immune-brain 4.4.1 → 4.6.0

package/plugins/immune-brain/runtime/unattended/batch_runner.ts

@@ -6,7 +6,6 @@ import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import {
-	BatchAuthorizationExpiryError,
 	type BatchAuthorityRegistry,
 	type ValidatedBatchAuthorization,
 	computeBatchPlanDigest,
@@ -23,6 +22,7 @@ export function batchQaFailureFacts(record: Pick<TaskRecord, "history"> & { find
 		recovery_findings: record.findings.filter(f => f.status === "open").map(f => ({ id: f.id, kind: f.kind, status: f.status, acceptance_id: f.acceptance_id })) };
 }
 import type { BatchPlanChild } from "./types";
+import { ownUnpersistedBatchHead, takeReconfirmation } from "./batch_reconfirmation";
 import {
 	type BatchRunnerGitPort,
 	type BatchGitPreflightResult,
@@ -30,6 +30,7 @@ import {
 	commitBatchChild,
 	lookupBatchCommit,
 } from "./batch_git";
+import { classifyBatchLineage, expectedBatchHead } from "./batch_preflight";
 import {
 	type BatchRunStateRecord,
 	type BatchChildRun,
@@ -38,6 +39,7 @@ import {
 	prepareBatchRunState,
 	readBatchRunState,
 	writeBatchRunState,
+	replaceBatchRunState,
 	writeBatchRunReport,
 } from "./batch_state";
 
@@ -90,15 +92,15 @@ export interface BatchRunnerKernelPort {
 	 * is held under this batch's derived capability (consumed child slot). */
 	ownsTaskClaim(taskId: string): boolean;
 	/** review-8(4th rework): Kernel-side proof that a replacement parked-batch
-	 * authorization is genuine, unexpired, and bound to this exact batch_id,
+	 * authorization is genuine and bound to this exact batch_id,
 	 * plan_digest, and base_head, validated against the Kernel's authoritative
-	 * binding state. Throws on fabrication, mismatch, or expiry; the driver
+	 * binding state. Throws on fabrication or mismatch; the driver
 	 * must call this before accepting a parked-batch resume. */
 	validateBatchAuthorization(input: {
 		registry: BatchAuthorityRegistry;
 		capability: object;
 		binding: Pick<ValidatedBatchAuthorization,
-			"batch_id" | "plan_digest" | "base_head" | "initiative_slug" | "budget" | "expires_at">;
+			"batch_id" | "plan_digest" | "base_head" | "initiative_slug" | "budget">;
 	}): ValidatedBatchAuthorization;
 }
 
@@ -121,8 +123,7 @@ export interface StartBatchInput {
 	plan_digest: string;
 	base_head: string;
 	confirmation_time: string;
-	authorization_expires_at: string;
-	budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
+	budget: { max_children: number; qa_failure_limit: number };
 	now: string;
 	kernel: BatchRunnerKernelPort;
 	git?: BatchRunnerGitPort;
@@ -153,7 +154,7 @@ function skipDependents(record: BatchRunStateRecord, taskId: string, reason: str
 	);
 }
 
-function budgetStopReason(record: BatchRunStateRecord, now: number): string | null {
+function budgetStopReason(record: BatchRunStateRecord): string | null {
 	// review-3: budget counts enrollments consumed (children that left
 	// pending), not commits, so parked children still consume authorization.
 	const enrolledCount = record.children.filter(
@@ -161,22 +162,9 @@ function budgetStopReason(record: BatchRunStateRecord, now: number): string | nu
 	).length;
 	if (enrolledCount >= record.budget.max_children)
 		return `max_children budget exhausted (${record.budget.max_children})`;
-	const deadline = Date.parse(record.budget.deadline_at);
-	if (!Number.isNaN(deadline) && now >= deadline)
-		return `deadline_at reached (${record.budget.deadline_at})`;
 	return null;
 }
 
-/** review-7(3rd rework): the typed expiry marker now lives at the Kernel
- * boundary (kernel/batch_authority.ts) so a real enrollment-time expiry is
- * structurally classifiable as an intentional budget stop; re-exported here
- * for driver API compatibility. */
-export { BatchAuthorizationExpiryError };
-
-function isAuthorizationExpiryError(error: unknown): boolean {
-	return error instanceof BatchAuthorizationExpiryError;
-}
-
 function requireFreshProjection<T extends AssuranceProjectionResult>(
 	result: T,
 	taskId: string,
@@ -201,7 +189,7 @@ function nextEnrollableChild(record: BatchRunStateRecord): BatchChildRun | null
 
 const TERMINAL_NEXT_ACTIONS: Record<string, string> = {
 	completed: "The batch settled every enrollable child; review the commits and the tracker.",
-	budget_stopped: "Budget, deadline, or authorization expiry stopped new enrollments; re-confirm to continue under a new authorization.",
+	budget_stopped: "The child budget stopped new enrollments; re-confirm to continue under a new authorization.",
 	failed: "A commit or lineage failure stopped the batch; inspect the failing child and the branch state.",
 	rejected: "The batch was rejected before any enrollment; correct the stated reason and re-confirm.",
 	needs_human: "A parked child needs a human decision; resolve it, then re-confirm to continue.",
@@ -296,32 +284,49 @@ function failPersistedLineage(
 	return writeBatchRunState(root, record);
 }
 
-/** review round 11: detect external HEAD movement or branch switch against a
- * persisted record's expected lineage; returns the failure message or null. */
-function externalHeadDriftMessage(root: string, record: BatchRunStateRecord): string | null {
-	if (!existsSync(join(root, ".git"))) return null;
-	const head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
-	const headCheck = spawnSync("git", ["-C", root, "rev-parse", "HEAD"], {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
-	});
-	if (headCheck.status === 0 && headCheck.stdout.trim() && headCheck.stdout.trim() !== head) {
-		return `batch_head_lineage_broken: current HEAD ${headCheck.stdout.trim()} does not match expected batch head ${head}`;
-	}
-	const branchCheck = spawnSync("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
+/** A HEAD that fast-forwards on the batch branch is the user's own work: adopt
+ * it as the new expected head and record it. Any other movement is the fatal
+ * lineage break, returned as the failure message with the record unchanged. */
+function reconcileLineage(
+	root: string,
+	record: BatchRunStateRecord,
+): { record: BatchRunStateRecord; failure: string | null } {
+	if (!existsSync(join(root, ".git"))) return { record, failure: null };
+	const expected = expectedBatchHead(record);
+	const lineage = classifyBatchLineage({
+		root,
+		branch: record.branch ?? "",
+		expectedHead: expected,
+		childCommits: record.commits,
+		batchId: record.batch_id,
 	});
-	const currentBranch = branchCheck.stdout.trim();
-	if (branchCheck.status !== 0 || currentBranch !== record.branch) {
-		return `batch_head_lineage_broken: current branch ${currentBranch} does not match expected batch branch ${record.branch}`;
-	}
-	return null;
+	if (lineage.kind === "broken") return { record, failure: lineage.message };
+	if (lineage.kind === "equal") return { record, failure: null };
+	return {
+		record: writeBatchRunState(root, {
+			...record,
+			adopted_heads: [...(record.adopted_heads ?? []), { from: expected, to: lineage.head }],
+		}),
+		failure: null,
+	};
 }
 
 async function validatePersistedRun(input: StartBatchInput, record: BatchRunStateRecord): Promise<void> {
+	if (!record.commits.length && record.children[0]?.state === "settled" && existsSync(join(input.root, ".git"))) {
+		const head = spawnSync("git", ["-C", input.root, "rev-parse", "HEAD"], { encoding: "utf8" });
+		const live = head.stdout.trim();
+		const expected = expectedBatchHead(record);
+		const adoptable = () =>
+			classifyBatchLineage({
+				root: input.root,
+				branch: record.branch ?? "",
+				expectedHead: expected,
+				childCommits: record.commits,
+				batchId: record.batch_id,
+			}).kind === "fast_forward";
+		if (head.status !== 0 || (live !== expected && !ownUnpersistedBatchHead(input.root, record, live) && !adoptable()))
+			throw new Error("first unpersisted batch commit provenance is invalid");
+	}
 	const plan = input.registry.children(input.capability);
 	if (record.plan_digest !== computeBatchPlanDigest(plan) ||
 		record.children.length !== plan.length || record.children.some((child, index) => {
@@ -384,7 +389,7 @@ function replayTerminal(
 	);
 }
 
-function validateRunAuthorization(input: StartBatchInput, existing: BatchRunStateRecord | null): void {
+function validateRunAuthorization(input: StartBatchInput, existing: BatchRunStateRecord | null): ValidatedBatchAuthorization {
 	const authorized = input.kernel.validateBatchAuthorization({
 		registry: input.registry,
 		capability: input.capability,
@@ -394,7 +399,6 @@ function validateRunAuthorization(input: StartBatchInput, existing: BatchRunStat
 			base_head: existing?.base_head ?? input.base_head,
 			initiative_slug: existing?.initiative_slug ?? input.initiative_slug,
 			budget: input.budget,
-			expires_at: input.authorization_expires_at,
 		},
 	});
 	if (authorized.issued_at !== input.confirmation_time ||
@@ -409,6 +413,32 @@ function validateRunAuthorization(input: StartBatchInput, existing: BatchRunStat
 	if (computeBatchPlanDigest(children) !== authorized.plan_digest ||
 		input.plan_digest !== authorized.plan_digest || input.base_head !== authorized.base_head)
 		throw new Error("batch run input does not match the authorized plan or base_head");
+	return authorized;
+}
+
+function applyPlanReconfirmation(input: StartBatchInput, existing: BatchRunStateRecord): BatchRunStateRecord {
+	if (existing.plan_digest === input.plan_digest) return existing;
+	const next = { ...existing, plan_digest: input.plan_digest, confirmation_time: input.confirmation_time,
+		budget: input.budget };
+	if (!existing.branch || input.batch_id !== existing.batch_id || input.initiative_slug !== existing.initiative_slug || input.base_head !== existing.base_head ||
+		input.budget.max_children !== existing.budget.max_children || input.budget.qa_failure_limit !== existing.budget.qa_failure_limit)
+		throw new Error("plan_digest mismatch: reconfirmation binding changed");
+	const validate = () => {
+		const plan = input.registry.children(input.capability);
+		if (existing.children.length !== plan.length || plan.some((child, index) => {
+			const old = existing.children[index]!, nextChild = input.children[index];
+			return !nextChild || old.task_id !== child.task_id || old.slice_id !== nextChild.slice_id ||
+				JSON.stringify(old.blocked_by) !== JSON.stringify(child.blocked_by) || JSON.stringify(nextChild.blocked_by) !== JSON.stringify(child.blocked_by);
+		})) throw new Error("plan_digest mismatch: reconfirmation topology changed");
+		const { issued_at: _issuedAt, ...binding } = validateRunAuthorization(input, { ...existing, plan_digest: input.plan_digest });
+		if (binding.branch !== existing.branch) throw new Error("plan_digest mismatch: reconfirmation branch changed");
+		prepareBatchRunState(input);
+		return input.registry.inspect(input.capability, binding);
+	};
+	const authority = validate();
+	const captured = takeReconfirmation(authority.nonce);
+	if (captured.root !== input.root || captured.plan_digest !== input.plan_digest) throw new Error("plan_digest mismatch: captured reconfirmation does not match run input");
+	return replaceBatchRunState(input.root, captured.stateBytes, next, () => { captured.assertUnchanged(); validate(); });
 }
 
 export async function startBatch(input: StartBatchInput): Promise<BatchRunReport> {
@@ -460,7 +490,9 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 	}
 
 	let existing = readBatchRunState(input.root, input.batch_id);
+	const reconfirmed = existing !== null && existing.plan_digest !== input.plan_digest;
 	if (existing) {
+		existing = applyPlanReconfirmation(input, existing);
 		try {
 			await validatePersistedRun(input, existing);
 		} catch (error) {
@@ -481,13 +513,10 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 	if (existing?.batch_state === "needs_human") {
 		const priorConfirmation = Date.parse(existing.confirmation_time);
 		const nextConfirmation = Date.parse(input.confirmation_time);
-		const nextExpiry = Date.parse(input.authorization_expires_at);
 		const freshAuthorization =
 			Number.isFinite(nextConfirmation) &&
-			nextConfirmation > priorConfirmation &&
-			Number.isFinite(nextExpiry) &&
-			nextExpiry > Date.now();
-		if (!freshAuthorization) {
+			nextConfirmation > priorConfirmation;
+		if (!freshAuthorization && !reconfirmed) {
 			return finalize(
 				input.root,
 				existing,
@@ -496,7 +525,7 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			);
 		}
 
-		validateRunAuthorization(input, existing);
+		if (!reconfirmed) validateRunAuthorization(input, existing);
 		prepareBatchRunState({ ...input, now: input.now });
 		const remapped = await Promise.all(
 			existing.children.map(async (child) => {
@@ -538,7 +567,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			existing = writeBatchRunState(input.root, {
 				...reparked,
 				confirmation_time: input.confirmation_time,
-				authorization_expires_at: input.authorization_expires_at,
 				budget: input.budget,
 				batch_state: "needs_human",
 			});
@@ -557,42 +585,12 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 		existing = writeBatchRunState(input.root, {
 			...existing,
 			confirmation_time: input.confirmation_time,
-			authorization_expires_at: input.authorization_expires_at,
 			budget: input.budget,
 			batch_state: "running",
 			children: resumedChildren,
 		});
 	}
 
-	// A running batch can outlive its authorization while it waits on a child's
-	// reserved foreground Review. The driver owns every batch state transition,
-	// so the renewal the Host bound into the capability must be adopted here;
-	// otherwise the record keeps the expired stamp and the next child enrollment
-	// stops the batch as budget_stopped even though the literal user just
-	// re-confirmed it. Renewal requires the same proof the parked path requires:
-	// a strictly newer literal-user confirmation and a later, still-valid expiry.
-	if (existing?.batch_state === "running") {
-		const nextConfirmation = Date.parse(input.confirmation_time);
-		const nextExpiry = Date.parse(input.authorization_expires_at);
-		const priorConfirmation = Date.parse(existing.confirmation_time);
-		const persistedExpiry = Date.parse(existing.authorization_expires_at);
-		const renewedAuthorization =
-			Number.isFinite(nextConfirmation) &&
-			nextConfirmation > priorConfirmation &&
-			Number.isFinite(nextExpiry) &&
-			nextExpiry > Date.now() &&
-			nextExpiry > persistedExpiry;
-		if (renewedAuthorization) {
-			validateRunAuthorization(input, existing);
-			existing = writeBatchRunState(input.root, {
-				...existing,
-				confirmation_time: input.confirmation_time,
-				authorization_expires_at: input.authorization_expires_at,
-				budget: input.budget,
-			});
-		}
-	}
-
 	// review-2(6th round): an enrolled or settled child from an interrupted
 	// run must be driven to its own terminal settlement and commit before any
 	// new child is selected, or startBatch would double-claim the task or
@@ -658,7 +656,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			plan_digest: input.plan_digest,
 			base_head: input.base_head,
 			confirmation_time: input.confirmation_time,
-			authorization_expires_at: input.authorization_expires_at,
 			budget: input.budget,
 			now: input.now,
 		});
@@ -672,17 +669,15 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 		persist();
 	}
 
-	let head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
-
 	// Validate current Git HEAD and branch against the expected head/branch before continuing (review rounds 7+11)
-	const driftMessage = externalHeadDriftMessage(input.root, record);
-	if (driftMessage) {
+	const lineage = reconcileLineage(input.root, record);
+	record = lineage.record;
+	if (lineage.failure) {
 		record.batch_state = "failed";
 		persist();
-		return finalize(input.root, record, driftMessage, "");
+		return finalize(input.root, record, lineage.failure, "");
 	}
+	let head = expectedBatchHead(record);
 
 	while (record.batch_state === "running") {
 		const child = nextEnrollableChild(record);
@@ -745,9 +740,8 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			);
 			persist();
 		} else {
-		// Re-read the clock after projection; an adopted claim is not a new enrollment.
-		const now = Date.now();
-		if (now >= Date.parse(record.authorization_expires_at) || budgetStopReason(record, now)) {
+		// An adopted claim is not a new enrollment.
+		if (budgetStopReason(record)) {
 			record.batch_state = record.children.some(
 				(c) => c.state === "needs_human" || c.state === "skipped_blocked",
 			) ? "needs_human" : "budget_stopped";
@@ -764,7 +758,7 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 				binding: {
 					batch_id: record.batch_id, plan_digest: record.plan_digest,
 					base_head: record.base_head, initiative_slug: record.initiative_slug,
-					budget: record.budget, expires_at: record.authorization_expires_at,
+					budget: record.budget,
 				},
 			});
 			for (const committed of record.children) {
@@ -786,17 +780,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			persist();
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			// Only a typed BatchAuthorizationExpiryError is an intentional
-			// budget stop; free-form message matching misclassified
-			// infrastructure and validation failures as intentional stops.
-			if (isAuthorizationExpiryError(error)) {
-				record.children = record.children.map((c) =>
-					c.task_id === child.task_id ? { ...c, state: "pending", reason: message } : c,
-				);
-				record.batch_state = "budget_stopped";
-				persist();
-				break;
-			}
 			// review round 10: external HEAD movement after the pre-loop check
 			// (including between children) fails the batch, it never parks.
 			if (isLineageBreakError(message)) {
@@ -834,8 +817,8 @@ function stopReasonFor(record: BatchRunStateRecord): string | null {
 	switch (record.batch_state) {
 		case "budget_stopped":
 			return (
-				budgetStopReason(record, Date.now()) ??
-				"budget, deadline, or authorization expiry stopped new enrollments"
+				budgetStopReason(record) ??
+				"the child budget stopped new enrollments"
 			);
 		case "failed": {
 			const failedChild = record.children.find((c) => c.state === "needs_human" && c.reason);
@@ -853,17 +836,17 @@ function stopReasonFor(record: BatchRunStateRecord): string | null {
 /**
  * review-1: resume the interrupted child first. A persisted enrolled child
  * is driven through the Kernel obligation surface to its own terminal
- * settlement and commit before any new enrollment or expiry check, so an
- * interrupted run can never falsely complete or enroll a sibling while a
- * child claim is still open. Never replays a committed mutation; refuses an
- * expired authorization by requiring a new literal-user confirmation.
+ * settlement and commit before any new enrollment, so an interrupted run can
+ * never falsely complete or enroll a sibling while a child claim is still
+ * open. Never replays a committed mutation.
  */
 export async function resumeBatch(
 	input: StartBatchInput,
 	projection: (root: string, taskId: string) => Promise<AssuranceProjectionResult>,
 ): Promise<BatchRunReport> {
 	let existing = readBatchRunState(input.root, input.batch_id);
-	if (!existing) return startBatch(input);
+	if (!existing || existing.batch_state === "needs_human") return startBatch(input);
+	existing = applyPlanReconfirmation(input, existing);
 	try {
 		await validatePersistedRun(input, existing);
 	} catch (error) {
@@ -877,11 +860,10 @@ export async function resumeBatch(
 	}
 	if (isTerminalBatchState(existing.batch_state))
 		return replayTerminal(input.root, existing);
-	if (existing.batch_state === "needs_human") return startBatch(input);
 
 	// An enrolled-but-unsettled child must reach its own Kernel terminal
-	// settlement before anything else, even under an expired authorization:
-	// its claim is already held and the Kernel owns its remaining obligations.
+	// settlement before anything else: its claim is already held and the
+	// Kernel owns its remaining obligations.
 	// review-1(2nd round): an `enrolled` child is verified against a fresh
 	// Kernel projection; a projection that finds no active claim means the
 	// persisted `enrolled` flag predates a successful enrollment, so the child
@@ -898,10 +880,11 @@ export async function resumeBatch(
 			// defers to driveInterruptedChild's lookupBatchCommit verification,
 			// which adopts a verified own commit (crash before committed-persist)
 			// instead of misjudging it as external drift.
-			const drivenDrift = externalHeadDriftMessage(input.root, existing);
-			if (drivenDrift) {
-				const failed = failPersistedLineage(input.root, existing, drivenDrift);
-				return finalize(input.root, failed, drivenDrift, "");
+			const drivenLineage = reconcileLineage(input.root, existing);
+			existing = drivenLineage.record;
+			if (drivenLineage.failure) {
+				const failed = failPersistedLineage(input.root, existing, drivenLineage.failure);
+				return finalize(input.root, failed, drivenLineage.failure, "");
 			}
 			const fresh = requireFreshProjection(
 				await input.kernel.projectTask(input.root, driven.task_id),
@@ -1032,9 +1015,7 @@ async function driveInterruptedChild(
 		record.batch_state = "running";
 		persist();
 	}
-	let head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
+	let head = expectedBatchHead(record);
 	while (child.state === "enrolled" || child.state === "settled") {
 		if (child.state === "settled") {
 			// review-2(2nd round): a persisted settled child must not replay
@@ -1085,6 +1066,13 @@ async function driveInterruptedChild(
 				persist();
 				throw new BatchCommitAbortError(`commit lookup failed: ${message}`);
 			}
+			if (!existing) {
+				// No own commit exists yet: a fast-forward since settlement is the
+				// user's work. Adopt it so this child's commit parents on it; a broken
+				// lineage is left for commitChild to refuse with its own message.
+				record = reconcileLineage(input.root, record).record;
+				head = expectedBatchHead(record);
+			}
 			const planChild = input.children.find((c) => c.task_id === child.task_id);
 			const intentPath = planChild?.intent_path ?? undefined;
 			const doCommit = async () => {
@@ -1103,6 +1091,8 @@ async function driveInterruptedChild(
 					intentPath,
 				});
 			};
+			if (existing && !record.commits.length && existsSync(join(input.root, ".git")) && !ownUnpersistedBatchHead(input.root, record, existing.commit))
+				throw new Error("first unpersisted batch commit provenance is invalid");
 			const adopted =
 				existing ??
 				(await doCommit().catch((error: unknown) => {

package/plugins/immune-brain/runtime/unattended/batch_state.ts

@@ -4,7 +4,7 @@
 import { existsSync, mkdirSync, openSync, closeSync, writeFileSync, renameSync, lstatSync, constants, rmSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
-import { readSecureProjectFile, withKernelStoreLock } from "../kernel/storage";
+import { readSecureProjectFile, readSecureProjectBytes, withKernelStoreLock } from "../kernel/storage";
 import type { BatchPlanChild } from "./types";
 
 export type BatchRunState =
@@ -45,11 +45,8 @@ export interface BatchRunStateRecord {
 	branch?: string;
 	/** Timestamp of the literal-user batch confirmation. */
 	confirmation_time: string;
-	/** Authorization expiry from the batch capability binding. */
-	authorization_expires_at: string;
 	budget: {
 		max_children: number;
-		deadline_at: string;
 		qa_failure_limit: number;
 	};
 	batch_state: BatchRunState;
@@ -58,6 +55,11 @@ export interface BatchRunStateRecord {
 	consecutive_qa_failures: number;
 	/** Commit heads produced by this batch, in child order. */
 	commits: string[];
+	/**
+	 * Fast-forward commits the user made on the batch branch, adopted as the new
+	 * expected head. Never attributed to a child and never rewritten.
+	 */
+	adopted_heads?: Array<{ from: string; to: string }>;
 	created_at: string;
 	updated_at: string;
 }
@@ -101,8 +103,19 @@ function statePath(batchId: string): string {
 	return join(".imm", "state", "batches", `${batchId}.json`);
 }
 
+/**
+ * A record persisted while batch authorization still carried a clock holds
+ * `authorization_expires_at` and `budget.deadline_at`. They are ignored on read
+ * and never written back.
+ */
+function withoutRetiredClock(record: BatchRunStateRecord): BatchRunStateRecord {
+	const { authorization_expires_at: _expiry, ...rest } = record as BatchRunStateRecord & { authorization_expires_at?: unknown };
+	const { deadline_at: _deadline, ...budget } = rest.budget as BatchRunStateRecord["budget"] & { deadline_at?: unknown };
+	return { ...rest, budget };
+}
+
 function canonicalBytes(record: BatchRunStateRecord): string {
-	return `${JSON.stringify(record, null, 2)}\n`;
+	return `${JSON.stringify(withoutRetiredClock(record), null, 2)}\n`;
 }
 
 function validateRecordShape(value: unknown, batchId: string): asserts value is BatchRunStateRecord {
@@ -121,8 +134,6 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		throw new Error(`batch run state ${batchId} has an invalid branch`);
 	if (!isCanonicalTimestamp(record.confirmation_time))
 		throw new Error(`batch run state ${batchId} has an invalid confirmation_time`);
-	if (!isCanonicalTimestamp(record.authorization_expires_at))
-		throw new Error(`batch run state ${batchId} has an invalid authorization_expires_at`);
 	if (!isCanonicalTimestamp(record.created_at) || !isCanonicalTimestamp(record.updated_at))
 		throw new Error(`batch run state ${batchId} has invalid state timestamps`);
 	if (!Array.isArray(record.children) || record.children.length === 0)
@@ -142,7 +153,6 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		typeof budget.max_children !== "number" ||
 		!Number.isInteger(budget.max_children) ||
 		budget.max_children <= 0 ||
-		!isCanonicalTimestamp(budget.deadline_at) ||
 		typeof budget.qa_failure_limit !== "number" ||
 		!Number.isInteger(budget.qa_failure_limit) ||
 		budget.qa_failure_limit <= 0
@@ -150,6 +160,20 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		throw new Error(`batch run state ${batchId} has an invalid budget`);
 	if (!Array.isArray(record.commits) || record.commits.some((c) => typeof c !== "string"))
 		throw new Error(`batch run state ${batchId} has an invalid commits list`);
+	if (
+		record.adopted_heads !== undefined &&
+		(!Array.isArray(record.adopted_heads) ||
+			record.adopted_heads.some(
+				(a: unknown) =>
+					typeof a !== "object" ||
+					a === null ||
+					typeof (a as { from?: unknown }).from !== "string" ||
+					!(a as { from: string }).from ||
+					typeof (a as { to?: unknown }).to !== "string" ||
+					!(a as { to: string }).to,
+			))
+	)
+		throw new Error(`batch run state ${batchId} has an invalid adopted_heads list`);
 	const seenTaskIds = new Set<string>();
 	for (const child of record.children) {
 		if (
@@ -211,8 +235,7 @@ export function prepareBatchRunState(input: {
 	base_head: string;
 	branch?: string;
 	confirmation_time: string;
-	authorization_expires_at: string;
-	budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
+	budget: { max_children: number; qa_failure_limit: number };
 	now: string;
 }): BatchRunStateRecord {
 	validateBatchId(input.batch_id);
@@ -224,7 +247,6 @@ export function prepareBatchRunState(input: {
 		base_head: input.base_head,
 		branch: input.branch ?? `imm/${input.initiative_slug}`,
 		confirmation_time: input.confirmation_time,
-		authorization_expires_at: input.authorization_expires_at,
 		budget: input.budget,
 		batch_state: "prepared",
 		children: input.children.map((child) => ({
@@ -243,12 +265,18 @@ export function prepareBatchRunState(input: {
 	return prepared;
 }
 
+/** Validate a captured snapshot without reading or writing filesystem state. */
+export function parseBatchRunState(raw: string, batchId: string): BatchRunStateRecord {
+	validateBatchId(batchId);
+	const parsed: unknown = JSON.parse(raw);
+	validateRecordShape(parsed, batchId);
+	return withoutRetiredClock(parsed);
+}
+
 export function readBatchRunState(root: string, batchId: string): BatchRunStateRecord | null {
 	const path = statePath(batchId);
 	if (!existsSync(join(root, path))) return null;
-	const parsed: unknown = JSON.parse(readSecureProjectFile(root, path));
-	validateRecordShape(parsed, batchId);
-	return parsed;
+	return parseBatchRunState(readSecureProjectFile(root, path), batchId);
 }
 
 function ensureSecureDirectory(root: string, relative: string): string {
@@ -287,6 +315,19 @@ function writeFileAtomically(root: string, relative: string, bytes: string): voi
 	}
 }
 
+/** Replace an existing authorization only after a locked expected-byte check. */
+export function replaceBatchRunState(root: string, expected: Buffer, next: BatchRunStateRecord, validate: () => void): BatchRunStateRecord {
+	const path = statePath(next.batch_id);
+	validateRecordShape(next, next.batch_id);
+	return withKernelStoreLock(root, () => {
+		if (!readSecureProjectBytes(root, path).equals(expected)) throw new Error("batch state CAS mismatch");
+		validate();
+		const stored = withoutRetiredClock({ ...next, updated_at: new Date().toISOString() });
+		writeFileAtomically(root, path, canonicalBytes(stored));
+		return stored;
+	});
+}
+
 export function writeBatchRunState(
 	root: string,
 	record: BatchRunStateRecord,
@@ -296,10 +337,10 @@ export function writeBatchRunState(
 	return withKernelStoreLock(root, () => {
 		const existing = existsSync(join(root, path)) ? readSecureProjectFile(root, path) : null;
 		if (existing !== null && existing === canonicalBytes(record)) return record;
-		const stored: BatchRunStateRecord = {
+		const stored = withoutRetiredClock({
 			...record,
 			updated_at: new Date().toISOString(),
-		};
+		});
 		// review-4: secure directory + atomic no-symlink write.
 		ensureSecureDirectory(root, join(".imm", "state", "batches"));
 		writeFileAtomically(root, path, canonicalBytes(stored));

package/plugins/immune-brain/runtime/unattended/types.ts

@@ -2,13 +2,11 @@ import type { GithubInitiativeObservation } from "../github_issue_tracker";
 
 export interface BatchPlanBudget {
 	max_children: number;
-	deadline_at: string;
 	qa_failure_limit: number;
 }
 
 export interface BatchPlanBudgetInput {
 	max_children?: number;
-	deadline_at?: string;
 	qa_failure_limit?: number;
 }