));
+}
+/**
+ * #832: close a MERGED batch whose report agent spent its respawns, without
+ * its report. The report is the batch's summary, not its work — the PR is
+ * merged and deployed — so the batch goes `deployed → reported → done` and
+ * is torn down like any finished batch. Blocking it instead would not stop
+ * anything: `reconcileStaleBlockedBatches` walks a blocked batch with a
+ * merged PR straight back to `deployed`, and the report agent would respawn.
+ */
+function closeWithoutReport(deps, batchId, why, now, result) {
+    const closed = deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        if (!b || b.status !== 'deployed')
+            return { state: s, result: false };
+        let n = (0, state_1.transitionBatch)(s, batchId, 'reported', { agent_exits: null }, now);
+        n = (0, state_1.transitionBatch)(n, batchId, 'done', {}, now);
+        return { state: n, result: true };
+    });
+    if (!closed)
+        return;
+    journalEvent(deps, 'report-failed', unit(batchId), {
+        detail: `${why} — batch closed without its report (the PR is merged); post the batch report by hand if one is wanted`,
+    });
+    result.failed.push(unit(batchId));
+    teardownBatch(deps, batchId);
+}
+function reconcileTailSlot(deps, config, batchId, slot, now, result) {
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.anchor === null)
@@ -2580,10 +2761,28 @@ function reconcileTailSlot(deps, batchId, slot, now, result) {
             const b = (0, state_1.findBatch)(s, batchId);
             if (!b || b.status !== 'reviewing')
                 return { state: s, result: undefined };
-            return { state: (0, state_1.transitionBatch)(s, batchId, 'shipping', {}, now), result: undefined };
+            const n = clearAgentExits(s, batchId, now);
+            return { state: (0, state_1.transitionBatch)(n, batchId, 'shipping', {}, now), result: undefined };
         });
         return;
     }
+    // #832: the tail handed back (`batch-review`/`batch-ship blocked`, e.g.
+    // `members-mismatch`) — block the batch with its reason, never respawn.
+    // Checked before liveness: the agent is done deciding whether or not its
+    // process has exited yet, and the block releases its slot. Only for a slot
+    // that recorded its dispatch time: a tail spawned before #832 stamped
+    // `spawned_at` has no fence, and an unfenced read would let an older
+    // `blocked` milestone on the anchor block this dispatch — that exit falls
+    // through to the (capped) unverified path instead.
+    const handedBack = slot.spawned_at === null
+        ? null
+        : (0, groundtruth_1.batchPhaseBlockedReason)(milestone, ['batch-review', 'batch-ship'], slot.spawned_at);
+    if (handedBack !== null) {
+        if (slot.pid !== null && !dead)
+            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        blockOnTailHandBack(deps, config, batch, `tail-blocked:${handedBack}`, now, result);
+        return;
+    }
     if ((0, groundtruth_1.isBatchTailParked)(milestone)) {
         const pr = (0, groundtruth_1.prOfMilestone)(milestone);
         journalEvent(deps, 'pr-parked', unit(batchId), { pr: pr ?? undefined });
@@ -2595,6 +2794,7 @@ function reconcileTailSlot(deps, batchId, slot, now, result) {
             const b = (0, state_1.findBatch)(n, batchId);
             if (!b)
                 return { state: n, result: undefined };
+            n = clearAgentExits(n, batchId, now);
             n = b.status === 'reviewing' ? (0, state_1.transitionBatch)(n, batchId, 'shipping', {}, now) : n;
             n = (0, state_1.transitionBatch)(n, batchId, 'awaiting-merge', { pr }, now);
             return { state: n, result: undefined };
@@ -2610,12 +2810,20 @@ function reconcileTailSlot(deps, batchId, slot, now, result) {
         if (handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchTailLogPath)(deps.store.runsDir, batchId), slot.log_offset_at_spawn ?? 0, now)) {
             return;
         }
-        deps.journal.append((0, journal_1.unitEvent)('unit-failed', unit(batchId), { reason: 'tail-agent-exited-unverified' }), now);
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        // #832: counted — once the respawns are spent the batch blocks instead.
+        const outcome = releaseAndCountAgentExit(deps, batchId, 'tail', {
+            event: 'unit-failed',
+            extra: { reason: 'tail-agent-exited-unverified' },
+            log: (0, dispatch_1.batchTailLogPath)(deps.store.runsDir, batchId),
+        }, now);
+        if (outcome === 'capped') {
+            blockBatchForOperator(deps, config, batchId, { reason: 'respawn-cap:tail', milestonePhase: 'batch-review' }, now, result);
+            return;
+        }
         result.failed.push(unit(batchId));
     }
 }
-function reconcileReportSlot(deps, batchId, slot, now, result) {
+function reconcileReportSlot(deps, config, batchId, slot, now, result) {
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.anchor === null)
@@ -2630,7 +2838,7 @@ function reconcileReportSlot(deps, batchId, slot, now, result) {
             // #629: a verified report completion is proof dispatch is healthy —
             // reset the confirmed-failure streak, mirroring the per-issue path's
             // own verified-complete branch.
-            let n = (0, dispatch_health_1.resetDispatchApiErrorStreak)(releaseSlot(s, batchId, now));
+            let n = clearAgentExits((0, dispatch_health_1.resetDispatchApiErrorStreak)(releaseSlot(s, batchId, now)), batchId, now);
             const b = (0, state_1.findBatch)(n, batchId);
             if (!b || b.status !== 'deployed')
                 return { state: n, result: undefined };
@@ -2650,8 +2858,15 @@ function reconcileReportSlot(deps, batchId, slot, now, result) {
         if (handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchReportLogPath)(deps.store.runsDir, batchId), slot.log_offset_at_spawn ?? 0, now)) {
             return;
         }
-        deps.journal.append((0, journal_1.unitEvent)('report-failed', unit(batchId), { detail: 'unverified exit' }), now);
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        // #832: counted — once the respawns are spent the merged batch closes
+        // without its report (see `closeWithoutReport` for why not a block).
+        const outcome = releaseAndCountAgentExit(deps, batchId, 'report', {
+            event: 'report-failed',
+            extra: { detail: 'unverified exit' },
+            log: (0, dispatch_1.batchReportLogPath)(deps.store.runsDir, batchId),
+        }, now);
+        if (outcome === 'capped')
+            closeWithoutReport(deps, batchId, 'respawn-cap:report', now, result);
     }
 }
 // --- PR watch for `awaiting-merge` batches (mirrors `pollParkedPrs`/`reconcileParked`) ---
@@ -4158,7 +4373,7 @@ function runBatchTick(deps, config, dispatch) {
             if (!fresh || types_1.TERMINAL_BATCH_STATUSES.has(fresh.status) || fresh.status === 'blocked') {
                 return { state, result: undefined };
             }
-            const blocked = (0, state_1.transitionBatch)(state, batchId, 'blocked', { blocked_reason: 'reconcile-error' }, now);
+            const blocked = (0, state_1.transitionBatch)(state, batchId, 'blocked', { blocked_reason: 'reconcile-error', agent_exits: null }, now);
             return { state: (0, state_1.releaseAllBatchSlots)(blocked, batchId, now), result: undefined };
         });
         journalEvent(deps, 'unit-failed', unit(batchId), { reason: 'reconcile-error', detail });
@@ -4272,10 +4487,10 @@ function runBatchTick(deps, config, dispatch) {
                     reconcileFixSlot(deps, config, batch.id, slot, now, result);
                 }
                 else if (batch.status === 'reviewing' || batch.status === 'shipping') {
-                    reconcileTailSlot(deps, batch.id, slot, now, result);
+                    reconcileTailSlot(deps, config, batch.id, slot, now, result);
                 }
                 else if (batch.status === 'deployed') {
-                    reconcileReportSlot(deps, batch.id, slot, now, result);
+                    reconcileReportSlot(deps, config, batch.id, slot, now, result);
                 }
                 continue;
             }