@ai-dossier/sched 0.55.1 → 0.56.0

package/README.md

@@ -1097,7 +1097,13 @@ hand-back shape (`blocked`, `review partial`) never counts: it keeps its own pat
 member rails then:
 
 - stop a live agent and wait for it to be gone before anything else (a dying full-cycle run
-  could still push, post or open a PR in that worktree);
+  could still push, post or open a PR in that worktree). The first sight sends SIGTERM
+  (re-sent each tick), stamps `SlotEntry.kill_sent_at` and journals `member-stop-requested`
+  once; an agent still alive `KILL_ESCALATION_MS` (120 s) later
+  is sent SIGKILL — to its process group when its recorded start time confirms its identity
+  (every agent is spawned detached, so it leads one), else to the pid alone — and
+  `kill-escalated` is journaled once (#844). Pre-#844 an agent ignoring SIGTERM held its
+  member here indefinitely;
 - if the milestone shows the run already SHIPPED (a `ship`/`report` phase or a `pr=` key —
   `wrongProcedureShippedPr`), evict it at once `wrong-procedure-shipped`, naming the stray PR
   (`stray_pr`) for the operator to close or reconcile — a re-prompt cannot undo a PR;
@@ -1109,6 +1115,21 @@ member rails then:
   the killed first dispatch's milestones would otherwise still count inside the 60s fence)
   evicts it `wrong-procedure` (parked `evicted`, branch kept, #810).
 
+### A member's slot release and its eviction are one write (#844)
+
+Every member-failure rail — serial dead/blocked, the incremental gate's `task-failed`, both
+wrong-procedure evictions, and their parallel twins — hands the slot release to
+`evictMemberDirectly`, which applies it inside the same lock that parks the member and
+appends its `evictions[]` record. Pre-#844 the release was its own earlier write, and an
+engine exit between the two left the member in-work with no slot: the serial wedge arm or
+`spawnParallelMembers` then dispatched it once more, with no eviction in the journal. An exit
+AFTER the combined write but before the serial advance is recovered too: the wedge arm finds
+the current member already in `evictions[]`, journals `member-advance-recovered` (carrying the
+record's `reason`/`kind`, since the exit may have beaten the `unit-failed` line), and finishes
+what the eviction would have done — the dissolve its threshold tripped, or the advance —
+instead of respawning it. The same one-write rule covers the parallel run's `evicted` status
+and `sched resume --batch`'s `blocked → executing` transition before a recheck eviction.
+
 ## API surface
 
 ```ts
@@ -1137,6 +1158,10 @@ import {
                          //   truth/clock/repoDir/teardownExec/fencer/batchExec/runBatchSuite/
                          //   runBatchCapability — #523)
   createSpawnDeps,       // real detached-spawn process I/O
+  KILL_ESCALATION_MS,    // #844: SIGTERM → SIGKILL bound (120 s) for an agent the batch
+                         //   wrong-procedure wait is stopping
+  type KillSignal,       // #844: 'SIGTERM' | 'SIGKILL' — SpawnDeps.kill's optional 3rd arg
+                         //   (SIGKILL targets the agent's process group on confirmed identity)
   createExecGroundTruth, // runstate/gh/git ground truth via subprocesses (injectable exec);
                          //   since #468 also gh pr view PR state + setup info from comments;
                          //   since #789 also mergedPrForBranch, and since #824
@@ -1431,7 +1456,7 @@ after-the-fact recovery, not a missing-data bug.
   queue data.
 - **Schema**: state/config files from #460 (schema 1.0.0), #464 (1.1.0), #468 (1.2.0),
   #472 (1.3.0), #500 (1.4.0), #505 (1.5.0), #504 (1.6.0), #523 (1.7.0) and #524 (1.8.0)
-  load and migrate to the current schema (1.28.0 — 1.24.0 was #810: no backfill,
+  load and migrate to the current schema (1.29.0 — 1.24.0 was #810: no backfill,
   `kind`/`branch` optional, absent = an `evicted` record with no branch) automatically
   (slot `branch`/`last_head`/`pid_start`, slot `role` (inferred from the
   unit's queue entry, with the persisted `phase` as a fallback — #500), entry
@@ -1458,6 +1483,9 @@ after-the-fact recovery, not a missing-data bug.
   decision, persisted; `false` backfilled) and `MemberRun` gains `teardown_failed_at`
   (`null` backfilled). A 1.27.0 `done` batch still carrying a live member run loads as
   kept — the old engine never recorded the decision, so the default is to keep.
+  Schema 1.29.0 (#844): `SlotEntry` gains `kill_sent_at`/`kill_escalated_at` (the
+  SIGTERM → SIGKILL escalation anchor and its journal dedup marker; `null`/`null`
+  backfilled, cleared when the slot goes idle).
 - **`max_slots`** bounds live units (`assigned | running | recovering`); dependency
   edges gate readiness — an issue with an unmerged dependency, and a batch behind an
   unmerged batch, are never runnable.

package/dist/batch-dispatch.d.ts

@@ -176,8 +176,14 @@ export interface MemberFailure {
 export declare function memberBranchFor(batchId: string, memberIndex: number, issue: number): string;
 /**
  * Evict the current member and either dissolve, or continue the batch via
- * `advanceMemberOrValidate` — the shared tail of both member-failure rails
- * (self-reported blocked, and the incremental gate below).
+ * `advanceMemberOrValidate` — the shared tail of the serial member-failure
+ * rails (dead/blocked, the incremental gate below, the wrong-procedure
+ * evictions, and `sched resume --batch`'s recheck).
+ *
+ * #844: a caller whose member still holds its slot MUST pass its release as
+ * `preWrite` — never release under a separate lock first. `evictMemberDirectly` commits
+ * the release with the park/eviction record in one write, so an engine exit
+ * cannot leave the member slotless and un-evicted (and so respawned).
  *
  * #613: `evictMemberDirectly`'s duplicate check (#595) is the one atomic,
  * lock-protected claim on "did THIS member's eviction already happen" — so
@@ -199,7 +205,9 @@ export declare function memberBranchFor(batchId: string, memberIndex: number, is
  * `runBatchTick`/`resumeBlockedGate` entry points cannot reproduce since
  * both always read state fresh.
  */
-export declare function evictMemberAndContinue(deps: BatchDispatchDeps, config: SchedConfig, dispatch: ResolvedDispatch, batchId: string, batch: BatchEntry, memberIssue: number, failure: MemberFailure, now: Date, result: BatchTickResult): void;
+export declare function evictMemberAndContinue(deps: BatchDispatchDeps, config: SchedConfig, dispatch: ResolvedDispatch, batchId: string, batch: BatchEntry, memberIssue: number, failure: MemberFailure, now: Date, result: BatchTickResult, 
+/** #844: the member's slot release (or any pre-write) — committed in the eviction's own write. */
+preWrite?: (s: SchedState) => SchedState): void;
 /**
  * `sched resume --batch <id>` (#583 AC4): an operator-triggered, synchronous
  * one-shot recheck of a batch blocked on `gate-inconclusive:<capabilityId>`

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAcjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAyBL,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAK9B,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAylBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AAs+CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CAgCN;AA4TD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAuxBD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAuf1C;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3F;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CAmMN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAuG/E;AAED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAoRD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAi3BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAuSjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAUH,OAAO,EAIL,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAcL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EAEf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,WAAW,EAcjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAYtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAyBL,kBAAkB,EAKnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,QAAQ,EAMd,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAGV,UAAU,EAEV,oBAAoB,EAKpB,kBAAkB,EAClB,cAAc,EAId,WAAW,EACX,UAAU,EAEX,MAAM,SAAS,CAAC;AAcjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAK9B,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAmmBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AA0gDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe;AACvB,kGAAkG;AAClG,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,UAAU,GACvC,IAAI,CAgBN;AAoWD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA+KA;AAw5BD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAuf1C;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAuB3F;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACvC,IAAI,CAmMN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAuG/E;AAED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,gBAAgB,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAoRD;;;;;;;;;;;GAWG;AACH,oCAAoC;AACpC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,kBAAkB,CAQpB;AAs4BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAgSjB"}

package/dist/batch-dispatch.js

@@ -164,9 +164,18 @@ function sanitizeUntrustedText(value) {
 function journalEvent(deps, event, unitId, extra = {}) {
     deps.journal.append((0, journal_1.unitEvent)(event, unitId, extra), deps.now());
 }
-/** Stop the slot's agent if it is still alive (pid-start-safe: a reused pid is never signalled). */
+/** Whether the slot's agent is still alive (pid-start-safe: a reused pid reads dead). */
+function agentAlive(deps, slot) {
+    return slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined);
+}
+/**
+ * Stop the slot's agent if it is still alive (pid-start-safe: a reused pid is
+ * never signalled). SIGTERM only — no wait, no escalation. A decision that
+ * must not run alongside the agent uses `stopAgentBeforeDeciding` instead,
+ * which escalates to SIGKILL (#844).
+ */
 function killLiveAgent(deps, slot) {
-    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+    if (agentAlive(deps, slot)) {
         deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
     }
 }
@@ -1285,6 +1294,9 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
     // contract `prepareMemberWorktree` documents). The wedge arm of
     // `runBatchTick` calls this EVERY tick while the batch is `executing`
     // with no slot, so the cheap gates run first:
+    // - recovery (#844): a current member already in `evictions[]` is advanced
+    //   past, never respawned — checked before capacity, since the advance
+    //   needs no slot.
     // - capacity: prep before the free-capacity check would do pool/git/npm
     //   work (and journal) per tick against a full scheduler — the #610/#630/
     //   #632 per-tick emission trap. `claimAndSpawn` re-checks under the lock;
@@ -1301,6 +1313,30 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
     const memberIssue = batch.members[batch.executing_member - 1];
     if (memberIssue === undefined)
         return;
+    const evicted = batch.evictions.find((e) => e.issue === memberIssue);
+    if (evicted !== undefined) {
+        // #844: the member's eviction (and its slot release, in the same write)
+        // landed, but the engine died before advancing past it — possibly before
+        // journaling its cause, too, so the record's cause goes on this line.
+        // Respawning it would dispatch an evicted member again — finish what the
+        // eviction would have done instead: the dissolve its threshold tripped,
+        // or the advance.
+        const kind = evicted.kind ?? 'evicted';
+        journalEvent(deps, 'member-advance-recovered', unit(batchId), {
+            issue: memberIssue,
+            reason: evicted.reason,
+            kind,
+            evicted_at: evicted.at,
+            detail: `member ${batch.executing_member} is already parked ${kind} (${evicted.reason}) but the batch never advanced past it (engine exit mid-eviction) — continuing instead of respawning it`,
+        });
+        if ((0, recovery_1.checkDissolveTrigger)(batch, (0, types_1.resolveDissolvePolicy)(config.dissolve_policy)) &&
+            settleEvictionThreshold(deps, config, batchId, memberIssue, (0, state_1.validatedMembersOf)(state, batch), now)) {
+            result.failed.push(unit(batchId));
+            return;
+        }
+        continuePastEvictedMember(deps, config, dispatch, batchId, batch, memberIssue, now, result);
+        return;
+    }
     if ((0, scheduler_1.freeCapacity)(state, config) === 0)
         return;
     const expectedBranch = memberBranchFor(batchId, batch.executing_member, memberIssue);
@@ -1772,8 +1808,14 @@ serialTeardown) {
 }
 /**
  * Evict the current member and either dissolve, or continue the batch via
- * `advanceMemberOrValidate` — the shared tail of both member-failure rails
- * (self-reported blocked, and the incremental gate below).
+ * `advanceMemberOrValidate` — the shared tail of the serial member-failure
+ * rails (dead/blocked, the incremental gate below, the wrong-procedure
+ * evictions, and `sched resume --batch`'s recheck).
+ *
+ * #844: a caller whose member still holds its slot MUST pass its release as
+ * `preWrite` — never release under a separate lock first. `evictMemberDirectly` commits
+ * the release with the park/eviction record in one write, so an engine exit
+ * cannot leave the member slotless and un-evicted (and so respawned).
  *
  * #613: `evictMemberDirectly`'s duplicate check (#595) is the one atomic,
  * lock-protected claim on "did THIS member's eviction already happen" — so
@@ -1795,14 +1837,27 @@ serialTeardown) {
  * `runBatchTick`/`resumeBlockedGate` entry points cannot reproduce since
  * both always read state fresh.
  */
-function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, failure, now, result) {
-    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now);
+function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, failure, now, result, 
+/** #844: the member's slot release (or any pre-write) — committed in the eviction's own write. */
+preWrite) {
+    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now, preWrite);
     if (duplicate)
         return;
     if (batchEnded) {
         result.failed.push(unit(batchId));
         return;
     }
+    continuePastEvictedMember(deps, config, dispatch, batchId, batch, memberIssue, now, result);
+}
+/**
+ * The serial rail after a member's eviction has been recorded: tear its tree
+ * down and advance. Also the crash recovery for an engine that died between
+ * the eviction's write and this advance (#844) — `spawnMemberContinuation`
+ * finds the batch still pointing at a member already in `evictions[]` and
+ * continues from here instead of respawning it. `advanceMemberOrValidate`'s
+ * one-shot claim (#613) keeps a re-entry from advancing twice.
+ */
+function continuePastEvictedMember(deps, config, dispatch, batchId, batch, memberIssue, now, result) {
     // #677: the evicted member's commits never landed (eviction is the
     // pre-landing rail), so there is nothing to revert on the integration
     // branch — but its worktree/branch must go, or the next tick's prep for
@@ -1842,7 +1897,9 @@ function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIs
  * configured or both checks came back `ok`, meaning the caller should treat
  * the member as genuinely complete.
  */
-function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result) {
+function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result, 
+/** The member's slot release — handed to the eviction on `failed` (#844). */
+release) {
     if (batch.worktree === null || !deps.runCapability)
         return false;
     // #677: the gate judges the member's OWN work — pre-landing, its diff
@@ -1854,11 +1911,10 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
     if (verdict.kind === 'pass')
         return false;
     if (verdict.kind === 'failed') {
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, { reason: verdict.reason, detail: verdict.detail }, now, result);
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, { reason: verdict.reason, detail: verdict.detail }, now, result, release);
         return true;
     }
-    deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+    deps.store.withLock((s) => ({ state: release(s), result: undefined }));
     // #677: F.11's block semantics are "the member's commit stays on the
     // branch, nothing requeued/reverted" — under member worktrees that is
     // true only if the member LANDS before the batch blocks. The block means
@@ -2176,19 +2232,21 @@ function resumeBlockedGate(deps, config, dispatch, batchId, now) {
             detail: excerpt,
         };
     }
-    deps.store.withLock((s) => ({
-        state: (0, state_1.patchBatch)((0, state_1.transitionBatch)(s, batchId, 'executing', {}, now), batchId, { blocked_reason: null }, now),
-        result: undefined,
-    }));
+    const unblock = (s) => (0, state_1.patchBatch)((0, state_1.transitionBatch)(s, batchId, 'executing', {}, now), batchId, { blocked_reason: null }, now);
     if (recheck.outcome === 'task-failed') {
         const reason = `incremental-gate-failed:${capabilityId}`;
         writeGateLog(deps, batchId, capabilityId, memberIssue, recheck.outputTail);
         evictMemberAndContinue(deps, config, batchDispatch, batchId, batch, memberIssue, {
             reason,
             detail: withExcerpt(`sched resume --batch: cap run ${capabilityId} reported task-failed on recheck`, excerpt),
-        }, now, result);
+        }, now, result, 
+        // #844: the unblock commits with the eviction — two writes left a
+        // slotless `executing` batch whose un-evicted member the wedge arm
+        // then respawned.
+        unblock);
         return { outcome: 'evicted', capability: capabilityId, detail: excerpt };
     }
+    deps.store.withLock((s) => ({ state: unblock(s), result: undefined }));
     journalEvent(deps, 'external-advance', unit(batchId), {
         issue: memberIssue,
         detail: `sched resume --batch: cap run ${capabilityId} reported ok on recheck`,
@@ -2389,6 +2447,84 @@ function wrongProcedureCounts(batch, memberIssue, read) {
     const repromptedAt = Date.parse(prior.reprompted_at);
     return Number.isNaN(at) || Number.isNaN(repromptedAt) ? false : at > repromptedAt;
 }
+/**
+ * A kill timestamp that belongs to the slot's CURRENT dispatch, or null
+ * (#844): one stamped before `spawned_at` was for an earlier dispatch in the
+ * same slot, and an unparseable or future one is no anchor at all.
+ */
+function currentDispatchStamp(stamp, spawnedAt, now) {
+    if (stamp === null)
+        return null;
+    const at = Date.parse(stamp);
+    if (Number.isNaN(at))
+        return null;
+    if (spawnedAt !== null && at < Date.parse(spawnedAt))
+        return null;
+    // A future stamp (clock step, hand edit) would make the elapsed time
+    // negative and switch the escalation off for good — re-stamp instead.
+    if (at > now.getTime())
+        return null;
+    return stamp;
+}
+/**
+ * Stop the slot's agent before a decision that must not run alongside it
+ * (#844). Returns `true` while it is still alive — the caller waits and
+ * decides on a later tick — and `false` once it is gone (or never had a pid).
+ *
+ * The first sight sends SIGTERM, stamps `kill_sent_at` and journals
+ * `member-stop-requested` once; each later tick
+ * re-sends SIGTERM until the agent has outlived it by `KILL_ESCALATION_MS`,
+ * then sends SIGKILL (to its process group — `SpawnDeps.kill`) and journals
+ * `kill-escalated` once (`kill_escalated_at`). Pre-#844 this path re-sent
+ * SIGTERM forever, so an agent ignoring it held its member indefinitely.
+ */
+function stopAgentBeforeDeciding(deps, batchId, memberIssue, slot, now) {
+    if (!agentAlive(deps, slot))
+        return false;
+    const pid = slot.pid;
+    const pidStart = slot.pid_start ?? undefined;
+    const sentAt = currentDispatchStamp(slot.kill_sent_at, slot.spawned_at, now);
+    const aliveForMs = sentAt === null ? 0 : now.getTime() - Date.parse(sentAt);
+    const escalate = sentAt !== null && aliveForMs >= dispatch_1.KILL_ESCALATION_MS;
+    // `kill` refuses a pid whose recorded identity no longer matches (reused by
+    // another process): the agent we spawned is gone, so stop waiting on it.
+    if (!deps.spawnDeps.kill(pid, pidStart, escalate ? 'SIGKILL' : 'SIGTERM'))
+        return false;
+    const firstEscalation = escalate && currentDispatchStamp(slot.kill_escalated_at, slot.spawned_at, now) === null;
+    if (sentAt === null || firstEscalation) {
+        deps.store.withLock((s) => {
+            const live = s.slots.find((x) => x.id === slot.id);
+            // Only the slot still holding THIS agent — never a later dispatch's.
+            if (!live || live.unit !== slot.unit || live.pid !== pid) {
+                return { state: s, result: undefined };
+            }
+            const stamp = now.toISOString();
+            return {
+                state: (0, state_1.patchSlot)(s, slot.id, sentAt === null
+                    ? { kill_sent_at: stamp, kill_escalated_at: null }
+                    : { kill_escalated_at: stamp }, now),
+                result: undefined,
+            };
+        });
+    }
+    if (sentAt === null) {
+        journalEvent(deps, 'member-stop-requested', unit(batchId), {
+            issue: memberIssue,
+            pid,
+            slot: slot.id,
+            detail: `SIGTERM sent — waiting for the agent to exit before deciding (SIGKILL after ${dispatch_1.KILL_ESCALATION_MS / 1000}s)`,
+        });
+    }
+    if (firstEscalation) {
+        journalEvent(deps, 'kill-escalated', unit(batchId), {
+            issue: memberIssue,
+            pid,
+            slot: slot.id,
+            detail: `agent still alive ${Math.round(aliveForMs / 1000)}s after SIGTERM (bound ${dispatch_1.KILL_ESCALATION_MS / 1000}s) — sent SIGKILL (to its process group where available)`,
+        });
+    }
+    return true;
+}
 /**
  * #822 (#810 proposal 3): the member's dispatch ran the wrong procedure (a
  * full-cycle-shaped trail — imboard #4174 ran full-cycle as a batch member).
@@ -2398,23 +2534,27 @@ function wrongProcedureCounts(batch, memberIssue, read) {
  * `reprompted_members` — the wedge arm (serial) or `spawnParallelMembers`
  * (parallel) respawns it in place, in the same worktree, with
  * `wrongProcedureDirective` appended. Returns `'evict'` when the member was
- * already re-prompted once: the caller evicts it `wrong-procedure`.
+ * already re-prompted once: the caller evicts it `wrong-procedure`. On
+ * `'evict'` the slot is NOT released here — the caller passes `release` to
+ * `evictMemberAndContinue`/`evictParallelMember`, which commits it in the
+ * eviction's own write (#844).
  */
 function repromptWrongProcedure(deps, batchId, memberIssue, milestoneAt, slot, release, now) {
     // Never respawn into (or release) a worktree the old agent is still in: a
     // dying full-cycle run could still push, post, or open a PR. Signal it and
     // decide on a later tick, once it is gone — and so the re-prompt's
     // `reprompted_at` fence postdates everything it could still post.
-    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
-        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+    if (stopAgentBeforeDeciding(deps, batchId, memberIssue, slot, now))
         return 'waiting';
-    }
     const outcome = deps.store.withLock((s) => {
-        const released = release(s);
-        const b = (0, state_1.findBatch)(released, batchId);
+        const b = (0, state_1.findBatch)(s, batchId);
         if (!b || b.reprompted_members.some((r) => r.issue === memberIssue)) {
-            return { state: released, result: 'evict' };
+            // #844: NOT released here — the caller's eviction commits the release
+            // in its own write, so a crash in between cannot leave the member
+            // slotless and un-evicted (and so respawned).
+            return { state: s, result: 'evict' };
         }
+        const released = release(s);
         return {
             state: (0, state_1.patchBatch)(released, batchId, {
                 reprompted_members: [
@@ -2455,18 +2595,16 @@ function wrongProcedureFailure(lastTool, shippedPr = null) {
  * #822: the one wrong-procedure decision shared by both member rails —
  * `'waiting'` (the old agent is still dying), `'reprompted'`, or the
  * eviction failure to apply. A run that already shipped is evicted without
- * a re-prompt.
+ * a re-prompt. On an eviction the slot is still held: the caller passes
+ * `release` to the eviction, which commits both in one write (#844).
  */
 function decideWrongProcedure(deps, batchId, memberIssue, milestone, slot, release, lastTool, now) {
     const shipped = (0, groundtruth_1.wrongProcedureShippedPr)(milestone);
     if (shipped !== null) {
-        if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
-            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        if (stopAgentBeforeDeciding(deps, batchId, memberIssue, slot, now))
             return 'waiting';
-        }
-        const tool = lastTool();
-        deps.store.withLock((s) => ({ state: release(s), result: undefined }));
-        return wrongProcedureFailure(tool, shipped);
+        // #844: the caller's eviction releases the slot in its own write.
+        return wrongProcedureFailure(lastTool(), shipped);
     }
     const verdict = repromptWrongProcedure(deps, batchId, memberIssue, milestone.at, slot, release, now);
     if (verdict === 'waiting')
@@ -2521,6 +2659,9 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     const memberIssue = batch.members[batch.executing_member - 1];
     if (memberIssue === undefined)
         return;
+    // #844: every rail below that evicts hands THIS to the eviction, which
+    // commits it in the same write — never released under a lock of its own.
+    const release = (s) => releaseSlot(s, batchId, now);
     const read = readMemberDispatch(deps, batchId, memberIssue, slot, now);
     if (read.kind === 'unreachable')
         return;
@@ -2538,7 +2679,7 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // gate already decided the member's fate (evicted or blocked) and
         // returned early; `false` means both checks were `ok` and the member is
         // genuinely done.
-        if (runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result)) {
+        if (runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result, release)) {
             return;
         }
         completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result);
@@ -2548,9 +2689,9 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     // before the dead/blocked rail, which would otherwise evict it as an
     // unverified exit at the first sight.
     if (wrongProcedureCounts(batch, memberIssue, read) && read.milestone !== null) {
-        const decision = decideWrongProcedure(deps, batchId, memberIssue, read.milestone, slot, (s) => releaseSlot(s, batchId, now), () => recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now), now);
+        const decision = decideWrongProcedure(deps, batchId, memberIssue, read.milestone, slot, release, () => recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now), now);
         if (typeof decision === 'object') {
-            evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, decision, now, result);
+            evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, decision, now, result, release);
         }
         return;
     }
@@ -2566,7 +2707,6 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     }
     if (read.blockedNow || read.dead) {
         const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now);
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
         // A member that never went green (RFC F.1) evicts DIRECTLY — no aggregate
         // suite has run yet, so there is nothing for `attributing`/`evicting` (the
         // AGGREGATE-suite-red pipeline, RFC F.2) to attribute or revert: the
@@ -2575,7 +2715,9 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // attributing → evicting` is not even a legal edge from mid-`executing`
         // (BATCH_TRANSITIONS has no `executing → evicting`) — this stays entirely
         // within `executing`/`dissolving`, both of which ARE legal from here.
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, memberFailureFor(read, lastTool), now, result);
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, memberFailureFor(read, lastTool), now, result, 
+        // #844: released in the eviction's own write, never before it.
+        release);
     }
 }
 /**
@@ -2616,14 +2758,26 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
  * retried by a re-entry: the re-entry takes the duplicate path (pre-existing,
  * #595/#613) and the batch continues.
  */
-function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
+function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now, 
+/**
+ * #844: a state transform applied inside pass 1's lock in every branch —
+ * typically the member's slot release (plus, on the parallel rail, its
+ * run's `evicted` status; on `sched resume --batch`, the batch's
+ * `blocked → executing` transition) — so it and the park/eviction record
+ * commit as ONE write. Pre-#844 callers wrote it under a separate lock
+ * first, and an engine exit between the two left the member in-work with
+ * no slot, which the wedge arm (serial) or `spawnParallelMembers`
+ * (parallel) then respawned.
+ */
+preWrite) {
     const { reason } = failure;
     const kind = failure.kind ?? 'evicted';
     const dissolvePolicy = (0, types_1.resolveDissolvePolicy)(config.dissolve_policy);
     // Pass 1 (pure — park + record the exit): safe to run entirely inside the
     // lock, unlike `dissolveBatch` below, which shells out
     // (`deps.exec`/`postMilestone`) and so must NOT hold the lock while it runs.
-    const { triggered, duplicate, prior, branch, validated } = deps.store.withLock((s) => {
+    const { triggered, duplicate, prior, branch, validated } = deps.store.withLock((held) => {
+        const s = preWrite ? preWrite(held) : held;
         const b = (0, state_1.findBatch)(s, batchId);
         if (!b) {
             return {
@@ -2708,6 +2862,20 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
     });
     if (!triggered)
         return { batchEnded: false, duplicate: false };
+    return {
+        batchEnded: settleEvictionThreshold(deps, config, batchId, memberIssue, validated, now),
+        duplicate: false,
+    };
+}
+/**
+ * Pass 2 of an eviction that tipped the batch past its dissolve threshold:
+ * dissolve it — unless members are already VALIDATED (#810: never dissolve
+ * over landed work; journal `dissolve-suppressed` and continue). Returns
+ * whether the batch's run ended. Shared by `evictMemberDirectly` and #844's
+ * crash recovery in `spawnMemberContinuation`, which re-runs it for an
+ * eviction whose pass 1 landed but whose engine exited before this ran.
+ */
+function settleEvictionThreshold(deps, config, batchId, memberIssue, validated, now) {
     if (validated.length > 0) {
         // #810: never dissolve over validated work — it stays landed and ships
         // with the batch; the members that failed are parked, not requeued.
@@ -2715,19 +2883,19 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
             issue: memberIssue,
             detail: `eviction threshold reached, but member(s) ${validated.join(',')} are validated on the integration branch — keeping them and continuing with the remaining members instead of dissolving`,
         });
-        return { batchEnded: false, duplicate: false };
+        return false;
     }
-    // Pass 2 (outside the lock — dissolveBatch shells out): re-load fresh
-    // (pass 1's write already landed), dissolve, then re-apply just this
-    // batch's + the requeued members' state under a fresh lock.
+    // Outside the lock — dissolveBatch shells out: re-load fresh (pass 1's
+    // write already landed), dissolve, then re-apply just this batch's + the
+    // requeued members' state under a fresh lock.
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch)
-        return { batchEnded: false, duplicate: false };
+        return false;
     const rDeps = recoveryDeps(deps, config, batch, now);
     const outcome = (0, recovery_1.dissolveBatch)(state, batchId, { strategy: 'full', reason: 'eviction-threshold' }, rDeps);
     applyDissolveOutcome(deps, batchId, outcome, now);
-    return { batchEnded: true, duplicate: false };
+    return true;
 }
 function reconcileFixSlot(deps, config, batchId, slot, now, result) {
     if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined))
@@ -4054,7 +4222,10 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
                 evictMemberDirectly(deps, config, batchId, next.issue, {
                     reason: `member-worktree-prep-failed:${prep.reason}`,
                     detail: `member worktree prep failed: ${prep.reason} (member ${next.index} #${next.issue}, branch ${memberBranchFor(batchId, next.index, next.issue)})`,
-                }, now);
+                }, now, 
+                // #844: a run already recorded (a respawn whose tree vanished) must
+                // not stay `running` once its member is evicted.
+                (s) => patchRun(s, batchId, next.issue, { status: 'evicted', gate_inconclusive: null }, now));
                 result.failed.push((0, state_1.batchMemberUnit)(batchId, next.issue));
                 continue;
             }
@@ -4115,17 +4286,19 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
  * evicted work's only recoverable copy, as in serial mode). A dissolve this
  * tips over is torn down by `teardownBatch`, which covers every live run.
  */
-function evictParallelMember(deps, config, batchId, run, failure, now, result) {
-    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, run.issue, failure, now);
+function evictParallelMember(deps, config, batchId, run, failure, now, result, 
+/** #844: the member's own slot release — committed in the eviction's write. */
+release) {
+    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, run.issue, failure, now, 
+    // #844: the run's `evicted` status lands in the eviction's write too — a
+    // separate write left an evicted member's run `running` (slotless, its
+    // tree kept until batch end) when the engine exited in between.
+    (s) => patchRun(release ? release(s) : s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now));
     if (duplicate)
         return;
     result.failed.push(batchEnded ? unit(batchId) : (0, state_1.batchMemberUnit)(batchId, run.issue));
     if (batchEnded)
         return;
-    deps.store.withLock((s) => ({
-        state: patchRun(s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now),
-        result: undefined,
-    }));
     teardownRunTree(deps, batchId, run, false, now);
 }
 /**
@@ -4156,8 +4329,7 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
         recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now);
         const verdict = evaluateIncrementalGate(deps, batchId, run.worktree, run.issue, now);
         if (verdict.kind === 'failed') {
-            deps.store.withLock((s) => ({ state: release(s), result: undefined }));
-            evictParallelMember(deps, config, batchId, run, { reason: verdict.reason, detail: verdict.detail }, now, result);
+            evictParallelMember(deps, config, batchId, run, { reason: verdict.reason, detail: verdict.detail }, now, result, release);
             return;
         }
         deps.store.withLock((s) => ({
@@ -4178,7 +4350,7 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
         read.milestone !== null) {
         const decision = decideWrongProcedure(deps, batchId, run.issue, read.milestone, slot, release, () => recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now), now);
         if (typeof decision === 'object') {
-            evictParallelMember(deps, config, batchId, run, decision, now, result);
+            evictParallelMember(deps, config, batchId, run, decision, now, result, release);
         }
         return;
     }
@@ -4191,8 +4363,7 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
     }
     if (read.blockedNow || read.dead) {
         const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now);
-        deps.store.withLock((s) => ({ state: release(s), result: undefined }));
-        evictParallelMember(deps, config, batchId, run, memberFailureFor(read, lastTool), now, result);
+        evictParallelMember(deps, config, batchId, run, memberFailureFor(read, lastTool), now, result, release);
     }
 }
 /**
@@ -4595,12 +4766,8 @@ function runBatchTick(deps, config, dispatch) {
             const dissolvable = fresh !== undefined && (0, state_1.allowedBatchTransitions)(fresh.status).includes('dissolving');
             if (dissolvable) {
                 // #809: a parallel batch holds one slot per running member too.
-                for (const liveSlot of (0, state_1.slotsForBatch)(current, batch.id)) {
-                    if (liveSlot.pid !== null &&
-                        deps.spawnDeps.isAlive(liveSlot.pid, liveSlot.pid_start ?? undefined)) {
-                        deps.spawnDeps.kill(liveSlot.pid, liveSlot.pid_start ?? undefined);
-                    }
-                }
+                for (const liveSlot of (0, state_1.slotsForBatch)(current, batch.id))
+                    killLiveAgent(deps, liveSlot);
                 const outcome = (0, recovery_1.dissolveBatch)(current, batch.id, {
                     strategy: 'full',
                     reason: `dispatch-profile-missing:${batch.dispatch_profile}`,