immune-brain 4.4.1 → 4.6.0

package/plugins/immune-brain/runtime/unattended/batch_plan.ts

@@ -19,7 +19,6 @@ import type {
 } from "./types";
 
 const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-export const DEFAULT_DEADLINE_MS = 8 * 60 * 60 * 1_000;
 const DEFAULT_QA_FAILURE_LIMIT = 2;
 
 /**
@@ -123,7 +122,7 @@ function dependencyClosures(order: GithubInitiativeObservation["tasks"]): Map<st
 	return closures;
 }
 
-function budget(input: ProjectBatchPlanInput, enrollableCount: number, confirmationTime: { milliseconds: number; iso: string }): BatchPlanBudget {
+function budget(input: ProjectBatchPlanInput, enrollableCount: number): BatchPlanBudget {
 	const maxChildren = input.budget?.max_children === undefined
 		? positiveSafeInteger(enrollableCount, "budget.max_children")
 		: positiveSafeInteger(input.budget.max_children, "budget.max_children");
@@ -132,12 +131,7 @@ function budget(input: ProjectBatchPlanInput, enrollableCount: number, confirmat
 	const qaFailureLimit = input.budget?.qa_failure_limit === undefined
 		? DEFAULT_QA_FAILURE_LIMIT
 		: positiveSafeInteger(input.budget.qa_failure_limit, "budget.qa_failure_limit");
-	const deadline = input.budget?.deadline_at === undefined
-		? new Date(confirmationTime.milliseconds + DEFAULT_DEADLINE_MS).toISOString()
-		: timestamp(input.budget.deadline_at, "budget.deadline_at").iso;
-	if (Date.parse(deadline) <= confirmationTime.milliseconds)
-		throw new Error("budget.deadline_at must be later than confirmation_time");
-	return { max_children: maxChildren, deadline_at: deadline, qa_failure_limit: qaFailureLimit };
+	return { max_children: maxChildren, qa_failure_limit: qaFailureLimit };
 }
 
 export async function projectBatchPlan(
@@ -238,6 +232,6 @@ export async function projectBatchPlan(
 		children,
 		enrollable,
 		plan_digest: planDigest,
-		budget: budget(input, enrollable.length, confirmationTime),
+		budget: budget(input, enrollable.length),
 	};
 }

package/plugins/immune-brain/runtime/unattended/batch_preflight.ts

@@ -22,7 +22,8 @@ import { readGitHead } from "../kernel/pi_canary_prepare";
 import { readTaskIntent } from "../kernel/intent";
 import { localRunId, readAuditTaskPair, readTaskRecordRaw, readWorkspaceStateRaw, reconcileKernelAuthority } from "../kernel/storage";
 import { pathMatchesScope } from "../workspace_scope";
-import { DEFAULT_DEADLINE_MS, projectBatchPlan } from "./batch_plan";
+import { captureBatchReconfirmation, retainReconfirmation, ownUnpersistedBatchHead, type ReconfirmationSnapshot } from "./batch_reconfirmation";
+import { projectBatchPlan } from "./batch_plan";
 import { batchReason, type BatchReasonKey } from "./batch_reasons";
 import { isTerminalBatchState, readBatchRunState, type BatchRunStateRecord } from "./batch_state";
 import { readRunRowByTask, withKernelRead } from "../kernel/sqlite_store";
@@ -44,6 +45,8 @@ export interface BatchPreflightOptions {
 }
 
 export interface BatchPreflightProjection {
+	/** Captured observations only; never serialized or used as capability. */
+	reconfirmation?: ReconfirmationSnapshot;
 	initiative_slug: string;
 	batch_branch: string;
 	is_resuming: boolean;
@@ -95,6 +98,29 @@ export function readActiveClaimTaskId(root: string): string | null {
 	return workspace.state.current_working || (claim?.lifecycle_status === "active" ? claim.task_id : null);
 }
 
+/**
+ * The initiative whose resumable batch holds `taskId` as an in-flight child, or
+ * null. Read-only; a Host uses it to re-enter the batch after a foreground
+ * child settles, and anything unreadable simply means there is nothing to continue.
+ */
+export function findResumableBatchSlugForTask(root: string, taskId: string): string | null {
+	const batchesDir = join(root, ".imm", "state", "batches");
+	if (!existsSync(batchesDir)) return null;
+	for (const file of readdirSync(batchesDir)) {
+		if (!file.endsWith(".json")) continue;
+		try {
+			const record = JSON.parse(readFileSync(join(batchesDir, file), "utf8")) as BatchRunStateRecord;
+			if (record?.contract !== "assurance_kernel/batch_run_state/v1") continue;
+			if (record.batch_state !== "running" && record.batch_state !== "needs_human") continue;
+			if (record.children.some((child) => child.task_id === taskId && (child.state === "enrolled" || child.state === "settled")))
+				return record.initiative_slug;
+		} catch {
+			continue;
+		}
+	}
+	return null;
+}
+
 /**
  * The batch record for this initiative, or a corruption marker. A terminal
  * record (completed, budget_stopped, failed, rejected) is not active: returning
@@ -179,10 +205,78 @@ export function findSettledBatchRecord(root: string, initiativeSlug: string): Ba
 	return newest;
 }
 
+export type BatchLineage =
+	| { kind: "equal"; head: string }
+	| { kind: "fast_forward"; head: string }
+	| { kind: "broken"; message: string };
+
+/**
+ * Classify live HEAD against the batch's recorded head. `fast_forward` is HEAD
+ * on the same batch branch with the recorded head as an ancestor and every
+ * recorded child commit still reachable: the user's own commit, adopted rather
+ * than refused. Anything else is the fatal `batch_head_lineage_broken`.
+ */
+export function classifyBatchLineage(input: {
+	root: string;
+	branch: string;
+	expectedHead: string;
+	childCommits: readonly string[];
+	/** When set, a fast-forward carrying this batch's own trailer is refused. */
+	batchId?: string;
+}): BatchLineage {
+	const { root, branch, expectedHead, childCommits } = input;
+	const run = (args: string[]) =>
+		spawnSync("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+	const broken = (reason: string): BatchLineage => ({
+		kind: "broken",
+		message: `batch_head_lineage_broken: ${reason}`,
+	});
+	const branchResult = run(["symbolic-ref", "--short", "HEAD"]);
+	const currentBranch = branchResult.stdout.trim();
+	if (branchResult.status !== 0 || currentBranch !== branch)
+		return broken(`current branch ${currentBranch} does not match expected branch ${branch}`);
+	const headResult = run(["rev-parse", "HEAD"]);
+	const head = headResult.stdout.trim();
+	if (headResult.status !== 0 || !head) return broken("current HEAD is unreadable");
+	if (head !== expectedHead && run(["merge-base", "--is-ancestor", expectedHead, head]).status !== 0)
+		return broken(`current HEAD ${head} does not descend from expected batch head ${expectedHead}`);
+	for (const commit of childCommits) {
+		if (run(["merge-base", "--is-ancestor", commit, head]).status !== 0)
+			return broken(`recorded commit ${commit} is no longer reachable from HEAD`);
+	}
+	if (head === expectedHead) return { kind: "equal", head };
+	// Only the runner writes this batch's trailer, and every commit it recorded
+	// is already in childCommits: a fast-forward claiming it is an impersonation
+	// (or an unverified own commit), never the user's own work.
+	if (input.batchId) {
+		const claimed = run([
+			"log",
+			"--fixed-strings",
+			`--grep=Immune-Brain-Batch: ${input.batchId}`,
+			"--format=%H",
+			`${expectedHead}..${head}`,
+		]);
+		const claimant = claimed.stdout.split(/\s+/).find(Boolean);
+		if (claimed.status !== 0 || claimant)
+			return broken(`commit ${claimant ?? head} claims batch ${input.batchId} without recorded evidence`);
+	}
+	return { kind: "fast_forward", head };
+}
+
 /** The HEAD a resumable batch must still sit on: its last child commit, or its base. */
-export function expectedBatchHead(record: { base_head: string; commits?: unknown }): string {
+export function expectedBatchHead(record: {
+	base_head: string;
+	commits?: unknown;
+	adopted_heads?: ReadonlyArray<{ from: string; to: string }>;
+}): string {
 	const commits = Array.isArray(record.commits) ? (record.commits as string[]) : [];
-	return commits.length > 0 ? commits[commits.length - 1]! : record.base_head;
+	let head = commits.length > 0 ? commits[commits.length - 1]! : record.base_head;
+	// An adoption is keyed by the head it moved from, so one recorded before the
+	// last child commit can never resurface as the expected head.
+	for (const adoption of record.adopted_heads ?? []) {
+		if (adoption.from === head) head = adoption.to;
+	}
+	return head;
 }
 
 /**
@@ -231,9 +325,9 @@ export function isOwnBatchClaim(
 		return false;
 	}
 	if (!rec) return false;
-	const lineageHeads = [existingBatch.base_head].concat(
-		Array.isArray(existingBatch.commits) ? existingBatch.commits : [],
-	);
+	const lineageHeads = [existingBatch.base_head]
+		.concat(Array.isArray(existingBatch.commits) ? existingBatch.commits : [])
+		.concat((existingBatch.adopted_heads ?? []).map((adoption) => adoption.to));
 	if (!lineageHeads.includes(rec.git_base_head)) return false;
 	if (claim.enrollment_event_id !== `enroll-${taskId}-${claim.created_at}`) return false;
 	const createdAt = Date.parse(claim.created_at);
@@ -291,8 +385,8 @@ function porcelainEntries(root: string): Array<{ code: string; path: string }> |
 	// an unstaged modification (" M path") and silently mis-scoped the path.
 	const statusProc = spawnSync(
 		"git",
-		["-C", root, "status", "--porcelain=v1", "-z", "--no-renames", "--untracked-files=all"],
-		{ encoding: "utf8" },
+		["-C", root, "status", "--porcelain=v1", "-z", "--no-renames", "--untracked-files=all", "--ignore-submodules=none"],
+		{ encoding: "utf8", env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } },
 	);
 	if (statusProc.status !== 0) return null;
 	const entries: Array<{ code: string; path: string }> = [];
@@ -344,11 +438,11 @@ async function projectPlanSurface(input: {
 	let budget: BatchPlanBudget;
 
 	if (isResuming && existingBatch) {
-		// Candidate only: renewal uses the same default window as a fresh plan,
-		// while preserving the confirmed count limits and the persisted record.
-		budget = { ...existingBatch.budget };
-		if (Date.parse(budget.deadline_at) <= Date.parse(now))
-			budget.deadline_at = new Date(Date.parse(now) + DEFAULT_DEADLINE_MS).toISOString();
+		// A resume keeps the confirmed count limits of the persisted record.
+		budget = {
+			max_children: existingBatch.budget.max_children,
+			qa_failure_limit: existingBatch.budget.qa_failure_limit,
+		};
 		try {
 			recoveryChildren = existingBatch.children.map((c) => {
 				const intentPath = `docs/plans/${c.task_id}.intent.json`;
@@ -552,22 +646,26 @@ export async function projectBatchPreflight(
 	});
 	if (!planSurface.ok)
 		return reject(planSurface.key, planSurface.detail);
+	let reconfirmation: ReconfirmationSnapshot | undefined;
+	if (activeRecord && activeRecord.plan_digest !== planSurface.surface.plan_digest) {
+		try { reconfirmation = await captureBatchReconfirmation(root, activeRecord, planSurface.surface.recovery_children); }
+		catch { return reject("plan_projection_failed", "batch plan reconfirmation is not eligible"); }
+	}
 
-	return {
-		ok: true,
-		projection: {
-			initiative_slug: initiativeSlug,
-			batch_branch: batchBranch,
-			is_resuming: isResuming,
-			existing_batch: existingBatch,
-			base_head: baseHead,
-			budget: planSurface.surface.budget,
-			plan_digest: planSurface.surface.plan_digest,
-			recovery_children: planSurface.surface.recovery_children,
-			risk_by_task: planSurface.surface.risk_by_task,
-			excluded: planSurface.surface.excluded,
-		},
+	const projection: BatchPreflightProjection = {
+		initiative_slug: initiativeSlug,
+		batch_branch: batchBranch,
+		is_resuming: isResuming,
+		existing_batch: existingBatch,
+		base_head: baseHead,
+		budget: planSurface.surface.budget,
+		plan_digest: planSurface.surface.plan_digest,
+		recovery_children: planSurface.surface.recovery_children,
+		risk_by_task: planSurface.surface.risk_by_task,
+		excluded: planSurface.surface.excluded,
 	};
+	if (reconfirmation) Object.defineProperty(projection, "reconfirmation", { value: reconfirmation });
+	return { ok: true, projection };
 }
 
 /**
@@ -628,7 +726,6 @@ export interface BatchConfirmationFacts {
 	batch_branch: string;
 	plan_digest: string;
 	budget: BatchPlanBudget;
-	expires_at: string;
 	reuse_blockers: string[];
 	children: Array<{ task_id: string; slice_id: string; risk: string; status: BatchPlanChildStatus }>;
 	excluded: Array<{ task_id: string; slice_id: string; reason: string }>;
@@ -649,7 +746,6 @@ export type BatchAuthorizationOutcome<HostRejection> =
 			batch_id: string;
 			reuse_authorization: boolean;
 			reuse_blockers: string[];
-			expires_at: string;
 			binding: BatchAuthorizationBinding;
 	  }
 	| { outcome: "rejected"; rejection: BatchPreflightRejection }
@@ -671,7 +767,7 @@ export interface BatchAuthorizationOptions<HostRejection> {
 
 /**
  * The one authorization flow both Host adapters call after the shared
- * preflight: ADR-0005's reuse/expiry decision, the literal-user gate, the
+ * preflight: ADR-0005's reuse decision, the literal-user gate, the
  * post-gate claim/drift cascade, and the BatchAuthorizationBinding. A Host
  * supplies its gate, its confirmation reference, and its nonce; every decision
  * below stays Host-independent.
@@ -689,10 +785,6 @@ export async function authorizeBatch<HostRejection>(
 	} = projection;
 	const existingBatch = projection.existing_batch;
 
-	// ADR-0005 Decision 1: one Batch Authorization spans the work it authorizes,
-	// so its expiry is the deadline the literal user confirmed rather than a fixed
-	// window that lapses while a child is parked on a foreground Review.
-	const isExistingExpired = isResuming && Date.parse(existingBatch!.authorization_expires_at) <= Date.now();
 	const branchBefore = spawnSync("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" });
 	if (branchBefore.status !== 0)
 		return { outcome: "rejected", rejection: batchRejection("repository_became_unreadable") };
@@ -700,17 +792,31 @@ export async function authorizeBatch<HostRejection>(
 	// ADR-0005 Decision 1: a resume of an intact, still-binding authorization
 	// reuses it instead of opening a second native gate. Anything that no longer
 	// binds falls through to the gate below, which names the reason.
+	const ownsUnpersistedHead = isResuming && existingBatch !== null && existingBatch.plan_digest === planDigest &&
+		expectedBatchHead(existingBatch) !== baseHead && ownUnpersistedBatchHead(root, existingBatch, baseHead);
+	// A fast-forward on the batch branch is the user's own work: the runner adopts
+	// it, so it neither blocks reuse nor counts as moved provenance.
+	const fastForwardsRecordedHead = isResuming && existingBatch !== null && existingBatch.branch === batchBranch &&
+		expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead &&
+		classifyBatchLineage({
+			root,
+			branch: batchBranch,
+			expectedHead: expectedBatchHead(existingBatch),
+			childCommits: existingBatch.commits,
+			batchId: existingBatch.batch_id,
+		}).kind === "fast_forward";
+	if (isResuming && existingBatch && !existingBatch.commits.length && existingBatch.children[0]?.state === "settled" &&
+		expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead && !fastForwardsRecordedHead)
+		return { outcome: "rejected", rejection: batchRejection("head_moved", "first unpersisted commit provenance is invalid") };
 	const reuseBlockers: string[] = [];
 	if (isResuming && existingBatch) {
-		if (isExistingExpired) reuseBlockers.push("batch_authorization_expired");
-		if (Date.parse(existingBatch.budget.deadline_at) <= Date.now()) reuseBlockers.push("batch_budget_expired");
 		if (existingBatch.batch_state !== "running") reuseBlockers.push("batch_not_running");
 		if (existingBatch.plan_digest !== planDigest) reuseBlockers.push("batch_plan_digest_changed");
 		if (existingBatch.branch !== batchBranch) reuseBlockers.push("batch_branch_changed");
-		if (expectedBatchHead(existingBatch) !== baseHead) reuseBlockers.push("batch_head_lineage_moved");
+		if (expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead && !fastForwardsRecordedHead)
+				reuseBlockers.push("batch_head_lineage_moved");
 	}
 	const reuseAuthorization = isResuming && reuseBlockers.length === 0;
-	const expiresAt = reuseAuthorization ? existingBatch!.authorization_expires_at : budget.deadline_at;
 
 	const batchId = isResuming && existingBatch ? existingBatch.batch_id : `batch-${initiativeSlug}-${randomUUID()}`;
 	const facts: BatchConfirmationFacts = {
@@ -718,7 +824,6 @@ export async function authorizeBatch<HostRejection>(
 		batch_branch: batchBranch,
 		plan_digest: planDigest,
 		budget,
-		expires_at: expiresAt,
 		reuse_blockers: reuseBlockers,
 		children: projection.recovery_children.map((child) => ({
 			task_id: child.task_id,
@@ -753,7 +858,7 @@ export async function authorizeBatch<HostRejection>(
 	if (drift.plan_digest !== planDigest)
 		return { outcome: "rejected", rejection: batchRejection("plan_changed", drift.plan_digest) };
 	if (drift.base_head === null) return { outcome: "rejected", rejection: batchRejection("repository_became_unreadable") };
-	if (drift.base_head !== baseHead)
+	if (drift.base_head !== baseHead || (ownsUnpersistedHead && !ownUnpersistedBatchHead(root, existingBatch!, baseHead)))
 		return { outcome: "rejected", rejection: batchRejection("head_moved", drift.base_head) };
 
 	// The drift projection's own claim read happened before its plan read; this
@@ -765,8 +870,8 @@ export async function authorizeBatch<HostRejection>(
 	if (finalClaimTaskId && !finalOwnClaim)
 		return { outcome: "rejected", rejection: batchRejection("claim_appeared_during_confirmation", finalClaimTaskId) };
 
-	// Confirmation cannot adopt a changed record or extend its displayed window
-	// after the user answers. Re-read the clock and branch after the async checks.
+	// Confirmation cannot adopt a changed record after the user answers. Re-read
+	// the record and branch after the async checks.
 	if (isResuming) {
 		const current = findExistingActiveBatch(root, initiativeSlug);
 		if (!current || current.corrupt || JSON.stringify(current.record) !== JSON.stringify(existingBatch))
@@ -775,9 +880,11 @@ export async function authorizeBatch<HostRejection>(
 	const branchAfter = spawnSync("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" });
 	if (branchAfter.status !== 0 || branchAfter.stdout !== branchBefore.stdout)
 		return { outcome: "rejected", rejection: batchRejection("confirmation_failed", "Git branch moved after native confirmation") };
-	if (Date.parse(expiresAt) <= Date.now())
-		return { outcome: "rejected", rejection: batchRejection("confirmation_failed", "confirmed batch deadline expired before authorization issuance") };
 
+	if (projection.reconfirmation) {
+		try { projection.reconfirmation.assertUnchanged(); }
+		catch { return { outcome: "rejected", rejection: batchRejection("plan_changed") }; }
+	}
 	const binding: BatchAuthorizationBinding = {
 		batch_id: batchId,
 		initiative_slug: initiativeSlug,
@@ -787,15 +894,14 @@ export async function authorizeBatch<HostRejection>(
 		budget,
 		actor_id: LITERAL_USER_ACTOR_ID,
 		confirmation_ref: options.confirmationRef({ batch_id: batchId, request_id: requestId }),
-		expires_at: expiresAt,
 		nonce: options.nonce,
 	};
+	if (projection.reconfirmation) retainReconfirmation(binding.nonce, projection.reconfirmation);
 	return {
 		outcome: "authorized",
 		batch_id: batchId,
 		reuse_authorization: reuseAuthorization,
 		reuse_blockers: reuseBlockers,
-		expires_at: expiresAt,
 		binding,
 	};
 }

package/plugins/immune-brain/runtime/unattended/batch_reasons.ts

@@ -24,7 +24,6 @@ export type BatchReasonKey =
 	| "empty_enrollable_set"
 	| "plan_projection_failed"
 	| "confirmation_port_unavailable"
-	| "confirmation_timed_out"
 	| "confirmation_cancelled"
 	| "confirmation_declined"
 	| "confirmation_no_decision"
@@ -115,11 +114,6 @@ export const BATCH_REASONS: Readonly<Record<BatchReasonKey, BatchReasonSpec>> =
 		reason: "native confirmation port is unavailable",
 		recovery_action: "retry through a fresh native gate in the current Host",
 	},
-	confirmation_timed_out: {
-		state: "rejected",
-		reason: "native confirmation timed out waiting for user interaction",
-		recovery_action: "retry through a fresh native gate in the current Host",
-	},
 	confirmation_cancelled: {
 		state: "cancelled",
 		reason: "native interaction cancelled",

package/plugins/immune-brain/runtime/unattended/batch_reconfirmation.ts

@@ -0,0 +1,193 @@
+// Read-only eligibility for a first, zero-commit plan reconfirmation.
+import { spawnSync } from "node:child_process";
+import { computeBatchPlanDigest, type BatchPlanChild as DigestChild } from "../kernel/batch_authority";
+import { canonicalIntentHash, parseTaskIntentV1, readTaskIntent } from "../kernel/intent";
+import { projectAssurance } from "../kernel/assurance_projection";
+import { localRunId, readAuditTaskPair, readSecureProjectBytes, readWorkspaceStateRaw } from "../kernel/storage";
+import { readRunRowByTask, withKernelRead } from "../kernel/sqlite_store";
+import { taskRevisionIdentity, taskCommitRevisionIdentity, pathMatchesScope } from "../workspace_scope";
+import { projectTask } from "../kernel/completion";
+import { isTerminalBatchState, type BatchRunStateRecord } from "./batch_state";
+import type { BatchPlanChild } from "./types";
+
+const oid = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const id = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const batchAuthor = process.env.GIT_AUTHOR_NAME || "Immune-Brain Batch";
+const decode = (bytes: Uint8Array) => new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+function refuse(): never { throw new Error("plan_digest mismatch: batch plan reconfirmation is not eligible"); }
+function matchesLocalProof(localJson: string | null, exported: object): boolean {
+	return localJson !== null && JSON.stringify(Object.entries(JSON.parse(localJson)).sort()) === JSON.stringify(Object.entries(exported).sort());
+}
+function git(root: string, args: string[]): string {
+	const r = spawnSync("git", ["-C", root, ...args], { encoding: "buffer", maxBuffer: 262144, env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } });
+	if (r.status !== 0) refuse();
+	return decode(r.stdout);
+}
+// Recognize only the first commit/persist crash window; never query Git with
+// an OID read from mutable evidence. The existing Git port performs final adoption.
+export function ownUnpersistedBatchHead(root: string, record: BatchRunStateRecord, head: string): boolean {
+	try {
+		if (!oid.test(head) || !oid.test(record.base_head) || !id.test(record.batch_id) || record.commits.length ||
+			record.children[0]?.state !== "settled" || record.children.some(c => c.commit !== null)) return false;
+		const task = record.children[0].task_id;
+		if (!id.test(task)) return false;
+		const evidence = JSON.parse(decode(readSecureProjectBytes(root, `.imm/state/batches/commits/${record.batch_id}-${task}.json`)));
+		if (evidence.contract !== "assurance_kernel/batch_commit_evidence/v1" || evidence.batch_id !== record.batch_id ||
+			evidence.task_id !== task || evidence.commit !== head || evidence.parent_head !== record.base_head) return false;
+		if (git(root, ["symbolic-ref", "--short", "HEAD"]).trim() !== record.branch) return false;
+		const parents = git(root, ["rev-list", "--parents", "-n", "1", head]).trim().split(/\s+/).slice(1);
+		if (parents.length !== 1 || parents[0] !== record.base_head) return false;
+		const metadata = git(root, ["show", "-s", "--format=%an%x00%s%x00%(trailers:key=Immune-Brain-Batch,valueonly)", head]).split("\0");
+		if (metadata[0] !== batchAuthor || !metadata[1]?.startsWith(`imm(${task}):`) || metadata[2]?.trim() !== record.batch_id) return false;
+		const run = localRunId(root, task);
+		if (!run || !id.test(run)) return false;
+		const pair = readAuditTaskPair(root, task, run);
+		if (!pair || pair.record.contract !== "assurance_kernel/task_record/v4" || pair.record.lifecycle !== "done" || pair.proof.terminal_lifecycle !== "done") return false;
+		const local = withKernelRead(root, db => readRunRowByTask(db, task));
+		if (!local || local.run_id !== run || local.state !== "done" || !matchesLocalProof(local.terminal_proof_json, pair.proof)) return false;
+		for (const file of ["task-record.json", "terminal-proof.json"]) {
+			const path = `.imm/audit/${task}/${run}/${file}`;
+			if (!readSecureProjectBytes(root, path).equals(Buffer.from(git(root, ["show", `${head}:${path}`])))) return false;
+		}
+		const paths = git(root, ["diff-tree", "--no-commit-id", "--name-only", "--no-renames", "-z", "-r", head]).split("\0").filter(Boolean);
+		if (!paths.length || paths.some(path => !path.startsWith(`.imm/audit/${task}/${run}/`) &&
+			!pair.record.intent_snapshot.scope_hint.some(s => pathMatchesScope(path, s)))) return false;
+		const identity = taskCommitRevisionIdentity(root, pair.record.intent_snapshot.scope_hint, pair.record.git_base_head, head);
+		if (!projectTask(pair.record.intent_snapshot, pair.record, identity.diff_hash, pair.record.intent_ref.content_hash, identity.changed_paths).complete) return false;
+		return git(root, ["rev-parse", "HEAD"]).trim() === head;
+	} catch { return false; }
+}
+
+export interface ReconfirmationSnapshot {
+	root: string;
+	plan_digest: string;
+	stateBytes: Buffer;
+	/** Synchronous read-only check repeated under the state owner's lock. */
+	assertUnchanged(): void;
+}
+
+// Ephemeral captured observations, not authority: the runner independently
+// validates the native capability. Entries are discarded on application.
+const confirmations = new Map<string, ReconfirmationSnapshot>();
+export function retainReconfirmation(nonce: string, snapshot: ReconfirmationSnapshot): void {
+	if (confirmations.has(nonce)) refuse();
+	confirmations.set(nonce, snapshot);
+}
+export function takeReconfirmation(nonce: string): ReconfirmationSnapshot {
+	const found = confirmations.get(nonce); confirmations.delete(nonce);
+	if (!found) refuse();
+	return found;
+}
+
+export async function captureBatchReconfirmation(root: string, record: BatchRunStateRecord, children: BatchPlanChild[]): Promise<ReconfirmationSnapshot> {
+	if (!id.test(record.batch_id) || !oid.test(record.base_head) || isTerminalBatchState(record.batch_state) || record.commits.length ||
+		record.children.some(c => c.commit !== null || c.state === "committed") || record.children.length !== children.length || !children.length) refuse();
+	const assertNoCommitEvidence = () => {
+		for (const child of record.children) {
+			if (!id.test(child.task_id)) refuse();
+			const path = `.imm/state/batches/commits/${record.batch_id}-${child.task_id}.json`;
+			let missing = false;
+			try { readSecureProjectBytes(root, path); }
+			catch (error) {
+				if (error instanceof Error && error.message === `source_missing: ${path}`) missing = true;
+				else refuse();
+			}
+			if (!missing) refuse();
+		}
+	};
+	assertNoCommitEvidence();
+	const statePath = `.imm/state/batches/${record.batch_id}.json`;
+	const stateBytes = readSecureProjectBytes(root, statePath);
+	if (JSON.stringify(JSON.parse(decode(stateBytes))) !== JSON.stringify(record)) refuse();
+	const files = new Map<string, Buffer>();
+	const capture = (path: string) => { const bytes = readSecureProjectBytes(root, path); files.set(path, bytes); return bytes; };
+	const oldChildren: DigestChild[] = [];
+	const changed: Array<{ task: string; run: string; identity: string; local: string }> = [];
+	let scope: string[] | null = null;
+	const workspace = readWorkspaceStateRaw(root);
+	if (workspace.state.current_working !== null) refuse();
+	for (const [index, child] of children.entries()) {
+		const previous = record.children[index]!;
+		if (!id.test(child.task_id) || child.task_id !== previous.task_id || child.slice_id !== previous.slice_id ||
+			JSON.stringify(child.blocked_by) !== JSON.stringify(previous.blocked_by) || child.intent_path !== `docs/plans/${child.task_id}.intent.json`) refuse();
+		const old = parseTaskIntentV1(JSON.parse(git(root, ["show", `${record.base_head}:${child.intent_path}`])));
+		if (old.task_id !== child.task_id) refuse();
+		const oldHash = canonicalIntentHash(old);
+		oldChildren.push({ task_id: child.task_id, blocked_by: [...child.blocked_by], intent_path: child.intent_path, intent_revision: old.revision, intent_content_hash: oldHash });
+		const currentBytes = capture(child.intent_path);
+		const current = parseTaskIntentV1(JSON.parse(decode(currentBytes)));
+		const currentHash = canonicalIntentHash(current);
+		const tracked = readTaskIntent(root, child.task_id, child.intent_path);
+		if (currentHash !== tracked.content_hash || currentHash !== child.intent_content_hash || current.revision !== child.intent_revision) refuse();
+		if (currentHash === oldHash) continue;
+		if (scope !== null || previous.state === "pending" || previous.state === "skipped_blocked" || current.revision <= old.revision || current.goal !== old.goal || current.owner !== old.owner) refuse();
+		const run = localRunId(root, child.task_id);
+		if (!run || !id.test(run)) refuse();
+		const local = withKernelRead(root, db => readRunRowByTask(db, child.task_id));
+		if (!local || local.run_id !== run || local.state !== "done" || local.enrollment_event_id !== `enroll-${child.task_id}-${local.created_at}` ||
+			Date.parse(local.created_at) > Date.parse(record.updated_at)) refuse();
+		const pair = readAuditTaskPair(root, child.task_id, run);
+		if (!pair || pair.record.contract !== "assurance_kernel/task_record/v4") refuse();
+		const r = pair.record;
+		if (r.lifecycle !== "done" || r.intent_ref.content_hash !== currentHash || canonicalIntentHash(r.intent_snapshot) !== currentHash ||
+			r.git_base_head !== record.base_head || pair.proof.terminal_lifecycle !== "done") refuse();
+		const terminal = r.history.at(-1);
+		if (terminal?.type !== "complete" || terminal.from_state !== "active:frozen" || terminal.to_state !== "done:frozen" || terminal.id !== pair.proof.terminal_event_id) refuse();
+		const recordPath = `.imm/audit/${child.task_id}/${run}/task-record.json`;
+		const proofPath = `.imm/audit/${child.task_id}/${run}/terminal-proof.json`;
+		if (!capture(recordPath).equals(Buffer.from(local.record_json))) refuse();
+		const capturedProof = JSON.parse(decode(capture(proofPath)));
+		if (!matchesLocalProof(local.terminal_proof_json, capturedProof) || !matchesLocalProof(local.terminal_proof_json, pair.proof)) refuse();
+		const identity = taskRevisionIdentity(root, r.intent_snapshot.scope_hint, r.git_base_head, r.task_id);
+		const projection = await projectAssurance(root, child.task_id, (cwd, task) => {
+			if (task.contract !== "assurance_kernel/task_record/v4" || !task.git_base_head) refuse();
+			return taskRevisionIdentity(cwd, task.intent_snapshot.scope_hint, task.git_base_head, task.task_id);
+		});
+		if (projection.error || projection.claim || projection.projection.run_id !== run || projection.projection.lifecycle !== "done" ||
+			!projection.projection.completion_ready || projection.projection.intent_content_hash !== currentHash || projection.projection.diff_hash !== identity.diff_hash ||
+			!projection.projection.fresh_approval_kinds.includes("qa") ||
+			(projection.projection.risk !== "routine" && !projection.projection.fresh_approval_kinds.includes("review"))) refuse();
+		scope = r.intent_snapshot.scope_hint;
+		changed.push({ task: child.task_id, run, identity: JSON.stringify(identity), local: JSON.stringify(local) });
+	}
+	if (computeBatchPlanDigest(oldChildren) !== record.plan_digest || changed.length !== 1 || scope === null) refuse();
+	const confirmedScope = scope;
+	const owner = changed[0]!;
+	const status = () => git(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--ignore-submodules=none"]);
+	const statusBytes = status();
+	const entries = statusBytes.split("\0").filter(Boolean);
+	// This bounded path refuses renames; staged regular edits/additions/deletions
+	// are enough for a revised child and cannot hide a second source path.
+	for (const entry of entries) {
+		const code = entry.slice(0, 2), path = entry.slice(3);
+		if (code[1] !== " " || !["A", "M", "D"].includes(code[0]!) ||
+			(!path.startsWith(`.imm/audit/${owner.task}/${owner.run}/`) &&
+			!confirmedScope.some(s => pathMatchesScope(path, s)))) refuse();
+	}
+	const flagsBytes = git(root, ["ls-files", "-v"]);
+	const flags = flagsBytes.split("\n").filter(Boolean);
+	if (flags.some(line => line[0] === "S" || line[0] !== line[0]?.toUpperCase())) refuse();
+	const head = () => git(root, ["rev-parse", "HEAD"]).trim();
+	const branch = () => git(root, ["symbolic-ref", "--short", "HEAD"]).trim();
+	if (head() !== record.base_head || branch() !== record.branch) refuse();
+	const assertDeliveryUnchanged = () => {
+		for (const c of changed) {
+			const pair = readAuditTaskPair(root, c.task, c.run);
+			if (!pair || pair.record.contract !== "assurance_kernel/task_record/v4" || !pair.record.git_base_head) refuse();
+			const local = withKernelRead(root, db => readRunRowByTask(db, c.task));
+			const diff = taskRevisionIdentity(root, pair.record.intent_snapshot.scope_hint, pair.record.git_base_head, c.task);
+			if (localRunId(root, c.task) !== c.run || JSON.stringify(local) !== c.local || JSON.stringify(diff) !== c.identity) refuse();
+		}
+	};
+	const assertUnchanged = () => {
+		assertNoCommitEvidence();
+		if (!readSecureProjectBytes(root, statePath).equals(stateBytes) || head() !== record.base_head || branch() !== record.branch || status() !== statusBytes || git(root, ["ls-files", "-v"]) !== flagsBytes ||
+			readWorkspaceStateRaw(root).revision !== workspace.revision) refuse();
+		for (const [path, bytes] of files) if (!readSecureProjectBytes(root, path).equals(bytes)) refuse();
+		assertDeliveryUnchanged();
+	};
+	assertUnchanged();
+	const plan_digest = computeBatchPlanDigest(oldChildren.map((old, index) => ({ ...old,
+		intent_revision: children[index]!.intent_revision!, intent_content_hash: children[index]!.intent_content_hash! })));
+	return { root, plan_digest, stateBytes, assertUnchanged };
+}