@ai-dossier/sched 0.54.0 → 0.55.0

package/README.md

@@ -807,6 +807,11 @@ failure rails: executing → dissolving (a member self-reports blocked)
   an eviction group, or a member `deps` on another member; a batch already past `ready`
   with no recorded mode (claimed by a pre-1.23.0 engine) stays serial across the upgrade.
   Dissolve, `sched stop --batch` and `abandon` stop/release every member slot.
+  A run's `torn_down` is set only after its tree teardown verifiably landed (path gone
+  and unlisted, or the pool reports it returned); a failed one records
+  `teardown_failed_at`, journals `teardown-failed` once and is never retried — the tree
+  stays for the operator and `sched status` names it (`kept-worktree`) (#855). A kept batch's (`worktree_kept`) runs are never torn
+  down by the scheduler.
 - **Serial mode: members run `member-cycle` one fresh agent at a time — each in its OWN
   worktree** on its OWN branch `batch/<id>-m<n>-<issue>` (#677, RFC-0001 §J.3), cut off
   the integration branch, warmed, and pushed before the agent spawns; the agent never
@@ -1426,7 +1431,7 @@ after-the-fact recovery, not a missing-data bug.
   queue data.
 - **Schema**: state/config files from #460 (schema 1.0.0), #464 (1.1.0), #468 (1.2.0),
   #472 (1.3.0), #500 (1.4.0), #505 (1.5.0), #504 (1.6.0), #523 (1.7.0) and #524 (1.8.0)
-  load and migrate to the current schema (1.27.0 — 1.24.0 was #810: no backfill,
+  load and migrate to the current schema (1.28.0 — 1.24.0 was #810: no backfill,
   `kind`/`branch` optional, absent = an `evicted` record with no branch) automatically
   (slot `branch`/`last_head`/`pid_start`, slot `role` (inferred from the
   unit's queue entry, with the persisted `phase` as a fallback — #500), entry
@@ -1449,6 +1454,10 @@ after-the-fact recovery, not a missing-data bug.
   respawn counter); `null` is backfilled on load.
   Schema 1.27.0 (#822): `BatchEntry` gains `reprompted_members`
   (`{ issue, milestone_at, reprompted_at }` records; `[]` backfilled).
+  Schema 1.28.0 (#855): `BatchEntry` gains `worktree_kept` (the members-closed keep
+  decision, persisted; `false` backfilled) and `MemberRun` gains `teardown_failed_at`
+  (`null` backfilled). A 1.27.0 `done` batch still carrying a live member run loads as
+  kept — the old engine never recorded the decision, so the default is to keep.
 - **`max_slots`** bounds live units (`assigned | running | recovering`); dependency
   edges gate readiness — an issue with an unmerged dependency, and a batch behind an
   unmerged batch, are never runnable.
@@ -1486,7 +1495,11 @@ to skip the check entirely):
 - **`kept-worktree`** (#791) — a `done` batch whose `worktree` or `member_worktree` is
   still set in the ledger: the `members-closed` stale-blocked reconcile below
   intentionally leaves it in place (it may hold unpushed operator repair work), and
-  nothing else surfaced it until now. For each kept path, `sched status` reports:
+  nothing else surfaced it until now. Also (#834/#855) each parallel `member_runs[]`
+  tree left on disk: every not-torn-down run of a `done` batch (a kept batch's, or one
+  a crash stranded), and a run of any ended batch whose teardown FAILED
+  (`teardown_failed_at` — the message says so; the cause is in the `teardown-failed`
+  journal line, and the scheduler never retries it). For each kept path, `sched status` reports:
   whether it still exists on disk; whether it is pool-claimed (the claim is held
   indefinitely until returned); and, via two local, read-only `git` probes scoped to
   that worktree's own `HEAD` (`git --no-optional-locks status --porcelain`, `git log
@@ -1544,7 +1557,9 @@ predicate in `anchor-close.ts`) over `blocked`/`done` batches touched within the
   for #686's stale-blocked reconcile (`members-closed`), which survives the mandated
   rebase-merge that makes the ancestry probe structurally dead. It finishes the terminal
   rail inline but never tears the blocked worktree down (it may hold unpushed work);
-  the journal line says the worktree was kept, and `sched status` then raises a
+  since #855 the decision is persisted as `worktree_kept`, so the terminal-batch safety
+  net leaves the batch's parallel `member_runs[]` trees in place too (`torn_down` stays
+  false). The journal line says the worktree was kept, and `sched status` then raises a
   `kept-worktree` warning for it on every run until the ledger field clears — see
   above and `reconcileKeptWorktrees` (#791).
 - **PR-detection evidence (#789).** When `batch.pr` was never recorded at all — a PR

package/dist/batch-dispatch.d.ts

@@ -300,6 +300,49 @@ export declare function undispatchedSurvivingMembers(state: SchedState, batch: B
  * #632 lesson: no journal inside a loop that doesn't terminate the unit).
  */
 export declare function reconcileStaleBlockedBatches(deps: BatchDispatchDeps, now: Date, result: BatchTickResult, anchorCtx: AnchorTickContext | undefined): void;
+/**
+ * #791: once a `done` batch's kept worktree (left in place by the
+ * `members-closed` branch above) is DEFINITIVELY gone — the path no longer
+ * exists on disk, or the pool itself now reports it back as a warm spare —
+ * clear the ledger's `worktree`/`pool_claimed` (and, separately,
+ * `member_worktree`/`member_pool_claimed`, and — #834 — each live
+ * `member_runs[]` entry's `torn_down`) fields so `sched status`'s
+ * `kept-worktree` warning does not persist after the operator's cleanup
+ * already happened. Ledger-only, by construction: this function reads
+ * `fsExists` and `worktree-pool status --json` (both read-only) and never
+ * builds a `git worktree remove` / `worktree-pool return` argv — the actual
+ * removal stays entirely the operator's call, exactly like the warning
+ * itself. Bounded the same way the warning's own candidate scan is: only
+ * `done` batches carrying a kept worktree are considered, which in practice
+ * is a small set.
+ *
+ * #834: `MemberRun.worktree` is a required `string` (unlike
+ * `BatchEntry.worktree: string | null`) — there is no null to clear it to,
+ * so "cleared" for a member run means `torn_down: true`, the same flag
+ * `recordRunTeardown` sets after a teardown that verifiably landed. Set
+ * here it means the same thing evidentially (nothing is holding this path
+ * any more), just reached by definitive evidence instead of by running
+ * `teardownParallelRuns`.
+ *
+ * #834/#855: a terminal batch's live `member_runs[]` entries are ALSO
+ * reached by the terminal-batch arm in `runBatchTick` (search
+ * `TERMINAL_BATCH_STATUSES.has(batch.status)` above the call site below),
+ * added by #809 for `sched stop`/`abandon`, which runs earlier in the same
+ * tick than this function. Since #855 that arm respects the keep decision
+ * (`worktree_kept`) and marks a run torn down only after a teardown that
+ * verifiably landed, so on a KEPT batch, or a run whose teardown failed
+ * (`teardown_failed_at`), `torn_down` stays false and this function is the
+ * only thing that ever clears it — once the operator has removed or
+ * returned the tree. On a non-kept batch the arm usually tears the tree
+ * down (and records it) first.
+ *
+ * Exported (not part of the package's public `index.ts` surface — same
+ * test-only convention as `reconcileStaleBlockedBatches`) so `member_runs[]`
+ * tests can call it directly, isolated from the terminal-batch safety net
+ * described above, which reaches a non-kept batch's `member_runs[]` first
+ * when both run inside one `runBatchTick` call.
+ */
+export declare function reconcileKeptWorktrees(deps: BatchDispatchDeps, now: Date): void;
 /**
  * #768: what one tick's anchor work reads GitHub and git through — built once
  * per tick so the stale-blocked reconcile and the anchor close never read the

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAcjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAwBL,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAK9B,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAylBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAs8CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AA2TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAuxBD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAkf1C;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3F;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CA+LN;AA4ED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AA+QD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAu0BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgSjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAcjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAyBL,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAK9B,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAylBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAs+CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CAgCN;AA4TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAuxBD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAkf1C;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3F;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CAmMN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAuG/E;AAED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAoRD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAi3BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAuSjB"}

package/dist/batch-dispatch.js

@@ -102,6 +102,7 @@ exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
 exports.undispatchedSurvivingMembers = undispatchedSurvivingMembers;
 exports.reconcileStaleBlockedBatches = reconcileStaleBlockedBatches;
+exports.reconcileKeptWorktrees = reconcileKeptWorktrees;
 exports.memberDispatchModeFor = memberDispatchModeFor;
 exports.runBatchTick = runBatchTick;
 const fs = __importStar(require("node:fs"));
@@ -819,7 +820,7 @@ landed) {
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.member_worktree === null)
-        return;
+        return null;
     const worktree = batch.member_worktree;
     const branch = batch.member_branch;
     // #677 review (defense in depth, matching `branchMergedIntoBase`'s bar):
@@ -830,7 +831,7 @@ landed) {
             cleanup: 'failed-invalid-branch-name',
             detail: branch,
         });
-        return;
+        return { path: worktree, cleared: false };
     }
     // Nulls first — clear the fields BEFORE the exec so a crash mid-teardown
     // doesn't retry into a half-cleaned tree (the re-derived path is
@@ -844,23 +845,39 @@ landed) {
             result: undefined,
         };
     });
-    teardownMemberTree(deps, batchId, { worktree, branch, poolClaimed: batch.member_pool_claimed === true }, landed);
+    const cleared = teardownMemberTree(deps, batchId, { worktree, branch, poolClaimed: batch.member_pool_claimed === true }, landed, batch.members[batch.executing_member - 1]);
+    return { path: worktree, cleared };
 }
+/** #855: the `teardown-failed` tail for a member tree that stays on disk. */
+const TREE_LEFT_FOR_OPERATOR = 'tree left on disk for the operator and NOT retried (it may hold work); inspect it, then remove it (`git worktree remove`, or `worktree-pool return` if pool-claimed) — `sched status` names it';
 /**
  * The exec half of a member teardown, shared by the serial rail
  * (`teardownMemberWorktree`, which first clears the batch's member fields) and
  * the parallel rail (#809: `evictParallelMember`, `advanceParallelBatch`,
  * `teardownParallelRuns`). See
  * `teardownMemberWorktree` for the landed/evicted branch policy.
+ *
+ * Returns whether the TREE is verifiably gone (#855) — `runTeardown` reports
+ * `done` only after the path is gone and unlisted, or the pool's self-check
+ * reports the entry returned. A failed branch delete after that does not
+ * un-clear the tree. Journals exactly one line per call; a failed tree is
+ * never re-attempted by any caller, so the line says what the operator does.
  */
-function teardownMemberTree(deps, batchId, tree, landed) {
+function teardownMemberTree(deps, batchId, tree, landed, 
+/** The member whose tree this is — named in the journal line. */
+issue) {
     const { worktree, branch } = tree;
+    const context = {
+        ...(issue !== undefined ? { issue } : {}),
+        worktree,
+    };
     if (branch !== null && !attribution_1.SAFE_REF_RE.test(branch)) {
         journalEvent(deps, 'teardown-failed', unit(batchId), {
+            ...context,
             cleanup: 'failed-invalid-branch-name',
-            detail: branch,
+            detail: `${branch} — ${TREE_LEFT_FOR_OPERATOR}`,
         });
-        return;
+        return false;
     }
     // Route through `runTeardown` for the same guarantees `teardownBatch`
     // gets: pool returns are verify-first idempotent and refuse to claim
@@ -883,11 +900,12 @@ function teardownMemberTree(deps, batchId, tree, landed) {
     }
     const failed = !treeCleared || branchCleanup.startsWith('failed');
     journalEvent(deps, failed ? 'teardown-failed' : 'member-worktree-torn-down', unit(batchId), {
+        ...context,
         cleanup: t.cleanup,
         branch_cleanup: branchCleanup,
-        detail: t.detail,
-        worktree,
+        detail: treeCleared ? t.detail : `${t.detail} — ${TREE_LEFT_FOR_OPERATOR}`,
     });
+    return treeCleared;
 }
 /**
  * The shared "block the batch for an operator" tail (#677 review — the same
@@ -1716,13 +1734,15 @@ function journalAdvanceSkipped(deps, batchId, memberIssue, currentMember, claim)
         detail: `another resolution already advanced past member ${currentMember} (batch is now executing_member=${claim.observed ?? 'gone'}, status=${claim.status ?? 'gone'}) — no second member-advanced and no second continuation`,
     });
 }
-function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, currentMember, memberIssue, now, result) {
+function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, currentMember, memberIssue, now, result, 
+/** What the caller's `teardownMemberWorktree` did with the member's tree (#855). */
+serialTeardown) {
     // #809: a parallel batch reaches this serial rail only through `sched resume
     // --batch` resolving its gate-inconclusive member — hand back to the
     // parallel rail instead of advancing a serial member pointer.
     const current = (0, state_1.findBatch)(deps.store.load(), batchId);
     if (current && isParallelBatch(current)) {
-        settleParallelResume(deps, batchId, memberIssue, now);
+        settleParallelResume(deps, batchId, memberIssue, now, serialTeardown);
         advanceParallelBatch(deps, config, dispatch, batchId, now, result);
         return;
     }
@@ -1788,8 +1808,8 @@ function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIs
     // branch — but its worktree/branch must go, or the next tick's prep for
     // the NEXT member collides with a stale tree. `teardownBatch` already
     // handled it on the dissolved path (the fields are cleared there).
-    teardownMemberWorktree(deps, batchId, now, false);
-    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result);
+    const serialTeardown = teardownMemberWorktree(deps, batchId, now, false);
+    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result, serialTeardown);
 }
 /**
  * The incremental gate (#523 AC2, revised #583): typecheck + focused tests
@@ -2026,8 +2046,8 @@ function completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue,
     // #677: the member's tree is done serving — landed, ranges recomputed.
     // Teardown before the advance so the next member's prep cannot collide
     // with this tree's cleanup.
-    teardownMemberWorktree(deps, batchId, now, true);
-    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result);
+    const serialTeardown = teardownMemberWorktree(deps, batchId, now, true);
+    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result, serialTeardown);
 }
 /**
  * `sched resume --batch <id>` (#583 AC4): an operator-triggered, synchronous
@@ -2919,7 +2939,7 @@ function reconcileTailSlot(deps, config, batchId, slot, now, result) {
         result.failed.push(unit(batchId));
     }
 }
-function reconcileReportSlot(deps, config, batchId, slot, now, result) {
+function reconcileReportSlot(deps, _config, batchId, slot, now, result) {
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.anchor === null)
@@ -3429,6 +3449,10 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
                 // clear into this same transition instead of a separate lock write.
                 ...state_1.CLEARED_PR_DETECT_AMBIGUOUS_FIELDS,
                 ...(prWasRecorded ? { pr: detectedPr } : {}),
+                // #855: persist the keep decision in the same transition, so every
+                // later teardown path — the terminal-batch safety net included —
+                // reads it for `member_runs[]` too.
+                ...(keepWorktree ? { worktree_kept: true } : {}),
             }, now);
             n = (0, state_1.transitionBatch)(n, batch.id, 'deployed', {}, now);
             unwalkable = [];
@@ -3505,7 +3529,8 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
  * `members-closed` branch above) is DEFINITIVELY gone — the path no longer
  * exists on disk, or the pool itself now reports it back as a warm spare —
  * clear the ledger's `worktree`/`pool_claimed` (and, separately,
- * `member_worktree`/`member_pool_claimed`) fields so `sched status`'s
+ * `member_worktree`/`member_pool_claimed`, and — #834 — each live
+ * `member_runs[]` entry's `torn_down`) fields so `sched status`'s
  * `kept-worktree` warning does not persist after the operator's cleanup
  * already happened. Ledger-only, by construction: this function reads
  * `fsExists` and `worktree-pool status --json` (both read-only) and never
@@ -3514,15 +3539,46 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
  * itself. Bounded the same way the warning's own candidate scan is: only
  * `done` batches carrying a kept worktree are considered, which in practice
  * is a small set.
+ *
+ * #834: `MemberRun.worktree` is a required `string` (unlike
+ * `BatchEntry.worktree: string | null`) — there is no null to clear it to,
+ * so "cleared" for a member run means `torn_down: true`, the same flag
+ * `recordRunTeardown` sets after a teardown that verifiably landed. Set
+ * here it means the same thing evidentially (nothing is holding this path
+ * any more), just reached by definitive evidence instead of by running
+ * `teardownParallelRuns`.
+ *
+ * #834/#855: a terminal batch's live `member_runs[]` entries are ALSO
+ * reached by the terminal-batch arm in `runBatchTick` (search
+ * `TERMINAL_BATCH_STATUSES.has(batch.status)` above the call site below),
+ * added by #809 for `sched stop`/`abandon`, which runs earlier in the same
+ * tick than this function. Since #855 that arm respects the keep decision
+ * (`worktree_kept`) and marks a run torn down only after a teardown that
+ * verifiably landed, so on a KEPT batch, or a run whose teardown failed
+ * (`teardown_failed_at`), `torn_down` stays false and this function is the
+ * only thing that ever clears it — once the operator has removed or
+ * returned the tree. On a non-kept batch the arm usually tears the tree
+ * down (and records it) first.
+ *
+ * Exported (not part of the package's public `index.ts` surface — same
+ * test-only convention as `reconcileStaleBlockedBatches`) so `member_runs[]`
+ * tests can call it directly, isolated from the terminal-batch safety net
+ * described above, which reaches a non-kept batch's `member_runs[]` first
+ * when both run inside one `runBatchTick` call.
  */
 function reconcileKeptWorktrees(deps, now) {
     const state = deps.store.load();
     const fsExists = deps.fsExists ?? ((p) => fs.existsSync(p));
-    const candidates = state.batches.filter((b) => b.status === 'done' && (b.worktree !== null || b.member_worktree !== null));
+    // #855: a `stopped`/`dissolved` batch's run whose teardown failed is a
+    // leftover too (`isLeftoverMemberRun`) — its ledger clears on the same
+    // evidence once the operator has dealt with it.
+    const candidates = state.batches.filter((b) => (b.status === 'done' && (b.worktree !== null || b.member_worktree !== null)) ||
+        b.member_runs.some((r) => (0, state_1.isLeftoverMemberRun)(b, r)));
     if (candidates.length === 0)
         return;
     const needsPoolCheck = candidates.some((b) => (b.worktree !== null && b.pool_claimed) ||
-        (b.member_worktree !== null && b.member_pool_claimed));
+        (b.member_worktree !== null && b.member_pool_claimed) ||
+        b.member_runs.some((r) => r.pool_claimed && (0, state_1.isLeftoverMemberRun)(b, r)));
     // One pool query per TICK, not per candidate — `worktree-pool status` is a
     // real subprocess (`npx ...`), and this reconcile is meant to be cheap.
     const poolStatusJson = needsPoolCheck
@@ -3539,27 +3595,67 @@ function reconcileKeptWorktrees(deps, now) {
     for (const batch of candidates) {
         const clears = {};
         const clearedFields = [];
-        if (batch.worktree !== null && goneOrReturned(batch.worktree, batch.pool_claimed)) {
+        const done = batch.status === 'done';
+        if (done && batch.worktree !== null && goneOrReturned(batch.worktree, batch.pool_claimed)) {
             clears.worktree = null;
             clears.pool_claimed = false;
             clearedFields.push('worktree', 'pool_claimed');
         }
-        if (batch.member_worktree !== null &&
+        if (done &&
+            batch.member_worktree !== null &&
             goneOrReturned(batch.member_worktree, batch.member_pool_claimed)) {
             clears.member_worktree = null;
             clears.member_pool_claimed = false;
             clearedFields.push('member_worktree', 'member_pool_claimed');
         }
-        if (clearedFields.length === 0)
+        // #834: unlike `worktree`/`member_worktree`, `member_runs[]` is actively
+        // mutated by many OTHER code paths while a tick runs (member dispatch,
+        // eviction, `recordRunTeardown`, `sched attach-pr`, ...), so its evidence
+        // check must NOT be computed from this function's own outer, unlocked
+        // `batch` snapshot: `patchBatch` merges `member_runs` as a whole-array
+        // replacement, not per-entry, so writing an array built from a stale
+        // snapshot would silently discard a concurrent writer's change to a
+        // SIBLING entry in the gap between this snapshot and the lock below
+        // (a lost update — found in review). Only a coarse "is there anything
+        // to look at" pre-check runs out here, to decide whether entering the
+        // lock is worth it at all; the real per-run evidence check re-reads
+        // `member_runs` fresh, from the batch `withLock` reloads below.
+        const mightClearRuns = batch.member_runs.some((r) => (0, state_1.isLeftoverMemberRun)(batch, r));
+        if (clearedFields.length === 0 && !mightClearRuns)
             continue;
+        const clearedRunIssues = [];
         deps.store.withLock((s) => {
             const b = (0, state_1.findBatch)(s, batch.id);
             // Re-check under the lock: another tick, or an operator command, may
             // have already moved this batch or cleared the fields itself.
-            if (!b || b.status !== 'done')
+            if (!b || b.status !== batch.status)
+                return { state: s, result: undefined };
+            const runClears = {};
+            if (mightClearRuns) {
+                const updatedRuns = b.member_runs.map((run) => {
+                    if (!(0, state_1.isLeftoverMemberRun)(b, run))
+                        return run;
+                    if (!goneOrReturned(run.worktree, run.pool_claimed))
+                        return run;
+                    clearedRunIssues.push(run.issue);
+                    return { ...run, torn_down: true };
+                });
+                if (clearedRunIssues.length > 0)
+                    runClears.member_runs = updatedRuns;
+            }
+            if (Object.keys(clears).length === 0 && Object.keys(runClears).length === 0) {
                 return { state: s, result: undefined };
-            return { state: (0, state_1.patchBatch)(s, batch.id, clears, now, false), result: undefined };
+            }
+            return {
+                state: (0, state_1.patchBatch)(s, batch.id, { ...clears, ...runClears }, now, false),
+                result: undefined,
+            };
         });
+        if (clearedRunIssues.length > 0) {
+            clearedFields.push(`member_runs[${clearedRunIssues.join(',')}].torn_down`);
+        }
+        if (clearedFields.length === 0)
+            continue;
         journalEvent(deps, 'kept-worktree-cleared', unit(batch.id), {
             cleared: clearedFields.join(','),
             detail: `kept-worktree ledger field(s) cleared on definitive evidence (${clearedFields.join(', ')}) — path gone or pool reports it returned; no removal command was run`,
@@ -3733,6 +3829,12 @@ function recordAnchorCloseFailed(deps, batch, outcome, shipped, now) {
  * left on disk forever, since nothing else ever calls this for it.
  */
 function teardownBatch(deps, batchId) {
+    // #855: a kept batch's trees are the operator's — every teardown path reads
+    // the same persisted decision. Only its live agents are stopped.
+    if ((0, state_1.findBatch)(deps.store.load(), batchId)?.worktree_kept === true) {
+        teardownParallelRuns(deps, batchId, null);
+        return;
+    }
     // #677: the current member's worktree goes first — it is batch-owned
     // state on the same teardown path as the shared tree, and a blocked or
     // dissolved batch must not leak a member tree (its branch/fields are
@@ -3743,9 +3845,8 @@ function teardownBatch(deps, batchId) {
     const terminal = (0, state_1.findBatch)(deps.store.load(), batchId);
     const lastMemberLanded = terminal?.ranges.some((r) => r.issue === terminal.members[terminal.executing_member - 1]) ===
         true;
-    const serialTree = terminal?.member_worktree ?? null;
-    teardownMemberWorktree(deps, batchId, deps.now(), lastMemberLanded);
-    teardownParallelRuns(deps, batchId, serialTree);
+    const serial = teardownMemberWorktree(deps, batchId, deps.now(), lastMemberLanded);
+    teardownParallelRuns(deps, batchId, serial);
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.worktree === null)
@@ -3811,13 +3912,30 @@ function runTree(r) {
         : { worktree: r.worktree, branch: r.branch, poolClaimed: r.poolClaimed };
 }
 /**
- * Record that a run's tree is gone. Written AFTER the teardown, so a crash in
+ * Tear one parallel member run's tree down and record what actually happened
+ * (#855) — the one teardown-and-record path for the evict, land and
+ * `teardownParallelRuns` rails.
+ */
+function teardownRunTree(deps, batchId, run, landed, now) {
+    const cleared = teardownMemberTree(deps, batchId, runTree(run), landed, run.issue);
+    recordRunTeardown(deps, batchId, run.issue, cleared, now);
+}
+/** The one mapping from a member-tree teardown outcome to its run record (#855). */
+function teardownOutcomePatch(cleared, now) {
+    return cleared ? { torn_down: true } : { teardown_failed_at: now.toISOString() };
+}
+/**
+ * Record a run's teardown outcome. Written AFTER the teardown, so a crash in
  * between re-runs the (idempotent) teardown from `teardownParallelRuns`
- * instead of leaking the tree.
+ * instead of leaking the tree. #855: `torn_down` is set only when the
+ * teardown verifiably landed; a failed one records `teardown_failed_at`
+ * instead and leaves the tree on disk for the operator (never retried — see
+ * `MemberRun.teardown_failed_at`). The caller's teardown already journaled
+ * the failure, once.
  */
-function markTornDown(deps, batchId, issue, now) {
+function recordRunTeardown(deps, batchId, issue, cleared, now) {
     deps.store.withLock((s) => ({
-        state: patchRun(s, batchId, issue, { torn_down: true }, now),
+        state: patchRun(s, batchId, issue, teardownOutcomePatch(cleared, now), now),
         result: undefined,
     }));
 }
@@ -3953,6 +4071,7 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
                 status: 'running',
                 gate_inconclusive: null,
                 torn_down: false,
+                teardown_failed_at: null,
             }, now);
             if ((0, scheduler_1.freeCapacity)(n, config) === 0)
                 return { state: n, result: true };
@@ -3980,7 +4099,7 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
                 reason: 'member-worktree-orphaned',
                 detail: `batch left executing while member ${next.index}'s tree ${member.worktree} was prepared — tearing it down`,
             });
-            teardownMemberTree(deps, batchId, runTree(member), false);
+            teardownMemberTree(deps, batchId, runTree(member), false, next.issue);
         }
     }
 }
@@ -4001,8 +4120,7 @@ function evictParallelMember(deps, config, batchId, run, failure, now, result) {
         state: patchRun(s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now),
         result: undefined,
     }));
-    teardownMemberTree(deps, batchId, runTree(run), false);
-    markTornDown(deps, batchId, run.issue, now);
+    teardownRunTree(deps, batchId, run, false, now);
 }
 /**
  * Reconcile one parallel member's slot — the parallel twin of
@@ -4238,8 +4356,7 @@ function advanceParallelBatch(deps, config, dispatch, batchId, now, result) {
         // A gate-inconclusive member keeps its tree for `sched resume --batch`'s
         // recheck; everyone else's is done serving.
         if (run.gate_inconclusive === null) {
-            teardownMemberTree(deps, batchId, runTree(run), true);
-            markTornDown(deps, batchId, run.issue, now);
+            teardownRunTree(deps, batchId, run, true, now);
         }
     }
 }
@@ -4287,7 +4404,7 @@ function finalizeParallelMembers(deps, config, dispatch, batchId, now, result) {
  * run so the landing walk treats it as resolved, then continue the parallel
  * rail from where it blocked.
  */
-function settleParallelResume(deps, batchId, memberIssue, now) {
+function settleParallelResume(deps, batchId, memberIssue, now, serialTeardown) {
     deps.store.withLock((s) => {
         const b = (0, state_1.findBatch)(s, batchId);
         if (!b)
@@ -4296,8 +4413,10 @@ function settleParallelResume(deps, batchId, memberIssue, now) {
         return {
             state: patchRun(s, batchId, memberIssue, {
                 gate_inconclusive: null,
-                // The serial rail's `teardownMemberWorktree` removed its tree.
-                torn_down: true,
+                // The serial rail's `teardownMemberWorktree` tore its tree down —
+                // recorded as torn down only when that verifiably landed (#855).
+                // No serial tree at all leaves the run live for `teardownBatch`.
+                ...(serialTeardown !== null ? teardownOutcomePatch(serialTeardown.cleared, now) : {}),
                 ...(evicted ? { status: 'evicted' } : {}),
             }, now),
             result: undefined,
@@ -4339,11 +4458,19 @@ function reconcileParallelBatch(deps, config, dispatch, batchId, now, result, pa
  * would be working a unit nothing tracks any more), `sched stop`/`abandon`
  * make a batch terminal without a teardown, and a crash between a run's
  * resolution and its teardown leaves `torn_down: false` behind. Teardown is
- * idempotent, so re-running it is always safe. `alreadyTornDown` names the
- * serial-field tree `teardownMemberWorktree` just handled (a gate-inconclusive
- * member of a blocked parallel batch).
+ * idempotent, so re-running it is always safe. `serial` is what
+ * `teardownMemberWorktree` just did with the serial-field tree (a
+ * gate-inconclusive member of a blocked parallel batch) — its outcome is
+ * recorded on the matching run without a second attempt.
+ *
+ * #855: default to KEEPING. A kept batch's (`worktree_kept`, #768's
+ * members-closed reconcile) trees may hold unpushed operator work: its live
+ * agents are still stopped (non-destructive), but no tree is removed or
+ * pool-returned and `torn_down` stays false, so `sched status`'s
+ * `kept-worktree` warning names them. A run whose earlier teardown failed
+ * (`teardown_failed_at`) is not re-attempted either.
  */
-function teardownParallelRuns(deps, batchId, alreadyTornDown) {
+function teardownParallelRuns(deps, batchId, serial) {
     const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
     if (!batch)
         return;
@@ -4352,15 +4479,25 @@ function teardownParallelRuns(deps, batchId, alreadyTornDown) {
         if (run.torn_down)
             continue;
         stopMemberAgent(deps, batchId, run.issue, now);
+        if (run.teardown_failed_at !== null)
+            continue;
         const landed = run.status === 'landed';
-        deps.store.withLock((s) => ({
-            state: patchRun(s, batchId, run.issue, { status: landed ? 'landed' : 'evicted', gate_inconclusive: null }, now),
-            result: undefined,
-        }));
-        if (run.worktree !== alreadyTornDown) {
-            teardownMemberTree(deps, batchId, runTree(run), landed);
+        const status = landed ? 'landed' : 'evicted';
+        // Only when it changes: a kept batch's runs pass through here every tick.
+        if (run.status !== status || run.gate_inconclusive !== null) {
+            deps.store.withLock((s) => ({
+                state: patchRun(s, batchId, run.issue, { status, gate_inconclusive: null }, now),
+                result: undefined,
+            }));
+        }
+        if (batch.worktree_kept)
+            continue;
+        if (serial !== null && run.worktree === serial.path) {
+            recordRunTeardown(deps, batchId, run.issue, serial.cleared, now);
+        }
+        else {
+            teardownRunTree(deps, batchId, run, landed, now);
         }
-        markTornDown(deps, batchId, run.issue, now);
     }
 }
 /** Kill a parallel member's live agent (pid-start checked) and release its slot. */
@@ -4568,6 +4705,13 @@ function runBatchTick(deps, config, dispatch) {
         if (types_1.TERMINAL_BATCH_STATUSES.has(batch.status)) {
             // #809: `sched stop`/`abandon` end a batch without a teardown — give
             // back every member tree (and stop any agent still running in one).
+            // #855: except a KEPT batch's trees (`worktree_kept`, the members-closed
+            // reconcile's decision — the same one `worktree`/`member_worktree`
+            // get) and a run whose teardown already failed: `teardownParallelRuns`
+            // leaves both on disk with `torn_down: false`, and marks a run torn
+            // down only after a teardown that verifiably landed. Such a batch
+            // re-enters here every tick by design — cheap (a state read per run),
+            // and it stops any agent that is somehow still running in a kept tree.
             if (batch.member_runs.some((r) => !r.torn_down)) {
                 try {
                     teardownParallelRuns(deps, batch.id, null);