@ai-dossier/sched 0.51.0 → 0.52.0

package/README.md

@@ -31,6 +31,7 @@ ai-dossier sched start --once     # a single reconcile+refill tick (cron-style)
 ai-dossier sched status           # queue (+pr/cleanup), engine lease, slots, batches, blocked/failed; --anchors adds the ledger anchor sweep (#768) plus orphaned anchors no longer in state.batches (#790)
 ai-dossier sched pause            # prevent every new agent process; live units keep running
 ai-dossier sched resume
+ai-dossier sched resume --batch b1  # recheck a gate-inconclusive block (#583), or re-run gate + tail over a batch blocked over landed work (#822)
 ai-dossier sched stop --issue 42  # terminate one full-cycle agent (or stop a parked batch member, #832) and record it stopped (no recovery)
 ai-dossier sched stop --batch b1  # terminate every batch agent (incl. parallel members) and stop unfinished members
 ai-dossier sched abandon --issue 42 --reason "operator abort"
@@ -771,6 +772,9 @@ failure rails: executing → dissolving (a member self-reports blocked)
                validating → blocked (suite report unreadable, #562) → validating
                executing → blocked (gate-inconclusive:<cap>, #583) → executing
                  (`sched resume --batch <id>` re-runs the gate; nothing requeued/reverted)
+               (dissolve refused | tail) → blocked (dissolve-refused:* / tail-blocked:* /
+                 members-mismatch:* / respawn-cap:tail) → validating
+                 (`sched resume --batch <id>` re-runs gate + tail over the landed members, #822)
 ```
 
 - **One shared worktree/branch per batch**, claimed once by a deterministic (no LLM)
@@ -1004,13 +1008,15 @@ Dissolve never throws validated work away:
   `gh pr create --head <integration branch> --base <base>` — once it merges,
   `reconcileStaleBlockedBatches` settles the validated members to shipped; for a red suite
   or a partial revert, inspect/fix the branch first; `sched abandon --batch` requeues them
-  full-cycle instead. (A `sched resume --batch` arm for these blocks is a follow-up.) Without validated members it dissolves
+  full-cycle instead. Since #822, `sched resume --batch <id>` re-runs the gate and the tail
+  over the validated members instead (see [below](#resuming-a-batch-blocked-over-landed-work-822)). Without validated members it dissolves
   as before, except that in-flight members with a member branch are parked `evicted` and
   every requeue carries the batch's dispatch profile (`carryDispatchProfile: false` only
   for `dispatch-profile-missing:*`, where the profile itself is what broke).
 - Not changed: the `halved` PR-conflict split still re-batches its members, and
   aggregate-suite evictions (`evictMembers`, post-landing, member branch already deleted)
-  still requeue full-cycle — now on the batch profile.
+  still requeue full-cycle — now on the batch profile. Both, plus an engine-set requeue base,
+  are tracked in #840.
 
 State schema 1.24.0: `IssueStatus` gains `handed-back`; `EvictionRecord` gains optional
 `kind`/`branch`, `FailureEvidence` optional `branch`.
@@ -1052,13 +1058,50 @@ State schema 1.24.0: `IssueStatus` gains `handed-back`; `EvictionRecord` gains o
   the batch. A spawn that finds the count already spent (a crash between the count and the
   block) refuses instead of spawning. Before #832, b-20260924-04's tail was respawned four
   times at the strong tier (~375k tokens) until an operator stopped the batch.
-- **Clearing these blocks.** `no-landed-members`, `members-mismatch:*`, `tail-blocked:*` and
-  `respawn-cap:tail` have no `sched resume --batch` recheck. `sched status` names the
-  evidence (the anchor's blocked milestone, or the tail log) and the exits: fix the cause
-  on the integration branch and open its PR by hand (`gh pr create --head <branch> --base
-  <base>`; once it merges, `reconcileStaleBlockedBatches` settles the batch), or `sched
-  abandon --batch <id>` (requeues the landed members full-cycle; for `no-landed-members`
-  there is nothing to lose).
+- **Clearing these blocks.** `sched status` names the evidence (the anchor's blocked
+  milestone, or the tail log) and the exits. For `members-mismatch:*`, `tail-blocked:*` and
+  `respawn-cap:tail`: fix the cause, then `sched resume --batch <id>` (#822, below), or open
+  the integration branch's PR by hand (`gh pr create --head <branch> --base <base>`; once it
+  merges, `reconcileStaleBlockedBatches` settles the batch), or `sched abandon --batch <id>`
+  (requeues the landed members full-cycle). `no-landed-members` has nothing to resume:
+  abandon it.
+
+### Resuming a batch blocked over landed work (#822)
+
+`sched resume --batch <id>` on a batch blocked `dissolve-refused:*` (#810) or on one of #832's
+tail blocks (`tail-blocked:*`, `members-mismatch:*`, `respawn-cap:tail`) —
+`LANDED_RESUMABLE_BLOCK_PREFIXES` — calls `resumeLandedBatch`: `blocked → validating`, with
+`blocked_reason`/`agent_exits` cleared and `executing_member` pinned to the last member (so
+`runValidate` never re-admits a member the dissolve released). The engine's next tick
+re-runs the batch gate and then the tail over the landed members only; a gate still red
+re-blocks it once. It journals `batch-resumed` (naming any tail exits it cleared). Refused,
+with the reason, when no member is landed, the batch still holds a slot, it has no
+integration worktree/branch/anchor, a PR is already recorded against it (let the stale-blocked
+reconcile settle it), or the tail's own members check would refuse the same landed set again
+(`tailMembersRefusal`). The CLI also refuses when the integration worktree is gone from disk
+or a profiled batch's dispatch profile no longer resolves (restore it first).
+`gate-inconclusive:*` keeps its own recheck (`resumeBlockedGate`).
+
+### Wrong-procedure members are re-prompted once (#822)
+
+A member whose dispatch posts a full-cycle-line milestone (`gate` … `report`) carrying neither
+`batch=` nor `mode=slot` ran the WRONG PROCEDURE (imboard #4174 ran full-cycle as a
+member: `review done next=ship`) — `isWrongProcedureMilestone`, fenced to this dispatch. A
+hand-back shape (`blocked`, `review partial`) never counts: it keeps its own path. Both
+member rails then:
+
+- stop a live agent and wait for it to be gone before anything else (a dying full-cycle run
+  could still push, post or open a PR in that worktree);
+- if the milestone shows the run already SHIPPED (a `ship`/`report` phase or a `pr=` key —
+  `wrongProcedureShippedPr`), evict it at once `wrong-procedure-shipped`, naming the stray PR
+  (`stray_pr`) for the operator to close or reconcile — a re-prompt cannot undo a PR;
+- otherwise, the first time, record it in `BatchEntry.reprompted_members`
+  (`{ issue, milestone_at, reprompted_at }`, schema 1.27.0) and journal `member-reprompted`:
+  it respawns in place, in the same worktree, with `wrongProcedureDirective` appended to its
+  prompt (engine values only — no milestone text);
+- a later wrong-procedure milestone posted strictly after `reprompted_at` (no skew tolerance:
+  the killed first dispatch's milestones would otherwise still count inside the 60s fence)
+  evicts it `wrong-procedure` (parked `evicted`, branch kept, #810).
 
 ## API surface
 
@@ -1225,6 +1268,11 @@ import {
   type CapOutcome,       // ok | task-failed | automation-broken | capability-unavailable
   type CapabilityGateResult, // {outcome: CapOutcome, outputTail?, reason?} — runCapability's return shape (#583)
   resumeBlockedGate,     // #583: sched resume --batch <id> — re-run the gate that blocked a batch
+  resumeLandedBatch,     // #822: sched resume --batch <id> over landed work — blocked → validating
+  isLandedResumableBlock, LANDED_RESUMABLE_BLOCK_PREFIXES, // #822: which blocks resumeLandedBatch accepts
+  isWrongProcedureMilestone, wrongProcedureShippedPr, // #822: wrong-procedure detection; did the stray run already ship?
+  wrongProcedureDirective, WRONG_PROCEDURE_MARKER, // #822: the re-prompt text and its fixed opening
+  type RepromptRecord,   // #822: BatchEntry.reprompted_members ({ issue, milestone_at, reprompted_at })
   buildMemberPrompt, buildBatchTailPrompt, buildBatchReportPrompt, // #523 prompt builders (#677: member carries {issue}/{batch}/{worktree}/{integration_branch})
   memberBranchFor, // #677: the member branch name, `batch/<id>-m<n>-<issue>` — one definition, every recovery surface derives from it
   DEFAULT_MEMBER_PROMPT_TEMPLATE, DEFAULT_BATCH_TAIL_PROMPT_TEMPLATE,
@@ -1366,7 +1414,7 @@ after-the-fact recovery, not a missing-data bug.
   queue data.
 - **Schema**: state/config files from #460 (schema 1.0.0), #464 (1.1.0), #468 (1.2.0),
   #472 (1.3.0), #500 (1.4.0), #505 (1.5.0), #504 (1.6.0), #523 (1.7.0) and #524 (1.8.0)
-  load and migrate to the current schema (1.26.0 — 1.24.0 was #810: no backfill,
+  load and migrate to the current schema (1.27.0 — 1.24.0 was #810: no backfill,
   `kind`/`branch` optional, absent = an `evicted` record with no branch) automatically
   (slot `branch`/`last_head`/`pid_start`, slot `role` (inferred from the
   unit's queue entry, with the persisted `phase` as a fallback — #500), entry
@@ -1387,6 +1435,8 @@ after-the-fact recovery, not a missing-data bug.
   backfill to `null`/`null`/`0` — #789, schema 1.25.0).
   Schema 1.26.0 (#832): `BatchEntry` gains `agent_exits` (the per-phase tail/report
   respawn counter); `null` is backfilled on load.
+  Schema 1.27.0 (#822): `BatchEntry` gains `reprompted_members`
+  (`{ issue, milestone_at, reprompted_at }` records; `[]` backfilled).
 - **`max_slots`** bounds live units (`assigned | running | recovering`); dependency
   edges gate readiness — an issue with an unmerged dependency, and a batch behind an
   unmerged batch, are never runnable.

package/dist/batch-dispatch.d.ts

@@ -68,8 +68,10 @@ import { type Journal } from './journal';
 import type { SchedStore } from './persist';
 import type { ExecFn } from './project';
 import { type BatchSuiteContext, type SuiteResult } from './recovery';
+import { tailMembersRefusal } from './state';
 import { type FsExists } from './teardown';
 import type { BatchEntry, CapabilityGateResult, MemberDispatchMode, MemberExitKind, SchedConfig, SchedState } from './types';
+export { tailMembersRefusal };
 export type { CapOutcome } from './types';
 /** Everything batch dispatch needs from the outside world. */
 export interface BatchDispatchDeps {
@@ -172,20 +174,6 @@ export interface MemberFailure {
  * scheduler lands it there.
  */
 export declare function memberBranchFor(batchId: string, memberIndex: number, issue: number): string;
-/**
- * #832: why the tail must NOT be dispatched over `landed`, or null when it may.
- * The deterministic half of the check the tail agent itself makes before
- * integrating (the members it is told about and the members it derives from
- * the integration branch's boundary commits must agree) — made here for free
- * instead of by a strong-tier agent that then exits `members-mismatch`.
- * `batch.ranges` is the recorded boundary attribution (recomputed at every
- * landing); when it is empty nothing was attributed, so there is nothing to
- * cross-check. Invariant this relies on: `ranges` names only landed members —
- * every exit path that reverts a member also drops its range
- * (`recovery.ts`'s partial dissolve); a path that re-derived `ranges` from
- * `git log` after a revert would make this refuse a healthy batch.
- */
-export declare function tailMembersRefusal(batch: BatchEntry, landed: readonly number[]): string | null;
 /**
  * Evict the current member and either dissolve, or continue the batch via
  * `advanceMemberOrValidate` — the shared tail of both member-failure rails

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAYjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAgCpB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAklBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAk4BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAa9F;AAikBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AA2TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAslBD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAsnB1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CA+LN;AA4ED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AA+QD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAozBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgSjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAcjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAwBL,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAK9B,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAylBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAs8CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AA2TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAuxBD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAsnB1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CA+LN;AA4ED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AA+QD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAu0BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgSjB"}

package/dist/batch-dispatch.js

@@ -96,9 +96,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_BATCH_AGENT_RESPAWNS = void 0;
+exports.MAX_BATCH_AGENT_RESPAWNS = exports.tailMembersRefusal = void 0;
 exports.memberBranchFor = memberBranchFor;
-exports.tailMembersRefusal = tailMembersRefusal;
 exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
 exports.reconcileStaleBlockedBatches = reconcileStaleBlockedBatches;
@@ -119,6 +118,7 @@ const recovery_1 = require("./recovery");
 const run_log_1 = require("./run-log");
 const scheduler_1 = require("./scheduler");
 const state_1 = require("./state");
+Object.defineProperty(exports, "tailMembersRefusal", { enumerable: true, get: function () { return state_1.tailMembersRefusal; } });
 const teardown_1 = require("./teardown");
 const types_1 = require("./types");
 function emptyResult() {
@@ -162,6 +162,12 @@ function sanitizeUntrustedText(value) {
 function journalEvent(deps, event, unitId, extra = {}) {
     deps.journal.append((0, journal_1.unitEvent)(event, unitId, extra), deps.now());
 }
+/** Stop the slot's agent if it is still alive (pid-start-safe: a reused pid is never signalled). */
+function killLiveAgent(deps, slot) {
+    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+    }
+}
 /**
  * Read a dead batch dispatch's own log and classify it (#629 AC3) — tail,
  * member, fix and report all reach a `dead` agent the same way (`pid` no
@@ -1016,7 +1022,11 @@ function spawnMemberAgent(deps, dispatch, state, slot, batchId, now, result, tar
     // #677: the prompt carries THIS member's own worktree and the integration
     // branch it was cut from — `member-cycle`'s `worktree`/`integration_branch`
     // inputs. The shared batch worktree is no longer a member surface at all.
-    const prompt = (0, dispatch_1.buildMemberPrompt)(dispatch.memberPrompt, memberIssue, batchId, target.member.worktree, batch.branch, review);
+    const prompt = (0, dispatch_1.buildMemberPrompt)(dispatch.memberPrompt, memberIssue, batchId, target.member.worktree, batch.branch, review) +
+        // #822: a member respawned after running the wrong procedure.
+        (batch.reprompted_members.some((r) => r.issue === memberIssue)
+            ? (0, dispatch_1.wrongProcedureDirective)(memberIssue, batchId)
+            : '');
     const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, target.index, memberIssue);
     // #629: captured BEFORE spawning, mirroring `engine.ts`'s own
     // `spawnAndRecord` — the log is per-role and append-mode, so the size at
@@ -1311,36 +1321,6 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
     }
     claimAndSpawn(deps, config, batchId, 'member', now, (nextState, slot) => spawnMember(deps, dispatch, nextState, slot, batchId, now, result, member));
 }
-/**
- * #832: why the tail must NOT be dispatched over `landed`, or null when it may.
- * The deterministic half of the check the tail agent itself makes before
- * integrating (the members it is told about and the members it derives from
- * the integration branch's boundary commits must agree) — made here for free
- * instead of by a strong-tier agent that then exits `members-mismatch`.
- * `batch.ranges` is the recorded boundary attribution (recomputed at every
- * landing); when it is empty nothing was attributed, so there is nothing to
- * cross-check. Invariant this relies on: `ranges` names only landed members —
- * every exit path that reverts a member also drops its range
- * (`recovery.ts`'s partial dissolve); a path that re-derived `ranges` from
- * `git log` after a revert would make this refuse a healthy batch.
- */
-function tailMembersRefusal(batch, landed) {
-    if (landed.length === 0)
-        return 'no-landed-members';
-    if (batch.ranges.length === 0)
-        return null;
-    const attributed = new Set(batch.ranges.map((r) => r.issue));
-    const missing = landed.filter((issue) => !attributed.has(issue));
-    if (missing.length > 0)
-        return `members-mismatch:no-boundary-commit-${missing.join(',')}`;
-    // The tail derives members from the boundary commits too, and refuses when
-    // the two lists disagree in EITHER direction (review-issue Aggregate Step 1).
-    const landedSet = new Set(landed);
-    const unlanded = [...attributed].filter((issue) => !landedSet.has(issue));
-    return unlanded.length > 0
-        ? `members-mismatch:unlanded-boundary-commit-${unlanded.join(',')}`
-        : null;
-}
 /**
  * #832: the one pre-dispatch verdict for a tail — checked before a slot is
  * claimed and again under the claim's lock. A tail whose respawns are spent
@@ -1353,7 +1333,7 @@ function tailDispatchRefusal(state, batch) {
         return null;
     if (agentRespawnsSpent(batch, 'tail'))
         return 'respawn-cap:tail';
-    return tailMembersRefusal(batch, (0, state_1.validatedMembersOf)(state, batch));
+    return (0, state_1.tailMembersRefusal)(batch, (0, state_1.validatedMembersOf)(state, batch));
 }
 /**
  * Tail/report/fix dispatches (this function, `spawnReportAgent`,
@@ -2091,7 +2071,7 @@ function resumeBlockedGate(deps, config, dispatch, batchId, now) {
         // `suite-unreadable`) — name the actual reason and the operator path
         // instead of a bare illegal-transition error that reads like a bug.
         if (batch.status === 'blocked') {
-            throw new types_1.SchedNotFoundError(`Batch ${batchId} is blocked on '${batch.blocked_reason ?? '?'}', which has no gate recheck: inspect the batch worktree/state named in its journal, then \`sched abandon --batch ${batchId}\` if it is a dead end`);
+            throw new types_1.SchedNotFoundError(`Batch ${batchId} is blocked on '${batch.blocked_reason ?? '?'}', which has no gate recheck (a batch blocked over landed work — dissolve-refused / tail-blocked / members-mismatch / respawn-cap:tail — resumes via \`sched resume --batch\`, #822): inspect the batch worktree/state named in its journal, then \`sched abandon --batch ${batchId}\` if it is a dead end`);
         }
         throw new types_1.IllegalTransitionError('batch', batch.status, 'executing');
     }
@@ -2367,8 +2347,113 @@ function readMemberDispatch(deps, batchId, memberIssue, slot, now) {
         milestone,
         dead,
         blockedNow: (0, groundtruth_1.isMemberBlocked)(milestone, slot.spawned_at),
+        wrongProcedure: (0, groundtruth_1.isWrongProcedureMilestone)(milestone, slot.spawned_at),
     };
 }
+/**
+ * #822: whether a wrong-procedure read counts against THIS dispatch of
+ * `memberIssue`. After a re-prompt, only a milestone posted strictly after
+ * the re-prompt does: the killed first dispatch's milestones still sit
+ * inside the respawn's 60s fence tolerance and would otherwise evict the
+ * member the moment it respawns. No tolerance here — the engine and the
+ * member's CLI stamp times on the same host.
+ */
+function wrongProcedureCounts(batch, memberIssue, read) {
+    if (!read.wrongProcedure || read.milestone === null)
+        return false;
+    const prior = batch.reprompted_members.find((r) => r.issue === memberIssue);
+    if (prior === undefined)
+        return true;
+    const at = Date.parse(read.milestone.at);
+    const repromptedAt = Date.parse(prior.reprompted_at);
+    return Number.isNaN(at) || Number.isNaN(repromptedAt) ? false : at > repromptedAt;
+}
+/**
+ * #822 (#810 proposal 3): the member's dispatch ran the wrong procedure (a
+ * full-cycle-shaped trail — imboard #4174 ran full-cycle as a batch member).
+ * That is a dispatch mistake, not the member's work failing, so the first
+ * time it is RE-PROMPTED: a live agent is stopped (a full-cycle run left going
+ * would open its own PR), the slot is released, and the member is recorded in
+ * `reprompted_members` — the wedge arm (serial) or `spawnParallelMembers`
+ * (parallel) respawns it in place, in the same worktree, with
+ * `wrongProcedureDirective` appended. Returns `'evict'` when the member was
+ * already re-prompted once: the caller evicts it `wrong-procedure`.
+ */
+function repromptWrongProcedure(deps, batchId, memberIssue, milestoneAt, slot, release, now) {
+    // Never respawn into (or release) a worktree the old agent is still in: a
+    // dying full-cycle run could still push, post, or open a PR. Signal it and
+    // decide on a later tick, once it is gone — and so the re-prompt's
+    // `reprompted_at` fence postdates everything it could still post.
+    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        return 'waiting';
+    }
+    const outcome = deps.store.withLock((s) => {
+        const released = release(s);
+        const b = (0, state_1.findBatch)(released, batchId);
+        if (!b || b.reprompted_members.some((r) => r.issue === memberIssue)) {
+            return { state: released, result: 'evict' };
+        }
+        return {
+            state: (0, state_1.patchBatch)(released, batchId, {
+                reprompted_members: [
+                    ...b.reprompted_members,
+                    { issue: memberIssue, milestone_at: milestoneAt, reprompted_at: now.toISOString() },
+                ],
+            }, now),
+            result: 'reprompted',
+        };
+    });
+    if (outcome === 'reprompted') {
+        journalEvent(deps, 'member-reprompted', unit(batchId), {
+            issue: memberIssue,
+            reason: 'wrong-procedure',
+            milestone_at: milestoneAt,
+            detail: `${WRONG_PROCEDURE_SHAPE} — respawning it once in place with a member-cycle directive`,
+        });
+    }
+    return outcome;
+}
+/** #822: the evidence line every wrong-procedure journal/eviction names. */
+const WRONG_PROCEDURE_SHAPE = 'member posted a full-cycle-shaped milestone (no batch=/mode=slot key)';
+/** #822: the eviction a member earns for running the wrong procedure after its one re-prompt. */
+function wrongProcedureFailure(lastTool, shippedPr = null) {
+    return {
+        reason: shippedPr === null ? 'wrong-procedure' : 'wrong-procedure-shipped',
+        detail: shippedPr === null
+            ? `${WRONG_PROCEDURE_SHAPE} again after its one re-prompt`
+            : `${WRONG_PROCEDURE_SHAPE} and its full-cycle run already reached ship (PR ${shippedPr === 'unknown' ? 'not named' : `#${shippedPr}`}) — evicted without a re-prompt; close or reconcile that PR by hand`,
+        kind: 'evicted',
+        extraKv: {
+            ...(lastTool ? { last_tool: lastTool } : {}),
+            ...(typeof shippedPr === 'number' ? { stray_pr: String(shippedPr) } : {}),
+        },
+    };
+}
+/**
+ * #822: the one wrong-procedure decision shared by both member rails —
+ * `'waiting'` (the old agent is still dying), `'reprompted'`, or the
+ * eviction failure to apply. A run that already shipped is evicted without
+ * a re-prompt.
+ */
+function decideWrongProcedure(deps, batchId, memberIssue, milestone, slot, release, lastTool, now) {
+    const shipped = (0, groundtruth_1.wrongProcedureShippedPr)(milestone);
+    if (shipped !== null) {
+        if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+            return 'waiting';
+        }
+        const tool = lastTool();
+        deps.store.withLock((s) => ({ state: release(s), result: undefined }));
+        return wrongProcedureFailure(tool, shipped);
+    }
+    const verdict = repromptWrongProcedure(deps, batchId, memberIssue, milestone.at, slot, release, now);
+    if (verdict === 'waiting')
+        return verdict;
+    // The finished dispatch's run-log entry, exactly once (never while waiting).
+    const tool = lastTool();
+    return verdict === 'reprompted' ? verdict : wrongProcedureFailure(tool);
+}
 /**
  * The eviction a blocked-or-dead member dispatch earns (shared by both rails).
  * #605: only a milestone THIS dispatch posted may name the reason. A dead
@@ -2438,6 +2523,16 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result);
         return;
     }
+    // #822: a wrong-procedure trail is re-prompted once, then evicted — decided
+    // before the dead/blocked rail, which would otherwise evict it as an
+    // unverified exit at the first sight.
+    if (wrongProcedureCounts(batch, memberIssue, read) && read.milestone !== null) {
+        const decision = decideWrongProcedure(deps, batchId, memberIssue, read.milestone, slot, (s) => releaseSlot(s, batchId, now), () => recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now), now);
+        if (typeof decision === 'object') {
+            evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, decision, now, result);
+        }
+        return;
+    }
     if (read.dead &&
         !read.blockedNow &&
         handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, batch.executing_member, memberIssue), slot.log_offset_at_spawn ?? 0, now)) {
@@ -2778,8 +2873,8 @@ function reconcileTailSlot(deps, config, batchId, slot, now, result) {
         ? null
         : (0, groundtruth_1.batchPhaseBlockedReason)(milestone, ['batch-review', 'batch-ship'], slot.spawned_at);
     if (handedBack !== null) {
-        if (slot.pid !== null && !dead)
-            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        if (!dead)
+            killLiveAgent(deps, slot);
         blockOnTailHandBack(deps, config, batch, `tail-blocked:${handedBack}`, now, result);
         return;
     }
@@ -3904,9 +3999,7 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
         // into that tree with its pid no longer tracked anywhere (so neither a
         // dissolve nor `sched stop --batch` could stop it). Its work is done —
         // stop it first.
-        if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
-            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
-        }
+        killLiveAgent(deps, slot);
         journalEvent(deps, 'external-advance', unit(batchId), {
             issue: run.issue,
             detail: 'member review done',
@@ -3929,6 +4022,17 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
         result.completed.push(memberUnit);
         return;
     }
+    // #822: re-prompt once, then evict — see the serial rail.
+    const parallelBatch = (0, state_1.findBatch)(state0, batchId);
+    if (parallelBatch &&
+        wrongProcedureCounts(parallelBatch, run.issue, read) &&
+        read.milestone !== null) {
+        const decision = decideWrongProcedure(deps, batchId, run.issue, read.milestone, slot, release, () => recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now), now);
+        if (typeof decision === 'object') {
+            evictParallelMember(deps, config, batchId, run, decision, now, result);
+        }
+        return;
+    }
     if (read.dead &&
         !read.blockedNow &&
         handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, run.index, run.issue), slot.log_offset_at_spawn ?? 0, now, { releaseWith: release })) {
@@ -4239,9 +4343,7 @@ function stopMemberAgent(deps, batchId, issue, now) {
     const slot = (0, state_1.slotForBatchMember)(deps.store.load(), batchId, issue);
     if (slot === undefined)
         return;
-    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
-        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
-    }
+    killLiveAgent(deps, slot);
     deps.store.withLock((s) => ({
         state: (0, state_1.releaseBatchMemberSlot)(s, batchId, issue, now),
         result: undefined,