@ai-dossier/sched 0.55.1 → 0.57.0

package/dist/batch-dispatch.js

@@ -164,9 +164,18 @@ function sanitizeUntrustedText(value) {
 function journalEvent(deps, event, unitId, extra = {}) {
     deps.journal.append((0, journal_1.unitEvent)(event, unitId, extra), deps.now());
 }
-/** Stop the slot's agent if it is still alive (pid-start-safe: a reused pid is never signalled). */
+/** Whether the slot's agent is still alive (pid-start-safe: a reused pid reads dead). */
+function agentAlive(deps, slot) {
+    return slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined);
+}
+/**
+ * Stop the slot's agent if it is still alive (pid-start-safe: a reused pid is
+ * never signalled). SIGTERM only — no wait, no escalation. A decision that
+ * must not run alongside the agent uses `stopAgentBeforeDeciding` instead,
+ * which escalates to SIGKILL (#844).
+ */
 function killLiveAgent(deps, slot) {
-    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+    if (agentAlive(deps, slot)) {
         deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
     }
 }
@@ -806,9 +815,11 @@ function landMemberBranch(deps, batchId, now) {
  * `-d` after a landing (fully merged into the integration branch), `-D` on
  * the eviction path (its commits never landed; since #810 the parked entry
  * records the branch and an operator requeue continues from the REMOTE copy).
- * The REMOTE member branch is deleted only on the landed path, and
- * deliberately KEPT on eviction — the pushed sha is the evicted work's only
- * recoverable copy.
+ * The REMOTE member branch is never deleted here (#840): on eviction the
+ * pushed sha is the evicted work's only recoverable copy, and after a landing
+ * it is what a later aggregate-suite eviction parks the member on. Batch
+ * teardown deletes it once the batch ships or dissolves
+ * (`deleteMemberBranches`).
  *
  * Best-effort and idempotent: null fields are a no-op, and a failed cleanup
  * journals `teardown-failed` rather than throwing into the caller's
@@ -894,9 +905,6 @@ issue) {
             deps.exec('git', ['branch', flag, branch], deps.repoDir) === null
                 ? `failed-branch-delete-${flag}`
                 : `branch-deleted-${flag}`;
-        if (landed) {
-            deps.exec('git', ['push', 'origin', '--delete', branch], deps.repoDir);
-        }
     }
     const failed = !treeCleared || branchCleanup.startsWith('failed');
     journalEvent(deps, failed ? 'teardown-failed' : 'member-worktree-torn-down', unit(batchId), {
@@ -1285,6 +1293,9 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
     // contract `prepareMemberWorktree` documents). The wedge arm of
     // `runBatchTick` calls this EVERY tick while the batch is `executing`
     // with no slot, so the cheap gates run first:
+    // - recovery (#844): a current member already in `evictions[]` is advanced
+    //   past, never respawned — checked before capacity, since the advance
+    //   needs no slot.
     // - capacity: prep before the free-capacity check would do pool/git/npm
     //   work (and journal) per tick against a full scheduler — the #610/#630/
     //   #632 per-tick emission trap. `claimAndSpawn` re-checks under the lock;
@@ -1301,6 +1312,30 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
     const memberIssue = batch.members[batch.executing_member - 1];
     if (memberIssue === undefined)
         return;
+    const evicted = batch.evictions.find((e) => e.issue === memberIssue);
+    if (evicted !== undefined) {
+        // #844: the member's eviction (and its slot release, in the same write)
+        // landed, but the engine died before advancing past it — possibly before
+        // journaling its cause, too, so the record's cause goes on this line.
+        // Respawning it would dispatch an evicted member again — finish what the
+        // eviction would have done instead: the dissolve its threshold tripped,
+        // or the advance.
+        const kind = evicted.kind ?? 'evicted';
+        journalEvent(deps, 'member-advance-recovered', unit(batchId), {
+            issue: memberIssue,
+            reason: evicted.reason,
+            kind,
+            evicted_at: evicted.at,
+            detail: `member ${batch.executing_member} is already parked ${kind} (${evicted.reason}) but the batch never advanced past it (engine exit mid-eviction) — continuing instead of respawning it`,
+        });
+        if ((0, recovery_1.checkDissolveTrigger)(batch, (0, types_1.resolveDissolvePolicy)(config.dissolve_policy)) &&
+            settleEvictionThreshold(deps, config, batchId, memberIssue, (0, state_1.validatedMembersOf)(state, batch), now)) {
+            result.failed.push(unit(batchId));
+            return;
+        }
+        continuePastEvictedMember(deps, config, dispatch, batchId, batch, memberIssue, now, result);
+        return;
+    }
     if ((0, scheduler_1.freeCapacity)(state, config) === 0)
         return;
     const expectedBranch = memberBranchFor(batchId, batch.executing_member, memberIssue);
@@ -1669,7 +1704,7 @@ function evictOffender(deps, config, batchId, offender, attribution, now, result
     const rDeps = recoveryDeps(deps, config, batch, now);
     const outcome = (0, recovery_1.evictMembers)(state, batchId, { issues: [offender], reason: 'suite-red-after-fix', attribution, ranges: batch.ranges }, rDeps);
     deps.store.withLock((s) => ({
-        state: applyBatchAndIssues(s, outcome.state, batchId, [...outcome.requeued, ...(outcome.dissolve?.parked ?? [])], batch.members),
+        state: applyBatchAndIssues(s, outcome.state, batchId, [...new Set([...outcome.requeued, ...outcome.parked, ...(outcome.dissolve?.parked ?? [])])], batch.members),
         result: undefined,
     }));
     // #810: `dissolve.blocked` — a full dissolve refused over validated
@@ -1772,8 +1807,14 @@ serialTeardown) {
 }
 /**
  * Evict the current member and either dissolve, or continue the batch via
- * `advanceMemberOrValidate` — the shared tail of both member-failure rails
- * (self-reported blocked, and the incremental gate below).
+ * `advanceMemberOrValidate` — the shared tail of the serial member-failure
+ * rails (dead/blocked, the incremental gate below, the wrong-procedure
+ * evictions, and `sched resume --batch`'s recheck).
+ *
+ * #844: a caller whose member still holds its slot MUST pass its release as
+ * `preWrite` — never release under a separate lock first. `evictMemberDirectly` commits
+ * the release with the park/eviction record in one write, so an engine exit
+ * cannot leave the member slotless and un-evicted (and so respawned).
  *
  * #613: `evictMemberDirectly`'s duplicate check (#595) is the one atomic,
  * lock-protected claim on "did THIS member's eviction already happen" — so
@@ -1795,14 +1836,27 @@ serialTeardown) {
  * `runBatchTick`/`resumeBlockedGate` entry points cannot reproduce since
  * both always read state fresh.
  */
-function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, failure, now, result) {
-    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now);
+function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, failure, now, result, 
+/** #844: the member's slot release (or any pre-write) — committed in the eviction's own write. */
+preWrite) {
+    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now, preWrite);
     if (duplicate)
         return;
     if (batchEnded) {
         result.failed.push(unit(batchId));
         return;
     }
+    continuePastEvictedMember(deps, config, dispatch, batchId, batch, memberIssue, now, result);
+}
+/**
+ * The serial rail after a member's eviction has been recorded: tear its tree
+ * down and advance. Also the crash recovery for an engine that died between
+ * the eviction's write and this advance (#844) — `spawnMemberContinuation`
+ * finds the batch still pointing at a member already in `evictions[]` and
+ * continues from here instead of respawning it. `advanceMemberOrValidate`'s
+ * one-shot claim (#613) keeps a re-entry from advancing twice.
+ */
+function continuePastEvictedMember(deps, config, dispatch, batchId, batch, memberIssue, now, result) {
     // #677: the evicted member's commits never landed (eviction is the
     // pre-landing rail), so there is nothing to revert on the integration
     // branch — but its worktree/branch must go, or the next tick's prep for
@@ -1842,7 +1896,9 @@ function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIs
  * configured or both checks came back `ok`, meaning the caller should treat
  * the member as genuinely complete.
  */
-function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result) {
+function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result, 
+/** The member's slot release — handed to the eviction on `failed` (#844). */
+release) {
     if (batch.worktree === null || !deps.runCapability)
         return false;
     // #677: the gate judges the member's OWN work — pre-landing, its diff
@@ -1854,11 +1910,10 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
     if (verdict.kind === 'pass')
         return false;
     if (verdict.kind === 'failed') {
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, { reason: verdict.reason, detail: verdict.detail }, now, result);
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, { reason: verdict.reason, detail: verdict.detail }, now, result, release);
         return true;
     }
-    deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+    deps.store.withLock((s) => ({ state: release(s), result: undefined }));
     // #677: F.11's block semantics are "the member's commit stays on the
     // branch, nothing requeued/reverted" — under member worktrees that is
     // true only if the member LANDS before the batch blocks. The block means
@@ -2176,19 +2231,21 @@ function resumeBlockedGate(deps, config, dispatch, batchId, now) {
             detail: excerpt,
         };
     }
-    deps.store.withLock((s) => ({
-        state: (0, state_1.patchBatch)((0, state_1.transitionBatch)(s, batchId, 'executing', {}, now), batchId, { blocked_reason: null }, now),
-        result: undefined,
-    }));
+    const unblock = (s) => (0, state_1.patchBatch)((0, state_1.transitionBatch)(s, batchId, 'executing', {}, now), batchId, { blocked_reason: null }, now);
     if (recheck.outcome === 'task-failed') {
         const reason = `incremental-gate-failed:${capabilityId}`;
         writeGateLog(deps, batchId, capabilityId, memberIssue, recheck.outputTail);
         evictMemberAndContinue(deps, config, batchDispatch, batchId, batch, memberIssue, {
             reason,
             detail: withExcerpt(`sched resume --batch: cap run ${capabilityId} reported task-failed on recheck`, excerpt),
-        }, now, result);
+        }, now, result, 
+        // #844: the unblock commits with the eviction — two writes left a
+        // slotless `executing` batch whose un-evicted member the wedge arm
+        // then respawned.
+        unblock);
         return { outcome: 'evicted', capability: capabilityId, detail: excerpt };
     }
+    deps.store.withLock((s) => ({ state: unblock(s), result: undefined }));
     journalEvent(deps, 'external-advance', unit(batchId), {
         issue: memberIssue,
         detail: `sched resume --batch: cap run ${capabilityId} reported ok on recheck`,
@@ -2389,6 +2446,84 @@ function wrongProcedureCounts(batch, memberIssue, read) {
     const repromptedAt = Date.parse(prior.reprompted_at);
     return Number.isNaN(at) || Number.isNaN(repromptedAt) ? false : at > repromptedAt;
 }
+/**
+ * A kill timestamp that belongs to the slot's CURRENT dispatch, or null
+ * (#844): one stamped before `spawned_at` was for an earlier dispatch in the
+ * same slot, and an unparseable or future one is no anchor at all.
+ */
+function currentDispatchStamp(stamp, spawnedAt, now) {
+    if (stamp === null)
+        return null;
+    const at = Date.parse(stamp);
+    if (Number.isNaN(at))
+        return null;
+    if (spawnedAt !== null && at < Date.parse(spawnedAt))
+        return null;
+    // A future stamp (clock step, hand edit) would make the elapsed time
+    // negative and switch the escalation off for good — re-stamp instead.
+    if (at > now.getTime())
+        return null;
+    return stamp;
+}
+/**
+ * Stop the slot's agent before a decision that must not run alongside it
+ * (#844). Returns `true` while it is still alive — the caller waits and
+ * decides on a later tick — and `false` once it is gone (or never had a pid).
+ *
+ * The first sight sends SIGTERM, stamps `kill_sent_at` and journals
+ * `member-stop-requested` once; each later tick
+ * re-sends SIGTERM until the agent has outlived it by `KILL_ESCALATION_MS`,
+ * then sends SIGKILL (to its process group — `SpawnDeps.kill`) and journals
+ * `kill-escalated` once (`kill_escalated_at`). Pre-#844 this path re-sent
+ * SIGTERM forever, so an agent ignoring it held its member indefinitely.
+ */
+function stopAgentBeforeDeciding(deps, batchId, memberIssue, slot, now) {
+    if (!agentAlive(deps, slot))
+        return false;
+    const pid = slot.pid;
+    const pidStart = slot.pid_start ?? undefined;
+    const sentAt = currentDispatchStamp(slot.kill_sent_at, slot.spawned_at, now);
+    const aliveForMs = sentAt === null ? 0 : now.getTime() - Date.parse(sentAt);
+    const escalate = sentAt !== null && aliveForMs >= dispatch_1.KILL_ESCALATION_MS;
+    // `kill` refuses a pid whose recorded identity no longer matches (reused by
+    // another process): the agent we spawned is gone, so stop waiting on it.
+    if (!deps.spawnDeps.kill(pid, pidStart, escalate ? 'SIGKILL' : 'SIGTERM'))
+        return false;
+    const firstEscalation = escalate && currentDispatchStamp(slot.kill_escalated_at, slot.spawned_at, now) === null;
+    if (sentAt === null || firstEscalation) {
+        deps.store.withLock((s) => {
+            const live = s.slots.find((x) => x.id === slot.id);
+            // Only the slot still holding THIS agent — never a later dispatch's.
+            if (!live || live.unit !== slot.unit || live.pid !== pid) {
+                return { state: s, result: undefined };
+            }
+            const stamp = now.toISOString();
+            return {
+                state: (0, state_1.patchSlot)(s, slot.id, sentAt === null
+                    ? { kill_sent_at: stamp, kill_escalated_at: null }
+                    : { kill_escalated_at: stamp }, now),
+                result: undefined,
+            };
+        });
+    }
+    if (sentAt === null) {
+        journalEvent(deps, 'member-stop-requested', unit(batchId), {
+            issue: memberIssue,
+            pid,
+            slot: slot.id,
+            detail: `SIGTERM sent — waiting for the agent to exit before deciding (SIGKILL after ${dispatch_1.KILL_ESCALATION_MS / 1000}s)`,
+        });
+    }
+    if (firstEscalation) {
+        journalEvent(deps, 'kill-escalated', unit(batchId), {
+            issue: memberIssue,
+            pid,
+            slot: slot.id,
+            detail: `agent still alive ${Math.round(aliveForMs / 1000)}s after SIGTERM (bound ${dispatch_1.KILL_ESCALATION_MS / 1000}s) — sent SIGKILL (to its process group where available)`,
+        });
+    }
+    return true;
+}
 /**
  * #822 (#810 proposal 3): the member's dispatch ran the wrong procedure (a
  * full-cycle-shaped trail — imboard #4174 ran full-cycle as a batch member).
@@ -2398,23 +2533,27 @@ function wrongProcedureCounts(batch, memberIssue, read) {
  * `reprompted_members` — the wedge arm (serial) or `spawnParallelMembers`
  * (parallel) respawns it in place, in the same worktree, with
  * `wrongProcedureDirective` appended. Returns `'evict'` when the member was
- * already re-prompted once: the caller evicts it `wrong-procedure`.
+ * already re-prompted once: the caller evicts it `wrong-procedure`. On
+ * `'evict'` the slot is NOT released here — the caller passes `release` to
+ * `evictMemberAndContinue`/`evictParallelMember`, which commits it in the
+ * eviction's own write (#844).
  */
 function repromptWrongProcedure(deps, batchId, memberIssue, milestoneAt, slot, release, now) {
     // Never respawn into (or release) a worktree the old agent is still in: a
     // dying full-cycle run could still push, post, or open a PR. Signal it and
     // decide on a later tick, once it is gone — and so the re-prompt's
     // `reprompted_at` fence postdates everything it could still post.
-    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
-        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+    if (stopAgentBeforeDeciding(deps, batchId, memberIssue, slot, now))
         return 'waiting';
-    }
     const outcome = deps.store.withLock((s) => {
-        const released = release(s);
-        const b = (0, state_1.findBatch)(released, batchId);
+        const b = (0, state_1.findBatch)(s, batchId);
         if (!b || b.reprompted_members.some((r) => r.issue === memberIssue)) {
-            return { state: released, result: 'evict' };
+            // #844: NOT released here — the caller's eviction commits the release
+            // in its own write, so a crash in between cannot leave the member
+            // slotless and un-evicted (and so respawned).
+            return { state: s, result: 'evict' };
         }
+        const released = release(s);
         return {
             state: (0, state_1.patchBatch)(released, batchId, {
                 reprompted_members: [
@@ -2455,18 +2594,16 @@ function wrongProcedureFailure(lastTool, shippedPr = null) {
  * #822: the one wrong-procedure decision shared by both member rails —
  * `'waiting'` (the old agent is still dying), `'reprompted'`, or the
  * eviction failure to apply. A run that already shipped is evicted without
- * a re-prompt.
+ * a re-prompt. On an eviction the slot is still held: the caller passes
+ * `release` to the eviction, which commits both in one write (#844).
  */
 function decideWrongProcedure(deps, batchId, memberIssue, milestone, slot, release, lastTool, now) {
     const shipped = (0, groundtruth_1.wrongProcedureShippedPr)(milestone);
     if (shipped !== null) {
-        if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
-            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        if (stopAgentBeforeDeciding(deps, batchId, memberIssue, slot, now))
             return 'waiting';
-        }
-        const tool = lastTool();
-        deps.store.withLock((s) => ({ state: release(s), result: undefined }));
-        return wrongProcedureFailure(tool, shipped);
+        // #844: the caller's eviction releases the slot in its own write.
+        return wrongProcedureFailure(lastTool(), shipped);
     }
     const verdict = repromptWrongProcedure(deps, batchId, memberIssue, milestone.at, slot, release, now);
     if (verdict === 'waiting')
@@ -2521,6 +2658,9 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     const memberIssue = batch.members[batch.executing_member - 1];
     if (memberIssue === undefined)
         return;
+    // #844: every rail below that evicts hands THIS to the eviction, which
+    // commits it in the same write — never released under a lock of its own.
+    const release = (s) => releaseSlot(s, batchId, now);
     const read = readMemberDispatch(deps, batchId, memberIssue, slot, now);
     if (read.kind === 'unreachable')
         return;
@@ -2538,7 +2678,7 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // gate already decided the member's fate (evicted or blocked) and
         // returned early; `false` means both checks were `ok` and the member is
         // genuinely done.
-        if (runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result)) {
+        if (runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result, release)) {
             return;
         }
         completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result);
@@ -2548,9 +2688,9 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     // before the dead/blocked rail, which would otherwise evict it as an
     // unverified exit at the first sight.
     if (wrongProcedureCounts(batch, memberIssue, read) && read.milestone !== null) {
-        const decision = decideWrongProcedure(deps, batchId, memberIssue, read.milestone, slot, (s) => releaseSlot(s, batchId, now), () => recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now), now);
+        const decision = decideWrongProcedure(deps, batchId, memberIssue, read.milestone, slot, release, () => recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now), now);
         if (typeof decision === 'object') {
-            evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, decision, now, result);
+            evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, decision, now, result, release);
         }
         return;
     }
@@ -2566,7 +2706,6 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     }
     if (read.blockedNow || read.dead) {
         const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now);
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
         // A member that never went green (RFC F.1) evicts DIRECTLY — no aggregate
         // suite has run yet, so there is nothing for `attributing`/`evicting` (the
         // AGGREGATE-suite-red pipeline, RFC F.2) to attribute or revert: the
@@ -2575,7 +2714,9 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // attributing → evicting` is not even a legal edge from mid-`executing`
         // (BATCH_TRANSITIONS has no `executing → evicting`) — this stays entirely
         // within `executing`/`dissolving`, both of which ARE legal from here.
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, memberFailureFor(read, lastTool), now, result);
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, memberFailureFor(read, lastTool), now, result, 
+        // #844: released in the eviction's own write, never before it.
+        release);
     }
 }
 /**
@@ -2616,14 +2757,26 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
  * retried by a re-entry: the re-entry takes the duplicate path (pre-existing,
  * #595/#613) and the batch continues.
  */
-function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
+function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now, 
+/**
+ * #844: a state transform applied inside pass 1's lock in every branch —
+ * typically the member's slot release (plus, on the parallel rail, its
+ * run's `evicted` status; on `sched resume --batch`, the batch's
+ * `blocked → executing` transition) — so it and the park/eviction record
+ * commit as ONE write. Pre-#844 callers wrote it under a separate lock
+ * first, and an engine exit between the two left the member in-work with
+ * no slot, which the wedge arm (serial) or `spawnParallelMembers`
+ * (parallel) then respawned.
+ */
+preWrite) {
     const { reason } = failure;
     const kind = failure.kind ?? 'evicted';
     const dissolvePolicy = (0, types_1.resolveDissolvePolicy)(config.dissolve_policy);
     // Pass 1 (pure — park + record the exit): safe to run entirely inside the
     // lock, unlike `dissolveBatch` below, which shells out
     // (`deps.exec`/`postMilestone`) and so must NOT hold the lock while it runs.
-    const { triggered, duplicate, prior, branch, validated } = deps.store.withLock((s) => {
+    const { triggered, duplicate, prior, branch, validated } = deps.store.withLock((held) => {
+        const s = preWrite ? preWrite(held) : held;
         const b = (0, state_1.findBatch)(s, batchId);
         if (!b) {
             return {
@@ -2708,6 +2861,20 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
     });
     if (!triggered)
         return { batchEnded: false, duplicate: false };
+    return {
+        batchEnded: settleEvictionThreshold(deps, config, batchId, memberIssue, validated, now),
+        duplicate: false,
+    };
+}
+/**
+ * Pass 2 of an eviction that tipped the batch past its dissolve threshold:
+ * dissolve it — unless members are already VALIDATED (#810: never dissolve
+ * over landed work; journal `dissolve-suppressed` and continue). Returns
+ * whether the batch's run ended. Shared by `evictMemberDirectly` and #844's
+ * crash recovery in `spawnMemberContinuation`, which re-runs it for an
+ * eviction whose pass 1 landed but whose engine exited before this ran.
+ */
+function settleEvictionThreshold(deps, config, batchId, memberIssue, validated, now) {
     if (validated.length > 0) {
         // #810: never dissolve over validated work — it stays landed and ships
         // with the batch; the members that failed are parked, not requeued.
@@ -2715,19 +2882,19 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
             issue: memberIssue,
             detail: `eviction threshold reached, but member(s) ${validated.join(',')} are validated on the integration branch — keeping them and continuing with the remaining members instead of dissolving`,
         });
-        return { batchEnded: false, duplicate: false };
+        return false;
     }
-    // Pass 2 (outside the lock — dissolveBatch shells out): re-load fresh
-    // (pass 1's write already landed), dissolve, then re-apply just this
-    // batch's + the requeued members' state under a fresh lock.
+    // Outside the lock — dissolveBatch shells out: re-load fresh (pass 1's
+    // write already landed), dissolve, then re-apply just this batch's + the
+    // requeued members' state under a fresh lock.
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch)
-        return { batchEnded: false, duplicate: false };
+        return false;
     const rDeps = recoveryDeps(deps, config, batch, now);
     const outcome = (0, recovery_1.dissolveBatch)(state, batchId, { strategy: 'full', reason: 'eviction-threshold' }, rDeps);
     applyDissolveOutcome(deps, batchId, outcome, now);
-    return { batchEnded: true, duplicate: false };
+    return true;
 }
 function reconcileFixSlot(deps, config, batchId, slot, now, result) {
     if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined))
@@ -3853,6 +4020,7 @@ function teardownBatch(deps, batchId) {
         true;
     const serial = teardownMemberWorktree(deps, batchId, deps.now(), lastMemberLanded);
     teardownParallelRuns(deps, batchId, serial);
+    deleteMemberBranches(deps, batchId);
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.worktree === null)
@@ -3876,6 +4044,30 @@ function teardownBatch(deps, batchId) {
         worktree: batch.worktree,
     });
 }
+/**
+ * #840: `teardownBatch`'s member-branch cleanup — `pruneMemberBranches`
+ * (recovery.ts) plus the journal line. Best-effort: a failed listing or delete
+ * is journaled, never thrown into the teardown path; a kept batch
+ * (`worktree_kept`) never gets here.
+ */
+function deleteMemberBranches(deps, batchId) {
+    const pruned = (0, recovery_1.pruneMemberBranches)(deps.exec, deps.repoDir, deps.store.load(), batchId);
+    if (pruned === null) {
+        journalEvent(deps, 'teardown-failed', unit(batchId), {
+            cleanup: 'member-branches-unlisted',
+            detail: `could not list origin's batch/${batchId}-m* member branches — none deleted`,
+        });
+        return;
+    }
+    const { deleted, kept, failed } = pruned;
+    if (deleted.length + kept.length + failed.length === 0)
+        return;
+    journalEvent(deps, failed.length === 0 ? 'member-branches-deleted' : 'teardown-failed', unit(batchId), {
+        ...(failed.length === 0 ? {} : { cleanup: 'member-branches-delete-failed' }),
+        detail: `deleted=${deleted.join(',') || 'none'} kept=${kept.join(',') || 'none'}` +
+            (failed.length > 0 ? ` failed=${failed.join(',')}` : ''),
+    });
+}
 // --- Parallel member dispatch (#809) ---
 /**
  * How a batch should dispatch its members (#809) — decided once, at the
@@ -4054,7 +4246,10 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
                 evictMemberDirectly(deps, config, batchId, next.issue, {
                     reason: `member-worktree-prep-failed:${prep.reason}`,
                     detail: `member worktree prep failed: ${prep.reason} (member ${next.index} #${next.issue}, branch ${memberBranchFor(batchId, next.index, next.issue)})`,
-                }, now);
+                }, now, 
+                // #844: a run already recorded (a respawn whose tree vanished) must
+                // not stay `running` once its member is evicted.
+                (s) => patchRun(s, batchId, next.issue, { status: 'evicted', gate_inconclusive: null }, now));
                 result.failed.push((0, state_1.batchMemberUnit)(batchId, next.issue));
                 continue;
             }
@@ -4115,17 +4310,19 @@ function spawnParallelMembers(deps, config, dispatch, batchId, now, result) {
  * evicted work's only recoverable copy, as in serial mode). A dissolve this
  * tips over is torn down by `teardownBatch`, which covers every live run.
  */
-function evictParallelMember(deps, config, batchId, run, failure, now, result) {
-    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, run.issue, failure, now);
+function evictParallelMember(deps, config, batchId, run, failure, now, result, 
+/** #844: the member's own slot release — committed in the eviction's write. */
+release) {
+    const { batchEnded, duplicate } = evictMemberDirectly(deps, config, batchId, run.issue, failure, now, 
+    // #844: the run's `evicted` status lands in the eviction's write too — a
+    // separate write left an evicted member's run `running` (slotless, its
+    // tree kept until batch end) when the engine exited in between.
+    (s) => patchRun(release ? release(s) : s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now));
     if (duplicate)
         return;
     result.failed.push(batchEnded ? unit(batchId) : (0, state_1.batchMemberUnit)(batchId, run.issue));
     if (batchEnded)
         return;
-    deps.store.withLock((s) => ({
-        state: patchRun(s, batchId, run.issue, { status: 'evicted', gate_inconclusive: null }, now),
-        result: undefined,
-    }));
     teardownRunTree(deps, batchId, run, false, now);
 }
 /**
@@ -4156,8 +4353,7 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
         recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now);
         const verdict = evaluateIncrementalGate(deps, batchId, run.worktree, run.issue, now);
         if (verdict.kind === 'failed') {
-            deps.store.withLock((s) => ({ state: release(s), result: undefined }));
-            evictParallelMember(deps, config, batchId, run, { reason: verdict.reason, detail: verdict.detail }, now, result);
+            evictParallelMember(deps, config, batchId, run, { reason: verdict.reason, detail: verdict.detail }, now, result, release);
             return;
         }
         deps.store.withLock((s) => ({
@@ -4178,7 +4374,7 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
         read.milestone !== null) {
         const decision = decideWrongProcedure(deps, batchId, run.issue, read.milestone, slot, release, () => recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now), now);
         if (typeof decision === 'object') {
-            evictParallelMember(deps, config, batchId, run, decision, now, result);
+            evictParallelMember(deps, config, batchId, run, decision, now, result, release);
         }
         return;
     }
@@ -4191,8 +4387,7 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
     }
     if (read.blockedNow || read.dead) {
         const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now);
-        deps.store.withLock((s) => ({ state: release(s), result: undefined }));
-        evictParallelMember(deps, config, batchId, run, memberFailureFor(read, lastTool), now, result);
+        evictParallelMember(deps, config, batchId, run, memberFailureFor(read, lastTool), now, result, release);
     }
 }
 /**
@@ -4595,12 +4790,8 @@ function runBatchTick(deps, config, dispatch) {
             const dissolvable = fresh !== undefined && (0, state_1.allowedBatchTransitions)(fresh.status).includes('dissolving');
             if (dissolvable) {
                 // #809: a parallel batch holds one slot per running member too.
-                for (const liveSlot of (0, state_1.slotsForBatch)(current, batch.id)) {
-                    if (liveSlot.pid !== null &&
-                        deps.spawnDeps.isAlive(liveSlot.pid, liveSlot.pid_start ?? undefined)) {
-                        deps.spawnDeps.kill(liveSlot.pid, liveSlot.pid_start ?? undefined);
-                    }
-                }
+                for (const liveSlot of (0, state_1.slotsForBatch)(current, batch.id))
+                    killLiveAgent(deps, liveSlot);
                 const outcome = (0, recovery_1.dissolveBatch)(current, batch.id, {
                     strategy: 'full',
                     reason: `dispatch-profile-missing:${batch.dispatch_profile}`,