@ai-dossier/sched 0.53.0 → 0.54.1

package/README.md

@@ -37,6 +37,7 @@ ai-dossier sched stop --batch b1  # terminate every batch agent (incl. parallel
 ai-dossier sched abandon --issue 42 --reason "operator abort"
 ai-dossier sched abandon --batch b1   # dissolve; every unshipped member — parked and validated ones included — requeues as full-cycle
 ai-dossier sched requeue --issue 42   # a PARKED batch member (evicted / handed-back) → full-cycle from its member branch, on the batch profile (#810)
+ai-dossier sched attach-pr --batch b1 4270  # record a blocked batch's own MERGED PR by hand (resolves pr-detect-ambiguous, #824)
 ai-dossier sched stats --issues 4..9  # per-issue tokens/cost from ~/.dossier/runs.jsonl (#524)
 ai-dossier sched stats --batch b1 --project owner-repo  # batch member/tail/report/fix costs from raw dispatch logs (#564)
 ```
@@ -1133,8 +1134,9 @@ import {
   createSpawnDeps,       // real detached-spawn process I/O
   createExecGroundTruth, // runstate/gh/git ground truth via subprocesses (injectable exec);
                          //   since #468 also gh pr view PR state + setup info from comments;
-                         //   since #789 also mergedPrForBranch when constructed with a
-                         //   verified `repo` (resolveProjectRepo)
+                         //   since #789 also mergedPrForBranch, and since #824
+                         //   batchPrCandidate, when constructed with a verified `repo`
+                         //   (resolveProjectRepo) — which also pins prState with -R
   resolveDispatch,       // config → resolved command/prompt/report-prompt/tier-models/timers/
                          //   per-tier spawn specs (tiers — #527)
   buildTierCommand,      // resolved dispatch + tier + issue → argv, using that tier's OWN
@@ -1168,6 +1170,16 @@ import {
   type MergedPrLookup,   // { kind: 'found', pr, mergedAt } | { kind: 'none' } |
                          //   { kind: 'ambiguous', matches } — GroundTruth.mergedPrForBranch's
                          //   own return type (#789)
+  checkBatchPrCandidate, // the #789 candidate checks (fork/head/base/merged/created-after)
+                         //   → { ok: true, pr, mergedAt } | { ok: false, check } — shared by
+                         //   parseMergedPrListJson and attachBatchPr (#824)
+  type BatchPrCheck,     // which check failed: fork|head|base|unmerged|created-before-batch|number
+  parsePrCandidateJson,  // gh pr view --json → the PR object (GroundTruth.batchPrCandidate, #824)
+  attachBatchPr,         // sched attach-pr: verify an operator-named PR, record batch.pr,
+                         //   clear the pr-detect-ambiguous streak, journal pr-attached (#824)
+  type AttachPrDeps,     // { store, journal, groundTruth (repo-verified), repo? }
+  type AttachPrResult,   // { outcome: 'attached', pr, mergedAt, clearedAmbiguousTicks } |
+                         //   { outcome: 'already-attached', pr }
   parseSetupInfo,        // gh issue view --json comments → teardown inputs
   runTeardown,           // #468 script teardown for a merged unit (pool return / worktree remove)
   isSafeWorktree,        // worktree-path containment check (CWE-22)
@@ -1547,7 +1559,8 @@ predicate in `anchor-close.ts`) over `blocked`/`done` batches touched within the
   batch that same tick is the ambiguity journaled (`pr-detect-ambiguous`, deduped like
   `pr-watch-failed`: once per `blocked` stretch, re-announced every
   `JOURNAL_DEDUP_REANNOUNCE_TICKS`; a batch that leaves `blocked` any way — this
-  reconcile's own success, `sched resume --batch`, `sched abandon` — clears the marker,
+  reconcile's own success, `sched resume --batch`, `sched abandon` — or `sched
+  attach-pr` recording the batch's PR clears the marker,
   so a later re-block never inherits a stale streak). A batch that still reconciles via
   `commits-in-base`/`members-closed` does so without a PR and finishes inline, same as
   before #789. On a match, `batch.pr` is recorded as part of the SAME `blocked →
@@ -1557,9 +1570,34 @@ predicate in `anchor-close.ts`) over `blocked`/`done` batches touched within the
   per-issue-only despite the section's origin) dispatches the report agent exactly as if the
   fleet had opened the PR itself, and `sched status`'s existing `pr` column shows it.
   Recording `batch.pr` never closes the anchor by itself — that stays #768's own
-  evidence-gated `reconcileAnchorClosure`, unchanged. An ambiguous match with no
-  explicit way to resolve it today (#824 tracks a `sched attach-pr` verb) still lets the
-  batch reconcile via its other evidence, or falls to `sched abandon --batch`.
+  evidence-gated `reconcileAnchorClosure`, unchanged. An ambiguous match still lets the
+  batch reconcile via its other evidence; otherwise the operator resolves it with
+  `sched attach-pr` (below), or falls to `sched abandon --batch`.
+- **`sched attach-pr --batch <id> <pr>` (#824).** The operator's explicit, auditable
+  answer to `pr-detect-ambiguous` — and the scripted form of the `batch-integrate`
+  dossier's manual-recovery step that hand-records a batch PR (Step 6b of that registry
+  dossier; `<pr>` also accepts `#4270`). Positive evidence only: the project repository is verified first
+  (`resolveProjectRepo`; unverifiable → refused before any PR is read), the PR is read
+  with `gh pr view <pr> -R <owner/name>` (`GroundTruth.batchPrCandidate`, repo-gated like
+  `mergedPrForBranch`), and it must pass the SAME candidate checks #789's automatic path
+  applies (`checkBatchPrCandidate`: not a fork, head = `batch.branch`, base =
+  `batch.base_branch`, a real merge timestamp, created at or after the batch) plus an
+  explicit `state == MERGED` and a positively-read `isCrossRepository == false`. Any
+  mismatch, a failed or unusable gh read, a batch that is not `blocked` (or has no
+  branch), or a batch whose `batch.pr` is already a DIFFERENT PR refuses with a message
+  naming why — nothing written, nothing journaled; the same PR already recorded is a
+  no-op. There is no `--force`: every check reads a field `gh pr view` always returns.
+  On success `batch.pr` is recorded and the `pr_detect_ambiguous_*` streak cleared in
+  one locked write (`updated_at` is touched, which re-arms the 7-day reconcile window),
+  journaled as its own `pr-attached` event — never `stale-failure-reconciled` /
+  `pr_detected`, so `events.jsonl` always tells operator from automatic apart. Nothing
+  else happens in the command: the next tick's stale-blocked reconcile settles the batch
+  on its ordinary `pr-merged` evidence (report + teardown follow; that read, `prState`,
+  is `-R`-pinned too whenever the engine's repo is verified), and the anchor closes only
+  through `reconcileAnchorClosure`, which never reads `batch.pr`. A batch with a surviving
+  member that was never dispatched is refused too — the reconcile would never settle it
+  on PR evidence. `--json` emits `{batch, repo, outcome: "attached", pr, mergedAt,
+  clearedAmbiguousTicks}` or `{batch, repo, outcome: "already-attached", pr}`.
 
 Everything else is surfaced, never closed: `sched status --anchors` (opt-in; `status`
 makes no GitHub call without it) lists each still-open anchor of a batch no longer in

package/dist/attach-pr.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `sched attach-pr --batch <id> <pr>` (#824): the operator's explicit, auditable
+ * way to record `batch.pr` when #789's automatic detection refused to guess
+ * (`pr-detect-ambiguous` — two or more merged PRs share the batch branch), and
+ * the scripted form of the `batch-integrate` dossier's manual-recovery step
+ * that hand-records a batch PR (the registry dossier's Step 6b).
+ *
+ * Trust boundary: the operator's word is not evidence. The named PR must pass
+ * the SAME candidate checks #789's automatic path applies
+ * (`checkBatchPrCandidate`) plus an explicit `state === 'MERGED'` and a
+ * positively-read same-repo flag, read through a ground truth pinned with `-R`
+ * to the verified project repository — absent that pin, nothing is read and
+ * nothing is recorded. There is no `--force`: every check reads a field
+ * `gh pr view` always returns, so an unreadable one refuses rather than
+ * inviting an override.
+ *
+ * Recording is ALL this does: `batch.pr` is set (and any
+ * `pr_detect_ambiguous_*` streak cleared) under the store lock, with no status
+ * transition and no GitHub write. The next engine tick's
+ * `reconcileStaleBlockedBatches` then settles the batch on its ordinary
+ * `pr-merged` evidence, and the anchor closes (or not) only through #768's own
+ * evidence-gated `reconcileAnchorClosure` — which never reads `batch.pr`.
+ */
+import type { GroundTruth } from './groundtruth';
+import type { Journal } from './journal';
+import type { SchedStore } from './persist';
+export interface AttachPrDeps {
+    store: SchedStore;
+    journal: Journal;
+    /** Must come from `createExecGroundTruth` with a verified `repo` — else `batchPrCandidate` is absent and the attach refuses. */
+    groundTruth: GroundTruth;
+    /** The verified `owner/name` the ground truth is pinned to — named in refusals and the journal line. */
+    repo?: string;
+}
+export type AttachPrResult = {
+    outcome: 'attached';
+    pr: number;
+    mergedAt: string;
+    /** Ticks of the `pr-detect-ambiguous` streak this attach cleared (0 when none was open). */
+    clearedAmbiguousTicks: number;
+} | {
+    outcome: 'already-attached';
+    pr: number;
+};
+/**
+ * Record an operator-named PR as `batch.pr` after verifying it (see the module
+ * comment). Throws `SchedNotFoundError` — nothing written, nothing journaled —
+ * on every refusal; returns `already-attached` (also nothing written) when the
+ * same PR is already recorded.
+ */
+export declare function attachBatchPr(deps: AttachPrDeps, batchId: string, pr: number, now?: Date): AttachPrResult;
+//# sourceMappingURL=attach-pr.d.ts.map

package/dist/attach-pr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach-pr.d.ts","sourceRoot":"","sources":["../src/attach-pr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAI5C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,gIAAgI;IAChI,WAAW,EAAE,WAAW,CAAC;IACzB,wGAAwG;IACxG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,cAAc,GACtB;IACE,OAAO,EAAE,UAAU,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,qBAAqB,EAAE,MAAM,CAAC;CAC/B,GACD;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AA6HhD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,GAAG,GAAE,IAAiB,GACrB,cAAc,CAqEhB"}

package/dist/attach-pr.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * `sched attach-pr --batch <id> <pr>` (#824): the operator's explicit, auditable
+ * way to record `batch.pr` when #789's automatic detection refused to guess
+ * (`pr-detect-ambiguous` — two or more merged PRs share the batch branch), and
+ * the scripted form of the `batch-integrate` dossier's manual-recovery step
+ * that hand-records a batch PR (the registry dossier's Step 6b).
+ *
+ * Trust boundary: the operator's word is not evidence. The named PR must pass
+ * the SAME candidate checks #789's automatic path applies
+ * (`checkBatchPrCandidate`) plus an explicit `state === 'MERGED'` and a
+ * positively-read same-repo flag, read through a ground truth pinned with `-R`
+ * to the verified project repository — absent that pin, nothing is read and
+ * nothing is recorded. There is no `--force`: every check reads a field
+ * `gh pr view` always returns, so an unreadable one refuses rather than
+ * inviting an override.
+ *
+ * Recording is ALL this does: `batch.pr` is set (and any
+ * `pr_detect_ambiguous_*` streak cleared) under the store lock, with no status
+ * transition and no GitHub write. The next engine tick's
+ * `reconcileStaleBlockedBatches` then settles the batch on its ordinary
+ * `pr-merged` evidence, and the anchor closes (or not) only through #768's own
+ * evidence-gated `reconcileAnchorClosure` — which never reads `batch.pr`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attachBatchPr = attachBatchPr;
+const batch_dispatch_1 = require("./batch-dispatch");
+const groundtruth_1 = require("./groundtruth");
+const journal_1 = require("./journal");
+const state_1 = require("./state");
+const types_1 = require("./types");
+/**
+ * Why each shared candidate check refuses, in operator words. `number` and
+ * `fork` are pre-empted by `verifyCandidate`'s own stricter checks and exist
+ * for the record's exhaustiveness (`fork` is also used directly there).
+ */
+const CHECK_REFUSALS = {
+    fork: () => 'it is from a fork (isCrossRepository=true), not the project repository',
+    head: (pr, batch) => `its head is ${JSON.stringify(pr.headRefName)}, not the batch branch ${JSON.stringify(batch.branch)}`,
+    base: (pr, batch) => `its base is ${JSON.stringify(pr.baseRefName)}, not the batch base ${JSON.stringify(batch.base_branch)}`,
+    unmerged: () => 'it has no merge timestamp — not merged',
+    'created-before-batch': (pr, batch) => `it was created ${JSON.stringify(pr.createdAt)}, before the batch itself (${batch.created_at}) — a PR from an earlier use of the branch`,
+    number: () => 'gh returned no usable PR number',
+};
+/** The one refusal shape every PR-level refusal uses. */
+function refusal(batchId, pr, why) {
+    return new types_1.SchedNotFoundError(`Refusing to attach PR #${pr} to batch ${batchId}: ${why}`);
+}
+/**
+ * The ledger-only preconditions, re-run under the lock on fresh state.
+ * Throws `SchedNotFoundError` naming why on every refusal.
+ */
+function precheck(state, batchId, pr) {
+    const batch = (0, state_1.findBatch)(state, batchId);
+    if (!batch)
+        throw new types_1.SchedNotFoundError(`Batch not found: ${batchId}`);
+    if (batch.pr === pr)
+        return { noop: true };
+    if (batch.pr !== null) {
+        throw new types_1.SchedNotFoundError(`Batch ${batchId} already has PR #${batch.pr} recorded — refusing to replace it with #${pr}`);
+    }
+    if (batch.status !== 'blocked') {
+        throw new types_1.SchedNotFoundError(`Batch ${batchId} is ${batch.status} — attach-pr only applies to a blocked batch (the state whose merge evidence reconcileStaleBlockedBatches settles from a recorded PR)`);
+    }
+    const { branch } = batch;
+    if (branch === null) {
+        throw new types_1.SchedNotFoundError(`Batch ${batchId} has no branch recorded — nothing to check PR #${pr}'s head against`);
+    }
+    // The reconcile never settles a batch with a surviving member that was never
+    // dispatched (it would call an issue `done` that shipped nothing), so a PR
+    // recorded here would sit unused forever — refuse instead of reporting a
+    // reconcile that will not happen.
+    const undispatched = (0, batch_dispatch_1.undispatchedSurvivingMembers)(state, batch);
+    if (undispatched.length > 0) {
+        throw new types_1.SchedNotFoundError(`Batch ${batchId} has member(s) ${undispatched.map((m) => `#${m}`).join(', ')} that were never dispatched — the stale-blocked reconcile will not settle it on PR evidence (it would mark unshipped work done); \`sched abandon --batch ${batchId}\` requeues them instead`);
+    }
+    return { noop: false, batch: { ...batch, branch } };
+}
+/** Refuse unless `candidate` is provably the batch's own merged PR `pr`; returns its merge time. */
+function verifyCandidate(candidate, batch, pr) {
+    if (candidate.number !== pr) {
+        throw refusal(batch.id, pr, `gh answered for PR ${JSON.stringify(candidate.number)}, not #${pr}`);
+    }
+    if (candidate.state !== 'MERGED') {
+        throw refusal(batch.id, pr, `it is ${JSON.stringify(candidate.state)}, not MERGED`);
+    }
+    // Positive evidence only: `checkBatchPrCandidate` treats a MISSING flag as
+    // "not a fork" (its #789 list convention); an operator-named PR must be
+    // read as same-repo explicitly.
+    if (candidate.isCrossRepository !== false) {
+        throw refusal(batch.id, pr, candidate.isCrossRepository === true
+            ? CHECK_REFUSALS.fork(candidate, batch)
+            : 'gh did not report whether it is from the project repository or a fork (isCrossRepository unreadable)');
+    }
+    const verdict = (0, groundtruth_1.checkBatchPrCandidate)(candidate, batch.branch, batch.base_branch, Date.parse(batch.created_at));
+    if (!verdict.ok)
+        throw refusal(batch.id, pr, CHECK_REFUSALS[verdict.check](candidate, batch));
+    return verdict.mergedAt;
+}
+/** The `pr-attached` journal line's `detail`. */
+function attachedDetail(prRef, mergedAt, batch, clearedAmbiguousTicks) {
+    return (`operator attached ${prRef} (MERGED ${mergedAt}, head=${batch.branch}, base=${batch.base_branch}, same repository) — recorded batch.pr` +
+        (clearedAmbiguousTicks > 0
+            ? `; cleared the pr-detect-ambiguous streak (${clearedAmbiguousTicks} tick(s))`
+            : '') +
+        '; the next engine tick reconciles the batch on pr-merged evidence — the anchor is left to #768');
+}
+/**
+ * Record an operator-named PR as `batch.pr` after verifying it (see the module
+ * comment). Throws `SchedNotFoundError` — nothing written, nothing journaled —
+ * on every refusal; returns `already-attached` (also nothing written) when the
+ * same PR is already recorded.
+ */
+function attachBatchPr(deps, batchId, pr, now = new Date()) {
+    if (!Number.isInteger(pr) || pr <= 0) {
+        throw new types_1.SchedNotFoundError(`PR must be a positive integer, got ${pr}`);
+    }
+    const first = precheck(deps.store.load(), batchId, pr);
+    if (first.noop)
+        return { outcome: 'already-attached', pr };
+    const repo = deps.repo ?? 'the project repository';
+    const read = deps.groundTruth.batchPrCandidate;
+    if (read === undefined) {
+        throw refusal(batchId, pr, "the project's GitHub repository is not verified, so the PR cannot be read with a pinned -R — run from the project's own checkout (or check --project)");
+    }
+    const candidate = read(pr);
+    if (candidate === undefined) {
+        throw refusal(batchId, pr, `could not read it from ${repo} (\`gh pr view ${pr} -R ${repo}\` failed or returned an unusable payload — see the stderr line above) — nothing recorded`);
+    }
+    verifyCandidate(candidate, first.batch, pr);
+    // The GitHub read ran outside the lock: re-run the ledger checks AND the
+    // candidate checks against the fresh batch, so a batch that left `blocked`,
+    // had a PR recorded, or changed its branch/base meanwhile is refused rather
+    // than written over.
+    const applied = deps.store.withLock((s) => {
+        const fresh = precheck(s, batchId, pr);
+        if (fresh.noop)
+            return { state: s, result: null };
+        const mergedAt = verifyCandidate(candidate, fresh.batch, pr);
+        // `updated_at` IS touched (unlike the dedup writes): an operator attach is
+        // real activity, and it re-arms the stale-blocked reconcile window
+        // (measured from `updated_at`), so the PR is acted on even when the batch
+        // had been blocked longer than that window.
+        return {
+            state: (0, state_1.patchBatch)(s, batchId, { pr, ...state_1.CLEARED_PR_DETECT_AMBIGUOUS_FIELDS }, now),
+            result: {
+                batch: fresh.batch,
+                mergedAt,
+                clearedAmbiguousTicks: fresh.batch.pr_detect_ambiguous_ticks,
+            },
+        };
+    });
+    if (applied === null)
+        return { outcome: 'already-attached', pr };
+    deps.journal.append((0, journal_1.unitEvent)('pr-attached', `batch:${batchId}`, {
+        pr,
+        mergedAt: applied.mergedAt,
+        branch: applied.batch.branch,
+        detail: attachedDetail(deps.repo !== undefined ? `${deps.repo}#${pr}` : `PR #${pr}`, applied.mergedAt, applied.batch, applied.clearedAmbiguousTicks),
+    }), now);
+    return {
+        outcome: 'attached',
+        pr,
+        mergedAt: applied.mergedAt,
+        clearedAmbiguousTicks: applied.clearedAmbiguousTicks,
+    };
+}
+//# sourceMappingURL=attach-pr.js.map

package/dist/attach-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach-pr.js","sourceRoot":"","sources":["../src/attach-pr.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AA+JH,sCA0EC;AAvOD,qDAAgE;AAEhE,+CAAsD;AAEtD,uCAAsC;AAEtC,mCAAoF;AACpF,mCAA+E;AAwB/E;;;;GAIG;AACH,MAAM,cAAc,GAGhB;IACF,IAAI,EAAE,GAAG,EAAE,CAAC,wEAAwE;IACpF,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAClB,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;IACvG,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAClB,eAAe,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;IAC1G,QAAQ,EAAE,GAAG,EAAE,CAAC,wCAAwC;IACxD,sBAAsB,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CACpC,kBAAkB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,8BAA8B,KAAK,CAAC,UAAU,4CAA4C;IAC1I,MAAM,EAAE,GAAG,EAAE,CAAC,iCAAiC;CAChD,CAAC;AAEF,yDAAyD;AACzD,SAAS,OAAO,CAAC,OAAe,EAAE,EAAU,EAAE,GAAW;IACvD,OAAO,IAAI,0BAAkB,CAAC,0BAA0B,EAAE,aAAa,OAAO,KAAK,GAAG,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CACf,KAAiB,EACjB,OAAe,EACf,EAAU;IAEV,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,0BAAkB,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,0BAAkB,CAC1B,SAAS,OAAO,oBAAoB,KAAK,CAAC,EAAE,4CAA4C,EAAE,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,0BAAkB,CAC1B,SAAS,OAAO,OAAO,KAAK,CAAC,MAAM,uIAAuI,CAC3K,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,0BAAkB,CAC1B,SAAS,OAAO,kDAAkD,EAAE,iBAAiB,CACtF,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,kCAAkC;IAClC,MAAM,YAAY,GAAG,IAAA,6CAA4B,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,0BAAkB,CAC1B,SAAS,OAAO,kBAAkB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4JAA4J,OAAO,0BAA0B,CAC3Q,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,oGAAoG;AACpG,SAAS,eAAe,CACtB,SAAkC,EAClC,KAAsB,EACtB,EAAU;IAEV,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,OAAO,CACX,KAAK,CAAC,EAAE,EACR,EAAE,EACF,sBAAsB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtF,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,gCAAgC;IAChC,IAAI,SAAS,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,OAAO,CACX,KAAK,CAAC,EAAE,EACR,EAAE,EACF,SAAS,CAAC,iBAAiB,KAAK,IAAI;YAClC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;YACvC,CAAC,CAAC,sGAAsG,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,mCAAqB,EACnC,SAAS,EACT,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,WAAW,EACjB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAC7B,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9F,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,iDAAiD;AACjD,SAAS,cAAc,CACrB,KAAa,EACb,QAAgB,EAChB,KAAsB,EACtB,qBAA6B;IAE7B,OAAO,CACL,qBAAqB,KAAK,YAAY,QAAQ,UAAU,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,WAAW,wCAAwC;QACvI,CAAC,qBAAqB,GAAG,CAAC;YACxB,CAAC,CAAC,6CAA6C,qBAAqB,WAAW;YAC/E,CAAC,CAAC,EAAE,CAAC;QACP,gGAAgG,CACjG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAC3B,IAAkB,EAClB,OAAe,EACf,EAAU,EACV,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,0BAAkB,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;IAE3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,wBAAwB,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,OAAO,CACX,OAAO,EACP,EAAE,EACF,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,CACX,OAAO,EACP,EAAE,EACF,0BAA0B,IAAI,kBAAkB,EAAE,OAAO,IAAI,2FAA2F,CACzJ,CAAC;IACJ,CAAC;IACD,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE5C,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,qBAAqB;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7D,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1E,4CAA4C;QAC5C,OAAO;YACL,KAAK,EAAE,IAAA,kBAAU,EAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,0CAAkC,EAAE,EAAE,GAAG,CAAC;YACjF,MAAM,EAAE;gBACN,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ;gBACR,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,yBAAyB;aAC7D;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;IAEjE,IAAI,CAAC,OAAO,CAAC,MAAM,CACjB,IAAA,mBAAS,EAAC,aAAa,EAAE,SAAS,OAAO,EAAE,EAAE;QAC3C,EAAE;QACF,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC5B,MAAM,EAAE,cAAc,CACpB,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAC5D,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,qBAAqB,CAC9B;KACF,CAAC,EACF,GAAG,CACJ,CAAC;IACF,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,EAAE;QACF,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CAAC;AACJ,CAAC"}

package/dist/batch-dispatch.d.ts

@@ -250,6 +250,14 @@ export declare function resumeBlockedGate(deps: BatchDispatchDeps, config: Sched
  * ~375k tokens, stopped only by hand).
  */
 export declare const MAX_BATCH_AGENT_RESPAWNS = 2;
+/**
+ * The surviving members `everySurvivingMemberDispatched` finds NOT yet
+ * dispatched — the members that keep a blocked batch out of
+ * `reconcileStaleBlockedBatches` (#686). Exported for `sched attach-pr`
+ * (#824), which refuses to record a PR the reconcile would then never act on,
+ * and names these members in the refusal.
+ */
+export declare function undispatchedSurvivingMembers(state: SchedState, batch: BatchEntry): number[];
 /**
  * #686: reconcile a `blocked` batch whose work demonstrably shipped anyway.
  * `reconcilePrWatch` above only watches `awaiting-merge` batches, and
@@ -292,6 +300,56 @@ export declare const MAX_BATCH_AGENT_RESPAWNS = 2;
  * #632 lesson: no journal inside a loop that doesn't terminate the unit).
  */
 export declare function reconcileStaleBlockedBatches(deps: BatchDispatchDeps, now: Date, result: BatchTickResult, anchorCtx: AnchorTickContext | undefined): void;
+/**
+ * #791: once a `done` batch's kept worktree (left in place by the
+ * `members-closed` branch above) is DEFINITIVELY gone — the path no longer
+ * exists on disk, or the pool itself now reports it back as a warm spare —
+ * clear the ledger's `worktree`/`pool_claimed` (and, separately,
+ * `member_worktree`/`member_pool_claimed`, and — #834 — each live
+ * `member_runs[]` entry's `torn_down`) fields so `sched status`'s
+ * `kept-worktree` warning does not persist after the operator's cleanup
+ * already happened. Ledger-only, by construction: this function reads
+ * `fsExists` and `worktree-pool status --json` (both read-only) and never
+ * builds a `git worktree remove` / `worktree-pool return` argv — the actual
+ * removal stays entirely the operator's call, exactly like the warning
+ * itself. Bounded the same way the warning's own candidate scan is: only
+ * `done` batches carrying a kept worktree are considered, which in practice
+ * is a small set.
+ *
+ * #834: `MemberRun.worktree` is a required `string` (unlike
+ * `BatchEntry.worktree: string | null`) — there is no null to clear it to,
+ * so "cleared" for a member run means `torn_down: true`, the same flag
+ * `markTornDown` sets after a real teardown. Set here it means the same
+ * thing evidentially (nothing is holding this path any more), just reached
+ * by definitive evidence instead of by running `teardownParallelRuns`.
+ *
+ * #834 discovery: unlike `worktree`/`member_worktree`, a terminal batch's
+ * live `member_runs[]` entries are ALSO reached by the unconditional
+ * terminal-batch arm in `runBatchTick` (search `TERMINAL_BATCH_STATUSES.has(batch.status)`
+ * above the call site below) — added by #809 for `sched stop`/`abandon`,
+ * but written generically enough that it fires for EVERY terminal batch,
+ * `members-closed`-reconciled ones included, and it runs earlier in the
+ * same tick than this function. It calls `teardownParallelRuns` (an actual
+ * teardown attempt, unlike this read-only reconcile) and — notably — calls
+ * `markTornDown` unconditionally, even when that teardown attempt itself
+ * FAILS (e.g. `isSafeWorktree` rejects the path). So in the normal
+ * scheduler-ticking case this function's own `member_runs[]` branch below
+ * is effectively a backstop, not the primary path: by the time it runs,
+ * `torn_down` is usually already `true` — correctly when the tree really
+ * is gone, but also when a real teardown attempt failed and left the tree
+ * on disk — filed as #855 (out of scope here; #834 only extends the
+ * evidence-based ledger reconcile, it does not change teardown behavior).
+ * This function's own branch still matters for the window before that
+ * safety net's next tick runs, and for `sched status` reads taken while
+ * the scheduler isn't ticking at all.
+ *
+ * Exported (not part of the package's public `index.ts` surface — same
+ * test-only convention as `reconcileStaleBlockedBatches`) so `member_runs[]`
+ * tests can call it directly, isolated from the terminal-batch safety net
+ * described above, which otherwise always beats it to `member_runs[]` when
+ * both run inside one `runBatchTick` call.
+ */
+export declare function reconcileKeptWorktrees(deps: BatchDispatchDeps, now: Date): void;
 /**
  * #768: what one tick's anchor work reads GitHub and git through — built once
  * per tick so the stale-blocked reconcile and the anchor close never read the

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAcjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAwBL,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAK9B,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAylBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAs8CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AA2TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAuxBD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAsnB1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CA+LN;AA4ED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AA+QD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAu0BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgSjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAcjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAwBL,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAK9B,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAylBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAs8CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AA2TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAuxBD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAkf1C;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3F;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CA+LN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAkG/E;AAED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AA+QD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAu0BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgSjB"}

package/dist/batch-dispatch.js

@@ -100,7 +100,9 @@ exports.MAX_BATCH_AGENT_RESPAWNS = exports.tailMembersRefusal = void 0;
 exports.memberBranchFor = memberBranchFor;
 exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
+exports.undispatchedSurvivingMembers = undispatchedSurvivingMembers;
 exports.reconcileStaleBlockedBatches = reconcileStaleBlockedBatches;
+exports.reconcileKeptWorktrees = reconcileKeptWorktrees;
 exports.memberDispatchModeFor = memberDispatchModeFor;
 exports.runBatchTick = runBatchTick;
 const fs = __importStar(require("node:fs"));
@@ -3141,7 +3143,18 @@ const MEMBER_RECONCILE_CHAIN = {
  * and the branch is exactly what the merge evidence below covers.
  */
 function everySurvivingMemberDispatched(state, batch) {
+    return undispatchedSurvivingMembers(state, batch).length === 0;
+}
+/**
+ * The surviving members `everySurvivingMemberDispatched` finds NOT yet
+ * dispatched — the members that keep a blocked batch out of
+ * `reconcileStaleBlockedBatches` (#686). Exported for `sched attach-pr`
+ * (#824), which refuses to record a PR the reconcile would then never act on,
+ * and names these members in the refusal.
+ */
+function undispatchedSurvivingMembers(state, batch) {
     const evicted = new Set(batch.evictions.map((e) => e.issue));
+    const undispatched = [];
     for (const issue of batch.members) {
         const entry = (0, state_1.findEntry)(state, issue);
         if (!entry)
@@ -3159,9 +3172,9 @@ function everySurvivingMemberDispatched(state, batch) {
         // completion — everything the entry can reach afterwards means the
         // member was dispatched and its work is on the branch.
         if (!DISPATCHED_MEMBER_STATUSES.has(entry.status))
-            return false;
+            undispatched.push(issue);
     }
-    return true;
+    return undispatched;
 }
 /** Slot-line statuses that prove a member was actually dispatched (see above). */
 const DISPATCHED_MEMBER_STATUSES = new Set([
@@ -3228,6 +3241,26 @@ function clearPrDetectAmbiguous(deps, batch, now) {
  */
 function recordPrDetectAmbiguous(deps, batch, matches, now) {
     const { since, ticks, announce } = advanceBatchDedupStreak(batch.pr_detect_ambiguous_reason, batch.pr_detect_ambiguous_since, batch.pr_detect_ambiguous_ticks, state_1.PR_DETECT_AMBIGUOUS_REASON, now);
+    // #824 review: the lookup above ran outside the lock — an operator's
+    // `sched attach-pr` (or a resume/abandon) may have landed meanwhile. Write
+    // the streak (and journal it) only while the batch is STILL blocked with no
+    // PR; never rewrite the marker an attach just cleared, nor tell the
+    // operator to run `sched attach-pr` after they already did.
+    const written = deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batch.id);
+        if (!b || b.status !== 'blocked' || b.pr !== null)
+            return { state: s, result: false };
+        return {
+            state: (0, state_1.patchBatch)(s, batch.id, {
+                pr_detect_ambiguous_reason: state_1.PR_DETECT_AMBIGUOUS_REASON,
+                pr_detect_ambiguous_since: since,
+                pr_detect_ambiguous_ticks: ticks,
+            }, now, false),
+            result: true,
+        };
+    });
+    if (!written)
+        return;
     if (announce) {
         journalEvent(deps, 'pr-detect-ambiguous', unit(batch.id), {
             reason: state_1.PR_DETECT_AMBIGUOUS_REASON,
@@ -3236,21 +3269,14 @@ function recordPrDetectAmbiguous(deps, batch, matches, now) {
             at: now.toISOString(),
             since,
             ticks_persisted: ticks,
-            // #789 review: neither "record it explicitly" (no command exists) nor
-            // "close the extras" (a MERGED PR cannot be closed, so it never leaves
-            // `gh pr list --state merged`) was ever an actionable remedy — state
-            // what actually resolves it instead. #824 tracks the missing verb.
-            detail: `${matches.length} MERGED PRs match head=${batch.branch ?? '?'} (#${matches.join(', #')}) — refusing to guess which is ours; nothing recorded. The batch still reconciles via commits-in-base/members-closed evidence if either holds; otherwise inspect and \`sched abandon --batch ${batch.id}\`, or use \`sched attach-pr\` once #824 ships it`,
+            // #789 review: "close the extras" (a MERGED PR cannot be closed, so it
+            // never leaves `gh pr list --state merged`) was never an actionable
+            // remedy — state what actually resolves it instead: the operator names
+            // the batch's own PR with `sched attach-pr` (#824), which holds it to
+            // these same candidate checks.
+            detail: `${matches.length} MERGED PRs match head=${batch.branch ?? '?'} (#${matches.join(', #')}) — refusing to guess which is ours; nothing recorded. The batch still reconciles via commits-in-base/members-closed evidence if either holds; otherwise inspect the candidates and record the batch's own with \`sched attach-pr --batch ${batch.id} <pr>\`, or \`sched abandon --batch ${batch.id}\``,
         });
     }
-    deps.store.withLock((s) => ({
-        state: (0, state_1.patchBatch)(s, batch.id, {
-            pr_detect_ambiguous_reason: state_1.PR_DETECT_AMBIGUOUS_REASON,
-            pr_detect_ambiguous_since: since,
-            pr_detect_ambiguous_ticks: ticks,
-        }, now, false),
-        result: undefined,
-    }));
 }
 /**
  * #686: reconcile a `blocked` batch whose work demonstrably shipped anyway.
@@ -3382,7 +3408,7 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
         // #789 review: what the lock ACTUALLY applied, not what the outer
         // snapshot predicted — re-derived from `b` (read under the lock) below,
         // since `batch.pr` could in principle have changed between the snapshot
-        // above and the lock acquiring (e.g. a future `sched attach-pr`, #824).
+        // above and the lock acquiring (e.g. `sched attach-pr`, #824).
         let effectivePr = null;
         let prWasRecorded = false;
         deps.store.withLock((s) => {
@@ -3480,7 +3506,8 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
  * `members-closed` branch above) is DEFINITIVELY gone — the path no longer
  * exists on disk, or the pool itself now reports it back as a warm spare —
  * clear the ledger's `worktree`/`pool_claimed` (and, separately,
- * `member_worktree`/`member_pool_claimed`) fields so `sched status`'s
+ * `member_worktree`/`member_pool_claimed`, and — #834 — each live
+ * `member_runs[]` entry's `torn_down`) fields so `sched status`'s
  * `kept-worktree` warning does not persist after the operator's cleanup
  * already happened. Ledger-only, by construction: this function reads
  * `fsExists` and `worktree-pool status --json` (both read-only) and never
@@ -3489,15 +3516,50 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
  * itself. Bounded the same way the warning's own candidate scan is: only
  * `done` batches carrying a kept worktree are considered, which in practice
  * is a small set.
+ *
+ * #834: `MemberRun.worktree` is a required `string` (unlike
+ * `BatchEntry.worktree: string | null`) — there is no null to clear it to,
+ * so "cleared" for a member run means `torn_down: true`, the same flag
+ * `markTornDown` sets after a real teardown. Set here it means the same
+ * thing evidentially (nothing is holding this path any more), just reached
+ * by definitive evidence instead of by running `teardownParallelRuns`.
+ *
+ * #834 discovery: unlike `worktree`/`member_worktree`, a terminal batch's
+ * live `member_runs[]` entries are ALSO reached by the unconditional
+ * terminal-batch arm in `runBatchTick` (search `TERMINAL_BATCH_STATUSES.has(batch.status)`
+ * above the call site below) — added by #809 for `sched stop`/`abandon`,
+ * but written generically enough that it fires for EVERY terminal batch,
+ * `members-closed`-reconciled ones included, and it runs earlier in the
+ * same tick than this function. It calls `teardownParallelRuns` (an actual
+ * teardown attempt, unlike this read-only reconcile) and — notably — calls
+ * `markTornDown` unconditionally, even when that teardown attempt itself
+ * FAILS (e.g. `isSafeWorktree` rejects the path). So in the normal
+ * scheduler-ticking case this function's own `member_runs[]` branch below
+ * is effectively a backstop, not the primary path: by the time it runs,
+ * `torn_down` is usually already `true` — correctly when the tree really
+ * is gone, but also when a real teardown attempt failed and left the tree
+ * on disk — filed as #855 (out of scope here; #834 only extends the
+ * evidence-based ledger reconcile, it does not change teardown behavior).
+ * This function's own branch still matters for the window before that
+ * safety net's next tick runs, and for `sched status` reads taken while
+ * the scheduler isn't ticking at all.
+ *
+ * Exported (not part of the package's public `index.ts` surface — same
+ * test-only convention as `reconcileStaleBlockedBatches`) so `member_runs[]`
+ * tests can call it directly, isolated from the terminal-batch safety net
+ * described above, which otherwise always beats it to `member_runs[]` when
+ * both run inside one `runBatchTick` call.
  */
 function reconcileKeptWorktrees(deps, now) {
     const state = deps.store.load();
     const fsExists = deps.fsExists ?? ((p) => fs.existsSync(p));
-    const candidates = state.batches.filter((b) => b.status === 'done' && (b.worktree !== null || b.member_worktree !== null));
+    const candidates = state.batches.filter((b) => b.status === 'done' &&
+        (b.worktree !== null || b.member_worktree !== null || b.member_runs.some((r) => !r.torn_down)));
     if (candidates.length === 0)
         return;
     const needsPoolCheck = candidates.some((b) => (b.worktree !== null && b.pool_claimed) ||
-        (b.member_worktree !== null && b.member_pool_claimed));
+        (b.member_worktree !== null && b.member_pool_claimed) ||
+        b.member_runs.some((r) => !r.torn_down && r.pool_claimed));
     // One pool query per TICK, not per candidate — `worktree-pool status` is a
     // real subprocess (`npx ...`), and this reconcile is meant to be cheap.
     const poolStatusJson = needsPoolCheck
@@ -3525,16 +3587,54 @@ function reconcileKeptWorktrees(deps, now) {
             clears.member_pool_claimed = false;
             clearedFields.push('member_worktree', 'member_pool_claimed');
         }
-        if (clearedFields.length === 0)
+        // #834: unlike `worktree`/`member_worktree`, `member_runs[]` is actively
+        // mutated by many OTHER code paths while a tick runs (member dispatch,
+        // eviction, `markTornDown`, `sched attach-pr`, ...), so its evidence
+        // check must NOT be computed from this function's own outer, unlocked
+        // `batch` snapshot: `patchBatch` merges `member_runs` as a whole-array
+        // replacement, not per-entry, so writing an array built from a stale
+        // snapshot would silently discard a concurrent writer's change to a
+        // SIBLING entry in the gap between this snapshot and the lock below
+        // (a lost update — found in review). Only a coarse "is there anything
+        // to look at" pre-check runs out here, to decide whether entering the
+        // lock is worth it at all; the real per-run evidence check re-reads
+        // `member_runs` fresh, from the batch `withLock` reloads below.
+        const mightClearRuns = batch.member_runs.some((r) => !r.torn_down);
+        if (clearedFields.length === 0 && !mightClearRuns)
             continue;
+        const clearedRunIssues = [];
         deps.store.withLock((s) => {
             const b = (0, state_1.findBatch)(s, batch.id);
             // Re-check under the lock: another tick, or an operator command, may
             // have already moved this batch or cleared the fields itself.
             if (!b || b.status !== 'done')
                 return { state: s, result: undefined };
-            return { state: (0, state_1.patchBatch)(s, batch.id, clears, now, false), result: undefined };
+            const runClears = {};
+            if (mightClearRuns) {
+                const updatedRuns = b.member_runs.map((run) => {
+                    if (run.torn_down)
+                        return run;
+                    if (!goneOrReturned(run.worktree, run.pool_claimed))
+                        return run;
+                    clearedRunIssues.push(run.issue);
+                    return { ...run, torn_down: true };
+                });
+                if (clearedRunIssues.length > 0)
+                    runClears.member_runs = updatedRuns;
+            }
+            if (Object.keys(clears).length === 0 && Object.keys(runClears).length === 0) {
+                return { state: s, result: undefined };
+            }
+            return {
+                state: (0, state_1.patchBatch)(s, batch.id, { ...clears, ...runClears }, now, false),
+                result: undefined,
+            };
         });
+        if (clearedRunIssues.length > 0) {
+            clearedFields.push(`member_runs[${clearedRunIssues.join(',')}].torn_down`);
+        }
+        if (clearedFields.length === 0)
+            continue;
         journalEvent(deps, 'kept-worktree-cleared', unit(batch.id), {
             cleared: clearedFields.join(','),
             detail: `kept-worktree ledger field(s) cleared on definitive evidence (${clearedFields.join(', ')}) — path gone or pool reports it returned; no removal command was run`,