immune-brain 3.6.9 → 4.0.1

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { join } from "node:path";
 import {
 	AssuranceCoordinator,
+	reviewAdvisoryRecords,
 	reviewReworkFindings,
 	type AssuranceCoordinatorPorts,
 	type AssuranceSubmitReviewResult,
@@ -12,22 +13,18 @@ import {
 	type SnapshotDescriptor,
 } from "../assurance/coordinator";
 import {
-	assertRunnerCompatible,
-	resolveBunRunner,
-	type FrozenRunner,
 	type VerificationDescriptor,
 } from "../assurance/verification";
 import {
-	captureReviewBundle,
 	captureReviewManifest,
 	writeNativeReviewEvidence,
 	type ReviewRevision,
 } from "../assurance/review_evidence";
 import { parseVerificationDescriptor } from "../verification_descriptor";
 import { projectAssurance, type AssuranceProjection, type AssuranceProjectionResult } from "../kernel/assurance_projection";
-import { isTaskRecordV4, type TaskApprovalV2, type TaskFinding, type TaskRecord } from "../kernel/types";
+import { type TaskApprovalV2, type TaskFinding, type TaskRecord } from "../kernel/types";
 import { findingsDigestV2 } from "../kernel/reducer";
-import { readAuditTaskPair, readTaskRecord, readTaskRecordRaw } from "../kernel/storage";
+import { readTaskRecord, readTaskRecordRaw, recoverKernelStoreFollowUps } from "../kernel/storage";
 import { canonicalIntentHash, parseTaskIntentV1, readTaskIntent } from "../kernel/intent";
 import { capabilityActionFor, createCanaryApplication } from "../kernel/canary_application";
 import {
@@ -44,8 +41,24 @@ import { enrollCanaryTask, runEnrollmentRehearsal } from "../kernel/enrollment";
 import { reconcileKernelAuthority, repairKernelAuthority } from "../kernel/storage";
 import { preparePiCanary, revalidatePiCanary } from "../kernel/pi_canary_prepare";
 import { runDeterministicQa } from "../assurance/qa";
-import { taskDiffIdentity, taskRevisionIdentity, pathMatchesScope } from "../workspace_scope";
-import { projectBatchPlan } from "../unattended/batch_plan";
+import { taskDiffIdentity, taskRevisionIdentity } from "../workspace_scope";
+import { batchReason } from "../unattended/batch_reasons";
+import { startConfirmationDeadline } from "../unattended/confirmation_deadline";
+import { deriveAuthorizationOperation } from "../authorization_operation";
+import { LITERAL_USER_ACTOR_ID, canonicalActorId } from "../kernel/actor_identity";
+import {
+	captureStagedIntent,
+	restoreStagedIntent as restoreStagedIntentShared,
+} from "../staged_intent";
+import { projectTerminalTrackerState, TRACKER_PROJECTION_FAILURE } from "../assurance/coordinator";
+import { runGithubTrackerOperation } from "../github_issue_tracker";
+import { readTaskTombstone } from "../kernel/backend_claim";
+import {
+	authorizeBatch,
+	projectBatchPreflight,
+	readActiveClaimTaskId,
+	isOwnBatchClaim,
+} from "../unattended/batch_preflight";
 import {
 	startBatch,
 	type BatchRunnerKernelPort,
@@ -53,24 +66,17 @@ import {
 } from "../unattended/batch_runner";
 import {
 	createBatchAuthorityRegistry,
-	computeBatchPlanDigest,
 	deriveChildEnrollment,
 	type BatchAuthorityRegistry,
 	type BatchAuthorizationBinding,
 } from "../kernel/batch_authority";
 import {
-	runBatchGitPreflight,
 	type BatchRunnerGitPort,
 } from "../unattended/batch_git";
 import type {
-	BatchPlan,
-	BatchPlanChild,
 	InitiativeObservationReader,
 } from "../unattended/types";
 import { observeGithubInitiative } from "../github_issue_tracker";
-import { readWorkspaceStateRaw } from "../kernel/storage";
-import { readBackendClaim } from "../kernel/backend_claim";
-import { readGitHead } from "../kernel/pi_canary_prepare";
 import {
 	confirmationRef,
 	enrollmentNonce,
@@ -78,6 +84,7 @@ import {
 	isPrivilegedOperation,
 	NativeAuthorityError,
 	type NativeConfirmationPort,
+	type NativeDecision,
 	type PrivilegedOperation,
 } from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, type ClaudeHookEvent } from "./review_host";
@@ -89,9 +96,9 @@ export function diffSnapshotOf(root: string, record: TaskRecord): {
 } {
 	if (record.contract === "assurance_kernel/task_record/v4") {
 		if (!record.git_base_head) throw new Error("TaskRecord v4 is missing git_base_head");
-		return taskRevisionIdentity(root, record.intent_snapshot.scope_hint, record.git_base_head);
+		return taskRevisionIdentity(root, record.intent_snapshot.scope_hint, record.git_base_head, record.task_id);
 	}
-	return taskDiffIdentity(root, record.intent_snapshot.scope_hint);
+	return taskDiffIdentity(root, record.intent_snapshot.scope_hint, record.task_id);
 }
 
 export function diffHashOf(root: string, record: TaskRecord): string {
@@ -101,12 +108,14 @@ export function diffHashOf(root: string, record: TaskRecord): string {
 /**
  * Read the TaskIntent through the TaskRecord's `intent_ref.path`.
  *
- * `freeze_artifacts` relocates the sidecar from `docs/plans/<task-id>.intent.json`
- * into `docs/plans/archive/`, so every post-freeze read — QA settlement included —
- * must follow the record instead of the pre-freeze default path. The Pi adapter
- * resolves the same way in its own runtime stub; both Hosts must stay in step.
+ * `freeze_artifacts` binds the sidecar in place. Every post-freeze read — QA
+ * settlement included — must follow the record instead of guessing a default
+ * path. Historical archived sidecars remain readable. The Pi adapter resolves
+ * the same way in its own runtime stub; both Hosts must stay in step.
  */
 function readTaskIntentForRecord(root: string, taskId: string) {
+	// Converge committed follow-ups first, then follow the record.
+	recoverKernelStoreFollowUps(root, taskId);
 	const currentPath = readTaskRecordRaw(root, taskId).record?.intent_ref?.path;
 	return readTaskIntent(root, taskId, currentPath);
 }
@@ -160,6 +169,20 @@ export async function submitClaudeReview(
 	return coordinator.submitReview(taskId, ctx, verdictInput);
 }
 
+/**
+ * Whether a Kernel result settled its task: the coordinator's own terminal
+ * outcomes, or the lifecycle a privileged mutation committed. Only such a result
+ * can have produced the claimless terminal projection the GitHub tracker step
+ * needs, and it is exported so the gate's terminal shapes are asserted directly
+ * instead of by settling a task against a live tracker.
+ */
+export function settledKernelResult(result: object): boolean {
+	const state = (result as { state?: unknown }).state;
+	if (state === "completed" || state === "stopped") return true;
+	const lifecycle = (result as { record?: { lifecycle?: unknown } }).record?.lifecycle;
+	return lifecycle === "done" || lifecycle === "stopped";
+}
+
 /** `extra` arrives as `Record<string, unknown>`; only a real string is a reason. */
 function stopReason(value: unknown): string {
 	return typeof value === "string" && value.length > 0 ? value : "user stop";
@@ -239,24 +262,18 @@ async function buildAssuranceSnapshot(
 	taskId: string,
 	role: "qa" | "review",
 	projection: AssuranceProjectionResult,
-	runner: FrozenRunner,
 ) {
 	const read = await readTaskRecord(root, taskId);
 	const record = read.record;
 	if (!record || read.revision !== projection.projection.record_revision) throw new Error("TaskRecord changed before assurance snapshot capture");
 	const intent = record.intent_snapshot;
 	const descriptors = new Map<string, VerificationDescriptor>();
-	for (const item of intent.acceptance) {
+	for (const item of role === "qa" ? intent.acceptance : []) {
 		const descriptor = parseVerificationDescriptor(item.verification);
-		assertRunnerCompatible(descriptor, runner);
 		descriptors.set(item.id, descriptor);
 	}
-	// `git_base_head` exists only on TaskRecord v4, so this must narrow the union
-	// rather than test the contract string into a plain boolean.
-	const reviewBundle = role === "review" && !isTaskRecordV4(record)
-		? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record))
-		: null;
-	const reviewManifest = role === "review" && isTaskRecordV4(record)
+	const reviewBundle = null;
+	const reviewManifest = role === "review"
 		? captureReviewManifest(root, {
 			taskId,
 			baseHead: record.git_base_head,
@@ -272,10 +289,11 @@ async function buildAssuranceSnapshot(
 			outcomes: qaOutcomes(record),
 		})
 		: null;
-	const dirtyFiles = reviewManifest ? Object.keys(reviewManifest.changed_paths) : reviewBundle ? Object.keys(reviewBundle.dirty_files) : [];
+	const dirtyFiles = reviewManifest ? Object.keys(reviewManifest.changed_paths) : [];
 	const snapshot: SnapshotDescriptor = {
 		contract: "assurance_kernel/assurance_snapshot/v2",
 		task_id: taskId,
+		run_id: projection.projection.run_id,
 		role,
 		record_revision: projection.projection.record_revision,
 		workspace_revision: projection.projection.workspace_revision,
@@ -290,7 +308,7 @@ async function buildAssuranceSnapshot(
 		stale_attestation_ids: projection.projection.stale_attestation_ids,
 		acceptance: intent.acceptance,
 		dirty_files: dirtyFiles,
-		review_bundle_digest: reviewManifest?.manifest_digest ?? reviewBundle?.bundle_digest ?? null,
+		review_bundle_digest: reviewManifest?.manifest_digest ?? null,
 		root,
 		...(reviewManifest
 			? {
@@ -329,6 +347,7 @@ async function mintCapability(
 	input: {
 		authority_kind: "review" | "qa" | "user";
 		task_id: string;
+		run_id?: string | null;
 		action_kind: string;
 		expected_record_hash: string;
 		intent_revision: number;
@@ -362,6 +381,7 @@ async function mintCapability(
 	const binding: CapabilityBindingV2 = {
 		authority_kind: input.authority_kind,
 		task_id: input.task_id,
+		...(input.run_id ? { run_id: input.run_id } : {}),
 		action_digest: digestOfAction(action),
 		expected_record_hash: input.expected_record_hash,
 		intent_revision: input.intent_revision,
@@ -400,6 +420,16 @@ export interface ClaudeRuntimeOptions {
 	readInitiative?: InitiativeObservationReader;
 }
 
+/**
+ * The Claude Host's own failure envelopes for a batch start; the shared
+ * authorization flow passes them through untouched.
+ */
+type ClaudeBatchStartResult =
+	| { state: "started"; batch_id: string; report: BatchRunReport }
+	| { state: "rejected"; reason: string; recovery_action: string }
+	| { state: "cancelled"; reason: string; recovery_action: string }
+	| { state: "blocked"; reason: string; recovery_action: string };
+
 /**
  * Synchronous re-verification that the currently held claim for `taskId` is this
  * batch's own Kernel enrollment. Positive evidence only (see the Pi adapter):
@@ -409,87 +439,6 @@ export interface ClaudeRuntimeOptions {
  * needs_human re-authorization can never turn this batch's own claim foreign.
  * Called fresh pre/post confirmation and from ownsTaskClaim.
  */
-function syncIsOwnBatchClaim(
-	cwd: string,
-	existingBatch: any,
-	taskId: string,
-	batchBranch: string,
-): boolean {
-	let claim: any = null;
-	let workspace: any = null;
-	try {
-		claim = JSON.parse(readFileSync(join(cwd, ".imm", "state", "active-claim.json"), "utf8"));
-		workspace = JSON.parse(readFileSync(join(cwd, ".imm", "state", "workspace.json"), "utf8"));
-	} catch {
-		return false;
-	}
-	const currentTaskId =
-		workspace?.state?.current_working ||
-		(claim?.lifecycle_status === "active" ? claim?.task_id : null);
-	if (currentTaskId !== taskId || !claim) return false;
-	const branch = spawnSync("git", ["-C", cwd, "branch", "--show-current"], { encoding: "utf8" }).stdout.trim();
-	if (branch !== batchBranch) return false;
-	const childInBatch = existingBatch.children.find((c: { task_id: string }) => c.task_id === taskId);
-	if (!childInBatch || !(childInBatch.state === "enrolled" || childInBatch.state === "needs_human")) {
-		return false;
-	}
-	let rec: any = null;
-	try {
-		rec = JSON.parse(readFileSync(join(cwd, ".imm", "state", "tasks", `${taskId}.json`), "utf8"));
-	} catch {
-		return false;
-	}
-	const lineageHeads = [existingBatch.base_head].concat(
-		Array.isArray(existingBatch.commits) ? existingBatch.commits : [],
-	);
-	if (!lineageHeads.includes(rec.git_base_head)) return false;
-	if (claim.enrollment_event_id !== `enroll-${taskId}-${claim.created_at}`) return false;
-	const createdAt = Date.parse(claim.created_at);
-	if (!Number.isFinite(createdAt) || createdAt > Date.parse(existingBatch.updated_at)) return false;
-	if (claim.task_id !== taskId || claim.lifecycle_status !== "active") return false;
-	if (claim.intent_revision !== rec.intent_snapshot?.revision) return false;
-	if (claim.intent_content_hash !== rec.intent_ref?.content_hash) return false;
-	return true;
-}
-
-function findExistingActiveBatch(root: string, initiativeSlug: string): any {
-	const batchesDir = join(root, ".imm", "state", "batches");
-	if (!existsSync(batchesDir)) return null;
-	const files = readdirSync(batchesDir);
-	for (const file of files) {
-		if (!file.endsWith(".json")) continue;
-		let record: any;
-		try {
-			record = JSON.parse(readFileSync(join(batchesDir, file), "utf8"));
-		} catch {
-			// Unreadable Kernel batch state must fail closed: silently treating the
-			// initiative as batchless could authorize a parallel run.
-			return { corrupt: true, path: file };
-		}
-		if (record.contract === "assurance_kernel/batch_run_state/v1" && record.initiative_slug === initiativeSlug) {
-			const validStates = new Set([
-				"prepared",
-				"running",
-				"needs_human",
-				"completed",
-				"budget_stopped",
-				"failed",
-				"rejected",
-			]);
-			if (
-				typeof record.batch_id !== "string" ||
-				typeof record.base_head !== "string" ||
-				!Array.isArray(record.children) ||
-				!validStates.has(record.batch_state)
-			) {
-				return { corrupt: true, path: file };
-			}
-			return record;
-		}
-	}
-	return null;
-}
-
 export class ClaudeRuntime {
 	readonly host: ClaudeReviewHost;
 	readonly coordinator: AssuranceCoordinator;
@@ -555,10 +504,9 @@ export class ClaudeRuntime {
 			projectTask: (root, taskId) => projectAssurance(root, taskId, diffSnapshotOf),
 			readTaskRecord: async (root, taskId) => readTaskRecord(root, taskId),
 			readTaskIntent: async (root, taskId) => readTaskIntentForRecord(root, taskId),
-			frozenRunner: async () => resolveBunRunner(),
-			buildAssurance: (root, taskId, role, projection, runner) => buildAssuranceSnapshot(root, taskId, role, projection, runner),
+			buildAssurance: (root, taskId, role, projection) => buildAssuranceSnapshot(root, taskId, role, projection),
 			ensureReviewRevision: (root, taskId, projection) => ensureClaudeReviewRevision(root, taskId, projection),
-			runQa: (snapshot, descriptors, runner, options) => runDeterministicQa(snapshot, descriptors, runner, options),
+			runQa: (snapshot, descriptors, options) => runDeterministicQa(snapshot, descriptors, options),
 			writeReviewEvidence: (input) => writeNativeReviewEvidence(input.evidence),
 			applyVerdict: (ctx, input) => this.applyVerdict(ctx, input),
 			applyOrdinaryOperation: (ctx, input) => this.executeOrdinary(ctx, input),
@@ -583,7 +531,10 @@ export class ClaudeRuntime {
 		const interactive = meta.interactive ?? this.interactive;
 		if (!interactive) throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
 		if (!isPrivilegedOperation(operation)) throw new Error(`unsupported native operation ${operation}`);
-		if (!this.requestConfirmation) throw new NativeAuthorityError("interaction_not_opened", "native confirmation port is unavailable");
+		// The text is table-owned; only the form (a thrown native error rather than
+		// a returned envelope) is this Host's.
+		if (!this.requestConfirmation)
+			throw new NativeAuthorityError("interaction_not_opened", batchReason("confirmation_port_unavailable").reason);
 		const result = await this.requestConfirmation({ operation, taskId: meta.taskId, toolCallId: meta.toolCallId, signal: meta.signal, ...binding });
 		throwIfCancelled(meta.signal);
 		const gate = evaluateNativeGate({ operation, interactive, decision: result.decision });
@@ -625,7 +576,7 @@ export class ClaudeRuntime {
 			intent_revision: preparation.intent.revision,
 			intent_content_hash: preparation.intent.content_hash,
 			preparation_digest: preparation.digest,
-			actor_id: "user",
+			actor_id: LITERAL_USER_ACTOR_ID,
 			confirmation_ref: gate.confirmation_ref,
 			expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 			nonce,
@@ -648,11 +599,51 @@ export class ClaudeRuntime {
 	}
 
 	async advance(taskId: string, signal?: AbortSignal) {
-		return this.coordinator.advance(taskId, { cwd: this.cwd }, signal);
+		return this.withTerminalTracker(
+			taskId,
+			await this.coordinator.advance(taskId, { cwd: this.cwd }, signal),
+		);
 	}
 
 	async submitReview(taskId: string, verdictInput: unknown) {
-		return submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput);
+		return this.withTerminalTracker(
+			taskId,
+			await submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput),
+		);
+	}
+
+	/**
+	 * Post-settlement GitHub tracker projection: the same shared step the Pi Host
+	 * runs, so an opted-in terminal projection no longer depends on which Host
+	 * settled the task. Only a call that settled its task pays for it: the step
+	 * cannot project anything from a result that reports a live obligation, so
+	 * every other invocation returns untouched without reading the Kernel.
+	 *
+	 * Transport, never authority: the shared projection derives nothing unless the
+	 * Kernel already shows a fresh claimless done/stopped task with its exact
+	 * terminal tombstone, a tracker failure is reported as `tracker` alongside the
+	 * authoritative result rather than as evidence or a blocker, and it never
+	 * repeats the settling mutation.
+	 */
+	private async withTerminalTracker<T>(taskId: string, result: T): Promise<T> {
+		if (result === null || typeof result !== "object") return result;
+		if (!settledKernelResult(result)) return result;
+		try {
+			const projection = await this.status(taskId);
+			const tracker = await projectTerminalTrackerState({
+				root: this.cwd,
+				task_id: taskId,
+				projection,
+				tombstone: readTaskTombstone(this.cwd, taskId),
+				markTerminal: (root, input) => runGithubTrackerOperation(root, { op: "mark-terminal", ...input }),
+			});
+			return tracker ? ({ ...(result as object), tracker } as T) : result;
+		} catch {
+			// The underlying Kernel mutation already committed, so a failed observation
+			// is reported beside the authoritative result instead of rethrown into a
+			// path a caller could read as "the mutation did not happen" and retry.
+			return { ...(result as object), tracker: TRACKER_PROJECTION_FAILURE } as T;
+		}
 	}
 
 	/**
@@ -688,6 +679,12 @@ export class ClaudeRuntime {
 	async authorize(taskId: string, operation: string, meta: ToolMeta, extra: Record<string, unknown> = {}) {
 		if (operation === "repair_authority_state") {
 			const authority = reconcileKernelAuthority(this.cwd, taskId);
+			// The workspace owner is derived from the single active run, so a claim
+			// that contradicts the run index cannot exist: a settled or unowned
+			// authority has nothing to repair, and any leftover retired claim file
+			// is inert. A live owner is a conflict the caller must resolve.
+			if (authority.state === "terminal_owner" || authority.state === "unowned")
+				return repairKernelAuthority(this.cwd, taskId, authority.revision);
 			if (authority.state !== "repairable_stale_claim" || authority.owner_task_id !== taskId) {
 				throw new Error(authority.diagnostic ?? "authority repair requires a repairable stale claim");
 			}
@@ -698,12 +695,14 @@ export class ClaudeRuntime {
 		let decisionOp: { finding_id: string; resolution: string } | undefined;
 		const projection = await this.status(taskId);
 		if (projection.error || !projection.claim) throw new Error(projection.error ?? "no active backend claim");
-		// Kernel projection is the sole source of authorization readiness:
-		// request_authorization submits the exact operation the projection
-		// derives, including the single bound user-decision resolution.
-		const readiness = projection.projection.authorization;
+		// Kernel projection is the sole source of authorization readiness, and the
+		// derivation is the shared export both Hosts use, so it cannot drift:
+		// request_authorization submits the exact operation the projection derives,
+		// including the single bound user-decision resolution.
 		if (operation === "request_authorization") {
-			if (readiness.state === "resolve_user_decision") {
+			const derived = deriveAuthorizationOperation({ readiness: projection.projection.authorization });
+			if ("blocked" in derived) throw new Error(derived.blocked);
+			if (derived.operation === "resolve-user-decision") {
 				const record = await readTaskRecord(this.cwd, taskId);
 				const open = (record.record?.findings ?? []).filter(
 					(finding) => finding.kind === "unresolved_user_decision" && finding.status === "open",
@@ -711,15 +710,13 @@ export class ClaudeRuntime {
 				if (open.length !== 1) throw new Error(`resolve-user-decision requires exactly one open user decision; found ${open.length}`);
 				op = "resolve_user_decision";
 				decisionOp = { finding_id: open[0].id, resolution: `resume after literal-user decision: ${open[0].summary}` };
-			} else if (readiness.state === "authorize_rework") {
-				op = "authorize_rework";
 			} else {
-				throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
+				op = "authorize_rework";
 			}
 		}
 		const priorIntent = await readTaskIntentForRecord(this.cwd, taskId);
 		const now = new Date().toISOString();
-		const actorId = "user";
+		const actorId = LITERAL_USER_ACTOR_ID;
 		const nextIntent = extra.next_intent ? await parseTaskIntentV1(extra.next_intent) : undefined;
 		if (op === "approve_breaking_intent_revision" && !nextIntent) throw new Error("approve_breaking_intent_revision requires next_intent");
 		const nextIntentHash = nextIntent ? canonicalIntentHash(nextIntent) : undefined;
@@ -727,27 +724,12 @@ export class ClaudeRuntime {
 			? { path: `docs/plans/${nextIntent.task_id}.intent.json`, content_hash: nextIntentHash! }
 			: undefined;
 		const sidecar = nextIntent ? join(this.cwd, priorIntent.intent_ref.path) : undefined;
-		const priorBytes = sidecar ? readFileSync(sidecar) : undefined;
-		const priorIndexState = sidecar
-			? execFileSync("git", ["ls-files", "--stage", "-z", "--", priorIntent.intent_ref.path], {
-				cwd: this.cwd,
-				stdio: ["ignore", "pipe", "pipe"],
-			})
-			: undefined;
+		// The snapshot carries the prior bytes; a second read would only be a
+		// second source for the same fact.
+		const stagedSnapshot = sidecar ? captureStagedIntent(this.cwd, priorIntent.intent_ref.path) : undefined;
 		const restoreStagedIntent = (): void => {
-			if (!sidecar || !priorBytes || !priorIndexState) return;
-			writeFileSync(sidecar, priorBytes);
-			execFileSync("git", ["update-index", "--force-remove", "--", priorIntent.intent_ref.path], {
-				cwd: this.cwd,
-				stdio: ["ignore", "pipe", "pipe"],
-			});
-			if (priorIndexState.length > 0) {
-				execFileSync("git", ["update-index", "-z", "--index-info"], {
-					cwd: this.cwd,
-					input: priorIndexState,
-					stdio: ["pipe", "ignore", "pipe"],
-				});
-			}
+			if (!stagedSnapshot) return;
+			restoreStagedIntentShared(this.cwd, stagedSnapshot);
 		};
 		let preparedDiffHash = projection.projection.diff_hash;
 		let gate: { confirmation_ref: string };
@@ -777,7 +759,7 @@ export class ClaudeRuntime {
 				bindingDigest: `${preparedDiffHash}:${nextIntentHash ?? ""}`,
 			});
 		} catch (error) {
-			if (sidecar && priorBytes && priorIndexState) {
+			if (stagedSnapshot) {
 				const current = await readTaskRecord(this.cwd, taskId);
 				if (current.record?.intent_snapshot.revision === priorIntent.intent.revision) {
 					restoreStagedIntent();
@@ -787,6 +769,7 @@ export class ClaudeRuntime {
 		}
 		const { registry, app } = this.authority();
 		const confirmation = gate.confirmation_ref;
+		let committed: ReturnType<typeof app.execute>;
 		try {
 			const capabilityProjection = await this.status(taskId);
 			try {
@@ -802,12 +785,13 @@ export class ClaudeRuntime {
 			const capability = await mintCapability(registry, {
 				authority_kind: "user",
 				task_id: taskId,
+				run_id: capabilityProjection.projection.run_id,
 				action_kind: op,
 				expected_record_hash: capabilityProjection.projection.record_revision,
 				intent_revision: nextIntent?.revision ?? capabilityProjection.projection.intent_revision,
 				intent_content_hash: nextIntentHash ?? capabilityProjection.projection.intent_content_hash,
 				diff_hash: operationDiffHash,
-				actor_id: actorId,
+				actor_id: canonicalActorId(actorId),
 				now,
 				confirmation_ref: confirmation,
 				...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
@@ -821,7 +805,7 @@ export class ClaudeRuntime {
 				operation: {
 					op,
 					capability,
-					actor_id: actorId,
+					actor_id: canonicalActorId(actorId),
 					...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 					...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
 					...(op === "stop" ? { reason: stopReason(extra.reason) } : {}),
@@ -830,14 +814,14 @@ export class ClaudeRuntime {
 				diffProvider: diffSnapshotOf,
 				now,
 			});
+			committed = result;
 			if (
 				op === "stop" ||
 				op === "authorize_rework" ||
 				op === "approve_breaking_intent_revision"
 			) stagePlanningArtifactTransition(this.cwd, result.record);
-			return result;
 		} catch (error) {
-			if (sidecar && priorBytes && priorIndexState) {
+			if (stagedSnapshot) {
 				const current = await readTaskRecord(this.cwd, taskId);
 				if (current.record?.intent_snapshot.revision === priorIntent.intent.revision) {
 					restoreStagedIntent();
@@ -845,6 +829,11 @@ export class ClaudeRuntime {
 			}
 			throw error;
 		}
+		// A stop settles the task: project the terminal tracker state exactly as the
+		// Pi Host does after its own settlement. It runs once the mutation's own
+		// try/catch has closed, so observation can never roll the staged intent back
+		// or turn a committed mutation into an exception.
+		return this.withTerminalTracker(taskId, committed);
 	}
 
 	private async applyVerdict(
@@ -874,6 +863,7 @@ export class ClaudeRuntime {
 			const capability = await mintCapability(registry, {
 				authority_kind: input.snapshot.role,
 				task_id: input.taskId,
+				run_id: input.snapshot.run_id,
 				action_kind: "request_rework",
 				expected_record_hash: input.snapshot.record_revision,
 				intent_revision: input.snapshot.intent_revision,
@@ -896,6 +886,7 @@ export class ClaudeRuntime {
 			stagePlanningArtifactTransition(ctx.cwd, result.record);
 			return;
 		}
+		const advisories = input.verdict.decision === "pass" ? reviewAdvisoryRecords(input.verdict) : [];
 		const approval: TaskApprovalV2 = {
 			id: `approval-${input.snapshot.role}-${randomUUID().slice(0, 8)}`,
 			kind: input.snapshot.role === "qa" ? "qa" : "review",
@@ -906,10 +897,12 @@ export class ClaudeRuntime {
 			actor_id: input.actorId,
 			summary: input.verdict.approval!.summary,
 			...(input.snapshot.role === "review" && input.snapshot.review_revision ? { review_revision: input.snapshot.review_revision } : {}),
+			...(input.snapshot.role === "review" && advisories.length > 0 ? { advisory_findings: advisories } : {}),
 		};
 		const capability = await mintCapability(registry, {
 			authority_kind: input.snapshot.role,
 			task_id: input.taskId,
+			run_id: input.snapshot.run_id,
 			action_kind: "record_approval",
 			expected_record_hash: input.snapshot.record_revision,
 			intent_revision: input.snapshot.intent_revision,
@@ -939,8 +932,18 @@ export class ClaudeRuntime {
 		const priorIntent = await readTaskIntentForRecord(ctx.cwd, input.taskId);
 		const sidecar = join(ctx.cwd, priorIntent.intent_ref.path);
 		const priorBytes = operation.op === "revise_intent" ? readFileSync(sidecar) : null;
+		// A content-changing revision writes the sidecar before the kernel's drift
+		// check runs, so the written sidecar is staged and the exact prior bytes and
+		// index entry are restored, verified, if the revision fails.
+		const priorStaged = priorBytes !== null ? captureStagedIntent(ctx.cwd, priorIntent.intent_ref.path) : null;
 		try {
-			if (priorBytes) writeFileSync(sidecar, `${JSON.stringify(operation.next_intent, null, 2)}\n`);
+			if (priorBytes) {
+				writeFileSync(sidecar, `${JSON.stringify(operation.next_intent, null, 2)}\n`);
+				execFileSync("git", ["add", "--", priorIntent.intent_ref.path], {
+					cwd: ctx.cwd,
+					stdio: ["ignore", "pipe", "pipe"],
+				});
+			}
 			const result = await app.execute({
 				root: ctx.cwd,
 				task_id: input.taskId,
@@ -952,9 +955,10 @@ export class ClaudeRuntime {
 			if (operation.op === "freeze_artifacts" || operation.op === "stop") stagePlanningArtifactTransition(ctx.cwd, result.record);
 			return result;
 		} catch (error) {
-			if (priorBytes) {
+			if (priorStaged) {
 				const current = await readTaskRecord(ctx.cwd, input.taskId);
-				if (current.record?.intent_snapshot.revision === priorIntent.intent.revision) writeFileSync(sidecar, priorBytes);
+				if (current.record?.intent_snapshot.revision === priorIntent.intent.revision)
+					restoreStagedIntentShared(ctx.cwd, priorStaged);
 			}
 			throw error;
 		}
@@ -963,577 +967,145 @@ export class ClaudeRuntime {
 	async startUnattendedBatch(
 		initiativeSlug: string,
 		meta: ToolMeta,
-	): Promise<
-		| { state: "started"; batch_id: string; report: BatchRunReport }
-		| { state: "rejected"; reason: string; recovery_action: string }
-		| { state: "cancelled"; reason: string; recovery_action: string }
-		| { state: "blocked"; reason: string; recovery_action: string }
-	> {
+	): Promise<ClaudeBatchStartResult> {
 		throwIfCancelled(meta.signal);
 		const probe = probeHost(this.env, process.platform, this.hostVersion);
 		if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
 		const interactive = meta.interactive ?? this.interactive;
 		if (!interactive) throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
-		if (!this.requestConfirmation) throw new NativeAuthorityError("interaction_not_opened", "native confirmation port is unavailable");
-
-		// 1. Validate initiative slug
-		if (!/^[a-z0-9][a-z0-9._-]{0,127}$/i.test(initiativeSlug)) {
-			return {
-				state: "rejected",
-				reason: `invalid initiative slug: ${initiativeSlug}`,
-				recovery_action: "specify a valid initiative slug and retry in the current Host",
-			};
-		}
-
-		// Check for an existing active/paused batch for this initiative
-		const existingBatch = findExistingActiveBatch(this.cwd, initiativeSlug);
-		const isResuming = existingBatch !== null;
-		if (existingBatch?.corrupt) {
-			return {
-				state: "blocked",
-				reason: `batch run state is unreadable or invalid: ${existingBatch.path}`,
-				recovery_action: "resolve or remove the invalid batch state file, then retry in the current Host",
-			};
-		}
-		const batchBranch = `imm/${initiativeSlug}`;
-
-		// 2. Active workspace claim check (pre-confirmation)
-		const workspaceState = readWorkspaceStateRaw(this.cwd);
-		const claim = readBackendClaim(this.cwd);
-		const activeTaskId = workspaceState.state.current_working || (claim?.lifecycle_status === "active" ? claim.task_id : null);
-		const isOwnClaim =
-			isResuming &&
-			activeTaskId !== null &&
-			syncIsOwnBatchClaim(this.cwd, existingBatch, activeTaskId, batchBranch);
-		if (activeTaskId && !isOwnClaim) {
-			return {
-				state: "blocked",
-				reason: `an active workspace claim already exists for task: ${activeTaskId}`,
-				recovery_action: "resolve or stop the active task before starting a batch in the current Host",
-			};
-		}
-
-		// 3. Git HEAD & read-only preflight check (pre-confirmation)
-		let baseHead: string;
-		try {
-			baseHead = readGitHead(this.cwd);
-		} catch (err) {
-			return {
-				state: "rejected",
-				reason: err instanceof Error ? err.message : String(err),
-				recovery_action: "commit working changes and ensure a committed Git HEAD exists in the current Host",
-			};
-		}
-
-		// Read-only check: verify clean tree and branch does not exist without creating refs before confirmation
-		const branchExists = spawnSync("git", ["-C", this.cwd, "show-ref", "--verify", "--quiet", `refs/heads/${batchBranch}`]);
-		if (branchExists.status === 0 && !isResuming) {
-			return {
-				state: "rejected",
-				reason: `branch preflight failed: branch refs/heads/${batchBranch} already exists`,
-				recovery_action: "delete or rename the conflicting branch, or commit working changes in the current Host",
-			};
-		}
-		// review-batch-resume-porcelain-leading-space: parse the NUL-delimited v1
-		// format so an unstaged modification (" M path") keeps its status columns.
-		const statusProc = spawnSync("git", ["-C", this.cwd, "status", "--porcelain=v1", "-z", "--no-renames", "--untracked-files=all"], {
-			encoding: "utf8",
+		// The text is table-owned; only the form (a thrown native error rather than
+		// a returned envelope) is this Host's.
+		if (!this.requestConfirmation)
+			throw new NativeAuthorityError("interaction_not_opened", batchReason("confirmation_port_unavailable").reason);
+
+		// 1. Host-independent batch preflight: claim ownership, branch
+		// availability, working-tree cleanliness against the authorized scope,
+		// recovery children, plan digest, and base HEAD are one shared projection,
+		// so neither Host re-implements a batch decision.
+		const now = new Date().toISOString();
+		const preflight = await projectBatchPreflight({
+			root: this.cwd,
+			initiative_slug: initiativeSlug,
+			now,
+			readInitiative: this.readInitiative ?? observeGithubInitiative,
 		});
-		if (statusProc.status !== 0) {
+		if (!preflight.ok) {
 			return {
-				state: "rejected",
-				reason: "branch preflight failed: git status is unreadable",
-				recovery_action: "check the repository integrity and retry in the current Host",
+				state: preflight.state,
+				reason: preflight.reason,
+				recovery_action: preflight.recovery_action,
 			};
 		}
-		const statusEntries: Array<{ code: string; path: string }> = [];
-		// -z with --no-renames lists each side of a rename as its own D/A entry, so a
-		// cross-scope rename cannot hide the out-of-scope source deletion.
-		for (const entry of statusProc.stdout.split("\0")) {
-			if (entry.length === 0) continue;
-			statusEntries.push({ code: entry.slice(0, 2), path: entry.slice(3) });
-		}
-		if (statusEntries.length > 0) {
-			if (!isResuming) {
-				return {
-					state: "rejected",
-					reason: "branch preflight failed: working tree is dirty",
-					recovery_action: "delete or rename the conflicting branch, or commit working changes in the current Host",
-				};
-			}
-			// Kernel projections accept staged in-flight work inside the active child's
-			// authorized scope, and reject unstaged/untracked bytes or out-of-scope paths.
-			// `settled` belongs here: Kernel settlement happens before the batch commits the
-			// child, and settlement clears the live state record, so a crash in that window
-			// resumes into a settled child whose staged work is legitimate.
-			const inFlightChild = existingBatch.children.find(
-				(c: { state: string }) => c.state === "enrolled" || c.state === "needs_human" || c.state === "settled",
-			);
-			let authorizedScope: string[] = [];
-			if (inFlightChild) {
-				// Derive the scope from the Kernel TaskRecord intent snapshot first: a
-				// frozen/archived sidecar must not shrink the authorized scope to empty.
+		const isResuming = preflight.projection.is_resuming;
+		const batchBranch = preflight.projection.batch_branch;
+		const existingBatch = preflight.projection.existing_batch;
+		const budget = preflight.projection.budget;
+		const planDigest = preflight.projection.plan_digest;
+		const recoveryChildren = preflight.projection.recovery_children;
+		// 5. Literal-user gate plus the shared reuse/expiry decision, the post-gate
+		// claim/drift cascade, and the Batch Authorization binding. The Host supplies
+		// only its gate, its confirmation reference, and its binding nonce.
+		const authorization = await authorizeBatch<ClaudeBatchStartResult>({
+			root: this.cwd,
+			initiative_slug: initiativeSlug,
+			now,
+			projection: preflight.projection,
+			readInitiative: this.readInitiative ?? observeGithubInitiative,
+			nonce: enrollmentNonce(),
+			gate: async (facts) => {
+				// review-4: the bounded elicitation deadline is shared behavior now, so
+				// both Hosts bound an unanswered confirmation by the same setting.
+				const deadline = startConfirmationDeadline({ env: this.env, signal: meta.signal });
+				let confirmationResult: { decision: NativeDecision; requestId: string };
 				try {
-					// Lock-free read: readTaskRecord would run pending-transaction recovery
-					// before the literal user approved anything, violating zero-write on
-					// decline/cancel/preflight rejection. Mutating Kernel entrypoints take
-					// their own lock when the batch actually starts.
-					const recordRead = readTaskRecordRaw(this.cwd, inFlightChild.task_id);
-					authorizedScope = (recordRead.record as any)?.intent_snapshot?.scope_hint ?? [];
-				} catch {
-					// fallback below
-				}
-				if (authorizedScope.length === 0 && inFlightChild.state === "settled") {
-					// A settled child has no live state record; its authority is the immutable
-					// terminal audit pair. Read-only, so a refusal still writes nothing.
-					try {
-						const settled = readAuditTaskPair(this.cwd, inFlightChild.task_id)?.record as
-							| { intent_snapshot?: { scope_hint?: string[] } }
-							| undefined;
-						authorizedScope = settled?.intent_snapshot?.scope_hint ?? [];
-					} catch {
-						// fallback below
-					}
-				}
-				if (authorizedScope.length === 0) {
-					// Resolve through the TaskRecord's intent_ref: after freeze the
-					// sidecar lives in docs/plans/archive/, so the default pre-freeze
-					// path would either throw or read a stale file.
-					try {
-						const read = readTaskIntentForRecord(this.cwd, inFlightChild.task_id);
-						authorizedScope = read.intent.scope_hint ?? [];
-					} catch {
-						// fallback below
-					}
-				}
-				if (authorizedScope.length === 0) {
-					return {
-						state: "rejected",
-						reason: "branch preflight failed: cannot derive the in-flight child's authorized scope",
-						recovery_action: "resolve the child's intent record, then retry in the current Host",
-					};
-				}
-			}
-			const dirtyBytes = statusEntries.some(({ code }) => code === "??" || code[1] !== " ");
-			if (dirtyBytes) {
-				return {
-					state: "rejected",
-					reason: "branch preflight failed: working tree has unstaged or untracked changes",
-					recovery_action: "stage the in-flight changes with git add, then retry in the current Host",
-				};
-			}
-			const outsideScope = statusEntries.some(({ path }) => {
-				if (path.startsWith(".imm/") || path.startsWith("docs/plans/") || path.startsWith("docs/specs/")) return false;
-				// Scope entries may be exact files, directories, or globs; delegate to the
-				// Kernel's own boundary matcher instead of exact includes.
-				return !authorizedScope.some((scopePath) => pathMatchesScope(path, scopePath));
-			});
-			if (outsideScope) {
-				return {
-					state: "rejected",
-					reason: "branch preflight failed: working tree has changes outside the authorized child scope",
-					recovery_action: "commit or unstage changes outside the active task scope, then retry in the current Host",
-				};
-			}
-		}
-
-		// 4. Project or reconstruct batch plan (pre-confirmation)
-		const now = new Date().toISOString();
-		let recoveryChildren: BatchPlanChild[] = [];
-		let planDigest: string;
-		let confirmChildrenDetails: Array<{ task_id: string; slice_id: string; risk: string }> = [];
-		let confirmExcludedDetails: Array<{ task_id: string; slice_id: string; reason: string }> = [];
-		const recoveryRiskByTask = new Map<string, string>();
-		let budget = existingBatch ? existingBatch.budget : { max_children: 10, deadline_at: new Date(Date.now() + 8 * 3600 * 1000).toISOString(), qa_failure_limit: 2 };
-
-		if (isResuming) {
-			try {
-				recoveryChildren = await Promise.all(
-					existingBatch.children.map(async (c: any) => {
-						const intentPath = `docs/plans/${c.task_id}.intent.json`;
-						let read = { intent: { revision: 1, risk: "material" }, content_hash: "" };
-						try {
-							const taskRecordRead = readTaskRecordRaw(this.cwd, c.task_id);
-							if (taskRecordRead.record) {
-								read = {
-									intent: taskRecordRead.record.intent_snapshot,
-									content_hash: taskRecordRead.record.intent_ref.content_hash,
-								};
-							} else {
-								read = (await readTaskIntent(this.cwd, c.task_id, intentPath)) as any;
-							}
-						} catch {
-							const archivePath = `docs/plans/archive/${c.task_id}.intent.json`;
-							try {
-								read = (await readTaskIntent(this.cwd, c.task_id, archivePath)) as any;
-							} catch {
-								read = (await readTaskIntent(this.cwd, c.task_id, intentPath)) as any;
-							}
+					confirmationResult = await this.requestConfirmation!({
+						operation: "start_unattended_batch",
+						initiativeSlug,
+						toolCallId: meta.toolCallId,
+						planDigest,
+						batchDetails: {
+							initiative_slug: facts.initiative_slug,
+							batch_branch: facts.batch_branch,
+							children: facts.children.map((child) => ({
+								task_id: child.task_id,
+								slice_id: child.slice_id,
+								risk: child.risk,
+							})),
+							excluded: facts.excluded.map((child) => ({
+								task_id: child.task_id,
+								slice_id: child.slice_id,
+								reason: child.reason,
+							})),
+							budget: facts.budget,
+							expires_at: facts.expires_at,
+							...(facts.reuse_blockers.length > 0
+								? {
+										re_confirmation_required: facts.reuse_blockers,
+										recovery: "confirm to issue a fresh authorization bound to the current plan and HEAD",
+									}
+								: {}),
+						},
+						signal: deadline.signal,
+					});
+				} catch (err) {
+					if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
+					if (meta.signal?.aborted)
+						return { kind: "host_rejection", value: batchReason("cancelled_before_execution") };
+					if (err instanceof NativeAuthorityError) {
+						if (err.reasonCode === "unsupported_host") throw err;
+						if (err.reasonCode === "user_cancelled") {
+							return {
+								kind: "host_rejection",
+								value: { state: "cancelled", reason: err.message, recovery_action: err.recoveryAction },
+							};
 						}
-						// Keep the risk captured by the authoritative read; a stale reconstructed
-						// path must never fabricate a risk in the confirmation details.
-						recoveryRiskByTask.set(c.task_id, read.intent?.risk ?? "material");
-						const isDone = c.state === "committed" || c.state === "settled";
 						return {
-							task_id: c.task_id,
-							slice_id: c.slice_id,
-							status: isDone ? ("already_settled" as const) : ("enrollable" as const),
-							blocked_by: [...c.blocked_by],
-							reason: c.reason ?? null,
-							intent_path: intentPath,
-							intent_revision: read.intent.revision,
-							intent_content_hash: read.content_hash,
+							kind: "host_rejection",
+							value: { state: "rejected", reason: err.message, recovery_action: err.recoveryAction },
 						};
-					}),
-				);
-			} catch (err) {
-				return {
-					state: "rejected",
-					reason: `failed to project batch plan: ${err instanceof Error ? err.message : String(err)}`,
-					recovery_action: "review initiative issues and planning sidecars in the current Host",
-				};
-			}
-			planDigest = computeBatchPlanDigest(recoveryChildren as any);
-			for (const c of recoveryChildren) {
-				// Risk captured from the authoritative recovery read; never fabricated.
-				confirmChildrenDetails.push({
-					task_id: c.task_id,
-					slice_id: c.slice_id,
-					risk: recoveryRiskByTask.get(c.task_id) ?? "material",
-				});
-			}
-		} else {
-			let plan: BatchPlan;
-			try {
-				plan = await projectBatchPlan(
-					this.cwd,
-					initiativeSlug,
-					{ confirmation_time: now },
-					this.readInitiative ?? observeGithubInitiative,
-				);
-			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
-				if (msg.includes("has no enrollable children")) {
-					return {
-						state: "rejected",
-						reason: "empty enrollable child set: no enrollable child tasks found in the initiative plan",
-						recovery_action: "ensure the initiative has uncompleted, non-critical child tasks in the current Host",
-					};
-				}
-				return {
-					state: "rejected",
-					reason: `failed to project batch plan: ${msg}`,
-					recovery_action: "review initiative issues and planning sidecars in the current Host",
-				};
-			}
-
-			if (plan.enrollable.length === 0) {
-				return {
-					state: "rejected",
-					reason: "empty enrollable child set: no enrollable child tasks found in the initiative plan",
-					recovery_action: "ensure the initiative has uncompleted, non-critical child tasks in the current Host",
-				};
-			}
-
-			budget = plan.budget;
-			const enrollableChildById = new Map(plan.enrollable.map((c) => [c.task_id, c]));
-			recoveryChildren = plan.children
-				.filter((c) => c.status === "enrollable")
-				.map((c) => {
-					const digestChild = enrollableChildById.get(c.task_id);
+					}
 					return {
-						...c,
-						blocked_by: digestChild ? [...digestChild.blocked_by] : c.blocked_by,
+						kind: "host_rejection",
+						value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
 					};
-				});
-			planDigest = computeBatchPlanDigest(plan.enrollable);
-
-			for (const c of plan.children.filter((item) => item.status === "enrollable")) {
-				let childRisk = "material";
-				try {
-					const intentRead = await readTaskIntent(this.cwd, c.task_id, c.intent_path ?? undefined);
-					childRisk = intentRead.intent.risk;
-				} catch {
-					// fallback
-				}
-				confirmChildrenDetails.push({
-					task_id: c.task_id,
-					slice_id: c.slice_id,
-					risk: childRisk,
-				});
-			}
-			confirmExcludedDetails = plan.children
-				.filter((c) => c.status !== "enrollable")
-				.map((c) => ({
-					task_id: c.task_id,
-					slice_id: c.slice_id,
-					reason: c.status === "needs_human" && c.reason === "critical" ? "critical" : (c.reason ?? c.status),
-				}));
-		}
-
-		// 5. Native confirmation elicitation
-		const isExistingExpired = isResuming && Date.parse(existingBatch.authorization_expires_at) <= Date.now();
-		const expiresAt = isResuming && !isExistingExpired && existingBatch.batch_state === "running"
-			? existingBatch.authorization_expires_at
-			: new Date(Date.now() + 10 * 60 * 1000).toISOString();
-		const batchDetails = {
-			initiative_slug: initiativeSlug,
-			batch_branch: batchBranch,
-			children: confirmChildrenDetails,
-			excluded: confirmExcludedDetails,
-			budget,
-			expires_at: expiresAt,
-		};
-
-		// review-4: bounded elicitation timeout preventing indefinite hang on missing/replayed evidence
-		const configuredTimeout = Number(this.env.IMMUNE_BRAIN_BATCH_TIMEOUT_MS);
-		const timeoutMs = Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : 60_000;
-		const timeoutController = new AbortController();
-		const timeoutTimer = setTimeout(() => {
-			timeoutController.abort(new NativeAuthorityError("user_cancelled", "native confirmation timed out"));
-		}, timeoutMs);
-		const elicitationSignal = meta.signal
-			? AbortSignal.any([meta.signal, timeoutController.signal])
-			: timeoutController.signal;
-
-		let confirmationResult: { decision: "accept" | "decline" | "cancel"; requestId: string };
-		try {
-			confirmationResult = await this.requestConfirmation({
-				operation: "start_unattended_batch",
-				initiativeSlug,
-				toolCallId: meta.toolCallId,
-				planDigest,
-				batchDetails,
-				signal: elicitationSignal,
-			});
-		} catch (err) {
-			if (timeoutController.signal.aborted && !meta.signal?.aborted) {
-				return {
-					state: "rejected",
-					reason: "native confirmation timed out waiting for user interaction",
-					recovery_action: "retry through a fresh native gate in the current Host",
-				};
-			}
-			if (meta.signal?.aborted) {
-				return {
-					state: "cancelled",
-					reason: "user cancelled before batch execution",
-					recovery_action: "wait for a fresh literal-user request",
-				};
-			}
-			if (err instanceof NativeAuthorityError) {
-				if (err.reasonCode === "unsupported_host") throw err;
-				if (err.reasonCode === "user_cancelled") {
-					return { state: "cancelled", reason: err.message, recovery_action: err.recoveryAction };
-				}
-				if (err.reasonCode === "user_denied") {
-					return { state: "rejected", reason: err.message, recovery_action: err.recoveryAction };
+				} finally {
+					deadline.clear();
 				}
-				return { state: "rejected", reason: err.message, recovery_action: err.recoveryAction };
-			}
-			return {
-				state: "rejected",
-				reason: err instanceof Error ? err.message : String(err),
-				recovery_action: "retry through a fresh native gate in the current Host",
-			};
-		} finally {
-			clearTimeout(timeoutTimer);
-		}
 
-		if (meta.signal?.aborted) {
-			return {
-				state: "cancelled",
-				reason: "user cancelled before batch execution",
-				recovery_action: "wait for a fresh literal-user request",
-			};
-		}
-
-		if (confirmationResult.decision === "decline") {
-			return {
-				state: "rejected",
-				reason: "native interaction declined",
-				recovery_action: "wait for a fresh literal-user request",
-			};
-		}
-		if (confirmationResult.decision === "cancel") {
-			return {
-				state: "cancelled",
-				reason: "native interaction cancelled",
-				recovery_action: "wait for a fresh literal-user request",
-			};
-		}
-		if (confirmationResult.decision !== "accept") {
-			return {
-				state: "rejected",
-				reason: "native interaction returned no decision",
-				recovery_action: "retry through a fresh native gate in the current Host",
-			};
-		}
-
-		// 6. Post-confirmation Revalidation (Drift check, Workspace claim, Git HEAD)
-		const postWorkspaceState = readWorkspaceStateRaw(this.cwd);
-		const postClaim = readBackendClaim(this.cwd);
-		const postActiveTaskId = postWorkspaceState.state.current_working || (postClaim?.lifecycle_status === "active" ? postClaim.task_id : null);
-		const isPostOwnClaim =
-			isResuming &&
-			postActiveTaskId !== null &&
-			syncIsOwnBatchClaim(this.cwd, existingBatch, postActiveTaskId, batchBranch);
-		if (postActiveTaskId && !isPostOwnClaim) {
-			return {
-				state: "blocked",
-				reason: `an active workspace claim appeared during confirmation for task: ${postActiveTaskId}`,
-				recovery_action: "resolve or stop the active task before starting a batch in the current Host",
-			};
-		}
-
-		if (isResuming) {
-			let recheckedDigest: string;
-			try {
-				const recheckedChildren = await Promise.all(
-					existingBatch.children.map(async (c: any) => {
-						const intentPath = `docs/plans/${c.task_id}.intent.json`;
-						let read = { intent: { revision: 1, risk: "material" }, content_hash: "" };
-						try {
-							const taskRecordRead = readTaskRecordRaw(this.cwd, c.task_id);
-							if (taskRecordRead.record) {
-								read = {
-									intent: taskRecordRead.record.intent_snapshot,
-									content_hash: taskRecordRead.record.intent_ref.content_hash,
-								};
-							} else {
-								read = (await readTaskIntent(this.cwd, c.task_id, intentPath)) as any;
-							}
-						} catch {
-							const archivePath = `docs/plans/archive/${c.task_id}.intent.json`;
-							try {
-								read = (await readTaskIntent(this.cwd, c.task_id, archivePath)) as any;
-							} catch {
-								read = (await readTaskIntent(this.cwd, c.task_id, intentPath)) as any;
-							}
-						}
-						const isDone = c.state === "committed" || c.state === "settled";
-						return {
-							task_id: c.task_id,
-							slice_id: c.slice_id,
-							status: isDone ? ("already_settled" as const) : ("enrollable" as const),
-							blocked_by: [...c.blocked_by],
-							reason: c.reason ?? null,
-							intent_path: intentPath,
-							intent_revision: read.intent.revision,
-							intent_content_hash: read.content_hash,
-						};
-					}),
-				);
-				recheckedDigest = computeBatchPlanDigest(recheckedChildren);
-			} catch (err) {
-				return {
-					state: "rejected",
-					reason: "batch plan became unreadable after native confirmation",
-					recovery_action: "review the current workspace and retry through a fresh native gate in the current Host",
-				};
-			}
-			if (recheckedDigest !== planDigest) {
-				return {
-					state: "rejected",
-					reason: "batch plan changed after native confirmation",
-					recovery_action: "review the current workspace and retry through a fresh native gate in the current Host",
-				};
-			}
-		} else {
-			let revalidatedPlan: BatchPlan;
-			try {
-				revalidatedPlan = await projectBatchPlan(
-					this.cwd,
+				// A transport that answers "cancel" on abort is still a timeout, not a user
+				// decision: the Host that owns the transport reports which one it was.
+				if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
+				if (confirmationResult.decision === "cancel" && meta.signal?.aborted)
+					return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+				if (meta.signal?.aborted)
+					return { kind: "host_rejection", value: batchReason("cancelled_before_execution") };
+				if (confirmationResult.decision === "decline")
+					return { kind: "host_rejection", value: batchReason("confirmation_declined") };
+				if (confirmationResult.decision === "cancel")
+					return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
+				if (confirmationResult.decision !== "accept")
+					return { kind: "host_rejection", value: batchReason("confirmation_no_decision") };
+				return { kind: "confirmed", request_id: confirmationResult.requestId };
+			},
+			// A reused authorization keeps this invocation's Kernel binding without a new
+			// literal-user act, so its confirmation reference names the resumed batch
+			// rather than a requestId no elicitation produced.
+			confirmationRef: ({ batch_id, request_id }) =>
+				confirmationRef({
+					connectionId: meta.sessionId,
+					toolCallId: meta.toolCallId,
+					requestId: request_id ?? `resumed-${batch_id}`,
+					operation: "start_unattended_batch",
 					initiativeSlug,
-					{ confirmation_time: now },
-					this.readInitiative ?? observeGithubInitiative,
-				);
-			} catch (err) {
-				return {
-					state: "rejected",
-					reason: "batch plan became unreadable after native confirmation",
-					recovery_action: "review the current workspace and retry through a fresh native gate in the current Host",
-				};
-			}
-
-			const revalidatedDigest = computeBatchPlanDigest(revalidatedPlan.enrollable);
-			if (revalidatedDigest !== planDigest) {
-				return {
-					state: "rejected",
-					reason: "batch plan changed after native confirmation",
-					recovery_action: "review the current workspace and retry through a fresh native gate in the current Host",
-				};
-			}
-		}
-
-		// review-batch-head-revalidation-window: re-verify Git HEAD after asynchronous revalidation
-		let postHead: string;
-		try {
-			postHead = readGitHead(this.cwd);
-		} catch (err) {
-			return {
-				state: "rejected",
-				reason: "Git repository became unreadable after native confirmation",
-				recovery_action: "review the current workspace and retry through a fresh native gate in the current Host",
-			};
-		}
-		if (postHead !== baseHead) {
-			return {
-				state: "rejected",
-				reason: "Git HEAD moved after native confirmation",
-				recovery_action: "review the current workspace and retry through a fresh native gate in the current Host",
-			};
-		}
-
-		// review-batch-active-claim-race: re-check workspace and backend claim after asynchronous revalidation
-		const finalWorkspaceState = readWorkspaceStateRaw(this.cwd);
-		const finalClaim = readBackendClaim(this.cwd);
-		const finalActiveTaskId = finalWorkspaceState.state.current_working || (finalClaim?.lifecycle_status === "active" ? finalClaim.task_id : null);
-		// Re-verify the full claim identity now: a claim swapped for the same child
-		// during confirmation must stay blocked even when plan and HEAD are stable.
-		const finalIsOwnClaim =
-			isResuming &&
-			finalActiveTaskId !== null &&
-			syncIsOwnBatchClaim(this.cwd, existingBatch, finalActiveTaskId, batchBranch);
-		if (finalActiveTaskId && !finalIsOwnClaim) {
-			return {
-				state: "blocked",
-				reason: `an active workspace claim appeared during confirmation for task: ${finalActiveTaskId}`,
-				recovery_action: "resolve or stop the active task before starting a batch in the current Host",
-			};
-		}
+					planDigest,
+				}),
+		});
+		if (authorization.outcome === "host_rejection") return authorization.value;
+		if (authorization.outcome === "rejected") return authorization.rejection;
+		const { binding, batch_id: batchId, expires_at: expiresAt } = authorization;
 
 		// review-1: verify cancellation signal right before authority issuance and startBatch
-		if (meta.signal?.aborted) {
-			return {
-				state: "cancelled",
-				reason: "user cancelled before batch execution",
-				recovery_action: "wait for a fresh literal-user request",
-			};
-		}
-
-		// 7. Issue Batch Authorization through Kernel registry and startBatch
-		const batchId = existingBatch ? existingBatch.batch_id : `batch-${initiativeSlug}-${Date.now()}`;
-		const confirmation = confirmationRef({
-			connectionId: meta.sessionId,
-			toolCallId: meta.toolCallId,
-			requestId: confirmationResult.requestId,
-			operation: "start_unattended_batch",
-			initiativeSlug,
-			planDigest,
-		});
-		const binding: BatchAuthorizationBinding = {
-			batch_id: batchId,
-			initiative_slug: initiativeSlug,
-			plan_digest: planDigest,
-			branch: batchBranch,
-			base_head: isResuming ? existingBatch.base_head : baseHead,
-			budget,
-			actor_id: "user",
-			confirmation_ref: confirmation,
-			expires_at: expiresAt,
-			nonce: enrollmentNonce(),
-		};
+		if (meta.signal?.aborted) return batchReason("cancelled_before_execution");
 
 		const capability = this.batchRegistry.issue(binding, recoveryChildren as any, now);
 
@@ -1541,9 +1113,9 @@ export class ClaudeRuntime {
 		const kernelPort: BatchRunnerKernelPort = {
 			...basePort,
 			ownsTaskClaim: (taskId) => {
-				if (isResuming && taskId === activeTaskId) {
+				if (isResuming && taskId === readActiveClaimTaskId(this.cwd)) {
 					// Re-verify the CURRENT claim identity synchronously.
-					return syncIsOwnBatchClaim(this.cwd, existingBatch, taskId, batchBranch);
+					return isOwnBatchClaim(this.cwd, existingBatch!, taskId, batchBranch);
 				}
 				return basePort.ownsTaskClaim(taskId);
 			},
@@ -1556,7 +1128,7 @@ export class ClaudeRuntime {
 			capability,
 			children: recoveryChildren,
 			plan_digest: planDigest,
-			base_head: isResuming ? existingBatch.base_head : baseHead,
+			base_head: binding.base_head,
 			confirmation_time: now,
 			authorization_expires_at: expiresAt,
 			budget,
@@ -1566,13 +1138,7 @@ export class ClaudeRuntime {
 		});
 
 		// review-3 & review-batch-preflight-recovery-is-diagnostic: map rejected batch state to rejected result with same-Host recovery action
-		if (report.batch_state === "rejected") {
-			return {
-				state: "rejected",
-				reason: report.reason ?? "batch run rejected",
-				recovery_action: "delete or rename the conflicting branch, or commit working changes and retry in the current Host",
-			};
-		}
+		if (report.batch_state === "rejected") return batchReason("batch_run_rejected", report.reason ?? "");
 
 		return {
 			state: "started",
@@ -1617,7 +1183,8 @@ export class ClaudeRuntime {
 				if (!rehearsal.rehearsed || rehearsal.evidence.outcome !== "ready") {
 					throw new Error(`Kernel enrollment rehearsal failed: ${rehearsal.evidence.blockers.join("; ")}`);
 				}
-				const enrolled = enrollCanaryTask(root, input, this.enrollmentRegistry);
+				// The enrollment itself is the effect; its record is re-read below.
+				enrollCanaryTask(root, input, this.enrollmentRegistry);
 				const recordRaw = readTaskRecordRaw(root, task_id);
 				return { record_revision: recordRaw.revision };
 			},