@ai-dossier/sched 0.54.1 → 0.55.1

package/dist/batch-dispatch.js

@@ -820,7 +820,7 @@ landed) {
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.member_worktree === null)
-        return;
+        return null;
     const worktree = batch.member_worktree;
     const branch = batch.member_branch;
     // #677 review (defense in depth, matching `branchMergedIntoBase`'s bar):
@@ -831,7 +831,7 @@ landed) {
             cleanup: 'failed-invalid-branch-name',
             detail: branch,
         });
-        return;
+        return { path: worktree, cleared: false };
     }
     // Nulls first — clear the fields BEFORE the exec so a crash mid-teardown
     // doesn't retry into a half-cleaned tree (the re-derived path is
@@ -845,23 +845,39 @@ landed) {
             result: undefined,
         };
     });
-    teardownMemberTree(deps, batchId, { worktree, branch, poolClaimed: batch.member_pool_claimed === true }, landed);
+    const cleared = teardownMemberTree(deps, batchId, { worktree, branch, poolClaimed: batch.member_pool_claimed === true }, landed, batch.members[batch.executing_member - 1]);
+    return { path: worktree, cleared };
 }
+/** #855: the `teardown-failed` tail for a member tree that stays on disk. */
+const TREE_LEFT_FOR_OPERATOR = 'tree left on disk for the operator and NOT retried (it may hold work); inspect it, then remove it (`git worktree remove`, or `worktree-pool return` if pool-claimed) — `sched status` names it';
 /**
  * The exec half of a member teardown, shared by the serial rail
  * (`teardownMemberWorktree`, which first clears the batch's member fields) and
  * the parallel rail (#809: `evictParallelMember`, `advanceParallelBatch`,
  * `teardownParallelRuns`). See
  * `teardownMemberWorktree` for the landed/evicted branch policy.
+ *
+ * Returns whether the TREE is verifiably gone (#855) — `runTeardown` reports
+ * `done` only after the path is gone and unlisted, or the pool's self-check
+ * reports the entry returned. A failed branch delete after that does not
+ * un-clear the tree. Journals exactly one line per call; a failed tree is
+ * never re-attempted by any caller, so the line says what the operator does.
  */
-function teardownMemberTree(deps, batchId, tree, landed) {
+function teardownMemberTree(deps, batchId, tree, landed, 
+/** The member whose tree this is — named in the journal line. */
+issue) {
     const { worktree, branch } = tree;
+    const context = {
+        ...(issue !== undefined ? { issue } : {}),
+        worktree,
+    };
     if (branch !== null && !attribution_1.SAFE_REF_RE.test(branch)) {
         journalEvent(deps, 'teardown-failed', unit(batchId), {
+            ...context,
             cleanup: 'failed-invalid-branch-name',
-            detail: branch,
+            detail: `${branch} — ${TREE_LEFT_FOR_OPERATOR}`,
         });
-        return;
+        return false;
     }
     // Route through `runTeardown` for the same guarantees `teardownBatch`
     // gets: pool returns are verify-first idempotent and refuse to claim
@@ -884,11 +900,12 @@ function teardownMemberTree(deps, batchId, tree, landed) {
     }
     const failed = !treeCleared || branchCleanup.startsWith('failed');
     journalEvent(deps, failed ? 'teardown-failed' : 'member-worktree-torn-down', unit(batchId), {
+        ...context,
         cleanup: t.cleanup,
         branch_cleanup: branchCleanup,
-        detail: t.detail,
-        worktree,
+        detail: treeCleared ? t.detail : `${t.detail} — ${TREE_LEFT_FOR_OPERATOR}`,
     });
+    return treeCleared;
 }
 /**
  * The shared "block the batch for an operator" tail (#677 review — the same
@@ -1717,13 +1734,15 @@ function journalAdvanceSkipped(deps, batchId, memberIssue, currentMember, claim)
         detail: `another resolution already advanced past member ${currentMember} (batch is now executing_member=${claim.observed ?? 'gone'}, status=${claim.status ?? 'gone'}) — no second member-advanced and no second continuation`,
     });
 }
-function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, currentMember, memberIssue, now, result) {
+function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, currentMember, memberIssue, now, result, 
+/** What the caller's `teardownMemberWorktree` did with the member's tree (#855). */
+serialTeardown) {
     // #809: a parallel batch reaches this serial rail only through `sched resume
     // --batch` resolving its gate-inconclusive member — hand back to the
     // parallel rail instead of advancing a serial member pointer.
     const current = (0, state_1.findBatch)(deps.store.load(), batchId);
     if (current && isParallelBatch(current)) {
-        settleParallelResume(deps, batchId, memberIssue, now);
+        settleParallelResume(deps, batchId, memberIssue, now, serialTeardown);
         advanceParallelBatch(deps, config, dispatch, batchId, now, result);
         return;
     }
@@ -1789,8 +1808,8 @@ function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIs
     // branch — but its worktree/branch must go, or the next tick's prep for
     // the NEXT member collides with a stale tree. `teardownBatch` already
     // handled it on the dissolved path (the fields are cleared there).
-    teardownMemberWorktree(deps, batchId, now, false);
-    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result);
+    const serialTeardown = teardownMemberWorktree(deps, batchId, now, false);
+    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result, serialTeardown);
 }
 /**
  * The incremental gate (#523 AC2, revised #583): typecheck + focused tests
@@ -2027,8 +2046,8 @@ function completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue,
     // #677: the member's tree is done serving — landed, ranges recomputed.
     // Teardown before the advance so the next member's prep cannot collide
     // with this tree's cleanup.
-    teardownMemberWorktree(deps, batchId, now, true);
-    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result);
+    const serialTeardown = teardownMemberWorktree(deps, batchId, now, true);
+    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result, serialTeardown);
 }
 /**
  * `sched resume --batch <id>` (#583 AC4): an operator-triggered, synchronous
@@ -2920,7 +2939,13 @@ function reconcileTailSlot(deps, config, batchId, slot, now, result) {
         result.failed.push(unit(batchId));
     }
 }
-function reconcileReportSlot(deps, config, batchId, slot, now, result) {
+function reconcileReportSlot(deps, 
+// Unused — kept so this function's signature matches its `reconcile*Slot`
+// siblings (`reconcileMemberSlot`, `reconcileFixSlot`, `reconcileTailSlot`),
+// all called uniformly as `reconcile*Slot(deps, config, ...)` from the same
+// dispatch loop (#830 — pre-existing Biome `noUnusedFunctionParameters`,
+// independently fixed the same way by #855/#857).
+_config, batchId, slot, now, result) {
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.anchor === null)
@@ -3430,6 +3455,10 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
                 // clear into this same transition instead of a separate lock write.
                 ...state_1.CLEARED_PR_DETECT_AMBIGUOUS_FIELDS,
                 ...(prWasRecorded ? { pr: detectedPr } : {}),
+                // #855: persist the keep decision in the same transition, so every
+                // later teardown path — the terminal-batch safety net included —
+                // reads it for `member_runs[]` too.
+                ...(keepWorktree ? { worktree_kept: true } : {}),
             }, now);
             n = (0, state_1.transitionBatch)(n, batch.id, 'deployed', {}, now);
             unwalkable = [];
@@ -3520,46 +3549,42 @@ function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
  * #834: `MemberRun.worktree` is a required `string` (unlike
  * `BatchEntry.worktree: string | null`) — there is no null to clear it to,
  * so "cleared" for a member run means `torn_down: true`, the same flag
- * `markTornDown` sets after a real teardown. Set here it means the same
- * thing evidentially (nothing is holding this path any more), just reached
- * by definitive evidence instead of by running `teardownParallelRuns`.
+ * `recordRunTeardown` sets after a teardown that verifiably landed. Set
+ * here it means the same thing evidentially (nothing is holding this path
+ * any more), just reached by definitive evidence instead of by running
+ * `teardownParallelRuns`.
  *
- * #834 discovery: unlike `worktree`/`member_worktree`, a terminal batch's
- * live `member_runs[]` entries are ALSO reached by the unconditional
- * terminal-batch arm in `runBatchTick` (search `TERMINAL_BATCH_STATUSES.has(batch.status)`
- * above the call site below) — added by #809 for `sched stop`/`abandon`,
- * but written generically enough that it fires for EVERY terminal batch,
- * `members-closed`-reconciled ones included, and it runs earlier in the
- * same tick than this function. It calls `teardownParallelRuns` (an actual
- * teardown attempt, unlike this read-only reconcile) and — notably — calls
- * `markTornDown` unconditionally, even when that teardown attempt itself
- * FAILS (e.g. `isSafeWorktree` rejects the path). So in the normal
- * scheduler-ticking case this function's own `member_runs[]` branch below
- * is effectively a backstop, not the primary path: by the time it runs,
- * `torn_down` is usually already `true` — correctly when the tree really
- * is gone, but also when a real teardown attempt failed and left the tree
- * on disk — filed as #855 (out of scope here; #834 only extends the
- * evidence-based ledger reconcile, it does not change teardown behavior).
- * This function's own branch still matters for the window before that
- * safety net's next tick runs, and for `sched status` reads taken while
- * the scheduler isn't ticking at all.
+ * #834/#855: a terminal batch's live `member_runs[]` entries are ALSO
+ * reached by the terminal-batch arm in `runBatchTick` (search
+ * `TERMINAL_BATCH_STATUSES.has(batch.status)` above the call site below),
+ * added by #809 for `sched stop`/`abandon`, which runs earlier in the same
+ * tick than this function. Since #855 that arm respects the keep decision
+ * (`worktree_kept`) and marks a run torn down only after a teardown that
+ * verifiably landed, so on a KEPT batch, or a run whose teardown failed
+ * (`teardown_failed_at`), `torn_down` stays false and this function is the
+ * only thing that ever clears it — once the operator has removed or
+ * returned the tree. On a non-kept batch the arm usually tears the tree
+ * down (and records it) first.
  *
  * Exported (not part of the package's public `index.ts` surface — same
  * test-only convention as `reconcileStaleBlockedBatches`) so `member_runs[]`
  * tests can call it directly, isolated from the terminal-batch safety net
- * described above, which otherwise always beats it to `member_runs[]` when
- * both run inside one `runBatchTick` call.
+ * described above, which reaches a non-kept batch's `member_runs[]` first
+ * when both run inside one `runBatchTick` call.
  */
 function reconcileKeptWorktrees(deps, now) {
     const state = deps.store.load();
     const fsExists = deps.fsExists ?? ((p) => fs.existsSync(p));
-    const candidates = state.batches.filter((b) => b.status === 'done' &&
-        (b.worktree !== null || b.member_worktree !== null || b.member_runs.some((r) => !r.torn_down)));
+    // #855: a `stopped`/`dissolved` batch's run whose teardown failed is a
+    // leftover too (`isLeftoverMemberRun`) — its ledger clears on the same
+    // evidence once the operator has dealt with it.
+    const candidates = state.batches.filter((b) => (b.status === 'done' && (b.worktree !== null || b.member_worktree !== null)) ||
+        b.member_runs.some((r) => (0, state_1.isLeftoverMemberRun)(b, r)));
     if (candidates.length === 0)
         return;
     const needsPoolCheck = candidates.some((b) => (b.worktree !== null && b.pool_claimed) ||
         (b.member_worktree !== null && b.member_pool_claimed) ||
-        b.member_runs.some((r) => !r.torn_down && r.pool_claimed));
+        b.member_runs.some((r) => r.pool_claimed && (0, state_1.isLeftoverMemberRun)(b, r)));
     // One pool query per TICK, not per candidate — `worktree-pool status` is a
     // real subprocess (`npx ...`), and this reconcile is meant to be cheap.
     const poolStatusJson = needsPoolCheck
@@ -3576,12 +3601,14 @@ function reconcileKeptWorktrees(deps, now) {
     for (const batch of candidates) {
         const clears = {};
         const clearedFields = [];
-        if (batch.worktree !== null && goneOrReturned(batch.worktree, batch.pool_claimed)) {
+        const done = batch.status === 'done';
+        if (done && batch.worktree !== null && goneOrReturned(batch.worktree, batch.pool_claimed)) {
             clears.worktree = null;
             clears.pool_claimed = false;
             clearedFields.push('worktree', 'pool_claimed');
         }
-        if (batch.member_worktree !== null &&
+        if (done &&
+            batch.member_worktree !== null &&
             goneOrReturned(batch.member_worktree, batch.member_pool_claimed)) {
             clears.member_worktree = null;
             clears.member_pool_claimed = false;
@@ -3589,7 +3616,7 @@ function reconcileKeptWorktrees(deps, now) {
         }
         // #834: unlike `worktree`/`member_worktree`, `member_runs[]` is actively
         // mutated by many OTHER code paths while a tick runs (member dispatch,
-        // eviction, `markTornDown`, `sched attach-pr`, ...), so its evidence
+        // eviction, `recordRunTeardown`, `sched attach-pr`, ...), so its evidence
         // check must NOT be computed from this function's own outer, unlocked
         // `batch` snapshot: `patchBatch` merges `member_runs` as a whole-array
         // replacement, not per-entry, so writing an array built from a stale
@@ -3599,7 +3626,7 @@ function reconcileKeptWorktrees(deps, now) {
         // to look at" pre-check runs out here, to decide whether entering the
         // lock is worth it at all; the real per-run evidence check re-reads
         // `member_runs` fresh, from the batch `withLock` reloads below.
-        const mightClearRuns = batch.member_runs.some((r) => !r.torn_down);
+        const mightClearRuns = batch.member_runs.some((r) => (0, state_1.isLeftoverMemberRun)(batch, r));
         if (clearedFields.length === 0 && !mightClearRuns)
             continue;
         const clearedRunIssues = [];
@@ -3607,12 +3634,12 @@ function reconcileKeptWorktrees(deps, now) {
             const b = (0, state_1.findBatch)(s, batch.id);
             // Re-check under the lock: another tick, or an operator command, may
             // have already moved this batch or cleared the fields itself.
-            if (!b || b.status !== 'done')
+            if (!b || b.status !== batch.status)
                 return { state: s, result: undefined };
             const runClears = {};
             if (mightClearRuns) {
                 const updatedRuns = b.member_runs.map((run) => {
-                    if (run.torn_down)
+                    if (!(0, state_1.isLeftoverMemberRun)(b, run))
                         return run;
                     if (!goneOrReturned(run.worktree, run.pool_claimed))
                         return run;
@@ -3808,6 +3835,12 @@ function recordAnchorCloseFailed(deps, batch, outcome, shipped, now) {
  * left on disk forever, since nothing else ever calls this for it.
  */
 function teardownBatch(deps, batchId) {
+    // #855: a kept batch's trees are the operator's — every teardown path reads
+    // the same persisted decision. Only its live agents are stopped.
+    if ((0, state_1.findBatch)(deps.store.load(), batchId)?.worktree_kept === true) {
+        teardownParallelRuns(deps, batchId, null);
+        return;
+    }
     // #677: the current member's worktree goes first — it is batch-owned
     // state on the same teardown path as the shared tree, and a blocked or
     // dissolved batch must not leak a member tree (its branch/fields are
@@ -3818,9 +3851,8 @@ function teardownBatch(deps, batchId) {
     const terminal = (0, state_1.findBatch)(deps.store.load(), batchId);
     const lastMemberLanded = terminal?.ranges.some((r) => r.issue === terminal.members[terminal.executing_member - 1]) ===
         true;
-    const serialTree = terminal?.member_worktree ?? null;
-    teardownMemberWorktree(deps, batchId, deps.now(), lastMemberLanded);
-    teardownParallelRuns(deps, batchId, serialTree);
+    const serial = teardownMemberWorktree(deps, batchId, deps.now(), lastMemberLanded);
+    teardownParallelRuns(deps, batchId, serial);
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.worktree === null)
@@ -3886,13 +3918,30 @@ function runTree(r) {
         : { worktree: r.worktree, branch: r.branch, poolClaimed: r.poolClaimed };
 }
 /**
- * Record that a run's tree is gone. Written AFTER the teardown, so a crash in
+ * Tear one parallel member run's tree down and record what actually happened
+ * (#855) — the one teardown-and-record path for the evict, land and
+ * `teardownParallelRuns` rails.
+ */
+function teardownRunTree(deps, batchId, run, landed, now) {
+    const cleared = teardownMemberTree(deps, batchId, runTree(run), landed, run.issue);
+    recordRunTeardown(deps, batchId, run.issue, cleared, now);
+}
+/** The one mapping from a member-tree teardown outcome to its run record (#855). */
+function teardownOutcomePatch(cleared, now) {
+    return cleared ? { torn_down: true } : { teardown_failed_at: now.toISOString() };
+}
+/**
+ * Record a run's teardown outcome. Written AFTER the teardown, so a crash in
  * between re-runs the (idempotent) teardown from `teardownParallelRuns`
- * instead of leaking the tree.
+ * instead of leaking the tree. #855: `torn_down` is set only when the
+ * teardown verifiably landed; a failed one records `teardown_failed_at`
+ * instead and leaves the tree on disk for the operator (never retried — see
+ * `MemberRun.teardown_failed_at`). The caller's teardown already journaled
+ * the failure, once.
  */
-function markTornDown(deps, batchId, issue, now) {
+function recordRunTeardown(deps, batchId, issue, cleared, now) {
     deps.store.withLock((s) => ({
-        state: patchRun(s, batchId, issue, { torn_down: true }, now),
+        state: patchRun(s, batchId, issue, teardownOutcomePatch(cleared, now), now),
         result: undefined,
     }));
 }
@@ -4028,6 +4077,7 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
                 status: 'running',
                 gate_inconclusive: null,
                 torn_down: false,
+                teardown_failed_at: null,
             }, now);
             if ((0, scheduler_1.freeCapacity)(n, config) === 0)
                 return { state: n, result: true };
@@ -4055,7 +4105,7 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
                 reason: 'member-worktree-orphaned',
                 detail: `batch left executing while member ${next.index}'s tree ${member.worktree} was prepared — tearing it down`,
             });
-            teardownMemberTree(deps, batchId, runTree(member), false);
+            teardownMemberTree(deps, batchId, runTree(member), false, next.issue);
         }
     }
 }
@@ -4076,8 +4126,7 @@ function evictParallelMember(deps, config, batchId, run, failure, now, result) {
         state: patchRun(s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now),
         result: undefined,
     }));
-    teardownMemberTree(deps, batchId, runTree(run), false);
-    markTornDown(deps, batchId, run.issue, now);
+    teardownRunTree(deps, batchId, run, false, now);
 }
 /**
  * Reconcile one parallel member's slot — the parallel twin of
@@ -4313,8 +4362,7 @@ function advanceParallelBatch(deps, config, dispatch, batchId, now, result) {
         // A gate-inconclusive member keeps its tree for `sched resume --batch`'s
         // recheck; everyone else's is done serving.
         if (run.gate_inconclusive === null) {
-            teardownMemberTree(deps, batchId, runTree(run), true);
-            markTornDown(deps, batchId, run.issue, now);
+            teardownRunTree(deps, batchId, run, true, now);
         }
     }
 }
@@ -4362,7 +4410,7 @@ function finalizeParallelMembers(deps, config, dispatch, batchId, now, result) {
  * run so the landing walk treats it as resolved, then continue the parallel
  * rail from where it blocked.
  */
-function settleParallelResume(deps, batchId, memberIssue, now) {
+function settleParallelResume(deps, batchId, memberIssue, now, serialTeardown) {
     deps.store.withLock((s) => {
         const b = (0, state_1.findBatch)(s, batchId);
         if (!b)
@@ -4371,8 +4419,10 @@ function settleParallelResume(deps, batchId, memberIssue, now) {
         return {
             state: patchRun(s, batchId, memberIssue, {
                 gate_inconclusive: null,
-                // The serial rail's `teardownMemberWorktree` removed its tree.
-                torn_down: true,
+                // The serial rail's `teardownMemberWorktree` tore its tree down —
+                // recorded as torn down only when that verifiably landed (#855).
+                // No serial tree at all leaves the run live for `teardownBatch`.
+                ...(serialTeardown !== null ? teardownOutcomePatch(serialTeardown.cleared, now) : {}),
                 ...(evicted ? { status: 'evicted' } : {}),
             }, now),
             result: undefined,
@@ -4414,11 +4464,19 @@ function reconcileParallelBatch(deps, config, dispatch, batchId, now, result, pa
  * would be working a unit nothing tracks any more), `sched stop`/`abandon`
  * make a batch terminal without a teardown, and a crash between a run's
  * resolution and its teardown leaves `torn_down: false` behind. Teardown is
- * idempotent, so re-running it is always safe. `alreadyTornDown` names the
- * serial-field tree `teardownMemberWorktree` just handled (a gate-inconclusive
- * member of a blocked parallel batch).
+ * idempotent, so re-running it is always safe. `serial` is what
+ * `teardownMemberWorktree` just did with the serial-field tree (a
+ * gate-inconclusive member of a blocked parallel batch) — its outcome is
+ * recorded on the matching run without a second attempt.
+ *
+ * #855: default to KEEPING. A kept batch's (`worktree_kept`, #768's
+ * members-closed reconcile) trees may hold unpushed operator work: its live
+ * agents are still stopped (non-destructive), but no tree is removed or
+ * pool-returned and `torn_down` stays false, so `sched status`'s
+ * `kept-worktree` warning names them. A run whose earlier teardown failed
+ * (`teardown_failed_at`) is not re-attempted either.
  */
-function teardownParallelRuns(deps, batchId, alreadyTornDown) {
+function teardownParallelRuns(deps, batchId, serial) {
     const batch = (0, state_1.findBatch)(deps.store.load(), batchId);
     if (!batch)
         return;
@@ -4427,15 +4485,25 @@ function teardownParallelRuns(deps, batchId, alreadyTornDown) {
         if (run.torn_down)
             continue;
         stopMemberAgent(deps, batchId, run.issue, now);
+        if (run.teardown_failed_at !== null)
+            continue;
         const landed = run.status === 'landed';
-        deps.store.withLock((s) => ({
-            state: patchRun(s, batchId, run.issue, { status: landed ? 'landed' : 'evicted', gate_inconclusive: null }, now),
-            result: undefined,
-        }));
-        if (run.worktree !== alreadyTornDown) {
-            teardownMemberTree(deps, batchId, runTree(run), landed);
+        const status = landed ? 'landed' : 'evicted';
+        // Only when it changes: a kept batch's runs pass through here every tick.
+        if (run.status !== status || run.gate_inconclusive !== null) {
+            deps.store.withLock((s) => ({
+                state: patchRun(s, batchId, run.issue, { status, gate_inconclusive: null }, now),
+                result: undefined,
+            }));
+        }
+        if (batch.worktree_kept)
+            continue;
+        if (serial !== null && run.worktree === serial.path) {
+            recordRunTeardown(deps, batchId, run.issue, serial.cleared, now);
+        }
+        else {
+            teardownRunTree(deps, batchId, run, landed, now);
         }
-        markTornDown(deps, batchId, run.issue, now);
     }
 }
 /** Kill a parallel member's live agent (pid-start checked) and release its slot. */
@@ -4643,6 +4711,13 @@ function runBatchTick(deps, config, dispatch) {
         if (types_1.TERMINAL_BATCH_STATUSES.has(batch.status)) {
             // #809: `sched stop`/`abandon` end a batch without a teardown — give
             // back every member tree (and stop any agent still running in one).
+            // #855: except a KEPT batch's trees (`worktree_kept`, the members-closed
+            // reconcile's decision — the same one `worktree`/`member_worktree`
+            // get) and a run whose teardown already failed: `teardownParallelRuns`
+            // leaves both on disk with `torn_down: false`, and marks a run torn
+            // down only after a teardown that verifiably landed. Such a batch
+            // re-enters here every tick by design — cheap (a state read per run),
+            // and it stops any agent that is somehow still running in a kept tree.
             if (batch.member_runs.some((r) => !r.torn_down)) {
                 try {
                     teardownParallelRuns(deps, batch.id, null);