@hone-ai/cli 1.38.1 → 1.40.0

package/lib/batch-follow.js

@@ -14,12 +14,39 @@
  *  - The loop never approves and never posts a verdict (`verify-patch --report` does). It never passes
  *    `--trust-source`, `--skip-verify`, `--ready` or `--acknowledge-*`: an untrusted story stays paused for a
  *    person (HC-GF-270), and so does one whose repository never consented to running its tests (HC-GF-064).
+ *  - HC-GF-363: under `verification.gate: enforce` the server refuses to approve a step_4 attempt whose
+ *    verify-patch verdict is `fail`, and the loop used to stop there (exit 2). It now sends that one case back
+ *    to the builder: POST /orchestrate/:runId/reject at step_4, with the measured failing tests as the reason,
+ *    at most AUTO_REJECT_LIMIT (2) times per run. It rejects ONLY when every one of these holds: the gate is
+ *    enforce for verify-patch, the server refuses approval, the latest completed step_4 attempt's LATEST
+ *    verify-patch record says `fail` (not timeout, unresolved, not_run, error, pass_narrowed), the run's error
+ *    says the same, and fewer than two earlier attempts carry AUTO_REJECT_PREFIX in their reject reason. The
+ *    count is read from the server's rows on every decision, never kept here, so a restart cannot reset it; a
+ *    read that fails means "unknown", and unknown never rejects. The two rejects spend step_4's re-execution
+ *    budget (`max_retries_per_step`, default 2): a later step_5 route-back can pause MAX_RETRIES_EXCEEDED.
+ *    A run stopped at the limit is named for a person (step, attempts, count, last failure) and the loop exits 2.
+ *    Upgrading changes one thing: a run already paused on a refused `fail` is rejected on the first tick.
  *  - It stops BEFORE acting when a breaker has fired. A terminal batch ends the loop after one last emit-pr pass.
  *  - It is idempotent across restarts: an attempt that already has a verify-patch verdict on the server is not
  *    verified again, and emit-pr's BRANCH_CONFLICT (5) means the branch was already emitted.
+ *  - HC-GF-351: it is never silent. A run paused at anything the loop cannot act on is named once, with its step
+ *    and the first line of why; when every unfinished run is waiting on a person the loop stops with NEEDS_YOU
+ *    instead of waiting out its deadline. And a run hard-paused for files it was not given is re-served ONCE: the
+ *    paused run is killed with a reason that names the new batch (the next start reads it back, which is what
+ *    makes the bound survive a restart), and its story is queued again as a one-story batch whose line carries
+ *    the files, which the loop then follows too. Only paths cli/lib/context-reserve.js lets through are served.
+ *    Killing a run FAILS every queued or paused run in its batch that lists it in `config.dependsOnRunIds`
+ *    (server/src/services/batch-deps.js cascadeOnFailure), so a run anything depends on is never re-served, and the
+ *    decision reads that list, not the dependents' waiting message, which names only one of their blockers.
  */
 
 const { classifyPollState, POLL_OUTCOMES } = require('./poll-decision');
+const { routerSafe } = require('./verify-patch');
+const { formatStoryLine } = require('./story-line');
+const { isGitRev, isStoryId } = require('./run-target');
+const {
+  reserveReason, reservedBatchOf, hardPauseRequest, judgeRequest, originalPathsOf, batchIdFromQueueOutput,
+} = require('./context-reserve');
 
 /** follow-batch's own exit codes. */
 const EXIT = Object.freeze({ DONE: 0, FATAL: 1, NEEDS_YOU: 2, DEADLINE: 3 });
@@ -78,10 +105,26 @@ function isTerminal(batch) {
   return !!(batch && batch.status && batch.status !== 'active');
 }
 
-/** The verify-patch verdict the server already holds for this run's step_4 attempt, or null. */
+/**
+ * The verify-patch verdict the server holds for this run's step_4 attempt, or null: the LATEST record for it, as the
+ * server reads them (verdictForAttempt takes the last by reportedAt). A record names its attempt, or carries
+ * `forAttempt` (the latest completed attempt when it arrived). HC-GF-363: this used to return the FIRST match, so an
+ * attempt that failed and then passed read as failed.
+ */
 function priorVerdict(run, attempt) {
   const list = Array.isArray(run && run.verifications) ? run.verifications : [];
-  return list.find((v) => v && v.source === 'verify-patch' && v.stepKey === 'step_4' && Number(v.attempt) === attempt) || null;
+  const forThis = (v) => v && v.source === 'verify-patch' && v.stepKey === 'step_4'
+    && (v.attempt != null ? Number(v.attempt) === attempt : v.forAttempt != null && Number(v.forAttempt) === attempt);
+  let best = null;
+  let bestAt = -Infinity;
+  for (const v of list) {
+    if (!forThis(v)) continue;
+    const at = Date.parse(v.reportedAt);
+    const t = Number.isFinite(at) ? at : -Infinity;
+    // Later by clock wins; equal or unreadable clocks fall back to list order (the server appends).
+    if (best === null || t >= bestAt) { best = v; bestAt = t; }
+  }
+  return best;
 }
 
 /**
@@ -91,7 +134,7 @@ function priorVerdict(run, attempt) {
  */
 function step4Action(run) {
   const c = classifyPollState(run);
-  // Not a step_4 gate: not this loop's business, and nothing to say about it.
+  // Not a step_4 gate: not this function's business. planTick asks otherPause who such a pause waits on (HC-GF-351).
   if (c.outcome !== POLL_OUTCOMES.HUMAN_GATE || c.stepKey !== 'step_4') return { actionable: false };
   const why = String((run && run.errorMessage) || '');
   if (NOT_A_GATE.test(why)) return { actionable: false, reason: `paused, not at a gate: ${firstLine(why)}` };
@@ -109,6 +152,88 @@ function step4Action(run) {
   return { actionable: true, attempt };
 }
 
+/** Marks a step_4 reject reason as this loop's own. It starts the reason (position 0), and is counted back from rows. */
+const AUTO_REJECT_PREFIX = 'auto-rejected by follow-batch: ';
+
+/** Automatic rejects per run. Each one is a full step_4 rebuild plus a verify-patch run. */
+const AUTO_REJECT_LIMIT = 2;
+
+/** The reason's tail, from the server-held verdict detail: one line, no control characters, bounded. */
+const DETAIL_IN_REASON = 1500;
+
+/**
+ * HC-GF-363: is this paused run a step_4 gate whose latest attempt FAILED verification under enforce, so that the
+ * loop may send it back? Every condition, none inferred from another (`approvalRefusal` alone is also set for a
+ * timeout, an unresolved or narrowed run, which are not measured failures and are never sent back):
+ *  1. a human gate at step_4 (not a breaker, budget, retry-limit or hard pause: condition 6 excludes those);
+ *  2. verification.gate is enforce for verify-patch;
+ *  3. the server refuses approval (`approvalRefusal`);
+ *  4. the latest step_4 attempt is completed (attempt L);
+ *  5. the LATEST verify-patch record for L has verdict exactly `fail`;
+ *  6. the run's error message is the one the enforce red branch writes for a `fail`.
+ * The count of earlier rejects (7) is read from the server by the caller: see autoRejectDecision.
+ * @returns {{attempt: number, detail: string}|null}
+ */
+function autoRejectCandidate(run) {
+  const c = classifyPollState(run);
+  if (c.outcome !== POLL_OUTCOMES.HUMAN_GATE || c.stepKey !== 'step_4') return null;
+  // Not a breaker, budget, retry-limit or hard pause (NOT_A_GATE): each carries its own error prefix, so the
+  // enforce-fail message required below already excludes them, and tests/…/batch-follow-reject.test.js drives them.
+  const why = String((run && run.errorMessage) || '');
+  if (!gateEnforced(run.config, 'verify-patch')) return null;
+  if (!run.approvalRefusal) return null;
+  const attempt = currentStep4Attempt(run);
+  if (!attempt) return null;
+  const row = run.steps.find((st) => st && st.stepKey === 'step_4' && (Number(st.attempt) || 1) === attempt);
+  if (!row || row.status !== 'completed') return null;
+  // A hard pause (files the step asked for) that a fail verdict then overwrote the error message of: HC-GF-351's
+  // re-serve owns it, not this reject.
+  const fr = row.diagnostics && row.diagnostics.failure_record;
+  if (fr && fr.context_requests && typeof fr.context_requests === 'object') return null;
+  const v = priorVerdict(run, attempt);
+  if (!v || v.verdict !== 'fail') return null;
+  if (!why.startsWith("verify verdict 'fail' at step_4")) return null;
+  return { attempt, detail: String(v.detail == null ? '' : v.detail) };
+}
+
+/** The attempts (1-based, of `contexts`) whose reject reason starts with the prefix. */
+function autoRejectedAttempts(contexts) {
+  const out = [];
+  (Array.isArray(contexts) ? contexts : []).forEach((ctx, i) => {
+    if (typeof ctx === 'string' && ctx.startsWith(AUTO_REJECT_PREFIX)) out.push(i + 1);
+  });
+  return out;
+}
+
+/**
+ * HC-GF-363: what to do about a paused run, given each earlier step_4 attempt's `errorContext`. Pure.
+ * @param {object} run  a fresh `GET /orchestrate/:runId`
+ * @param {Array<string|null>|null} contexts  `errorContext` of attempts 1..L-1, in order; null when any read failed
+ * @returns {{kind: 'none'} | {kind: 'unknown', attempt: number, why: string}
+ *   | {kind: 'exhausted', attempt: number, count: number, rejected: number[], note: string}
+ *   | {kind: 'reject', attempt: number, n: number, reason: string}}
+ */
+function autoRejectDecision(run, contexts) {
+  const cand = autoRejectCandidate(run);
+  if (!cand) return { kind: 'none' };
+  const L = cand.attempt;
+  if (!Array.isArray(contexts) || contexts.length !== L - 1) {
+    return { kind: 'unknown', attempt: L, why: 'the earlier attempts could not all be read, so the rejects already used are unknown' };
+  }
+  const rejected = autoRejectedAttempts(contexts);
+  const count = rejected.length;
+  const clean = routerSafe(cand.detail).replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').replace(/\s+/g, ' ').trim().slice(0, DETAIL_IN_REASON);
+  if (count >= AUTO_REJECT_LIMIT) {
+    const budget = contexts.some((x) => /MAX_RETRIES_EXCEEDED/.test(String(x || ''))) || /MAX_RETRIES_EXCEEDED/.test(String(run.errorMessage || ''))
+      ? ' MAX_RETRIES_EXCEEDED was seen: the rejects use step_4\'s retry budget.' : '';
+    return { kind: 'exhausted', attempt: L, count, rejected,
+      note: `step_4 attempt ${L} failed verify-patch; ${count} automatic reject(s) used (attempt${rejected.length === 1 ? '' : 's'} ${rejected.join(', ')}); `
+        + `last failure: ${clean.slice(0, 200) || '(no detail)'}.${budget} Read it: hone run-report ${run.runId || '<runId>'}` };
+  }
+  return { kind: 'reject', attempt: L, n: count + 1,
+    reason: `${AUTO_REJECT_PREFIX}attempt ${L} failed verify-patch under verification.gate: enforce (automatic reject ${count + 1} of ${AUTO_REJECT_LIMIT}). ${clean || '(no detail)'}` };
+}
+
 /**
  * The argv for one child verb. Exit codes are the contract; `--format json` only carries detail.
  * @param {'check-patch'|'verify-patch'|'emit-pr'} verb
@@ -124,6 +249,20 @@ function buildArgs(verb, runId, { attempt, openPr = false, branch } = {}) {
   return args;
 }
 
+/**
+ * The argv that queues one story again (HC-GF-351). The file, repository and branch are values from outside this
+ * module, so they ride in `--flag=value` form: a value that starts with a dash cannot become an option. No flag
+ * here overrides a safety gate, and none is `--overnight` (the loop does not know the original batch's mode).
+ * @param {string} file  a stories file holding the one line
+ */
+function buildReserveArgs(file, { repoName, branch } = {}) {
+  const args = ['queue-stories', `--file=${file}`];
+  if (repoName) args.push(`--repo=${repoName}`);
+  if (branch && isGitRev(branch)) args.push(`--branch=${branch}`);
+  args.push('--format', 'json');
+  return args;
+}
+
 /** The step_4 attempt a run is on now: the highest step_4 attempt in its steps, or null. */
 function currentStep4Attempt(run) {
   const steps = Array.isArray(run && run.steps) ? run.steps : [];
@@ -147,25 +286,207 @@ function draftBranch(storyId, runId, attempt) {
   return `hone/${storyId || 'story'}-${String(runId).slice(0, 8)}-a${attempt}`;
 }
 
+/** One line of agent- or server-written text, safe to print: control characters (a terminal escape) become spaces. */
+const oneLine = (s, max = 240) => firstLine(String(s || '')).replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').trim().slice(0, max);
+
+/** Polls an accepted reject may wait for the worker before a person is told. */
+const REJECT_WAIT_TICKS = 20;
+
+/** The statuses a batch child ends in. Anything else is still moving as far as the loop can tell. */
+const TERMINAL_RUN = new Set(['completed', 'failed', 'killed', 'stalled']);
+
+/** The shape every planTick return carries, so a caller never meets an absent field. `stop` is always the caller's. */
+const tickPlan = (over) => ({ actions: [], notes: [], waiting: [], moving: 0, follow: [], rejecting: [], ...over });
+
+/**
+ * Batches the server's own rows say were re-served: a killed run whose reason names the batch its story went on in.
+ * @param {object} batch  a `GET /orchestrate/batch/:id` payload
+ * @returns {Array<{storyId: string, batchId: string}>}
+ */
+function reservedFrom(batch) {
+  const out = [];
+  for (const r of Array.isArray(batch && batch.runs) ? batch.runs : []) {
+    const batchId = reservedBatchOf(r);
+    if (batchId) out.push({ storyId: r.storyId, batchId });
+  }
+  return out;
+}
+
+/**
+ * A paused run that is not at a step_4 gate and has no request to serve: who is it waiting on?
+ * `person`: a gate or a refusal only a human clears. `dependency`: it will wake when the run it waits on ends.
+ * `moving`: paused without a gate or a reason the loop knows (the server decides what is next); a poll more costs
+ * an interval, and calling it stuck would end a live run.
+ * @returns {{kind: 'person', stepKey: string|null, reason: string}|{kind: 'dependency'}|{kind: 'moving'}}
+ */
+function otherPause(run, row) {
+  const msg = String((run && run.errorMessage) || '');
+  const stepKey = (run && run.currentStep) || (row && row.currentStep) || null;
+  if (/^BATCH_DEPENDENCY_WAITING:/.test(msg)) return { kind: 'dependency' };
+  const c = classifyPollState(run);
+  if (c.outcome === POLL_OUTCOMES.EDITOR_PARKED) {
+    return { kind: 'person', stepKey, reason: 'parked for your editor (execution.mode: editor): submit its output, then approve' };
+  }
+  if (c.outcome === POLL_OUTCOMES.EXHAUSTED || NOT_A_GATE.test(msg)) return { kind: 'person', stepKey, reason: oneLine(msg) };
+  if (c.outcome === POLL_OUTCOMES.HUMAN_GATE) {
+    return { kind: 'person', stepKey, reason: msg ? oneLine(msg) : `awaiting your approval: hone run-story ${run.runId} --approve ${stepKey}` };
+  }
+  return { kind: 'moving' };
+}
+
+/**
+ * True when a verdict from `source` drives the step_4 gate on this run. Mirrors isEnforced in
+ * server/src/services/verification-refusal.js (the CLI does not ship server code); tests/regression/HC-GF-351 pins
+ * the two equal.
+ */
+function gateEnforced(config, source = 'verify-patch') {
+  const mode = String((config && config.verification_gate) || 'advisory').toLowerCase();
+  const sources = config && Array.isArray(config.verification_gate_sources) && config.verification_gate_sources.length
+    ? config.verification_gate_sources : ['verify-patch'];
+  return mode === 'enforce' && sources.includes(source);
+}
+
+/**
+ * A paused step_4 gate whose attempt passed verify-patch under `verification_gate: enforce`. The pass only QUEUES the
+ * approval (POST /:runId/verdict → enqueueApproval); the run stays paused at step_4 until a worker takes the job. It
+ * is moving, not waiting on a person, and saying "approve it" in that window sends the operator to a gate that is
+ * already being approved.
+ */
+function approvalQueued(run) {
+  const why = String((run && run.errorMessage) || '');
+  return !!run && run.currentStep === 'step_4' && !NOT_A_GATE.test(why) && !run.approvalRefusal
+    && gateEnforced(run.config) && verifiedStep4Attempt(run) !== null;
+}
+
+/** step_0 → 0, step_4 → 400, step_5b → 502: the order steps run in, for "after step_4". NaN for a key it cannot read. */
+function stepRank(stepKey) {
+  const m = String(stepKey).match(/^step_(\d+)([a-z]?)$/);
+  return m ? Number(m[1]) * 100 + (m[2] ? m[2].charCodeAt(0) - 96 : 0) : NaN;
+}
+
+/**
+ * The queued or paused runs of this batch that killing `runId` would fail: those whose `config.dependsOnRunIds` lists
+ * it, or whose waiting message names it. `unread` are queued or paused runs whose config was not read, so nothing is
+ * known about them.
+ * @returns {{found: string[], unread: string[]}}  story ids
+ */
+function dependentsOf(runId, runs, details) {
+  const found = [];
+  const unread = [];
+  for (const x of runs) {
+    if (!x || x.runId === runId || (x.status !== 'queued' && x.status !== 'paused')) continue;
+    const d = details[x.runId];
+    const listed = !!d && !!d.config && Array.isArray(d.config.dependsOnRunIds) && d.config.dependsOnRunIds.includes(runId);
+    const named = String(x.errorMessage || (d && d.errorMessage) || '').startsWith(`BATCH_DEPENDENCY_WAITING:${runId}`);
+    if (listed || named) found.push(x.storyId);
+    else if (!d) unread.push(x.storyId);
+  }
+  return { found, unread };
+}
+
+/** Why a story that was served before is not served again, in the words of what actually happened. */
+function priorWhy(prior, runId) {
+  const b = prior.batchId;
+  if (prior.state === 'kill-failed') {
+    return `it was queued again as batch ${b}, but this run could not be killed; kill it (hone run-story ${runId} --kill) once you have looked at that batch. Nothing more is tried`;
+  }
+  if (prior.state === 'adopted') {
+    return `a newer run of this story already exists${b ? ` (batch ${b})` : ''}, queued by an earlier re-serve or by you, so it is not re-served again`;
+  }
+  if (prior.state === 'queue-failed') return 're-serving it failed earlier in this run; nothing more is tried';
+  return `it names files again after being re-served as batch ${b}; a second re-serve is not tried`;
+}
+
+/**
+ * HC-GF-351: may this hard-paused run be re-served now? One of
+ *  - `{ action }`: yes, here is the action;
+ *  - `{ retry }`: not this tick, something transient (the text says what), and the run is still moving;
+ *  - `{ why }`: no, and a person has to look.
+ */
+function decideReserve({ r, d, request, runs, details, ctx, prior, planned, batchId }) {
+  if (prior) return { why: priorWhy(prior, r.runId) };
+  if (planned.has(r.storyId)) return { why: 'the same story is hard-paused twice in this batch; only one is re-served' };
+  const dep = dependentsOf(r.runId, runs, details);
+  if (dep.found.length) {
+    return { why: `${dep.found.length} run(s) in this batch depend on it (${dep.found.slice(0, 5).join(', ')}), and killing it fails them` };
+  }
+  if (dep.unread.length) {
+    return { why: `${dep.unread.length} queued or paused run(s) in this batch could not be checked for a dependency on it, and killing it fails its dependents` };
+  }
+  if (!isStoryId(r.storyId)) return { why: 'its story id cannot be written into a stories file' };
+  const rank = stepRank(request.stepKey);
+  const verified = verifiedStep4Attempt(d);
+  if (rank > 400 && verified !== null) {
+    return { why: `step_4 attempt ${verified} already passed verify-patch, and re-serving from ${request.stepKey} would throw that verified work away` };
+  }
+  if (ctx.tracked == null && ctx.trackedRetry) {
+    return { retry: `could not list the files git tracks (${oneLine(ctx.trackedRetry, 120)}); trying again next poll` };
+  }
+  const original = originalPathsOf(d);
+  if (original.dropped) {
+    return { why: `${original.dropped} path(s) on the story's own line hold characters a shell could misread; nothing was served` };
+  }
+  const judged = judgeRequest(request, { tracked: ctx.tracked, realPath: ctx.realPath, original: original.paths });
+  if (!judged.ok) return { why: judged.reason };
+  return { action: { kind: 'reserve', runId: r.runId, storyId: r.storyId, stepKey: request.stepKey, batchId, paths: judged.tokens,
+    since: d.createdAt || null, repoName: r.repoName || ctx.repoName || null, branch: r.branch || null } };
+}
+
+/** What the loop says when every unfinished run is waiting on a person. */
+function stuckReason(waiting) {
+  const who = waiting.map((w) => `${w.storyId} ${w.runId} at ${w.stepKey || 'a step'} (${oneLine(w.reason, 400)})`);
+  return `every unfinished run is waiting on you: ${who.join('; ')}`;
+}
+
 /**
  * One tick's decisions, from the batch and the details of its paused runs. Pure.
+ *
+ * `stop.kind` says why the batch ends the loop: `breaker` (stop before acting), `terminal` (the server settled
+ * it), or `stuck` (HC-GF-351: nothing is running, nothing is left to do, and the unfinished runs wait on a person).
+ * `waiting` lists those runs, `moving` counts the ones still in motion, and `follow` the batches this one's killed
+ * runs were re-served as.
+ *
  * @param {object} batch     `GET /orchestrate/batch/:id`
  * @param {Record<string, object>} details  runId → `GET /orchestrate/:runId`, for paused runs and runs to emit
- * @param {{emitted: Set<string>}} memory   runs whose emit-pr already ran in this process
- * @param {{repoName?: string|null}} [ctx]  this checkout, so a run for another repository is not touched
- * @returns {{stop: {exitCode: number, reason: string}|null, actions: object[], notes: string[]}}
+ * @param {{emitted: Set<string>, reserved?: Map<string, {batchId: string|null, state: string}>}} memory  `emitted`: runs
+ *   whose emit-pr already ran in this process; `reserved`: story → what became of its re-serve (`state`: served,
+ *   kill-failed, queue-failed or adopted)
+ * @param {{repoName?: string|null, openPr?: boolean, tracked?: Set<string>|null, trackedRetry?: string|null,
+ *          realPath?: ((file: string) => string|null)|null}} [ctx]  this checkout, so a run for another repository is
+ *   not touched; `tracked`: the regular files git tracks here, which a request is checked against (`trackedRetry`:
+ *   why listing them failed this tick, which is worth another poll); `realPath`: where a path resolves on the disk
+ * @returns {{stop: {kind: string, exitCode: number, reason: string}|null, actions: object[], notes: string[],
+ *            waiting: Array<{runId: string, storyId: string, stepKey: string|null, reason: string}>,
+ *            moving: number, follow: Array<{storyId: string, batchId: string}>}}
  */
 function planTick(batch, details, memory, ctx = {}) {
   const b = (batch && typeof batch === 'object') ? batch : {};
   const halt = breakerStop(b);
-  if (halt) return { stop: { exitCode: EXIT.NEEDS_YOU, reason: halt }, actions: [], notes: [] };
+  if (halt) return tickPlan({ stop: { kind: 'breaker', exitCode: EXIT.NEEDS_YOU, reason: halt } });
 
   const actions = [];
   const notes = [];
-  for (const r of Array.isArray(b.runs) ? b.runs : []) {
+  const waiting = [];
+  let moving = 0;
+  const rejecting = [];
+  const runs = Array.isArray(b.runs) ? b.runs : [];
+  // Stories already re-served: by this process (memory), or by an earlier one (a killed run says so).
+  const follow = reservedFrom(b);
+  const reserved = new Map(memory.reserved || []);
+  for (const f of follow) reserved.set(f.storyId, { batchId: f.batchId, state: 'served' });
+  const planned = new Set();
+  const waitOn = (r, stepKey, reason) => waiting.push({ runId: r.runId, storyId: r.storyId, stepKey, reason });
+  const needsYou = (r, stepKey, reason) => {
+    const why = oneLine(reason, 400);
+    notes.push(`${r.storyId} ${r.runId} needs you at ${stepKey || 'a step'}: ${why}`);
+    waitOn(r, stepKey, why);
+  };
+
+  for (const r of runs) {
     if (!r || !r.runId) continue;
     if (ctx.repoName && r.repoName && r.repoName !== ctx.repoName) {
       notes.push(`${r.storyId} ${r.runId} belongs to ${r.repoName}, not this checkout (${ctx.repoName}): skipped`);
+      if (!TERMINAL_RUN.has(r.status) && r.status !== 'paused') moving += 1;
       continue;
     }
     if (r.status === 'completed') {
@@ -178,14 +499,19 @@ function planTick(batch, details, memory, ctx = {}) {
       }
       continue;
     }
-    if (r.status !== 'paused' || !details[r.runId]) continue;
+    if (r.status !== 'paused') {
+      if (!TERMINAL_RUN.has(r.status)) moving += 1;
+      continue;
+    }
+    const d = details[r.runId];
+    if (!d) { moving += 1; continue; }
     // HC-GF-301: opening PRs, a step_4 attempt that passed verify-patch gets its draft now, while step_5 and its
     // gate are still ahead, instead of when the whole run completes.
-    const verified = ctx.openPr ? verifiedStep4Attempt(details[r.runId]) : null;
+    const verified = ctx.openPr ? verifiedStep4Attempt(d) : null;
     if (verified && !(memory.drafted && memory.drafted.has(`${r.runId}#${verified}`))) {
-      actions.push({ kind: 'draft', runId: r.runId, storyId: r.storyId, attempt: verified, run: details[r.runId],
+      actions.push({ kind: 'draft', runId: r.runId, storyId: r.storyId, attempt: verified, run: d,
         branch: draftBranch(r.storyId, r.runId, verified) });
-      const vs = Array.isArray(details[r.runId].verifications) ? details[r.runId].verifications : [];
+      const vs = Array.isArray(d.verifications) ? d.verifications : [];
       const earlier = vs.filter((v) => v && v.source === 'verify-patch' && v.stepKey === 'step_4' && v.verdict === 'pass'
         && Number(v.attempt) < verified).map((v) => Number(v.attempt));
       if (earlier.length) {
@@ -193,28 +519,190 @@ function planTick(batch, details, memory, ctx = {}) {
         notes.push(`${r.storyId} ${r.runId}: the draft for attempt ${verified} supersedes the one on ${draftBranch(r.storyId, r.runId, m)}; close that one when you are ready`);
       }
     }
-    const a = step4Action(details[r.runId]);
+
+    // HC-GF-351: a hard pause for files the step was not given. Served once per story, and only if every path passes.
+    const request = hardPauseRequest(d);
+    if (request) {
+      const decided = decideReserve({ r, d, request, runs, details, ctx, prior: reserved.get(r.storyId), planned, batchId: b.batchId });
+      if (decided.action) {
+        planned.add(r.storyId);
+        actions.push(decided.action);
+      } else if (decided.retry) {
+        notes.push(`${r.storyId} ${r.runId}: ${decided.retry}`);
+        moving += 1;
+      } else {
+        needsYou(r, request.stepKey, `it asked for files it was not given: ${decided.why}`);
+      }
+      continue;
+    }
+
+    // HC-GF-363: a refused `fail` is sent back, once per attempt, by the executor, which re-reads the run and the
+    // earlier attempts' rows before it POSTs. `memory.rejected` and `rejectStuck` only stop this tick repeating
+    // itself; the bound is read from the server.
+    const cand = autoRejectCandidate(d);
+    if (cand) {
+      const key = `${r.runId}#${cand.attempt}`;
+      const stuck = memory.rejectStuck && memory.rejectStuck.get(key);
+      if (stuck) needsYou(r, 'step_4', stuck);
+      else if (memory.rejected && memory.rejected.has(key)) { moving += 1; rejecting.push(key); }
+      else actions.push({ kind: 'reject', runId: r.runId, storyId: r.storyId, attempt: cand.attempt, run: d });
+      continue;
+    }
+
+    const a = step4Action(d);
     // verify-patch's verdict POST is best-effort: an attempt this process already ran is not re-run every tick.
     if (a.actionable && memory.tried && memory.tried.has(`${r.runId}#${a.attempt}`)) {
-      notes.push(`${r.storyId} ${r.runId} needs you: attempt ${a.attempt} was verified here but no verdict reached the server`);
+      needsYou(r, 'step_4', `attempt ${a.attempt} was handled here (see the lines above) and the server holds no verdict for it`);
       continue;
     }
     if (a.actionable) {
-      actions.push({ kind: 'verify', runId: r.runId, storyId: r.storyId, attempt: a.attempt, run: details[r.runId] });
+      actions.push({ kind: 'verify', runId: r.runId, storyId: r.storyId, attempt: a.attempt, run: d });
+    } else if (a.reason && approvalQueued(d)) {
+      moving += 1;
     } else if (a.reason) {
-      notes.push(`${r.storyId} ${r.runId} needs you: ${a.reason}`);
+      needsYou(r, 'step_4', a.reason);
+    } else {
+      const p = otherPause(d, r);
+      if (p.kind === 'person') needsYou(r, p.stepKey, p.reason);
+      else if (p.kind === 'moving') moving += 1;
     }
   }
 
-  if (!isTerminal(b)) return { stop: null, actions, notes };
-  const unfinished = (b.counts && ((b.counts.failed || 0) + (b.counts.killed || 0) + (b.counts.stalled || 0))) || 0;
-  return {
+  if (!isTerminal(b)) {
+    const stuck = actions.length === 0 && moving === 0 && waiting.length > 0;
+    return tickPlan({ stop: stuck ? { kind: 'stuck', exitCode: EXIT.NEEDS_YOU, reason: stuckReason(waiting) } : null,
+      actions, notes, waiting, moving, follow, rejecting });
+  }
+  // A killed run that was re-served is not unfinished: its story went on in the batch it names.
+  const raw = (b.counts && ((b.counts.failed || 0) + (b.counts.killed || 0) + (b.counts.stalled || 0))) || 0;
+  const unfinished = Math.max(0, raw - follow.length);
+  return tickPlan({
     stop: unfinished
-      ? { exitCode: EXIT.NEEDS_YOU, reason: `batch ${b.status}: ${unfinished} run(s) did not complete` }
-      : { exitCode: EXIT.DONE, reason: `batch ${b.status}` },
-    actions,
-    notes,
-  };
+      ? { kind: 'terminal', exitCode: EXIT.NEEDS_YOU, reason: `batch ${b.status}: ${unfinished} run(s) did not complete` }
+      : { kind: 'terminal', exitCode: EXIT.DONE, reason: `batch ${b.status}` },
+    actions, notes, waiting, moving, follow, rejecting,
+  });
+}
+
+/**
+ * HC-GF-351: queue the story again with the files its step asked for, then kill the paused run. In that order: the
+ * kill's reason names the new batch (the next start reads it back, which is what keeps the story from being served
+ * twice), and a story with no run in flight is worse than one with two. If the queue fails the paused run is left
+ * alone; if the kill fails the new batch still runs and the paused run is named for a person.
+ *
+ * Before queueing it asks the server whether the story was served already (io.priorServe): a kill that failed, or a
+ * crash between the queue and the kill, leaves no marker, and only a newer run of the same story shows it happened.
+ * @returns {Promise<{lines: string[], needsYou: boolean, batchId: string|null, state: string|null, retry?: boolean}>}
+ *   `batchId`: the batch the story was queued as, set whenever it was, even when the kill then failed; `state`: what
+ *   became of the re-serve (served, kill-failed, queue-failed, adopted); `retry`: nothing was decided, ask again
+ */
+async function reserve(action, io, tag) {
+  if (io.priorServe) {
+    let prior;
+    try {
+      prior = await io.priorServe(action);
+    } catch (e) {
+      return { lines: [`${tag} not re-served yet: could not ask whether the story was served already (${firstLine(e && e.message)}); asking again next poll`],
+        needsYou: false, batchId: null, state: null, retry: true };
+    }
+    if (prior && prior.kind === 'unknown') {
+      return { lines: [`${tag} not re-served: could not tell whether the story was served already; the paused run was left alone`],
+        needsYou: true, batchId: null, state: 'queue-failed' };
+    }
+    if (prior) {
+      const where = prior.batchId ? ` in batch ${prior.batchId}` : '';
+      return { lines: [`${tag} not re-served: run ${prior.runId}${where} is this story's ${prior.kind === 'later' ? 'newer' : 'earlier, re-served'} run; following it`],
+        needsYou: true, batchId: prior.batchId || null, state: 'adopted' };
+    }
+  }
+  let queued;
+  let file = null;
+  try {
+    file = io.writeStoriesFile(`${formatStoryLine({ storyId: action.storyId, paths: action.paths })}\n`);
+    queued = await io.runVerb(buildReserveArgs(file.file, { repoName: action.repoName, branch: action.branch }), { capture: true });
+  } catch (e) {
+    return { lines: [`${tag} not re-served: ${firstLine(e && e.message)}; the paused run was left alone`], needsYou: true, batchId: null, state: 'queue-failed' };
+  } finally {
+    if (file) file.remove();
+  }
+  const batchId = queued.code === 0 ? batchIdFromQueueOutput(queued.stdout) : null;
+  if (!batchId) {
+    const why = queued.code === 0 ? 'printed no batch id' : `exited ${queued.code}`;
+    return { lines: [`${tag} not re-served: queue-stories ${why}; the paused run was left alone`], needsYou: true, batchId: null, state: 'queue-failed' };
+  }
+  const lines = [`${tag} ${action.stepKey} named files it was not given: queued batch ${batchId} with paths:${action.paths.join(',')}`];
+  try {
+    await io.killRun(action.runId, reserveReason(batchId, action.stepKey));
+  } catch (e) {
+    const status = e && e.response && e.response.status;
+    lines.push(`${tag} could NOT kill the paused run (${status || firstLine(e && e.message)}); it is still paused beside batch ${batchId}: kill it with hone run-story ${action.runId} --kill`);
+    return { lines, needsYou: true, batchId, state: 'kill-failed' };
+  }
+  lines.push(`${tag} killed the paused run: ${reserveReason(batchId, action.stepKey)}`);
+  return { lines, needsYou: false, batchId, state: 'served' };
+}
+
+/** The HTTP status of a thrown axios error, or undefined. */
+const statusOf = (e) => (e && e.response && e.response.status) || undefined;
+
+/**
+ * HC-GF-363: send a refused step_4 `fail` back to the builder, if the bound allows. Re-reads the run and re-decides
+ * right before the POST (the plan is up to one poll old), then counts the earlier rejects from each earlier attempt's
+ * stored reject reason. Any read that fails means the count is unknown, and unknown never rejects.
+ * @returns {Promise<{lines: string[], needsYou: boolean, state: 'posted'|'moved'|'stuck'|'retry', note?: string,
+ *   countsRead?: boolean, fatal?: string}>}
+ *   `retry`: nothing was sent, ask again next poll (`countsRead: true` when it was a read that failed, which is
+ *   given up on after three); `fatal`: the server answered 401, 403 or 404 where it never should
+ */
+async function autoReject(action, io, tag) {
+  const where = `step_4 attempt ${action.attempt}`;
+  const fatal = (e, what) => ([401, 403, 404].includes(statusOf(e)) ? `the server answered ${statusOf(e)} while ${what}` : null);
+  if (!io.rejectRun || !io.fetchStep) {
+    return { lines: [`${tag} ${where} failed verification; this client cannot reject, so it is left for you`], needsYou: true, state: 'stuck', note: `${where} failed verification and was not sent back` };
+  }
+  let fresh;
+  try {
+    fresh = await io.fetchRun(action.runId);
+  } catch (e) {
+    const f = fatal(e, `re-reading run ${action.runId}`);
+    if (f) return { lines: [], needsYou: false, state: 'retry', fatal: f };
+    return { lines: [`${tag} not rejected yet: could not re-read the run (${firstLine(e && e.message)}); asking again next poll`], needsYou: false, state: 'retry' };
+  }
+  const now = autoRejectCandidate(fresh);
+  if (!now || now.attempt !== action.attempt) {
+    return { lines: [`${tag} ${where} is no longer a refused failure; nothing sent`], needsYou: false, state: 'moved' };
+  }
+  const contexts = [];
+  for (let k = 1; k < action.attempt; k += 1) {
+    try {
+      const row = await io.fetchStep(action.runId, 'step_4', k);
+      contexts.push(row && typeof row.errorContext === 'string' ? row.errorContext : null);
+    } catch (e) {
+      return { lines: [`${tag} not rejected yet: could not read step_4 attempt ${k} (${statusOf(e) || firstLine(e && e.message)}), so the rejects already used are unknown; asking again next poll`],
+        needsYou: false, state: 'retry', countsRead: true };
+    }
+  }
+  const dec = autoRejectDecision(fresh, contexts);
+  if (dec.kind === 'exhausted') {
+    return { lines: [`${tag} ${dec.note}`], needsYou: true, state: 'stuck', note: dec.note };
+  }
+  if (dec.kind !== 'reject') {
+    return { lines: [`${tag} ${where}: no automatic reject (${dec.why || dec.kind})`], needsYou: false, state: 'retry', countsRead: true };
+  }
+  try {
+    await io.rejectRun(action.runId, { stepKey: 'step_4', reason: dec.reason });
+  } catch (e) {
+    const status = statusOf(e);
+    const f = fatal(e, `rejecting ${where}`);
+    if (f) return { lines: [], needsYou: false, state: 'retry', fatal: f };
+    if (status === 409) return { lines: [`${tag} ${where} was not rejected: the run moved on (409); this does not count`], needsYou: false, state: 'moved' };
+    if (status === 400) {
+      const note = `${where} failed verification and the server refused the reject (400: ${oneLine(e.response.data && e.response.data.error, 120)})`;
+      return { lines: [`${tag} ${note}`], needsYou: true, state: 'stuck', note };
+    }
+    return { lines: [`${tag} not rejected yet: ${status || firstLine(e && e.message)}; asking again next poll`], needsYou: false, state: 'retry' };
+  }
+  return { lines: [`${tag} ${where} failed verification: rejected it (automatic reject ${dec.n} of ${AUTO_REJECT_LIMIT}): ${oneLine(now.detail, 200)}`], needsYou: false, state: 'posted' };
 }
 
 /**
@@ -229,6 +717,8 @@ function planTick(batch, details, memory, ctx = {}) {
  */
 async function runTask(action, io, opts = {}) {
   const tag = `[follow-batch] ${action.storyId} ${action.runId}`;
+  if (action.kind === 'reserve') return reserve(action, io, tag);
+  if (action.kind === 'reject') return autoReject(action, io, tag);
   if (action.kind === 'emit' || action.kind === 'draft') {
     // emit-pr re-runs the tests before it commits, even as a local dry run, so it needs the same consent and
     // provenance verify-patch does. Without this, a repository that never set ci.local_command gets `make ci`.
@@ -255,11 +745,34 @@ async function runTask(action, io, opts = {}) {
   return { lines, needsYou: v.code !== 0 };
 }
 
+/**
+ * What the loop returns once every batch it follows has ended (settled by the server, or stuck on a person).
+ * DONE only when every one of them completed and no emit is owed; the reason of each batch that did not is kept.
+ * A batch stuck on a person is not over: step_5's gate is mandatory, so this is where most runs end, and the reason
+ * says how to continue (`again`: the batches to follow once the person has acted).
+ */
+function settle(stops, memory, again = []) {
+  const open = stops.filter((s) => s.exitCode !== EXIT.DONE);
+  const owed = memory.owed.size ? `${memory.owed.size} run(s) were not emitted: ${[...memory.owed.values()].join(', ')}` : '';
+  if (open.length === 0 && !owed) return { exitCode: EXIT.DONE, reason: stops.map((s) => s.reason).join('; ') };
+  const why = [...open.map((s) => s.reason), owed].filter(Boolean);
+  const next = again.length ? ` (after you act, run again to emit: hone follow-batch ${again.join('; hone follow-batch ')})` : '';
+  return { exitCode: EXIT.NEEDS_YOU, reason: (open.length ? why.join('; ') : `${stops.map((s) => s.reason).join('; ')}, but ${owed}`) + next };
+}
+
 /**
  * The loop. Every effect is injected, so a test drives it with a stub server and a recording runVerb.
+ *
+ * It follows a SET of batches: the one it was given, and every batch a killed run says its story was re-served as
+ * (HC-GF-351), found in the same tick. It ends when every one of them has ended, or when one has fired a breaker.
  * @param {string} batchId
  * @param {{fetchBatch: Function, fetchRun: Function, runVerb: Function, verifyDecision: Function,
- *          sleep: (ms: number) => Promise<void>, now: () => number, log: (line: string) => void}} io
+ *          sleep: (ms: number) => Promise<void>, now: () => number, log: (line: string) => void,
+ *          trackedPaths?: () => Promise<Set<string>>|Set<string>, realPath?: (file: string) => string|null,
+ *          priorServe?: Function, writeStoriesFile?: Function, killRun?: Function, rejectRun?: Function,
+ *          fetchStep?: Function}} io
+ *   trackedPaths, realPath, priorServe, writeStoriesFile and killRun serve a re-serve; without trackedPaths or
+ *   realPath every request is refused, and without priorServe nobody asks whether the story was served already.
  * @param {{pollMs?: number, deadlineMs?: number|null, maxOfflineMs?: number, openPr?: boolean,
  *          repoName?: string|null}} [opts]
  * @returns {Promise<{exitCode: number, reason: string}>}
@@ -268,8 +781,13 @@ async function followBatch(batchId, io, opts = {}) {
   const pollMs = opts.pollMs || 30_000;
   const maxOfflineMs = opts.maxOfflineMs || 15 * 60_000;
   // owed: runs whose emit-pr needed a person. A completed batch with one of these is not DONE (HC-GF-207's shape:
-  // a failure path that exits 0).
-  const memory = { emitted: new Set(), tried: new Set(), drafted: new Set(), said: new Set(), owed: new Map() };
+  // a failure path that exits 0). reserved: story → what became of its re-serve ({batchId, state}). trackedFails:
+  // consecutive ticks on which listing the tracked files failed.
+  const memory = { emitted: new Set(), tried: new Set(), drafted: new Set(), said: new Set(), owed: new Map(), reserved: new Map(), trackedFails: 0,
+    // HC-GF-363: only to stop a tick repeating itself. rejected: attempt key → ticks waited since the reject was accepted;
+    // rejectStuck: key → why a person has to act; rejectReads: key → consecutive failed reads of the earlier attempts.
+    rejected: new Map(), rejectStuck: new Map(), rejectReads: new Map() };
+  const followed = [batchId];
   const start = io.now();
   let offlineSince = null;
   const say = (line) => { if (!memory.said.has(line)) { memory.said.add(line); io.log(line); } };
@@ -280,19 +798,36 @@ async function followBatch(batchId, io, opts = {}) {
     }
     // A tick reads everything or acts on nothing: a run that could not be read is the server being unreachable,
     // not a run with no details (which would skip its gate, or emit it with no provenance to assess).
-    let batch;
-    const details = {};
+    const reads = [];
+    let reading = batchId;
     try {
-      batch = await io.fetchBatch(batchId);
-      for (const r of Array.isArray(batch && batch.runs) ? batch.runs : []) {
-        const wanted = r && r.runId && (r.status === 'paused' || (r.status === 'completed' && !memory.emitted.has(r.runId)));
-        if (wanted) details[r.runId] = await io.fetchRun(r.runId);
+      for (let i = 0; i < followed.length; i += 1) {
+        reading = followed[i];
+        const batch = await io.fetchBatch(reading);
+        const details = {};
+        for (const r of Array.isArray(batch && batch.runs) ? batch.runs : []) {
+          const wanted = r && r.runId && (r.status === 'paused' || (r.status === 'completed' && !memory.emitted.has(r.runId)));
+          if (wanted) details[r.runId] = await io.fetchRun(r.runId);
+        }
+        // A run hard-paused on a request is only re-served if nothing depends on it, and a queued run has not said
+        // what it depends on: its config is the only place that is written. Read them when a request is waiting.
+        if (Object.values(details).some((d) => hardPauseRequest(d))) {
+          for (const r of Array.isArray(batch && batch.runs) ? batch.runs : []) {
+            if (r && r.runId && r.status === 'queued' && !details[r.runId]) details[r.runId] = await io.fetchRun(r.runId);
+          }
+        }
+        reads.push({ batch, details });
+        // A killed run that says where its story went: follow that batch, and do not serve the story again.
+        for (const f of reservedFrom(batch)) {
+          memory.reserved.set(f.storyId, { batchId: f.batchId, state: 'served' });
+          if (!followed.includes(f.batchId)) followed.push(f.batchId);
+        }
       }
       offlineSince = null;
     } catch (e) {
       const status = e && e.response && e.response.status;
       if (status === 401 || status === 403 || status === 404) {
-        return { exitCode: EXIT.FATAL, reason: `the server answered ${status} while reading batch ${batchId}` };
+        return { exitCode: EXIT.FATAL, reason: `the server answered ${status} while reading batch ${reading}` };
       }
       if (offlineSince === null) offlineSince = io.now();
       if (io.now() - offlineSince >= maxOfflineMs) {
@@ -302,32 +837,85 @@ async function followBatch(batchId, io, opts = {}) {
       continue;
     }
 
-    const plan = planTick(batch, details, memory, { repoName: opts.repoName || null, openPr: !!opts.openPr });
-    for (const n of plan.notes) say(`[follow-batch] ${n}`);
-    for (const action of plan.actions) {
-      const out = await runTask(action, io, { openPr: opts.openPr });
-      if (action.kind === 'emit' || action.kind === 'draft') {
-        if (action.kind === 'emit') memory.emitted.add(action.runId);
-        else memory.drafted.add(`${action.runId}#${action.attempt}`);
-        // A run is owed until an emit for it succeeds: a draft that failed is retried by the completed-run emit.
-        if (out.needsYou) memory.owed.set(action.runId, `${action.storyId} ${action.runId}`);
-        else if (action.kind === 'emit') memory.owed.delete(action.runId);
-      } else {
-        memory.tried.add(`${action.runId}#${action.attempt}`);
+    // The checkout's tracked files, asked for only when a run is hard-paused on a request. Without them every
+    // path is refused: a request cannot be served on a list that could not be read. A listing that fails is
+    // worth three more polls (git can be busy), not an exit.
+    let tracked = null;
+    let trackedRetry = null;
+    const asks = reads.some((x) => Object.values(x.details).some((d) => hardPauseRequest(d)));
+    if (asks && io.trackedPaths) {
+      try {
+        tracked = await io.trackedPaths();
+        memory.trackedFails = 0;
+      } catch (e) {
+        memory.trackedFails += 1;
+        if (memory.trackedFails <= 3) trackedRetry = firstLine(e && e.message) || 'git ls-files failed';
+      }
+    }
+    const ctx = { repoName: opts.repoName || null, openPr: !!opts.openPr, tracked, trackedRetry, realPath: io.realPath || null };
+    const plans = reads.map((x) => planTick(x.batch, x.details, memory, ctx));
+    for (const plan of plans) for (const n of plan.notes) say(`[follow-batch] ${n}`);
+    // A fired breaker stops the loop BEFORE any batch's action runs.
+    const halted = plans.find((plan) => plan.stop && plan.stop.kind === 'breaker');
+    if (halted) return { exitCode: halted.stop.exitCode, reason: halted.stop.reason };
+
+    // An accepted reject that the worker has not applied for REJECT_WAIT_TICKS polls is named for a person.
+    for (const plan of plans) {
+      for (const key of plan.rejecting) {
+        const waited = (memory.rejected.get(key) || 0) + 1;
+        memory.rejected.set(key, waited);
+        if (waited >= REJECT_WAIT_TICKS) {
+          memory.rejectStuck.set(key, `a reject was accepted ${waited} polls ago and the run is still paused at the same attempt; look at it with hone run-report`);
+        }
+      }
+    }
+
+    let grew = false;
+    for (const plan of plans) {
+      for (const action of plan.actions) {
+        const out = await runTask(action, io, { openPr: opts.openPr });
+        if (action.kind === 'reject') {
+          if (out.fatal) return { exitCode: EXIT.FATAL, reason: out.fatal };
+          const key = `${action.runId}#${action.attempt}`;
+          if (out.state === 'posted' || out.state === 'moved') memory.rejected.set(key, 0);
+          else if (out.state === 'stuck') memory.rejectStuck.set(key, out.note);
+          else if (out.countsRead) {
+            const n = (memory.rejectReads.get(key) || 0) + 1;
+            memory.rejectReads.set(key, n);
+            if (n >= 3) memory.rejectStuck.set(key, `step_4 attempt ${action.attempt} failed verification, but the rejects already used could not be read after ${n} polls; nothing was sent`);
+          }
+          for (const line of out.lines) say(line);
+          continue;
+        }
+        if (action.kind === 'reserve') {
+          if (!out.retry) {
+            memory.reserved.set(action.storyId, { batchId: out.batchId, state: out.state });
+            if (out.batchId && !followed.includes(out.batchId)) { followed.push(out.batchId); grew = true; }
+          }
+        } else if (action.kind === 'emit' || action.kind === 'draft') {
+          if (action.kind === 'emit') memory.emitted.add(action.runId);
+          else memory.drafted.add(`${action.runId}#${action.attempt}`);
+          // A run is owed until an emit for it succeeds: a draft that failed is retried by the completed-run emit.
+          if (out.needsYou) memory.owed.set(action.runId, `${action.storyId} ${action.runId}`);
+          else if (action.kind === 'emit') memory.owed.delete(action.runId);
+        } else {
+          memory.tried.add(`${action.runId}#${action.attempt}`);
+        }
+        for (const line of out.lines) io.log(line);
       }
-      for (const line of out.lines) io.log(line);
     }
-    if (plan.stop && plan.stop.exitCode === EXIT.DONE && memory.owed.size) {
-      return { exitCode: EXIT.NEEDS_YOU,
-        reason: `${plan.stop.reason}, but ${memory.owed.size} run(s) were not emitted: ${[...memory.owed.values()].join(', ')}` };
+    // Ended means every batch read this tick has: settled by the server, or stuck on a person. A batch queued
+    // this tick has not been read yet.
+    if (!grew && plans.every((plan) => plan.stop)) {
+      return settle(plans.map((plan) => plan.stop), memory, followed.filter((id, i) => plans[i].stop.kind === 'stuck'));
     }
-    if (plan.stop) return plan.stop;
     await io.sleep(pollMs);
   }
 }
 
 module.exports = {
   EXIT, FORBIDDEN_FLAGS, NOT_A_GATE,
-  breakerStop, isTerminal, priorVerdict, step4Action, buildArgs, planTick, runTask, followBatch,
-  currentStep4Attempt, verifiedStep4Attempt, draftBranch,
+  breakerStop, isTerminal, priorVerdict, step4Action, buildArgs, buildReserveArgs, planTick, runTask, followBatch,
+  currentStep4Attempt, verifiedStep4Attempt, draftBranch, reservedFrom, otherPause, stuckReason, gateEnforced, stepRank,
+  AUTO_REJECT_PREFIX, AUTO_REJECT_LIMIT, autoRejectCandidate, autoRejectDecision, autoRejectedAttempts,
 };