immune-brain 4.5.0 → 4.6.0

package/plugins/immune-brain/dist/claude/mcp-server.mjs

@@ -39,7 +39,7 @@ function probeHost(env = process.env, platform = process.platform, hostVersion)
 }
 
 // plugins/immune-brain/runtime/plugin_version.ts
-var PLUGIN_VERSION = "4.5.0";
+var PLUGIN_VERSION = "4.6.0";
 
 // plugins/immune-brain/runtime/claude/interaction.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -220,6 +220,7 @@ function parseAsyncAgentLaunch(result) {
     return null;
   return { agentId, outputFile };
 }
+var HANDBACK_TOOL = "SubagentHandback";
 function readAgentTranscriptResult(transcript, agentId) {
   let last = null;
   for (const line of transcript.split(`
@@ -247,6 +248,13 @@ function readAgentTranscriptResult(transcript, agentId) {
       const part = block;
       if (part.type === "text" && typeof part.text === "string")
         text += part.text;
+      if (part.type === "tool_use" && part.name === HANDBACK_TOOL && part.input && typeof part.input === "object") {
+        const report = part.input.message;
+        if (typeof report === "string" && report.trim()) {
+          last = report;
+          text = "";
+        }
+      }
     }
     if (text.trim())
       last = text;
@@ -1448,6 +1456,7 @@ var QA_MIN_JOB_TIMEOUT_SECONDS = 15 * 60;
 var QA_MAX_JOB_TIMEOUT_SECONDS = 60 * 60;
 var QA_JOB_OVERHEAD_SECONDS = 2 * 60;
 var QA_JOB_TIMEOUT_SECONDS = QA_MIN_JOB_TIMEOUT_SECONDS;
+var QA_MAX_IDENTICAL_FAILURES = 2;
 var REVIEW_TIMING_PROFILES = {
   quick: { softDeadlineSeconds: 5 * 60, stopThresholdSeconds: 15 * 60 },
   standard: { softDeadlineSeconds: 10 * 60, stopThresholdSeconds: 30 * 60 },
@@ -1682,6 +1691,8 @@ class AssuranceCoordinator {
   operationControllers = new Map;
   reviewReservations = new Map;
   rejectedReviewOperations = new Map;
+  qaFailureStreaks = new Map;
+  qaAttemptKeys = new Map;
   unknownOperations = new Map;
   sessionInvocations = new Set;
   sessionActive = true;
@@ -1710,6 +1721,8 @@ class AssuranceCoordinator {
       this.removeEvidence(reservation);
     }
     this.reviewReservations.clear();
+    this.qaFailureStreaks.clear();
+    this.qaAttemptKeys.clear();
     for (const invocation of [...this.sessionInvocations])
       this.closeSessionInvocation(invocation);
   }
@@ -1756,7 +1769,21 @@ class AssuranceCoordinator {
   }
   async advance(taskId, ctx, signal, onUpdate) {
     const checks = new Map;
+    const started = performance.now();
+    const stageMs = {};
+    let stage = "preparing";
+    let stageStarted = started;
+    const closeStage = (now) => {
+      stageMs[stage] = (stageMs[stage] ?? 0) + Math.round(now - stageStarted);
+    };
     const result = await this.advanceOnce(taskId, ctx, signal, (update) => {
+      const next = update.details.stage;
+      if (typeof next === "string" && next !== stage) {
+        const now = performance.now();
+        closeStage(now);
+        stage = next;
+        stageStarted = now;
+      }
       const diagnostic = update.details.diagnostic;
       if (diagnostic) {
         checks.set(diagnostic.descriptor_ref, diagnostic);
@@ -1765,8 +1792,26 @@ class AssuranceCoordinator {
       }
       onUpdate?.(update);
     });
+    this.recordQaAttempt(taskId, result);
     const diagnostics = result.diagnostics ?? [...checks.values()];
-    return this.withRecovery(taskId, ctx, diagnostics.length ? { ...result, diagnostics } : result);
+    const enriched = diagnostics.length ? { ...result, diagnostics } : result;
+    if (!(this.ports.reportTimings ?? process.env.IMM_ASSURANCE_TIMINGS === "1"))
+      return this.withRecovery(taskId, ctx, enriched);
+    const finished = performance.now();
+    closeStage(finished);
+    return this.withRecovery(taskId, ctx, { ...enriched, timings: { total_ms: Math.round(finished - started), stage_ms: stageMs } });
+  }
+  recordQaAttempt(taskId, result) {
+    const key = this.qaAttemptKeys.get(taskId);
+    this.qaAttemptKeys.delete(taskId);
+    if (!key || result.state === "cancelled")
+      return;
+    if (result.state !== "failed" || result.operation !== "qa") {
+      this.qaFailureStreaks.delete(taskId);
+      return;
+    }
+    const streak = this.qaFailureStreaks.get(taskId);
+    this.qaFailureStreaks.set(taskId, { key, count: streak?.key === key ? streak.count + 1 : 1 });
   }
   async withRecovery(taskId, ctx, enriched) {
     if (enriched.recovery_error || !["failed", "blocked", "rework", "review_preparation_failed"].includes(enriched.state))
@@ -1933,6 +1978,12 @@ class AssuranceCoordinator {
         ensureOperationLive();
         const assurance = await this.ports.buildAssurance(ctx.cwd, taskId, "qa", projection);
         ensureOperationLive();
+        const qaKey = `${assurance.snapshot.record_revision}|${assurance.snapshot.intent_content_hash}|${assurance.snapshot.diff_hash}`;
+        const streak = this.qaFailureStreaks.get(taskId);
+        const maxFailures = this.ports.qaMaxIdenticalFailures ?? QA_MAX_IDENTICAL_FAILURES;
+        if (streak?.key === qaKey && streak.count >= maxFailures)
+          return { state: "blocked", reason: `deterministic QA already failed ${streak.count} times on this exact snapshot; change the workspace diff or intent, or restart the session after fixing the environment, before retrying` };
+        this.qaAttemptKeys.set(taskId, qaKey);
         const declaredQaJobMs = deriveQaJobTimeoutMs(assurance.descriptors.values());
         const qaJobTimeoutMs = Math.min(declaredQaJobMs, this.ports.qaJobTimeoutMs ?? declaredQaJobMs);
         const qaJobDeadline = setTimeout(() => {
@@ -2409,7 +2460,7 @@ function fileFingerprint(root, relativePath) {
   return `file:${stat.mode}:${createHash7("sha256").update(readFileSync3(absolutePath)).digest("hex")}`;
 }
 function dirtyPaths(root) {
-  const tracked = git(root, ["diff", "--name-only", "-z", "HEAD", "--"]);
+  const tracked = git(root, ["diff", "--name-only", "--no-renames", "-z", "HEAD", "--"]);
   const untracked = git(root, [
     "ls-files",
     "--others",
@@ -2584,6 +2635,25 @@ function headEntry(root, head, path) {
 function taskPathMatchesScope(path, scope) {
   return scope.some((scopePath) => pathMatchesScope(path, scopePath));
 }
+function assertNoPreEnrollmentScopeChanges(root, scopedStagedPaths, taskId) {
+  const baseline = readEnrollmentBaseline(root);
+  if (!baseline)
+    return;
+  const current = captureGitWorkspaceSnapshot(root);
+  if (!current)
+    throw new Error("enrollment baseline cannot be compared because Git is unavailable");
+  const withheld = [...new Set(scopedStagedPaths)].filter((path) => !isOwnPlanningSidecar(path, taskId)).filter((path) => baseline.dirty_files[path] !== undefined && baseline.dirty_files[path] === current.dirty_files[path]).sort(comparePaths);
+  if (withheld.length > 0)
+    throw new Error(`task scope contains staged changes that predate Enrollment and cannot become task work: ${withheld.join(", ")}; stop the task and re-enroll from a clean scope`);
+}
+function dirtyScopePaths(projectRoot, scopeHint, taskId) {
+  const root = realpathSync3(resolve2(projectRoot));
+  const scope = assertCanonicalTaskScope(scopeHint);
+  const paths = dirtyPaths(root);
+  if (!paths)
+    throw new Error("cannot inspect the task scope outside a committed Git workspace");
+  return paths.filter((path) => !isNonDeliveryPath(path) && !isOwnPlanningSidecar(path, taskId) && taskPathMatchesScope(path, scope));
+}
 function taskSnapshotOnce(root, scope, taskId) {
   const repositoryRoot = git(root, ["rev-parse", "--show-toplevel"])?.trim();
   const head = git(root, ["rev-parse", "--verify", "HEAD^{commit}"])?.trim();
@@ -2606,9 +2676,8 @@ function taskSnapshotOnce(root, scope, taskId) {
   const uncommittedInScope = [...new Set([...unstagedPaths, ...untrackedPaths])].filter((path) => taskPathMatchesScope(path, scope)).sort(comparePaths);
   if (uncommittedInScope.length > 0)
     throw new Error(`task scope contains unstaged or untracked changes: ${uncommittedInScope.join(", ")}`);
-  const baseline = readEnrollmentBaseline(root);
-  const current = baseline ? captureGitWorkspaceSnapshot(root) : null;
-  const taskPaths = [...new Set(stagedPaths)].filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope)).filter((path) => !(baseline && current && baseline.dirty_files[path] === current.dirty_files[path] && baseline.dirty_files[path] !== undefined)).sort(comparePaths);
+  const taskPaths = [...new Set(stagedPaths)].filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope)).sort(comparePaths);
+  assertNoPreEnrollmentScopeChanges(root, taskPaths, taskId);
   const stagedFiles = {};
   for (const path of taskPaths) {
     const current = indexEntry(root, path);
@@ -2686,9 +2755,8 @@ function taskRevisionSnapshotOnce(root, scope, baseHead, taskId) {
   const unstagedPaths = decodeNullPaths(gitBytes(root, ["diff", "--no-renames", "--name-only", "-z", "--"]), "unstaged task revision paths");
   const untrackedPaths = decodeNullPaths(gitBytes(root, ["ls-files", "--others", "--exclude-standard", "-z", "--"]), "untracked task revision paths");
   assertNoEnvelopeEscape(root, stagedPaths, scope, taskId);
-  const baseline = readEnrollmentBaseline(root);
-  const current = baseline ? captureGitWorkspaceSnapshot(root) : null;
-  const scopedStagedPaths = stagedPaths.filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope)).filter((path) => !(baseline && current && baseline.dirty_files[path] === current.dirty_files[path] && baseline.dirty_files[path] !== undefined));
+  const scopedStagedPaths = stagedPaths.filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope));
+  assertNoPreEnrollmentScopeChanges(root, scopedStagedPaths, taskId);
   const scopedUnstagedPaths = unstagedPaths.filter((path) => taskPathMatchesScope(path, scope));
   const scopedUntrackedPaths = untrackedPaths.filter((path) => taskPathMatchesScope(path, scope));
   assertNoCaseFoldCollisions([...scopedStagedPaths, ...scopedUnstagedPaths, ...scopedUntrackedPaths], "Git task revision paths");
@@ -4196,7 +4264,7 @@ function parseHistoryV3(value, index, violations) {
       actor_id: stringAt(auth.actor_id, `${path}.authority.actor_id`, violations),
       confirmation_ref: stringAt(auth.confirmation_ref, `${path}.authority.confirmation_ref`, violations),
       issued_at: stringAt(auth.issued_at, `${path}.authority.issued_at`, violations),
-      expires_at: stringAt(auth.expires_at, `${path}.authority.expires_at`, violations)
+      ...auth.expires_at !== undefined ? { expires_at: stringAt(auth.expires_at, `${path}.authority.expires_at`, violations) } : {}
     };
   }
   return {
@@ -6718,6 +6786,8 @@ function publishInput(root, input) {
   const recomputed = `sha256:${createHash13("sha256").update(JSON.stringify(snapshot)).digest("hex")}`;
   if (recomputed !== input.expectedDiffHash)
     throw new Error("review task revision does not match assurance snapshot");
+  if (Object.keys(snapshot.changed_paths).length === 0)
+    throw new Error("review revision carries no task change; stage the task's in-scope work before Review");
   return { snapshot, revision: publishReviewRevision(snapshot.repository_root, snapshot, recomputed, input.taskId) };
 }
 function captureReviewManifest(root, input) {
@@ -7007,7 +7077,7 @@ async function projectAssurance(root, taskId, diffProvider) {
 
 // plugins/immune-brain/runtime/kernel/application.ts
 function applyTaskAction(input) {
-  const { root, task_id, prior_intent_token, registry, capability, diffProvider, now } = input;
+  const { root, task_id, prior_intent_token, registry, capability, diffProvider } = input;
   return withKernelStoreLock(root, () => {
     const current = readTaskRecordRaw(root, task_id);
     if (!current.record)
@@ -7058,7 +7128,7 @@ function applyTaskAction(input) {
       diff_hash: trustedDiff.diff_hash,
       ...action.type === "request_rework" ? { findings_digest: findingsDigestV2(action.findings) } : {}
     } : null;
-    const inspectedAudit = expectedAuthority ? registry.inspect(capability, expectedAuthority, now) : null;
+    const inspectedAudit = expectedAuthority ? registry.inspect(capability, expectedAuthority) : null;
     const authorityRunId = inspectedAudit?.run_id;
     const mutation = reduceTask(current.record, action, inspectedAudit ? inspectedAudit.audit : null, trustedDiff.changed_paths);
     if (!isReducedMutation(mutation))
@@ -7084,7 +7154,7 @@ function applyTaskAction(input) {
     consumeIntentToken(prior_intent_token);
     consumeIntentToken(freshRead.token);
     if (expectedAuthority) {
-      registry.consume(capability, expectedAuthority, now);
+      registry.consume(capability, expectedAuthority);
     }
     const nextWorking = mutation.next_workspace_working;
     const nextRecord = input.artifact_transition ? {
@@ -7410,7 +7480,6 @@ function createCanaryApplication(registry) {
       registry,
       capability,
       diffProvider: input.diffProvider,
-      now: Date.parse(now),
       ...operation.op === "complete" || operation.op === "stop" ? { terminal: { terminalized_at: now } } : {},
       ...artifactTransition ? { artifact_transition: artifactTransition } : {}
     });
@@ -7458,7 +7527,7 @@ function createCanaryApplication(registry) {
         intent_revision: current.record.intent_snapshot.revision,
         intent_content_hash: current.record.intent_ref.content_hash,
         diff_hash: "sha256:" + "0".repeat(64)
-      }, Date.parse(now));
+      });
       const nextClaim = {
         ...claim,
         lifecycle_status: "draining",
@@ -7499,7 +7568,7 @@ function createCapabilityRegistry(capabilityBrand, hooks, domainLabel) {
   return {
     brand,
     issue(binding, issuedAt = new Date().toISOString()) {
-      hooks.validateBinding(binding, issuedAt);
+      hooks.validateBinding(binding);
       const capability = Object.freeze(Object.defineProperties({}, {
         [capabilityBrand]: { value: true, enumerable: false, writable: false, configurable: false },
         [brand]: { value: true, enumerable: false, writable: false, configurable: false }
@@ -7507,16 +7576,16 @@ function createCapabilityRegistry(capabilityBrand, hooks, domainLabel) {
       states.set(capability, { binding: { ...binding }, issued_at: issuedAt, consumed: false });
       return capability;
     },
-    inspect(capability, expected, now = Date.now()) {
+    inspect(capability, expected) {
       if (!isCapability(capability))
         throw new Error(`${domainLabel} capability is not recognized by this registry`);
       const state = stateOf(capability);
       if (state.consumed)
         throw new Error(`${domainLabel} capability already consumed`);
-      return hooks.validateAndProject({ ...state.binding, issued_at: state.issued_at }, expected, now);
+      return hooks.validateAndProject({ ...state.binding, issued_at: state.issued_at }, expected);
     },
-    consume(capability, expected, now = Date.now()) {
-      const validated = this.inspect(capability, expected, now);
+    consume(capability, expected) {
+      const validated = this.inspect(capability, expected);
       stateOf(capability).consumed = true;
       return validated;
     },
@@ -7533,7 +7602,7 @@ function digestOfAction(action) {
 }
 function createMutationAuthorityRegistry() {
   const inner = createCapabilityRegistry(MUTATION_AUTHORITY_CAPABILITY_BRAND, {
-    validateBinding(binding, issuedAt) {
+    validateBinding(binding) {
       const missing = [];
       if (binding.run_id !== undefined && binding.run_id.length === 0)
         throw new Error("authority capability run_id must not be empty");
@@ -7547,12 +7616,8 @@ function createMutationAuthorityRegistry() {
         throw new Error(`authority capability binding is incomplete: ${missing.join(", ")}`);
       if (binding.findings_digest !== null && !/^sha256:[a-f0-9]{64}$/.test(binding.findings_digest))
         throw new Error("authority capability findings_digest must be a canonical sha256 hash");
-      if (Number.isNaN(Date.parse(binding.expires_at)) || Date.parse(binding.expires_at) <= Date.parse(issuedAt))
-        throw new Error("authority capability must have a future expiry");
     },
-    validateAndProject(state, expected, now) {
-      if (Date.parse(state.expires_at) <= now)
-        throw new Error("authority capability has expired");
+    validateAndProject(state, expected) {
       const actionDigest = digestOfAction(expected.action);
       if (state.action_digest !== actionDigest)
         throw new Error("authority capability action digest mismatch");
@@ -7579,8 +7644,7 @@ function createMutationAuthorityRegistry() {
           authority_kind: state.authority_kind,
           actor_id: canonicalActorId(state.actor_id),
           confirmation_ref: state.confirmation_ref,
-          issued_at: state.issued_at,
-          expires_at: state.expires_at
+          issued_at: state.issued_at
         },
         action_digest: actionDigest,
         ...state.run_id !== undefined ? { run_id: state.run_id } : {},
@@ -7595,20 +7659,20 @@ function createMutationAuthorityRegistry() {
   return {
     brand: inner.brand,
     issue: inner.issue.bind(inner),
-    inspect(capability, expected, now = Date.now()) {
+    inspect(capability, expected) {
       if (!capability)
         throw new Error("privileged action requires an opaque authority capability");
       try {
-        return inner.inspect(capability, expected, now);
+        return inner.inspect(capability, expected);
       } catch (err) {
         if (err instanceof Error && err.message.includes("not recognized by this registry"))
           throw new Error("privileged action requires an opaque authority capability");
         throw err;
       }
     },
-    consume(capability, expected, now = Date.now()) {
+    consume(capability, expected) {
       try {
-        return inner.consume(capability, expected, now);
+        return inner.consume(capability, expected);
       } catch (err) {
         if (err instanceof Error && err.message.includes("not recognized by this registry"))
           throw new Error("privileged action requires an opaque authority capability");
@@ -7623,7 +7687,7 @@ function createMutationAuthorityRegistry() {
 var ENROLLMENT_CAPABILITY_BRAND = Symbol.for("assurance-kernel.enrollment-capability-brand");
 function createEnrollmentAuthorityRegistry() {
   return createCapabilityRegistry(ENROLLMENT_CAPABILITY_BRAND, {
-    validateBinding(binding, issuedAt) {
+    validateBinding(binding) {
       const missing = [];
       for (const [key, value] of Object.entries(binding)) {
         if (value === undefined || value === null || value === "")
@@ -7631,12 +7695,8 @@ function createEnrollmentAuthorityRegistry() {
       }
       if (missing.length > 0)
         throw new Error(`enrollment capability binding is incomplete: ${missing.join(", ")}`);
-      if (Number.isNaN(Date.parse(binding.expires_at)) || Date.parse(binding.expires_at) <= Date.parse(issuedAt))
-        throw new Error("enrollment capability must have a future expiry");
     },
-    validateAndProject(state, expected, now) {
-      if (Date.parse(state.expires_at) <= now)
-        throw new Error("enrollment capability has expired");
+    validateAndProject(state, expected) {
       for (const key of Object.keys(expected)) {
         if (state[key] !== expected[key])
           throw new Error(`enrollment capability ${key} mismatch`);
@@ -7650,13 +7710,16 @@ function createEnrollmentAuthorityRegistry() {
         actor_id: state.actor_id,
         confirmation_ref: state.confirmation_ref,
         issued_at: state.issued_at,
-        expires_at: state.expires_at,
         nonce: state.nonce
       };
     }
   }, "enrollment");
 }
 
+// plugins/immune-brain/runtime/kernel/batch_authority.ts
+import { createHash as createHash16 } from "node:crypto";
+import { spawnSync as spawnSync4 } from "node:child_process";
+
 // plugins/immune-brain/runtime/kernel/pi_canary_prepare.ts
 import { createHash as createHash15 } from "node:crypto";
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -7758,6 +7821,238 @@ function revalidatePiCanary(root, input, previous) {
   return { unchanged: current.digest === previous.digest, current };
 }
 
+// plugins/immune-brain/runtime/kernel/batch_authority.ts
+var BATCH_AUTHORITY_CAPABILITY_BRAND = Symbol.for("assurance-kernel.batch-authority-capability-brand");
+var GIT_COMMIT_ID2 = /^[a-f0-9]{40}$/;
+function sha256Hex3(bytes) {
+  return createHash16("sha256").update(bytes).digest("hex");
+}
+function stableStringify3(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map((entry) => stableStringify3(entry)).join(",")}]`;
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify3(record[key])}`).join(",")}}`;
+}
+function computeBatchPlanDigest(children) {
+  const canonical = children.map((child) => ({
+    blocked_by: [...child.blocked_by],
+    intent_content_hash: child.intent_content_hash,
+    intent_path: child.intent_path,
+    intent_revision: child.intent_revision,
+    task_id: child.task_id
+  }));
+  return `sha256:${sha256Hex3(stableStringify3(canonical))}`;
+}
+function requireNonEmpty(binding) {
+  const missing = [];
+  for (const key of [
+    "batch_id",
+    "initiative_slug",
+    "plan_digest",
+    "branch",
+    "base_head",
+    "actor_id",
+    "confirmation_ref",
+    "nonce"
+  ]) {
+    const value = binding[key];
+    if (value === undefined || value === null || value === "")
+      missing.push(key);
+  }
+  if (!binding.budget || typeof binding.budget !== "object")
+    missing.push("budget");
+  if (missing.length > 0)
+    throw new Error(`batch authorization binding is incomplete: ${missing.join(", ")}`);
+}
+function validateBudget(budget) {
+  if (!Number.isInteger(budget.max_children) || budget.max_children <= 0)
+    throw new Error("batch budget max_children must be a positive integer");
+  if (!Number.isInteger(budget.qa_failure_limit) || budget.qa_failure_limit <= 0)
+    throw new Error("batch budget qa_failure_limit must be a positive integer");
+}
+function validateChildren(children, planDigest) {
+  if (!Array.isArray(children) || children.length === 0)
+    throw new Error("batch authorization requires a non-empty child plan");
+  const seen = new Set;
+  for (const child of children) {
+    if (!child || typeof child !== "object")
+      throw new Error("batch plan child must be an object");
+    for (const key of ["task_id", "intent_path", "intent_content_hash"]) {
+      if (typeof child[key] !== "string" || child[key] === "")
+        throw new Error(`batch plan child ${key} must be a non-empty string`);
+    }
+    if (!Number.isInteger(child.intent_revision) || child.intent_revision <= 0)
+      throw new Error("batch plan child intent_revision must be a positive integer");
+    if (!Array.isArray(child.blocked_by) || child.blocked_by.some((id) => typeof id !== "string" || id === ""))
+      throw new Error("batch plan child blocked_by must be an array of task ids");
+    if (seen.has(child.task_id))
+      throw new Error(`batch plan child ${child.task_id} appears more than once`);
+    seen.add(child.task_id);
+  }
+  for (const child of children) {
+    for (const blocker of child.blocked_by) {
+      if (!seen.has(blocker))
+        throw new Error(`batch plan child ${child.task_id} is blocked by ${blocker}, which is not in the confirmed plan`);
+    }
+  }
+  const dependencies = new Map(children.map((child) => [child.task_id, child.blocked_by]));
+  const visiting = new Set;
+  const visited = new Set;
+  function visit(taskId) {
+    if (visiting.has(taskId))
+      throw new Error(`batch plan dependency cycle at ${taskId}`);
+    if (visited.has(taskId))
+      return;
+    visiting.add(taskId);
+    for (const blocker of dependencies.get(taskId))
+      visit(blocker);
+    visiting.delete(taskId);
+    visited.add(taskId);
+  }
+  for (const child of children)
+    visit(child.task_id);
+  if (computeBatchPlanDigest(children) !== planDigest)
+    throw new Error("batch plan digest does not match the confirmed child plan");
+}
+function createBatchAuthorityRegistry() {
+  const inner = createCapabilityRegistry(BATCH_AUTHORITY_CAPABILITY_BRAND, {
+    validateBinding(binding) {
+      requireNonEmpty(binding);
+      if (!isLiteralUserActor(binding.actor_id))
+        throw new Error("batch authorization requires a literal-user actor_id");
+      if (!GIT_COMMIT_ID2.test(binding.base_head))
+        throw new Error("batch authorization base_head must be a committed 40-hex commit id");
+      validateBudget(binding.budget);
+    },
+    validateAndProject(state, expected) {
+      for (const key of Object.keys(expected)) {
+        if (key === "budget") {
+          const a = state.budget ?? {};
+          const b = expected.budget ?? {};
+          if (a.max_children !== b.max_children || a.qa_failure_limit !== b.qa_failure_limit)
+            throw new Error("batch authorization budget mismatch");
+          continue;
+        }
+        if (state[key] !== expected[key])
+          throw new Error(`batch authorization ${key} mismatch`);
+      }
+      return {
+        batch_id: state.batch_id,
+        initiative_slug: state.initiative_slug,
+        plan_digest: state.plan_digest,
+        branch: state.branch,
+        base_head: state.base_head,
+        budget: { ...state.budget },
+        actor_id: state.actor_id,
+        confirmation_ref: state.confirmation_ref,
+        issued_at: state.issued_at,
+        nonce: state.nonce
+      };
+    }
+  }, "batch authorization");
+  const plans = new WeakMap;
+  const consumed = new WeakMap;
+  function planOf(capability) {
+    const plan = plans.get(capability);
+    if (!plan)
+      throw new Error("batch authorization capability is not recognized by this registry");
+    return plan;
+  }
+  function slotsOf(capability) {
+    const slots = consumed.get(capability);
+    if (!slots)
+      throw new Error("batch authorization capability is not recognized by this registry");
+    return slots;
+  }
+  return {
+    brand: inner.brand,
+    issue(binding, children, issuedAt = new Date().toISOString()) {
+      requireNonEmpty(binding);
+      validateChildren(children, binding.plan_digest);
+      const capability = inner.issue(binding, issuedAt);
+      plans.set(capability, children.map((child) => ({ ...child, blocked_by: [...child.blocked_by] })));
+      consumed.set(capability, new Set);
+      return capability;
+    },
+    inspect(capability, expected) {
+      planOf(capability);
+      return inner.inspect(capability, expected);
+    },
+    children(capability) {
+      return planOf(capability).map((child) => ({ ...child, blocked_by: [...child.blocked_by] }));
+    },
+    consumedChildren(capability) {
+      return [...slotsOf(capability)];
+    },
+    isChildConsumed(capability, taskId) {
+      return slotsOf(capability).has(taskId);
+    },
+    consumeChild(capability, expected, taskId) {
+      const validated = this.inspect(capability, expected);
+      const plan = planOf(capability);
+      if (!plan.some((child) => child.task_id === taskId))
+        throw new Error(`batch_child_not_in_plan: ${taskId}`);
+      const slots = slotsOf(capability);
+      if (slots.has(taskId))
+        throw new Error(`batch_child_slot_consumed: ${taskId}`);
+      slots.add(taskId);
+      return validated;
+    },
+    releaseChild(capability, taskId) {
+      slotsOf(capability).delete(taskId);
+    },
+    isExhausted(capability) {
+      return slotsOf(capability).size >= planOf(capability).length;
+    }
+  };
+}
+function assertBatchLineageOrigin(root, baseHead, expectedHead) {
+  if (expectedHead === baseHead)
+    return;
+  const descends = spawnSync4("git", ["-C", root, "merge-base", "--is-ancestor", baseHead, expectedHead], {
+    stdio: ["ignore", "ignore", "ignore"]
+  }).status === 0;
+  if (!descends)
+    throw new Error(`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${baseHead} or a fast-forward of it, not ${expectedHead}`);
+}
+function deriveChildEnrollment(root, registry, input) {
+  const validated = registry.inspect(input.capability, input.binding);
+  const child = registry.children(input.capability).find((entry) => entry.task_id === input.task_id);
+  if (!child)
+    throw new Error(`batch_child_not_in_plan: ${input.task_id}`);
+  if (registry.isChildConsumed(input.capability, input.task_id))
+    throw new Error(`batch_child_slot_consumed: ${input.task_id}`);
+  if (!GIT_COMMIT_ID2.test(input.expected_head))
+    throw new Error("batch_head_lineage_broken: expected_head is not a commit id");
+  const preparation = preparePiCanary(root, { task_id: input.task_id, now: input.now });
+  if (!preparation.git_base_head)
+    throw new Error(preparation.git_error ?? "enrollment requires a committed Git HEAD");
+  if (preparation.git_base_head !== input.expected_head)
+    throw new Error(`batch_head_lineage_broken: expected ${input.expected_head}, found ${preparation.git_base_head}`);
+  if (!preparation.intent)
+    throw new Error(`batch_child_intent_changed: ${input.task_id} intent sidecar is unreadable`);
+  if (preparation.intent.path !== child.intent_path || preparation.intent.revision !== child.intent_revision || preparation.intent.content_hash !== child.intent_content_hash)
+    throw new Error(`batch_child_intent_changed: ${input.task_id}`);
+  if (registry.consumedChildren(input.capability).length === 0)
+    assertBatchLineageOrigin(root, validated.base_head, input.expected_head);
+  return {
+    child,
+    preparation,
+    binding: {
+      task_id: child.task_id,
+      intent_path: child.intent_path,
+      intent_revision: child.intent_revision,
+      intent_content_hash: child.intent_content_hash,
+      preparation_digest: preparation.digest,
+      actor_id: validated.actor_id,
+      confirmation_ref: validated.confirmation_ref,
+      nonce: `${validated.nonce}:${child.task_id}`
+    }
+  };
+}
+
 // plugins/immune-brain/runtime/kernel/enrollment.ts
 function runEnrollmentPreconditionChecks(root, input, capability, registry, mode, beforeLock, onReady) {
   const blockers = [];
@@ -7809,6 +8104,17 @@ function runEnrollmentPreconditionChecks(root, input, capability, registry, mode
     } catch (error) {
       fail(`git base: ${error instanceof Error ? error.message : String(error)}`, error);
     }
+    if (intent && gitBaseHead) {
+      try {
+        const dirty = dirtyScopePaths(root, intent.intent.scope_hint, input.task_id);
+        if (dirty.length > 0) {
+          const message = `task scope is already dirty before Enrollment: ${dirty.join(", ")}; commit, stash or revert these paths first`;
+          fail(message, new Error(message));
+        }
+      } catch (error) {
+        fail(`scope: ${error instanceof Error ? error.message : String(error)}`, error);
+      }
+    }
     const state = {
       validated,
       current,
@@ -7905,16 +8211,16 @@ function enrollCanaryTask(root, input, registry) {
       if (checks.gitBaseHead !== gitBaseHead)
         throw new Error("Git HEAD moved after the enrollment confirmation");
       if (input.batch) {
-        const batch = input.batch.registry.inspect(input.batch.capability, input.batch.binding, Date.parse(input.now));
-        if (input.batch.registry.consumedChildren(input.batch.capability).length === 0 && input.batch.expected_head !== batch.base_head)
-          throw new Error(`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${batch.base_head}, not ${input.batch.expected_head}`);
+        const batch = input.batch.registry.inspect(input.batch.capability, input.batch.binding);
+        if (input.batch.registry.consumedChildren(input.batch.capability).length === 0)
+          assertBatchLineageOrigin(root, batch.base_head, input.batch.expected_head);
         if (checks.gitBaseHead !== input.batch.expected_head)
           throw new Error(`batch_head_lineage_broken: expected ${input.batch.expected_head}, found ${checks.gitBaseHead}`);
       }
       registry.consume(input.capability, input.capability_binding);
       consumed = true;
       if (input.batch)
-        input.batch.registry.consumeChild(input.batch.capability, input.batch.binding, input.task_id, Date.parse(input.now));
+        input.batch.registry.consumeChild(input.batch.capability, input.batch.binding, input.task_id);
       if (!gitBaseHead)
         throw new Error("enrollment requires a committed Git HEAD");
       const record = buildTaskRecordV4(input, checks.intent, gitBaseHead);
@@ -7968,7 +8274,7 @@ function enrollCanaryTask(root, input, registry) {
 }
 
 // plugins/immune-brain/runtime/assurance/enrollment_git_base.ts
-import { execFileSync as execFileSync4, spawnSync as spawnSync4 } from "node:child_process";
+import { execFileSync as execFileSync4, spawnSync as spawnSync5 } from "node:child_process";
 function git2(root, args, input, env = process.env) {
   return execFileSync4("git", args, { cwd: root, encoding: "utf8", input, env, stdio: ["pipe", "pipe", "pipe"] }).trim();
 }
@@ -7981,8 +8287,8 @@ function inspectEnrollmentGitBase(root) {
   const branch = git2(root, ["symbolic-ref", "--no-recurse", "HEAD"]);
   if (!branch.startsWith("refs/heads/"))
     throw new Error("Enrollment HEAD must name a local branch");
-  const ref = spawnSync4("git", ["show-ref", "--verify", "--quiet", branch], { cwd: root });
-  const symbolic = spawnSync4("git", ["symbolic-ref", "-q", branch], { cwd: root });
+  const ref = spawnSync5("git", ["show-ref", "--verify", "--quiet", branch], { cwd: root });
+  const symbolic = spawnSync5("git", ["symbolic-ref", "-q", branch], { cwd: root });
   if (ref.status !== 1 || symbolic.status !== 1)
     throw new Error("Enrollment Git HEAD is invalid; only an absent branch can be initialized");
   return { state: "unborn", branch };
@@ -7992,7 +8298,7 @@ function enrollmentGitBaseNotice(base) {
 }
 function identityEnv(root) {
   const configured = (key) => {
-    const result = spawnSync4("git", ["config", "--get", key], { cwd: root, encoding: "utf8" });
+    const result = spawnSync5("git", ["config", "--get", key], { cwd: root, encoding: "utf8" });
     if (result.status !== 0 && result.status !== 1)
       throw new Error(`Cannot read Git identity: ${key}`);
     return result.stdout?.trim() ?? "";
@@ -8041,10 +8347,10 @@ function initializeEnrollmentGitBase(root, input, previous, base, signal) {
 }
 
 // plugins/immune-brain/runtime/assurance/qa.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 // plugins/immune-brain/runtime/assurance/delivery_workspace.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import { chmodSync as chmodSync2, lstatSync as lstatSync8, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync2, readdirSync as readdirSync5, readFileSync as readFileSync10, readlinkSync as readlinkSync2, realpathSync as realpathSync9, rmSync as rmSync5 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { dirname as dirname6, isAbsolute as isAbsolute5, join as join8, parse, relative as relative4, resolve as resolve9, sep as sep5 } from "node:path";
@@ -8194,7 +8500,7 @@ function workspaceFiles(root, dir = root, result = Object.create(null)) {
       result[rel] = `${stat.mode & 4095}:directory`;
       workspaceFiles(root, path, result);
     } else if (stat.isFile())
-      result[rel] = `${stat.mode & 4095}:${createHash16("sha256").update(readFileSync10(path)).digest("hex")}`;
+      result[rel] = `${stat.mode & 4095}:${createHash17("sha256").update(readFileSync10(path)).digest("hex")}`;
     else
       throw new DeliveryWorkspaceError("delivery contains an unsupported filesystem entry");
   }
@@ -8296,7 +8602,7 @@ function deliveryTreeForSnapshot(snapshot, writeTree) {
   if (!record || record.contract !== "assurance_kernel/task_record/v4" || !record.git_base_head)
     throw new Error("QA delivery requires a TaskRecord v4 git_base_head");
   const captured = captureGitTaskRevisionSnapshot(snapshot.root, record.intent_snapshot.scope_hint, record.git_base_head, snapshot.task_id);
-  const digest = `sha256:${createHash17("sha256").update(JSON.stringify(captured)).digest("hex")}`;
+  const digest = `sha256:${createHash18("sha256").update(JSON.stringify(captured)).digest("hex")}`;
   if (digest !== snapshot.diff_hash)
     throw new Error("QA delivery identity does not match the frozen snapshot");
   return writeDeliveryTree(snapshot.root, captured);
@@ -8331,7 +8637,7 @@ async function runDeterministicQa(snapshot, descriptors, options = {}) {
     const diagnostics = (stage, outcome, affected = group, commandStage = "check", elapsed = 0, result) => affected.map((item) => ({
       acceptance_id: item.id,
       descriptor_ref: `acceptance/${item.index}/verification/${commandStage === "prepare" ? "environment/prepare" : "command"}`,
-      descriptor_digest: `sha256:${createHash17("sha256").update(JSON.stringify(item.descriptor)).digest("hex")}`,
+      descriptor_digest: `sha256:${createHash18("sha256").update(JSON.stringify(item.descriptor)).digest("hex")}`,
       stage,
       outcome,
       elapsed_ms: elapsed,
@@ -8405,8 +8711,8 @@ async function runDeterministicQa(snapshot, descriptors, options = {}) {
       }
       evidence.push({
         stage,
-        environment: createHash17("sha256").update(environmentKey).digest("hex"),
-        command: createHash17("sha256").update(JSON.stringify(command)).digest("hex"),
+        environment: createHash18("sha256").update(environmentKey).digest("hex"),
+        command: createHash18("sha256").update(JSON.stringify(command)).digest("hex"),
         entry: frozen?.entry?.content_hash ?? null,
         interpreter: frozen?.interpreter?.content_hash ?? null,
         exit_code: result.exit_code,
@@ -8484,7 +8790,7 @@ async function runDeterministicQa(snapshot, descriptors, options = {}) {
   };
   if (findings.length)
     return { ...base, decision: "rework", findings };
-  const executionDigest = createHash17("sha256").update(JSON.stringify({
+  const executionDigest = createHash18("sha256").update(JSON.stringify({
     tree,
     platform: process.platform,
     arch: process.arch,
@@ -8569,11 +8875,6 @@ var BATCH_REASONS = Object.freeze({
     reason: "native confirmation port is unavailable",
     recovery_action: "retry through a fresh native gate in the current Host"
   },
-  confirmation_timed_out: {
-    state: "rejected",
-    reason: "native confirmation timed out waiting for user interaction",
-    recovery_action: "retry through a fresh native gate in the current Host"
-  },
   confirmation_cancelled: {
     state: "cancelled",
     reason: "native interaction cancelled",
@@ -8639,23 +8940,6 @@ function batchReason(key, detail = "") {
   };
 }
 
-// plugins/immune-brain/runtime/unattended/confirmation_deadline.ts
-var CONFIRMATION_TIMEOUT_DEFAULT_MS = 60000;
-var CONFIRMATION_TIMEOUT_ENV = "IMMUNE_BRAIN_BATCH_TIMEOUT_MS";
-function startConfirmationDeadline(input) {
-  const configured = Number(input.env?.[CONFIRMATION_TIMEOUT_ENV]);
-  const timeoutMs = Number.isFinite(configured) && configured > 0 ? configured : CONFIRMATION_TIMEOUT_DEFAULT_MS;
-  const controller = new AbortController;
-  const timer = setTimeout(() => {
-    controller.abort(new Error("native confirmation timed out waiting for user interaction"));
-  }, timeoutMs);
-  return {
-    signal: input.signal ? AbortSignal.any([input.signal, controller.signal]) : controller.signal,
-    timedOut: () => controller.signal.aborted && !input.signal?.aborted,
-    clear: () => clearTimeout(timer)
-  };
-}
-
 // plugins/immune-brain/runtime/authorization_operation.ts
 function deriveAuthorizationOperation(input) {
   if (input.readiness.state === "resolve_user_decision")
@@ -8885,17 +9169,17 @@ function createGhTransport(binary = "gh") {
       return new Promise((complete) => {
         let stdout = Buffer.alloc(0);
         let stderr = Buffer.alloc(0);
-        const remaining = options.budget === undefined ? GH_TIMEOUT_MS : Math.min(GH_TIMEOUT_MS, options.budget.deadline_ms - Date.now());
-        if (options.budget && (options.budget.signal?.aborted || remaining <= 0)) {
+        if (options.signal?.aborted) {
           complete({
             exit_code: 1,
             stdout: "",
-            stderr: options.budget.signal?.aborted ? "operation cancelled by the caller" : "publication deadline exceeded before the next remote call",
+            stderr: "operation cancelled by the caller",
             timed_out: true,
             output_exceeded: false
           });
           return;
         }
+        const remaining = GH_TIMEOUT_MS;
         let timedOut = false;
         let outputExceeded = false;
         let timer;
@@ -9283,7 +9567,7 @@ ${provenance}## How to use this Issue
 
 - Edit planning prose and Slice ordering directly after creation.
 - Keep each Slice marker attached to exactly one stable Slice entry.
-- The tracker never rewrites or closes this Parent after creation; the tracker never changes or closes it automatically.
+- The tracker never rewrites this Parent after creation; the tracker closes it as completed once every Slice Child is completed, and never closes it otherwise.
 
 ## Problem
 
@@ -9432,7 +9716,7 @@ ${publicText(projection.agent_handoff ?? "Implement only the bounded TaskIntent
 ${ISSUE_FOOTER}
 `;
 }
-async function upsertTask(root, gh, operation, source, pendingBinding = null, amendmentContext = undefined) {
+async function upsertTask(root, gh, operation, source) {
   const labelFailure = await labelAvailabilityFailure(root, gh, source.repository, desiredTaskLabels(operation));
   if (labelFailure)
     return labelFailure;
@@ -9447,8 +9731,6 @@ async function upsertTask(root, gh, operation, source, pendingBinding = null, am
   const found = lookup(source.issues);
   if (found.kind === "ambiguous")
     return result(operation.op, "ambiguous_remote_state", found.message);
-  if (found.kind === "missing" && pendingBinding !== null && pendingBinding !== undefined)
-    return result(operation.op, "ambiguous_remote_state", `Task ${operation.task_id} is bound to Issue #${pendingBinding.issue_number} but that Issue no longer holds its Task marker; amend the binding or restore the marker instead of recreating`, parent.issue);
   const blockerIds = operation.projection?.blocked_by ?? [];
   const blockers = [];
   for (const blockerId of blockerIds) {
@@ -9473,32 +9755,6 @@ async function upsertTask(root, gh, operation, source, pendingBinding = null, am
   let createdChild = false;
   let labelsConverged = false;
   if (found.kind === "missing") {
-    if (amendmentContext !== undefined) {
-      const reRead = await snapshot(root, gh, operation.op);
-      if ("contract" in reRead)
-        return reRead;
-      const reReadParent = initiativeLookup(reRead.issues, reRead.repository.id, operation.initiative_id);
-      if (reReadParent.kind !== "found")
-        return result(operation.op, "ambiguous_remote_state", reReadParent.kind === "ambiguous" ? reReadParent.message : "amendment Parent is not observable before creating a new Child", parent.issue);
-      if (reReadParent.issue.number !== amendmentContext.parentIssueNumber)
-        return result(operation.op, "ambiguous_remote_state", `amendment Parent is bound to Issue #${amendmentContext.parentIssueNumber} but observed Issue #${reReadParent.issue.number} before creating a new Child`, reReadParent.issue);
-      if (reReadParent.issue.state !== "open")
-        return result(operation.op, "ambiguous_remote_state", "amendment Parent is no longer open before creating a new Child", reReadParent.issue);
-      if (amendmentContext.parent.title !== reReadParent.issue.title || amendmentContext.parent.body !== reReadParent.issue.body)
-        return result(operation.op, "ambiguous_remote_state", "amendment Parent content changed before creating a new Child", reReadParent.issue);
-      if (sliceCount(reReadParent.issue.body, operation.slice_id) !== 1)
-        return result(operation.op, "ambiguous_remote_state", `Parent Issue #${reReadParent.issue.number} lost its exact Slice marker ${operation.slice_id} before creating a new Child`, reReadParent.issue);
-      const raced = lookup(reRead.issues);
-      if (raced.kind === "ambiguous")
-        return result(operation.op, "ambiguous_remote_state", raced.message);
-      if (raced.kind === "found") {
-        const approved = amendmentContext.pendingContent.get(operation.task_id);
-        const resumable = approved !== undefined && raced.issue.state === "open" && carriesApprovedContent(raced.issue.title, raced.issue.body, approved);
-        if (!resumable)
-          return result(operation.op, "ambiguous_remote_state", `new pending Task ${operation.task_id} is unbound but Issue #${raced.issue.number} already exists with divergent content; bind it to amend`, raced.issue);
-        return updatePendingChild(root, gh, reRead, operation, raced.issue, undefined, blockers, approved, amendmentContext);
-      }
-    }
     const mutation = await gh.run([
       "issue",
       "create",
@@ -9521,11 +9777,6 @@ async function upsertTask(root, gh, operation, source, pendingBinding = null, am
     }
     if (created.issue.body !== body || created.issue.title !== title)
       return result(operation.op, "retryable_failure", "Task Issue did not converge to the requested title and body", created.issue);
-    if (amendmentContext !== undefined) {
-      if (created.issue.state !== "open")
-        return result(operation.op, "ambiguous_remote_state", `new pending Task ${operation.task_id} (Issue #${created.issue.number}) is not open after creation`, created.issue);
-      return updatePendingChild(root, gh, source, operation, created.issue, undefined, blockers, amendmentContext.pendingContent.get(operation.task_id), amendmentContext);
-    }
     child = created.issue;
     createdChild = true;
   } else {
@@ -9533,27 +9784,6 @@ async function upsertTask(root, gh, operation, source, pendingBinding = null, am
     if (owned.kind !== "found")
       return result(operation.op, "ambiguous_remote_state", owned.kind === "ambiguous" ? owned.message : "Task Issue ownership changed during publication", found.issue);
     child = owned.issue;
-    if (pendingBinding !== null) {
-      if (child.state !== "open")
-        return result(operation.op, "ambiguous_remote_state", `Task ${operation.task_id} is closed and cannot be amended as pending work`, found.issue);
-      if (pendingBinding !== undefined && pendingBinding.issue_number !== child.number)
-        return result(operation.op, "ambiguous_remote_state", `Task ${operation.task_id} is bound to Issue #${pendingBinding.issue_number} but observed Issue #${child.number}`, found.issue);
-      const approvedFinal = amendmentContext?.pendingContent.get(operation.task_id);
-      const isFinal = approvedFinal !== undefined && carriesApprovedContent(found.issue.title, found.issue.body, approvedFinal);
-      if (!isFinal) {
-        const baselineMatches = pendingBinding !== undefined && pendingBinding.title === found.issue.title && carriesApprovedContent(found.issue.title, found.issue.body, pendingBinding);
-        if (!baselineMatches)
-          return result(operation.op, "ambiguous_remote_state", `Task ${operation.task_id} changed since the approved amendment baseline`, found.issue);
-      }
-      return updatePendingChild(root, gh, source, operation, child, pendingBinding?.issue_number, blockers, approvedFinal, amendmentContext);
-    }
-    if (amendmentContext !== undefined) {
-      const approvedFinal = amendmentContext.pendingContent.get(operation.task_id);
-      const resumable = approvedFinal !== undefined && child.state === "open" && carriesApprovedContent(found.issue.title, found.issue.body, approvedFinal);
-      if (!resumable)
-        return result(operation.op, "ambiguous_remote_state", `new pending Task ${operation.task_id} is unbound but Issue #${child.number} already exists with divergent content; bind it to amend`, found.issue);
-      return updatePendingChild(root, gh, source, operation, child, undefined, blockers, approvedFinal, amendmentContext);
-    }
     if (!sameTrackedBody(found.issue.body, body) || found.issue.title !== title)
       return result(operation.op, "permanent_failure", "Task Issue already exists with a different title or Agent Brief; edit the GitHub source or retry the original projection before changing native relations", found.issue);
     const intentMismatch = publishedIntentMismatch(found.issue.body, operation.task_id, operation.intent_hash);
@@ -9660,7 +9890,7 @@ async function closeTerminalIssue(root, gh, operation, source, issue, lookup) {
     return result(operation.op, "updated", "terminal Task Issue closure confirmed", found.issue);
   return close.exit_code !== 0 ? ghFailure(operation.op, close, "terminal Issue closure failed") : result(operation.op, "retryable_failure", "terminal Issue closure did not converge", found.issue);
 }
-async function markTerminal(root, gh, operation, source) {
+async function markChildTerminal(root, gh, operation, source) {
   const lookup = (issues) => taskLookup(issues, source.repository.id, operation.task_id);
   const found = lookup(source.issues);
   if (found.kind === "missing")
@@ -9710,6 +9940,69 @@ async function markTerminal(root, gh, operation, source) {
     return refreshedOwnership;
   return closeTerminalIssue(root, gh, operation, refreshed, reread.issue, lookup);
 }
+async function closeParentWhenComplete(root, gh, operation, source, childResult) {
+  const child = taskLookup(source.issues, source.repository.id, operation.task_id);
+  if (child.kind !== "found")
+    return childResult;
+  const initiativeId = ownershipMarkerValue(child.issue.body, "initiative-id");
+  if (!initiativeId)
+    return childResult;
+  const parentLookup = initiativeLookup(source.issues, source.repository.id, initiativeId);
+  if (parentLookup.kind !== "found")
+    return childResult;
+  const parentNumber = parentLookup.issue.number;
+  const retry = (message, status = "retryable_failure") => result(operation.op, status, `Parent #${parentNumber}: ${message}; the Task closure is unchanged, retry the same mark-terminal`, child.issue);
+  const endpoint = `repos/${source.repository.name_with_owner}/issues/${parentNumber}`;
+  const readParent = async () => {
+    const read = await gh.run(["api", endpoint], { cwd: root });
+    if (read.exit_code !== 0 || read.output_exceeded) {
+      const failed = ghFailure(operation.op, read, "cannot read the Initiative Parent");
+      return retry(failed.message, failed.status);
+    }
+    try {
+      const [issue] = parseIssues(`[${read.stdout}]`);
+      return issue ?? retry("gh returned a malformed Issue", "permanent_failure");
+    } catch (error) {
+      return retry(error instanceof Error ? error.message : String(error), "permanent_failure");
+    }
+  };
+  const parent = await readParent();
+  if ("contract" in parent)
+    return parent;
+  if (parent.state === "closed")
+    return childResult;
+  const listed = await gh.run(["api", "--paginate", "--slurp", `${endpoint}/sub_issues?per_page=100`], { cwd: root });
+  if (listed.exit_code !== 0 || listed.output_exceeded) {
+    const failed = ghFailure(operation.op, listed, "cannot read the Initiative Sub-issues");
+    return retry(failed.message, failed.status);
+  }
+  let children;
+  try {
+    children = parseIssues(listed.stdout);
+  } catch (error) {
+    return retry(error instanceof Error ? error.message : String(error), "permanent_failure");
+  }
+  const sliceChildren = children.filter((candidate) => candidate.body.includes(marker("initiative-id", initiativeId)) && /<!-- immune-brain:slice-id=[^>]+ -->/.test(candidate.body));
+  if (sliceChildren.length === 0 || !sliceChildren.every((candidate) => candidate.state === "closed" && candidate.state_reason === "completed"))
+    return childResult;
+  const close = await gh.run(["issue", "close", String(parentNumber), "--repo", source.repository.name_with_owner, "--reason", "completed"], { cwd: root });
+  const confirmed = await readParent();
+  if ("contract" in confirmed)
+    return confirmed;
+  if (confirmed.state === "closed" && confirmed.state_reason === "completed")
+    return result(operation.op, "updated", `${childResult.message}; Initiative Parent #${parentNumber} closed as completed`, child.issue);
+  if (close.exit_code !== 0 || close.output_exceeded) {
+    const failed = ghFailure(operation.op, close, "Initiative Parent closure failed");
+    return retry(failed.message, failed.status);
+  }
+  return retry("closure did not converge");
+}
+async function markTerminal(root, gh, operation, source) {
+  const terminal = await markChildTerminal(root, gh, operation, source);
+  if (operation.phase !== "done" || terminal.status !== "updated" && terminal.status !== "already_current" || !terminal.association_found)
+    return terminal;
+  return closeParentWhenComplete(root, gh, operation, source, terminal);
+}
 function normalizedList(value, name, max = 2000) {
   if (value === undefined)
     return;
@@ -9850,457 +10143,15 @@ async function runGithubTrackerOperation(root, input, gh = createGhTransport())
       return markTerminal(absoluteRoot, gh, operation, source);
   }
 }
-function issueTerminalEventId(body) {
-  const suffixMatch = [...body.matchAll(/<!-- immune-brain:terminal-event=([A-Za-z0-9._:-]+) -->/g)];
-  if (suffixMatch.length === 0)
-    return null;
-  if (suffixMatch.length > 1)
-    return "multiple";
-  const eventId = suffixMatch[0][1];
-  if (eventId.length > MAX_TERMINAL_EVENT_ID || !body.endsWith(terminalSuffix(eventId)))
-    return "malformed";
-  return eventId;
-}
-function stripTerminalSuffixFromBytes(body) {
-  if (body === undefined)
-    return null;
-  const eventId = issueTerminalEventId(body);
-  if (eventId === null || eventId === "multiple" || eventId === "malformed")
-    return eventId;
-  const suffix = terminalSuffix(eventId);
-  if (!body.endsWith(suffix))
-    return null;
-  return body.slice(0, body.length - suffix.length);
-}
-function carriesApprovedContent(title, body, approved) {
-  if (title !== approved.title)
-    return false;
-  if (body === approved.body)
-    return true;
-  const stripped = stripTerminalSuffixFromBytes(body);
-  return typeof stripped === "string" && stripped.trimEnd() === approved.body.trimEnd();
-}
-async function updatePendingChild(root, gh, source, op, child, boundNumber, desiredBlockers, approvedFinal, amendmentContext = undefined) {
-  const parent = initiativeLookup(source.issues, source.repository.id, op.initiative_id);
-  const body = childBody(source.repository, op, parent.kind === "found" ? parent.issue : child);
-  const oversized = bodyLimitFailure(op.op, body, MAX_TERMINAL_SUFFIX_BYTES);
-  if (oversized)
-    return oversized;
-  const title = taskIssueTitle(op, sliceOrdinalFromChecklist(parent.kind === "found" ? parent.issue.body : child.body, op.slice_id, op.projection?.slice_ordinal ?? 1));
-  const parentApprovedContent = amendmentContext?.parent;
-  const parentBoundNumber = amendmentContext?.parentIssueNumber;
-  const baseBody = child.body;
-  const suffixEvent = issueTerminalEventId(baseBody);
-  if (suffixEvent === "multiple")
-    return result(op.op, "ambiguous_remote_state", "pending Task has multiple terminal markers", child);
-  if (suffixEvent === "malformed")
-    return result(op.op, "ambiguous_remote_state", `pending Task ${op.task_id} carries a malformed terminal marker (marker without its exact canonical suffix)`, child);
-  let finalBody = suffixEvent !== null ? `${body.trimEnd()}${terminalSuffix(suffixEvent)}` : body;
-  const approvedMatches = approvedFinal !== undefined && carriesApprovedContent(title, body, approvedFinal);
-  if (!approvedMatches)
-    return result(op.op, "ambiguous_remote_state", `pending Task ${op.task_id} carries a terminal suffix that diverges from the approved amendment content`, child);
-  const approvedNow = approvedFinal !== undefined && carriesApprovedContent(child.title, child.body, approvedFinal);
-  if (approvedNow) {
-    const currentParent = initiativeLookup(source.issues, source.repository.id, op.initiative_id);
-    if (currentParent.kind !== "found")
-      return result(op.op, "ambiguous_remote_state", "pending Task Parent is not observable before attachment convergence", child);
-    const revalidated = await revalidatePendingChildBeforeWrite(root, gh, child.number, op.task_id, approvedFinal, undefined, true, parentApprovedContent, parentBoundNumber);
-    if ("contract" in revalidated)
-      return revalidated;
-    const targetParentNumber = parentBoundNumber ?? currentParent.issue.number;
-    const attachment = await confirmAttachment(root, gh, op.op, source.repository, targetParentNumber, child.number);
-    if (!("attached" in attachment))
-      return attachment;
-    if (!attachment.attached) {
-      const attached = await attachSubIssue(root, gh, op.op, source.repository, targetParentNumber, child);
-      if (!("attached" in attached))
-        return attached;
-    }
-  }
-  let observed = child;
-  const desiredLabels = desiredTaskLabels(op);
-  if (child.title !== title || child.body !== finalBody || labelMutationArgs(child.labels, desiredLabels).length) {
-    const revalidated = await revalidatePendingChildBeforeWrite(root, gh, child.number, op.task_id, approvedFinal, { title: child.title, body: child.body }, false, parentApprovedContent, parentBoundNumber);
-    if ("contract" in revalidated)
-      return revalidated;
-    observed = revalidated;
-    const observedEvent = issueTerminalEventId(observed.body);
-    if (observedEvent === "malformed")
-      return result(op.op, "ambiguous_remote_state", `pending Task ${op.task_id} carries a malformed terminal marker (marker without its exact canonical suffix)`, child);
-    const writeBody = typeof observedEvent === "string" ? `${body.trimEnd()}${terminalSuffix(observedEvent)}` : finalBody;
-    const labelArgs = labelMutationArgs(observed.labels, desiredLabels);
-    if (observed.title !== title || observed.body !== writeBody || labelArgs.length) {
-      const edited = await gh.run([
-        "issue",
-        "edit",
-        String(child.number),
-        "--repo",
-        source.repository.name_with_owner,
-        "--title",
-        title,
-        "--body-file",
-        "-",
-        ...labelArgs
-      ], { cwd: root, stdin: writeBody });
-      if (edited.exit_code !== 0 || edited.output_exceeded)
-        return ghFailure(op.op, edited, `pending Task Issue #${child.number} update failed`);
-      finalBody = writeBody;
-    }
-  }
-  const dependencies = await convergePendingDependencies(root, gh, source, child.number, op.task_id, desiredBlockers, approvedFinal, parentApprovedContent, parentBoundNumber);
-  if (!("complete" in dependencies))
-    return dependencies;
-  const refreshed = await snapshot(root, gh, op.op);
-  if ("contract" in refreshed)
-    return refreshed;
-  const reread = ownedTaskLookup(refreshed.issues, refreshed.repository.id, op.task_id, op.initiative_id, op.slice_id);
-  if (reread.kind !== "found" || reread.issue.number !== child.number)
-    return result(op.op, "ambiguous_remote_state", `pending Task ${op.task_id} changed identity during amendment`, child);
-  if (reread.issue.title !== title || reread.issue.body !== finalBody)
-    return result(op.op, "retryable_failure", `pending Task ${op.task_id} update did not converge`, reread.issue);
-  const labelsCurrent = !desiredLabels.some((label) => !reread.issue.labels.includes(label));
-  if (!labelsCurrent)
-    return result(op.op, "retryable_failure", `pending Task ${op.task_id} labels did not converge`, reread.issue);
-  const currentDependencies = await confirmBlockedBy(root, gh, op.op, refreshed.repository, reread.issue.number, desiredBlockers);
-  if (!("complete" in currentDependencies))
-    return currentDependencies;
-  if (!currentDependencies.complete)
-    return result(op.op, "retryable_failure", `pending Task ${op.task_id} dependencies did not converge`, reread.issue);
-  const contentCurrent = child.title === title && child.body === finalBody && labelMutationArgs(child.labels, desiredLabels).length === 0;
-  return contentCurrent ? result(op.op, "already_current", `pending Task ${op.task_id} already carries the approved amendment content`, reread.issue) : result(op.op, "updated", `pending Task ${op.task_id} Agent Brief updated with approved amendment content`, reread.issue);
-}
-async function convergePendingDependencies(root, gh, source, childNumber, childTaskId, requestedBlockers, approvedFinal, parentApprovedContent = undefined, parentBoundNumber = undefined) {
-  const expected = requestedBlockers.map((blocker) => blocker.id);
-  const existing = await readBlockedByIds(root, gh, "upsert-task", source.repository, childNumber);
-  if (!Array.isArray(existing))
-    return existing;
-  const removed = existing.filter((id) => !expected.includes(id));
-  for (const id of removed) {
-    const revalidated = await revalidatePendingChildBeforeWrite(root, gh, childNumber, childTaskId, approvedFinal, undefined, false, parentApprovedContent, parentBoundNumber);
-    if ("contract" in revalidated)
-      return revalidated;
-    const mutation = await gh.run([
-      "api",
-      "--method",
-      "DELETE",
-      `repos/${source.repository.name_with_owner}/issues/${childNumber}/dependencies/blocked_by/${id}`
-    ], { cwd: root });
-    if (mutation.exit_code !== 0 || mutation.output_exceeded)
-      return ghFailure("upsert-task", mutation, `native blocked_by removal failed for Issue #${childNumber}`);
-  }
-  const additions = requestedBlockers.filter((blocker) => !existing.includes(blocker.id));
-  for (const blocker of additions) {
-    const revalidated = await revalidatePendingChildBeforeWrite(root, gh, childNumber, childTaskId, approvedFinal, undefined, false, parentApprovedContent, parentBoundNumber);
-    if ("contract" in revalidated)
-      return revalidated;
-    const mutation = await gh.run([
-      "api",
-      "-F",
-      `issue_id=${blocker.id}`,
-      `repos/${source.repository.name_with_owner}/issues/${childNumber}/dependencies/blocked_by`
-    ], { cwd: root });
-    if (mutation.exit_code !== 0 || mutation.output_exceeded)
-      return ghFailure("upsert-task", mutation, `native blocked_by attachment failed for Issue #${blocker.number}`);
-  }
-  const confirm = await confirmBlockedBy(root, gh, "upsert-task", source.repository, childNumber, requestedBlockers);
-  if (!("complete" in confirm))
-    return confirm;
-  return confirm.complete ? { complete: true } : { complete: true };
-}
-async function revalidatePendingChildBeforeWrite(root, gh, childNumber, childTaskId, approvedFinal, allowedBaseline = undefined, skipAttachmentCheck = false, parentApproved = undefined, parentExpectedNumber = undefined) {
-  const refreshed = await snapshot(root, gh, "upsert-task");
-  if ("contract" in refreshed)
-    return refreshed;
-  const resolved = taskLookup(refreshed.issues, refreshed.repository.id, childTaskId);
-  if (resolved.kind !== "found")
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} is not uniquely owned before a write: ${resolved.kind}`);
-  const child = resolved.issue;
-  if (child.number !== childNumber)
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} resolves to Issue #${child.number}, not the bound Issue #${childNumber}`, child);
-  if (child.state !== "open")
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) is no longer open before a dependency write`, child);
-  const contentFinal = approvedFinal !== undefined && carriesApprovedContent(child.title, child.body, approvedFinal);
-  const contentBaseline = allowedBaseline !== undefined && child.title === allowedBaseline.title && child.body === allowedBaseline.body;
-  if (!contentFinal && !contentBaseline)
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) content is no longer the approved final bytes before a dependency write`, child);
-  const initiativeId = [...child.body.matchAll(/<!-- immune-brain:initiative-id=([A-Za-z0-9._:-]+) -->/g)].map((match) => match[1])[0];
-  if (!initiativeId)
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) lost its Initiative marker before a dependency write`, child);
-  const parent = initiativeLookup(refreshed.issues, refreshed.repository.id, initiativeId);
-  if (parent.kind !== "found" || parent.issue.state !== "open")
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) lost its open Parent before a dependency write`, child);
-  if (parentExpectedNumber !== undefined && parent.issue.number !== parentExpectedNumber)
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) Parent resolves to Issue #${parent.issue.number}, not the bound Parent Issue #${parentExpectedNumber} before a dependency write`, child);
-  if (parentApproved !== undefined && (parent.issue.title !== parentApproved.title || parent.issue.body !== parentApproved.body))
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) Parent changed since the approved amendment content before a dependency write`, child);
-  if (!skipAttachmentCheck) {
-    const attachedNow = await readSubIssueNumbers(root, gh, "upsert-task", refreshed.repository, parent.issue.number);
-    if (!Array.isArray(attachedNow))
-      return attachedNow;
-    if (!attachedNow.includes(childNumber))
-      return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) is no longer attached to the Parent before a dependency write`, child);
-  }
-  const sliceId = ownershipMarkerValue(child.body, "slice-id");
-  if (sliceId && sliceCount(parent.issue.body, sliceId) !== 1)
-    return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) lost its exact Slice in the Parent before a dependency write`, child);
-  return child;
-}
 
 // plugins/immune-brain/runtime/unattended/batch_preflight.ts
 import { existsSync as existsSync7, readdirSync as readdirSync6, readFileSync as readFileSync13 } from "node:fs";
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { join as join12 } from "node:path";
-import { spawnSync as spawnSync6 } from "node:child_process";
-
-// plugins/immune-brain/runtime/kernel/batch_authority.ts
-import { createHash as createHash18 } from "node:crypto";
-var BATCH_AUTHORITY_CAPABILITY_BRAND = Symbol.for("assurance-kernel.batch-authority-capability-brand");
-var GIT_COMMIT_ID2 = /^[a-f0-9]{40}$/;
-
-class BatchAuthorizationExpiryError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "BatchAuthorizationExpiryError";
-  }
-}
-function sha256Hex3(bytes) {
-  return createHash18("sha256").update(bytes).digest("hex");
-}
-function stableStringify3(value) {
-  if (value === null || typeof value !== "object")
-    return JSON.stringify(value);
-  if (Array.isArray(value))
-    return `[${value.map((entry) => stableStringify3(entry)).join(",")}]`;
-  const record = value;
-  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify3(record[key])}`).join(",")}}`;
-}
-function computeBatchPlanDigest(children) {
-  const canonical = children.map((child) => ({
-    blocked_by: [...child.blocked_by],
-    intent_content_hash: child.intent_content_hash,
-    intent_path: child.intent_path,
-    intent_revision: child.intent_revision,
-    task_id: child.task_id
-  }));
-  return `sha256:${sha256Hex3(stableStringify3(canonical))}`;
-}
-function requireNonEmpty(binding) {
-  const missing = [];
-  for (const key of [
-    "batch_id",
-    "initiative_slug",
-    "plan_digest",
-    "branch",
-    "base_head",
-    "actor_id",
-    "confirmation_ref",
-    "expires_at",
-    "nonce"
-  ]) {
-    const value = binding[key];
-    if (value === undefined || value === null || value === "")
-      missing.push(key);
-  }
-  if (!binding.budget || typeof binding.budget !== "object")
-    missing.push("budget");
-  if (missing.length > 0)
-    throw new Error(`batch authorization binding is incomplete: ${missing.join(", ")}`);
-}
-function validateBudget(budget, issuedAt) {
-  if (!Number.isInteger(budget.max_children) || budget.max_children <= 0)
-    throw new Error("batch budget max_children must be a positive integer");
-  if (!Number.isInteger(budget.qa_failure_limit) || budget.qa_failure_limit <= 0)
-    throw new Error("batch budget qa_failure_limit must be a positive integer");
-  const deadline = Date.parse(budget.deadline_at);
-  if (Number.isNaN(deadline) || deadline <= Date.parse(issuedAt))
-    throw new Error("batch budget must have a future deadline_at");
-}
-function validateChildren(children, planDigest) {
-  if (!Array.isArray(children) || children.length === 0)
-    throw new Error("batch authorization requires a non-empty child plan");
-  const seen = new Set;
-  for (const child of children) {
-    if (!child || typeof child !== "object")
-      throw new Error("batch plan child must be an object");
-    for (const key of ["task_id", "intent_path", "intent_content_hash"]) {
-      if (typeof child[key] !== "string" || child[key] === "")
-        throw new Error(`batch plan child ${key} must be a non-empty string`);
-    }
-    if (!Number.isInteger(child.intent_revision) || child.intent_revision <= 0)
-      throw new Error("batch plan child intent_revision must be a positive integer");
-    if (!Array.isArray(child.blocked_by) || child.blocked_by.some((id) => typeof id !== "string" || id === ""))
-      throw new Error("batch plan child blocked_by must be an array of task ids");
-    if (seen.has(child.task_id))
-      throw new Error(`batch plan child ${child.task_id} appears more than once`);
-    seen.add(child.task_id);
-  }
-  for (const child of children) {
-    for (const blocker of child.blocked_by) {
-      if (!seen.has(blocker))
-        throw new Error(`batch plan child ${child.task_id} is blocked by ${blocker}, which is not in the confirmed plan`);
-    }
-  }
-  const dependencies = new Map(children.map((child) => [child.task_id, child.blocked_by]));
-  const visiting = new Set;
-  const visited = new Set;
-  function visit(taskId) {
-    if (visiting.has(taskId))
-      throw new Error(`batch plan dependency cycle at ${taskId}`);
-    if (visited.has(taskId))
-      return;
-    visiting.add(taskId);
-    for (const blocker of dependencies.get(taskId))
-      visit(blocker);
-    visiting.delete(taskId);
-    visited.add(taskId);
-  }
-  for (const child of children)
-    visit(child.task_id);
-  if (computeBatchPlanDigest(children) !== planDigest)
-    throw new Error("batch plan digest does not match the confirmed child plan");
-}
-function createBatchAuthorityRegistry() {
-  const inner = createCapabilityRegistry(BATCH_AUTHORITY_CAPABILITY_BRAND, {
-    validateBinding(binding, issuedAt) {
-      requireNonEmpty(binding);
-      if (!isLiteralUserActor(binding.actor_id))
-        throw new Error("batch authorization requires a literal-user actor_id");
-      if (!GIT_COMMIT_ID2.test(binding.base_head))
-        throw new Error("batch authorization base_head must be a committed 40-hex commit id");
-      const expires = Date.parse(binding.expires_at);
-      if (Number.isNaN(expires) || expires <= Date.parse(issuedAt))
-        throw new Error("batch authorization must have a future expiry");
-      validateBudget(binding.budget, issuedAt);
-    },
-    validateAndProject(state, expected, now) {
-      if (!Number.isFinite(now))
-        throw new Error("batch authorization requires a valid clock");
-      const expires = Date.parse(state.expires_at);
-      if (Number.isNaN(expires) || expires <= now)
-        throw new BatchAuthorizationExpiryError("batch authorization has expired");
-      if (Date.parse(state.budget.deadline_at) <= now)
-        throw new BatchAuthorizationExpiryError("batch authorization deadline has expired");
-      for (const key of Object.keys(expected)) {
-        if (key === "budget") {
-          const a = state.budget ?? {};
-          const b = expected.budget ?? {};
-          if (a.max_children !== b.max_children || a.deadline_at !== b.deadline_at || a.qa_failure_limit !== b.qa_failure_limit)
-            throw new Error("batch authorization budget mismatch");
-          continue;
-        }
-        if (state[key] !== expected[key])
-          throw new Error(`batch authorization ${key} mismatch`);
-      }
-      return {
-        batch_id: state.batch_id,
-        initiative_slug: state.initiative_slug,
-        plan_digest: state.plan_digest,
-        branch: state.branch,
-        base_head: state.base_head,
-        budget: { ...state.budget },
-        actor_id: state.actor_id,
-        confirmation_ref: state.confirmation_ref,
-        issued_at: state.issued_at,
-        expires_at: state.expires_at,
-        nonce: state.nonce
-      };
-    }
-  }, "batch authorization");
-  const plans = new WeakMap;
-  const consumed = new WeakMap;
-  function planOf(capability) {
-    const plan = plans.get(capability);
-    if (!plan)
-      throw new Error("batch authorization capability is not recognized by this registry");
-    return plan;
-  }
-  function slotsOf(capability) {
-    const slots = consumed.get(capability);
-    if (!slots)
-      throw new Error("batch authorization capability is not recognized by this registry");
-    return slots;
-  }
-  return {
-    brand: inner.brand,
-    issue(binding, children, issuedAt = new Date().toISOString()) {
-      requireNonEmpty(binding);
-      validateChildren(children, binding.plan_digest);
-      const capability = inner.issue(binding, issuedAt);
-      plans.set(capability, children.map((child) => ({ ...child, blocked_by: [...child.blocked_by] })));
-      consumed.set(capability, new Set);
-      return capability;
-    },
-    inspect(capability, expected, now = Date.now()) {
-      planOf(capability);
-      return inner.inspect(capability, expected, now);
-    },
-    children(capability) {
-      return planOf(capability).map((child) => ({ ...child, blocked_by: [...child.blocked_by] }));
-    },
-    consumedChildren(capability) {
-      return [...slotsOf(capability)];
-    },
-    isChildConsumed(capability, taskId) {
-      return slotsOf(capability).has(taskId);
-    },
-    consumeChild(capability, expected, taskId, now = Date.now()) {
-      const validated = this.inspect(capability, expected, now);
-      const plan = planOf(capability);
-      if (!plan.some((child) => child.task_id === taskId))
-        throw new Error(`batch_child_not_in_plan: ${taskId}`);
-      const slots = slotsOf(capability);
-      if (slots.has(taskId))
-        throw new Error(`batch_child_slot_consumed: ${taskId}`);
-      slots.add(taskId);
-      return validated;
-    },
-    releaseChild(capability, taskId) {
-      slotsOf(capability).delete(taskId);
-    },
-    isExhausted(capability) {
-      return slotsOf(capability).size >= planOf(capability).length;
-    }
-  };
-}
-function deriveChildEnrollment(root, registry, input) {
-  const validated = registry.inspect(input.capability, input.binding, Date.parse(input.now));
-  const child = registry.children(input.capability).find((entry) => entry.task_id === input.task_id);
-  if (!child)
-    throw new Error(`batch_child_not_in_plan: ${input.task_id}`);
-  if (registry.isChildConsumed(input.capability, input.task_id))
-    throw new Error(`batch_child_slot_consumed: ${input.task_id}`);
-  if (!GIT_COMMIT_ID2.test(input.expected_head))
-    throw new Error("batch_head_lineage_broken: expected_head is not a commit id");
-  const preparation = preparePiCanary(root, { task_id: input.task_id, now: input.now });
-  if (!preparation.git_base_head)
-    throw new Error(preparation.git_error ?? "enrollment requires a committed Git HEAD");
-  if (preparation.git_base_head !== input.expected_head)
-    throw new Error(`batch_head_lineage_broken: expected ${input.expected_head}, found ${preparation.git_base_head}`);
-  if (!preparation.intent)
-    throw new Error(`batch_child_intent_changed: ${input.task_id} intent sidecar is unreadable`);
-  if (preparation.intent.path !== child.intent_path || preparation.intent.revision !== child.intent_revision || preparation.intent.content_hash !== child.intent_content_hash)
-    throw new Error(`batch_child_intent_changed: ${input.task_id}`);
-  if (registry.consumedChildren(input.capability).length === 0 && input.expected_head !== validated.base_head)
-    throw new Error(`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${validated.base_head}, not ${input.expected_head}`);
-  return {
-    child,
-    preparation,
-    binding: {
-      task_id: child.task_id,
-      intent_path: child.intent_path,
-      intent_revision: child.intent_revision,
-      intent_content_hash: child.intent_content_hash,
-      preparation_digest: preparation.digest,
-      actor_id: validated.actor_id,
-      confirmation_ref: validated.confirmation_ref,
-      expires_at: validated.expires_at,
-      nonce: `${validated.nonce}:${child.task_id}`
-    }
-  };
-}
+import { spawnSync as spawnSync7 } from "node:child_process";
 
 // plugins/immune-brain/runtime/unattended/batch_reconfirmation.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 
 // plugins/immune-brain/runtime/unattended/batch_state.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync6, openSync as openSync6, closeSync as closeSync6, writeFileSync as writeFileSync6, renameSync as renameSync3, lstatSync as lstatSync9, constants as constants5, rmSync as rmSync6 } from "node:fs";
@@ -10339,8 +10190,13 @@ function statePath(batchId) {
   validateBatchId(batchId);
   return join11(".imm", "state", "batches", `${batchId}.json`);
 }
+function withoutRetiredClock(record) {
+  const { authorization_expires_at: _expiry, ...rest } = record;
+  const { deadline_at: _deadline, ...budget } = rest.budget;
+  return { ...rest, budget };
+}
 function canonicalBytes(record) {
-  return `${JSON.stringify(record, null, 2)}
+  return `${JSON.stringify(withoutRetiredClock(record), null, 2)}
 `;
 }
 function validateRecordShape(value, batchId) {
@@ -10359,8 +10215,6 @@ function validateRecordShape(value, batchId) {
     throw new Error(`batch run state ${batchId} has an invalid branch`);
   if (!isCanonicalTimestamp(record.confirmation_time))
     throw new Error(`batch run state ${batchId} has an invalid confirmation_time`);
-  if (!isCanonicalTimestamp(record.authorization_expires_at))
-    throw new Error(`batch run state ${batchId} has an invalid authorization_expires_at`);
   if (!isCanonicalTimestamp(record.created_at) || !isCanonicalTimestamp(record.updated_at))
     throw new Error(`batch run state ${batchId} has invalid state timestamps`);
   if (!Array.isArray(record.children) || record.children.length === 0)
@@ -10370,10 +10224,12 @@ function validateRecordShape(value, batchId) {
   if (typeof record.consecutive_qa_failures !== "number" || !Number.isInteger(record.consecutive_qa_failures) || record.consecutive_qa_failures < 0)
     throw new Error(`batch run state ${batchId} has an invalid consecutive_qa_failures`);
   const budget = record.budget;
-  if (typeof record.budget !== "object" || record.budget === null || typeof budget.max_children !== "number" || !Number.isInteger(budget.max_children) || budget.max_children <= 0 || !isCanonicalTimestamp(budget.deadline_at) || typeof budget.qa_failure_limit !== "number" || !Number.isInteger(budget.qa_failure_limit) || budget.qa_failure_limit <= 0)
+  if (typeof record.budget !== "object" || record.budget === null || typeof budget.max_children !== "number" || !Number.isInteger(budget.max_children) || budget.max_children <= 0 || typeof budget.qa_failure_limit !== "number" || !Number.isInteger(budget.qa_failure_limit) || budget.qa_failure_limit <= 0)
     throw new Error(`batch run state ${batchId} has an invalid budget`);
   if (!Array.isArray(record.commits) || record.commits.some((c) => typeof c !== "string"))
     throw new Error(`batch run state ${batchId} has an invalid commits list`);
+  if (record.adopted_heads !== undefined && (!Array.isArray(record.adopted_heads) || record.adopted_heads.some((a) => typeof a !== "object" || a === null || typeof a.from !== "string" || !a.from || typeof a.to !== "string" || !a.to)))
+    throw new Error(`batch run state ${batchId} has an invalid adopted_heads list`);
   const seenTaskIds = new Set;
   for (const child of record.children) {
     if (typeof child !== "object" || child === null || typeof child.task_id !== "string" || !child.task_id || typeof child.slice_id !== "string" || !child.slice_id)
@@ -10413,7 +10269,6 @@ function prepareBatchRunState(input) {
     base_head: input.base_head,
     branch: input.branch ?? `imm/${input.initiative_slug}`,
     confirmation_time: input.confirmation_time,
-    authorization_expires_at: input.authorization_expires_at,
     budget: input.budget,
     batch_state: "prepared",
     children: input.children.map((child) => ({
@@ -10435,7 +10290,7 @@ function parseBatchRunState(raw, batchId) {
   validateBatchId(batchId);
   const parsed = JSON.parse(raw);
   validateRecordShape(parsed, batchId);
-  return parsed;
+  return withoutRetiredClock(parsed);
 }
 function readBatchRunState(root, batchId) {
   const path = statePath(batchId);
@@ -10488,7 +10343,7 @@ function replaceBatchRunState(root, expected, next, validate) {
     if (!readSecureProjectBytes(root, path).equals(expected))
       throw new Error("batch state CAS mismatch");
     validate();
-    const stored = { ...next, updated_at: new Date().toISOString() };
+    const stored = withoutRetiredClock({ ...next, updated_at: new Date().toISOString() });
     writeFileAtomically(root, path, canonicalBytes(stored));
     return stored;
   });
@@ -10500,10 +10355,10 @@ function writeBatchRunState(root, record) {
     const existing = existsSync6(join11(root, path)) ? readSecureProjectFile(root, path) : null;
     if (existing !== null && existing === canonicalBytes(record))
       return record;
-    const stored = {
+    const stored = withoutRetiredClock({
       ...record,
       updated_at: new Date().toISOString()
-    };
+    });
     ensureSecureDirectory2(root, join11(".imm", "state", "batches"));
     writeFileAtomically(root, path, canonicalBytes(stored));
     return stored;
@@ -10552,7 +10407,7 @@ function matchesLocalProof(localJson, exported) {
   return localJson !== null && JSON.stringify(Object.entries(JSON.parse(localJson)).sort()) === JSON.stringify(Object.entries(exported).sort());
 }
 function git4(root, args) {
-  const r = spawnSync5("git", ["-C", root, ...args], { encoding: "buffer", maxBuffer: 262144, env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } });
+  const r = spawnSync6("git", ["-C", root, ...args], { encoding: "buffer", maxBuffer: 262144, env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } });
   if (r.status !== 0)
     refuse();
   return decode(r.stdout);
@@ -10601,20 +10456,17 @@ function ownUnpersistedBatchHead(root, record, head) {
   }
 }
 var confirmations = new Map;
-function retainReconfirmation(nonce, expires, snapshot) {
-  for (const [key, value] of confirmations)
-    if (value.expires <= Date.now())
-      confirmations.delete(key);
+function retainReconfirmation(nonce, snapshot) {
   if (confirmations.has(nonce))
     refuse();
-  confirmations.set(nonce, { snapshot, expires: Date.parse(expires) });
+  confirmations.set(nonce, snapshot);
 }
 function takeReconfirmation(nonce) {
   const found = confirmations.get(nonce);
   confirmations.delete(nonce);
-  if (!found || found.expires <= Date.now())
+  if (!found)
     refuse();
-  return found.snapshot;
+  return found;
 }
 async function captureBatchReconfirmation(root, record, children) {
   if (!id.test(record.batch_id) || !oid.test(record.base_head) || isTerminalBatchState(record.batch_state) || record.commits.length || record.children.some((c) => c.commit !== null || c.state === "committed") || record.children.length !== children.length || !children.length)
@@ -10759,7 +10611,6 @@ async function captureBatchReconfirmation(root, record, children) {
 // plugins/immune-brain/runtime/unattended/batch_plan.ts
 import { createHash as createHash19 } from "node:crypto";
 var ID_PATTERN2 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-var DEFAULT_DEADLINE_MS = 8 * 60 * 60 * 1000;
 var DEFAULT_QA_FAILURE_LIMIT = 2;
 function specBindingReason(inspection) {
   if (inspection.missing.length > 0)
@@ -10852,15 +10703,12 @@ function dependencyClosures(order) {
   }
   return closures;
 }
-function budget(input, enrollableCount, confirmationTime) {
+function budget(input, enrollableCount) {
   const maxChildren = input.budget?.max_children === undefined ? positiveSafeInteger(enrollableCount, "budget.max_children") : positiveSafeInteger(input.budget.max_children, "budget.max_children");
   if (maxChildren > enrollableCount)
     throw new Error("budget.max_children exceeds the enrollable Child count");
   const qaFailureLimit = input.budget?.qa_failure_limit === undefined ? DEFAULT_QA_FAILURE_LIMIT : positiveSafeInteger(input.budget.qa_failure_limit, "budget.qa_failure_limit");
-  const deadline = input.budget?.deadline_at === undefined ? new Date(confirmationTime.milliseconds + DEFAULT_DEADLINE_MS).toISOString() : timestamp(input.budget.deadline_at, "budget.deadline_at").iso;
-  if (Date.parse(deadline) <= confirmationTime.milliseconds)
-    throw new Error("budget.deadline_at must be later than confirmation_time");
-  return { max_children: maxChildren, deadline_at: deadline, qa_failure_limit: qaFailureLimit };
+  return { max_children: maxChildren, qa_failure_limit: qaFailureLimit };
 }
 async function projectBatchPlan(root, initiativeSlug, input, readInitiative = observeGithubInitiative) {
   if (!ID_PATTERN2.test(initiativeSlug))
@@ -10958,7 +10806,7 @@ async function projectBatchPlan(root, initiativeSlug, input, readInitiative = ob
     children,
     enrollable,
     plan_digest: planDigest,
-    budget: budget(input, enrollable.length, confirmationTime)
+    budget: budget(input, enrollable.length)
   };
 }
 
@@ -10980,6 +10828,27 @@ function readActiveClaimTaskId(root) {
   const claim = readBackendClaim(root);
   return workspace.state.current_working || (claim?.lifecycle_status === "active" ? claim.task_id : null);
 }
+function findResumableBatchSlugForTask(root, taskId) {
+  const batchesDir = join12(root, ".imm", "state", "batches");
+  if (!existsSync7(batchesDir))
+    return null;
+  for (const file of readdirSync6(batchesDir)) {
+    if (!file.endsWith(".json"))
+      continue;
+    try {
+      const record = JSON.parse(readFileSync13(join12(batchesDir, file), "utf8"));
+      if (record?.contract !== "assurance_kernel/batch_run_state/v1")
+        continue;
+      if (record.batch_state !== "running" && record.batch_state !== "needs_human")
+        continue;
+      if (record.children.some((child) => child.task_id === taskId && (child.state === "enrolled" || child.state === "settled")))
+        return record.initiative_slug;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
 function findExistingActiveBatch(root, initiativeSlug) {
   const batchesDir = join12(root, ".imm", "state", "batches");
   if (!existsSync7(batchesDir))
@@ -11051,9 +10920,51 @@ function findSettledBatchRecord(root, initiativeSlug) {
   }
   return newest;
 }
+function classifyBatchLineage(input) {
+  const { root, branch, expectedHead, childCommits } = input;
+  const run = (args) => spawnSync7("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  const broken = (reason) => ({
+    kind: "broken",
+    message: `batch_head_lineage_broken: ${reason}`
+  });
+  const branchResult = run(["symbolic-ref", "--short", "HEAD"]);
+  const currentBranch = branchResult.stdout.trim();
+  if (branchResult.status !== 0 || currentBranch !== branch)
+    return broken(`current branch ${currentBranch} does not match expected branch ${branch}`);
+  const headResult = run(["rev-parse", "HEAD"]);
+  const head = headResult.stdout.trim();
+  if (headResult.status !== 0 || !head)
+    return broken("current HEAD is unreadable");
+  if (head !== expectedHead && run(["merge-base", "--is-ancestor", expectedHead, head]).status !== 0)
+    return broken(`current HEAD ${head} does not descend from expected batch head ${expectedHead}`);
+  for (const commit of childCommits) {
+    if (run(["merge-base", "--is-ancestor", commit, head]).status !== 0)
+      return broken(`recorded commit ${commit} is no longer reachable from HEAD`);
+  }
+  if (head === expectedHead)
+    return { kind: "equal", head };
+  if (input.batchId) {
+    const claimed = run([
+      "log",
+      "--fixed-strings",
+      `--grep=Immune-Brain-Batch: ${input.batchId}`,
+      "--format=%H",
+      `${expectedHead}..${head}`
+    ]);
+    const claimant = claimed.stdout.split(/\s+/).find(Boolean);
+    if (claimed.status !== 0 || claimant)
+      return broken(`commit ${claimant ?? head} claims batch ${input.batchId} without recorded evidence`);
+  }
+  return { kind: "fast_forward", head };
+}
 function expectedBatchHead(record) {
   const commits = Array.isArray(record.commits) ? record.commits : [];
-  return commits.length > 0 ? commits[commits.length - 1] : record.base_head;
+  let head = commits.length > 0 ? commits[commits.length - 1] : record.base_head;
+  for (const adoption of record.adopted_heads ?? []) {
+    if (adoption.from === head)
+      head = adoption.to;
+  }
+  return head;
 }
 function isOwnBatchClaim(root, existingBatch, taskId, batchBranch) {
   let claim = null;
@@ -11067,7 +10978,7 @@ function isOwnBatchClaim(root, existingBatch, taskId, batchBranch) {
   const currentTaskId = workspaceOwner || (claim?.lifecycle_status === "active" ? claim?.task_id : null);
   if (currentTaskId !== taskId || !claim)
     return false;
-  const branch = spawnSync6("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" }).stdout.trim();
+  const branch = spawnSync7("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" }).stdout.trim();
   if (branch !== batchBranch)
     return false;
   const childInBatch = existingBatch.children.find((c) => c.task_id === taskId);
@@ -11083,7 +10994,7 @@ function isOwnBatchClaim(root, existingBatch, taskId, batchBranch) {
   }
   if (!rec)
     return false;
-  const lineageHeads = [existingBatch.base_head].concat(Array.isArray(existingBatch.commits) ? existingBatch.commits : []);
+  const lineageHeads = [existingBatch.base_head].concat(Array.isArray(existingBatch.commits) ? existingBatch.commits : []).concat((existingBatch.adopted_heads ?? []).map((adoption) => adoption.to));
   if (!lineageHeads.includes(rec.git_base_head))
     return false;
   if (claim.enrollment_event_id !== `enroll-${taskId}-${claim.created_at}`)
@@ -11124,7 +11035,7 @@ function authorizedScopeOf(root, taskId, state) {
   return scope;
 }
 function porcelainEntries(root) {
-  const statusProc = spawnSync6("git", ["-C", root, "status", "--porcelain=v1", "-z", "--no-renames", "--untracked-files=all", "--ignore-submodules=none"], { encoding: "utf8", env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } });
+  const statusProc = spawnSync7("git", ["-C", root, "status", "--porcelain=v1", "-z", "--no-renames", "--untracked-files=all", "--ignore-submodules=none"], { encoding: "utf8", env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } });
   if (statusProc.status !== 0)
     return null;
   const entries = [];
@@ -11143,9 +11054,10 @@ async function projectPlanSurface(input) {
   const riskByTask = new Map;
   let budget;
   if (isResuming && existingBatch) {
-    budget = { ...existingBatch.budget };
-    if (Date.parse(budget.deadline_at) <= Date.parse(now))
-      budget.deadline_at = new Date(Date.parse(now) + DEFAULT_DEADLINE_MS).toISOString();
+    budget = {
+      max_children: existingBatch.budget.max_children,
+      qa_failure_limit: existingBatch.budget.qa_failure_limit
+    };
     try {
       recoveryChildren = existingBatch.children.map((c) => {
         const intentPath = `docs/plans/${c.task_id}.intent.json`;
@@ -11262,7 +11174,7 @@ async function projectBatchPreflight(options) {
   } catch (err) {
     return reject("git_head_unreadable", err instanceof Error ? err.message : String(err));
   }
-  const branchExists = spawnSync6("git", ["-C", root, "show-ref", "--verify", "--quiet", `refs/heads/${batchBranch}`]);
+  const branchExists = spawnSync7("git", ["-C", root, "show-ref", "--verify", "--quiet", `refs/heads/${batchBranch}`]);
   if (branchExists.status === 0 && !existingBatch)
     return reject("branch_already_exists", batchBranch);
   const statusEntries = porcelainEntries(root);
@@ -11373,37 +11285,37 @@ async function authorizeBatch(options) {
     is_resuming: isResuming
   } = projection;
   const existingBatch = projection.existing_batch;
-  const isExistingExpired = isResuming && Date.parse(existingBatch.authorization_expires_at) <= Date.now();
-  const branchBefore = spawnSync6("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" });
+  const branchBefore = spawnSync7("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" });
   if (branchBefore.status !== 0)
     return { outcome: "rejected", rejection: batchRejection("repository_became_unreadable") };
   const ownsUnpersistedHead = isResuming && existingBatch !== null && existingBatch.plan_digest === planDigest && expectedBatchHead(existingBatch) !== baseHead && ownUnpersistedBatchHead(root, existingBatch, baseHead);
-  if (isResuming && existingBatch && !existingBatch.commits.length && existingBatch.children[0]?.state === "settled" && expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead)
+  const fastForwardsRecordedHead = isResuming && existingBatch !== null && existingBatch.branch === batchBranch && expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead && classifyBatchLineage({
+    root,
+    branch: batchBranch,
+    expectedHead: expectedBatchHead(existingBatch),
+    childCommits: existingBatch.commits,
+    batchId: existingBatch.batch_id
+  }).kind === "fast_forward";
+  if (isResuming && existingBatch && !existingBatch.commits.length && existingBatch.children[0]?.state === "settled" && expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead && !fastForwardsRecordedHead)
     return { outcome: "rejected", rejection: batchRejection("head_moved", "first unpersisted commit provenance is invalid") };
   const reuseBlockers = [];
   if (isResuming && existingBatch) {
-    if (isExistingExpired)
-      reuseBlockers.push("batch_authorization_expired");
-    if (Date.parse(existingBatch.budget.deadline_at) <= Date.now())
-      reuseBlockers.push("batch_budget_expired");
     if (existingBatch.batch_state !== "running")
       reuseBlockers.push("batch_not_running");
     if (existingBatch.plan_digest !== planDigest)
       reuseBlockers.push("batch_plan_digest_changed");
     if (existingBatch.branch !== batchBranch)
       reuseBlockers.push("batch_branch_changed");
-    if (expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead)
+    if (expectedBatchHead(existingBatch) !== baseHead && !ownsUnpersistedHead && !fastForwardsRecordedHead)
       reuseBlockers.push("batch_head_lineage_moved");
   }
   const reuseAuthorization = isResuming && reuseBlockers.length === 0;
-  const expiresAt = reuseAuthorization ? existingBatch.authorization_expires_at : budget.deadline_at;
   const batchId = isResuming && existingBatch ? existingBatch.batch_id : `batch-${initiativeSlug}-${randomUUID7()}`;
   const facts = {
     initiative_slug: initiativeSlug,
     batch_branch: batchBranch,
     plan_digest: planDigest,
     budget,
-    expires_at: expiresAt,
     reuse_blockers: reuseBlockers,
     children: projection.recovery_children.map((child) => ({
       task_id: child.task_id,
@@ -11445,11 +11357,9 @@ async function authorizeBatch(options) {
     if (!current || current.corrupt || JSON.stringify(current.record) !== JSON.stringify(existingBatch))
       return { outcome: "rejected", rejection: batchRejection("plan_changed") };
   }
-  const branchAfter = spawnSync6("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" });
+  const branchAfter = spawnSync7("git", ["-C", root, "branch", "--show-current"], { encoding: "utf8" });
   if (branchAfter.status !== 0 || branchAfter.stdout !== branchBefore.stdout)
     return { outcome: "rejected", rejection: batchRejection("confirmation_failed", "Git branch moved after native confirmation") };
-  if (Date.parse(expiresAt) <= Date.now())
-    return { outcome: "rejected", rejection: batchRejection("confirmation_failed", "confirmed batch deadline expired before authorization issuance") };
   if (projection.reconfirmation) {
     try {
       projection.reconfirmation.assertUnchanged();
@@ -11466,28 +11376,26 @@ async function authorizeBatch(options) {
     budget,
     actor_id: LITERAL_USER_ACTOR_ID,
     confirmation_ref: options.confirmationRef({ batch_id: batchId, request_id: requestId }),
-    expires_at: expiresAt,
     nonce: options.nonce
   };
   if (projection.reconfirmation)
-    retainReconfirmation(binding.nonce, binding.expires_at, projection.reconfirmation);
+    retainReconfirmation(binding.nonce, projection.reconfirmation);
   return {
     outcome: "authorized",
     batch_id: batchId,
     reuse_authorization: reuseAuthorization,
     reuse_blockers: reuseBlockers,
-    expires_at: expiresAt,
     binding
   };
 }
 
 // plugins/immune-brain/runtime/unattended/batch_runner.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { existsSync as existsSync9 } from "node:fs";
 import { join as join14 } from "node:path";
 
 // plugins/immune-brain/runtime/unattended/batch_git.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 import { createHash as createHash20, randomUUID as randomUUID8 } from "node:crypto";
 import {
   constants as constants6,
@@ -11512,7 +11420,7 @@ var DEFAULT_GIT_ENV = {
 function runBatchGitPreflight(input) {
   const { root, initiative_slug: initiativeSlug, base_head: baseHead } = input;
   const branch = `imm/${initiativeSlug}`;
-  const toplevelResult = spawnSync7("git", ["-C", root, "rev-parse", "--show-toplevel"], {
+  const toplevelResult = spawnSync8("git", ["-C", root, "rev-parse", "--show-toplevel"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11550,7 +11458,7 @@ function runBatchGitPreflight(input) {
       message: `unsupported index flags (assume-unchanged/skip-worktree) detected: ${flaggedPreflight.join(", ")}`
     };
   }
-  const statusResult = spawnSync7("git", ["-C", root, "status", "--porcelain", "--untracked-files=all", "--ignore-submodules=none"], {
+  const statusResult = spawnSync8("git", ["-C", root, "status", "--porcelain", "--untracked-files=all", "--ignore-submodules=none"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11568,7 +11476,7 @@ function runBatchGitPreflight(input) {
       message: "working tree is dirty before batch preflight"
     };
   }
-  const headResult = spawnSync7("git", ["-C", root, "rev-parse", "--verify", "HEAD^{commit}"], {
+  const headResult = spawnSync8("git", ["-C", root, "rev-parse", "--verify", "HEAD^{commit}"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11579,11 +11487,11 @@ function runBatchGitPreflight(input) {
       message: "HEAD is uncommitted or not a valid commit"
     };
   }
-  const branchCheck = spawnSync7("git", ["-C", root, "show-ref", "--verify", "--quiet", `refs/heads/${branch}`], { stdio: ["ignore", "ignore", "ignore"] });
+  const branchCheck = spawnSync8("git", ["-C", root, "show-ref", "--verify", "--quiet", `refs/heads/${branch}`], { stdio: ["ignore", "ignore", "ignore"] });
   if (branchCheck.status === 0) {
     const settled = findSettledBatchRecord(root, initiativeSlug);
-    const currentBranch = spawnSync7("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], { encoding: "utf8" });
-    if (findExistingActiveBatch(root, initiativeSlug) === null && settled?.branch === branch && currentBranch.status === 0 && currentBranch.stdout.trim() === branch && headResult.stdout.trim() === baseHead && spawnSync7("git", ["-C", root, "merge-base", "--is-ancestor", expectedBatchHead(settled), baseHead]).status === 0)
+    const currentBranch = spawnSync8("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], { encoding: "utf8" });
+    if (findExistingActiveBatch(root, initiativeSlug) === null && settled?.branch === branch && currentBranch.status === 0 && currentBranch.stdout.trim() === branch && headResult.stdout.trim() === baseHead && spawnSync8("git", ["-C", root, "merge-base", "--is-ancestor", expectedBatchHead(settled), baseHead]).status === 0)
       return { ok: true, branch };
     return {
       ok: false,
@@ -11591,25 +11499,25 @@ function runBatchGitPreflight(input) {
       message: `branch refs/heads/${branch} already exists`
     };
   }
-  const originalBranchResult = spawnSync7("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
+  const originalBranchResult = spawnSync8("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
   const originalBranch = originalBranchResult.stdout.trim();
-  const checkoutResult = spawnSync7("git", ["-C", root, "-c", "core.hooksPath=/dev/null", "checkout", "-b", branch, baseHead], {
+  const checkoutResult = spawnSync8("git", ["-C", root, "-c", "core.hooksPath=/dev/null", "checkout", "-b", branch, baseHead], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     env: DEFAULT_GIT_ENV
   });
   if (checkoutResult.status !== 0) {
     const stderr = checkoutResult.stderr?.trim() || "";
-    const branchExists = stderr.includes("already exists") || spawnSync7("git", ["-C", root, "show-ref", "--verify", "--quiet", `refs/heads/${branch}`]).status === 0;
-    const currentBranchCheck = spawnSync7("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
+    const branchExists = stderr.includes("already exists") || spawnSync8("git", ["-C", root, "show-ref", "--verify", "--quiet", `refs/heads/${branch}`]).status === 0;
+    const currentBranchCheck = spawnSync8("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).stdout.trim();
     if (currentBranchCheck === branch && originalBranch && originalBranch !== branch) {
-      spawnSync7("git", ["-C", root, "-c", "core.hooksPath=/dev/null", "checkout", originalBranch], {
+      spawnSync8("git", ["-C", root, "-c", "core.hooksPath=/dev/null", "checkout", originalBranch], {
         stdio: ["ignore", "ignore", "ignore"]
       });
     }
@@ -11632,7 +11540,7 @@ function hasBoundaryWhitespace(path) {
   return path.split("/").some((segment) => segment.trim() !== segment || segment.length === 0);
 }
 function getUnsupportedIndexFlags(root) {
-  const result = spawnSync7("git", ["-C", root, "ls-files", "-v", "-z", "--"], {
+  const result = spawnSync8("git", ["-C", root, "ls-files", "-v", "-z", "--"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11666,13 +11574,13 @@ function isPathAllowedForChild(path, taskId, scopeHint) {
   });
 }
 function getChangedProjectPaths(root) {
-  const tracked = spawnSync7("git", ["-C", root, "diff-index", "--name-only", "-z", "--ignore-submodules=none", "HEAD", "--"], {
+  const tracked = spawnSync8("git", ["-C", root, "diff-index", "--name-only", "-z", "--ignore-submodules=none", "HEAD", "--"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (tracked.status !== 0)
     throw new Error("failed to inspect tracked diff vs HEAD");
-  const untracked = spawnSync7("git", ["-C", root, "ls-files", "--others", "--exclude-standard", "-z", "--"], {
+  const untracked = spawnSync8("git", ["-C", root, "ls-files", "--others", "--exclude-standard", "-z", "--"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11682,7 +11590,7 @@ function getChangedProjectPaths(root) {
   return [...new Set([...splitZ(tracked.stdout), ...splitZ(untracked.stdout)])];
 }
 function getStagedProjectPaths(root) {
-  const staged = spawnSync7("git", ["-C", root, "diff-index", "--cached", "--name-only", "-z", "--ignore-submodules=none", "HEAD", "--"], {
+  const staged = spawnSync8("git", ["-C", root, "diff-index", "--cached", "--name-only", "-z", "--ignore-submodules=none", "HEAD", "--"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11691,13 +11599,13 @@ function getStagedProjectPaths(root) {
   return staged.stdout.split("\x00").filter((p) => p.length > 0);
 }
 function getUnstagedProjectPaths(root) {
-  const diffFiles = spawnSync7("git", ["-C", root, "diff-files", "--name-only", "-z", "--ignore-submodules=none", "--"], {
+  const diffFiles = spawnSync8("git", ["-C", root, "diff-files", "--name-only", "-z", "--ignore-submodules=none", "--"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
   if (diffFiles.status !== 0)
     throw new Error("failed to inspect unstaged tracked changes");
-  const untracked = spawnSync7("git", ["-C", root, "ls-files", "--others", "--exclude-standard", "-z", "--"], {
+  const untracked = spawnSync8("git", ["-C", root, "ls-files", "--others", "--exclude-standard", "-z", "--"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11707,7 +11615,7 @@ function getUnstagedProjectPaths(root) {
   return [...new Set([...splitZ(diffFiles.stdout), ...splitZ(untracked.stdout)])];
 }
 function getCommittedDeltaPaths(root) {
-  const delta = spawnSync7("git", ["-C", root, "diff-tree", "--no-commit-id", "--name-only", "-z", "-r", "HEAD~1", "HEAD"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  const delta = spawnSync8("git", ["-C", root, "diff-tree", "--no-commit-id", "--name-only", "-z", "-r", "HEAD~1", "HEAD"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   if (delta.status !== 0)
     throw new Error("failed to inspect committed tree delta");
   return delta.stdout.split("\x00").filter((p) => p.length > 0);
@@ -11813,7 +11721,7 @@ async function commitBatchChild(input) {
   const goal = typeof intentSnapshot.goal === "string" ? intentSnapshot.goal : "";
   const scopeHint = Array.isArray(intentSnapshot.scope_hint) ? intentSnapshot.scope_hint.filter((s) => typeof s === "string") : [];
   if (expectedBranch !== undefined) {
-    const currentBranchResult = spawnSync7("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
+    const currentBranchResult = spawnSync8("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -11822,7 +11730,7 @@ async function commitBatchChild(input) {
       throw new Error(`batch_head_lineage_broken: current branch ${currentBranch} does not match expected branch ${expectedBranch}`);
     }
   }
-  const currentHeadResult = spawnSync7("git", ["-C", root, "rev-parse", "HEAD"], {
+  const currentHeadResult = spawnSync8("git", ["-C", root, "rev-parse", "HEAD"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11841,7 +11749,7 @@ async function commitBatchChild(input) {
   }
   const pathsToStage = getUnstagedProjectPaths(root);
   if (pathsToStage.length > 0) {
-    const addResult = spawnSync7("git", ["-C", root, "--literal-pathspecs", "add", "-A", "--", ...pathsToStage], {
+    const addResult = spawnSync8("git", ["-C", root, "--literal-pathspecs", "add", "-A", "--", ...pathsToStage], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -11856,7 +11764,7 @@ async function commitBatchChild(input) {
   const staged = getStagedProjectPaths(root);
   const stagedOutside = staged.filter((p) => !isPathAllowedForChild(p, taskId, scopeHint));
   if (stagedOutside.length > 0) {
-    spawnSync7("git", ["-C", root, "reset", "--quiet"], { stdio: ["ignore", "ignore", "ignore"] });
+    spawnSync8("git", ["-C", root, "reset", "--quiet"], { stdio: ["ignore", "ignore", "ignore"] });
     throw new Error("dirty_outside_scope");
   }
   const record = auditPair.record;
@@ -11874,7 +11782,7 @@ async function commitBatchChild(input) {
 
 Immune-Brain-Batch: ${batchId}
 `;
-  const commitResult = spawnSync7("git", ["-C", root, "-c", "core.hooksPath=/dev/null", "commit", "--no-verify", "-F", "-"], {
+  const commitResult = spawnSync8("git", ["-C", root, "-c", "core.hooksPath=/dev/null", "commit", "--no-verify", "-F", "-"], {
     input: commitMessage,
     encoding: "utf8",
     stdio: ["pipe", "pipe", "pipe"],
@@ -11883,7 +11791,7 @@ Immune-Brain-Batch: ${batchId}
   if (commitResult.status !== 0) {
     throw new Error(`commit failed for child ${taskId}: ${commitResult.stderr?.trim() || "git commit failed"}`);
   }
-  const newHeadResult = spawnSync7("git", ["-C", root, "rev-parse", "HEAD"], {
+  const newHeadResult = spawnSync8("git", ["-C", root, "rev-parse", "HEAD"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11891,7 +11799,7 @@ Immune-Brain-Batch: ${batchId}
   if (newHeadResult.status !== 0 || !newHead || newHead === expectedHead) {
     throw new Error("commit_failed");
   }
-  const parentsResult = spawnSync7("git", ["-C", root, "rev-parse", "HEAD^@"], {
+  const parentsResult = spawnSync8("git", ["-C", root, "rev-parse", "HEAD^@"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11924,7 +11832,7 @@ async function lookupBatchCommit(input) {
   let candidates = [];
   let evidenceBacked = false;
   if (evidence && evidence.commit) {
-    const direct = spawnSync7("git", ["-C", root, "log", "-n", "1", `--format=${FORMAT}`, evidence.commit, "--"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const direct = spawnSync8("git", ["-C", root, "log", "-n", "1", `--format=${FORMAT}`, evidence.commit, "--"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
     if (direct.status !== 0) {
       throw new Error(`failed to inspect batch commit for ${taskId}: ${direct.stderr?.trim() || "git log failed"}`);
     }
@@ -11937,7 +11845,7 @@ async function lookupBatchCommit(input) {
     }
   }
   if (!candidates.length) {
-    const result = spawnSync7("git", [
+    const result = spawnSync8("git", [
       "-C",
       root,
       "log",
@@ -11974,7 +11882,7 @@ async function lookupBatchCommit(input) {
     throw new Error(`batch_head_lineage_broken: adopted commit author ${match.authorName} does not match batch authority ${DEFAULT_GIT_ENV.GIT_AUTHOR_NAME}`);
   }
   if (expectedBranch !== undefined) {
-    const currentBranchResult = spawnSync7("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
+    const currentBranchResult = spawnSync8("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -11984,15 +11892,17 @@ async function lookupBatchCommit(input) {
     }
   }
   if (expectedHead !== undefined) {
-    const currentHeadResult = spawnSync7("git", ["-C", root, "rev-parse", "HEAD"], {
+    const currentHeadResult = spawnSync8("git", ["-C", root, "rev-parse", "HEAD"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
     const currentHead = currentHeadResult.stdout.trim();
-    if (currentHead !== commit) {
+    if (currentHead !== commit && spawnSync8("git", ["-C", root, "merge-base", "--is-ancestor", commit, currentHead], {
+      stdio: ["ignore", "ignore", "ignore"]
+    }).status !== 0) {
       throw new Error(`batch_head_lineage_broken: current HEAD ${currentHead} diverged from adopted commit ${commit}`);
     }
-    const parentsResult = spawnSync7("git", ["-C", root, "rev-parse", `${commit}^@`], {
+    const parentsResult = spawnSync8("git", ["-C", root, "rev-parse", `${commit}^@`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -12010,7 +11920,7 @@ async function lookupBatchCommit(input) {
       throw new Error(`batch_head_lineage_broken: adopted commit task lifecycle is not done: ${lifecycle}`);
     }
     const scopeHint = Array.isArray(auditPair.record.intent_snapshot.scope_hint) ? auditPair.record.intent_snapshot.scope_hint.filter((s) => typeof s === "string") : [];
-    const deltaResult = spawnSync7("git", ["-C", root, "diff-tree", "--no-commit-id", "--name-only", "-z", "-r", expectedHead, commit], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const deltaResult = spawnSync8("git", ["-C", root, "diff-tree", "--no-commit-id", "--name-only", "-z", "-r", expectedHead, commit], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
     if (deltaResult.status !== 0) {
       throw new Error("batch_head_lineage_broken: failed to inspect adopted commit delta");
     }
@@ -12049,18 +11959,12 @@ function skipDependents(record, taskId, reason) {
   }
   record.children = record.children.map((child) => skip.has(child.task_id) && child.state === "pending" ? { ...child, state: "skipped_blocked", reason } : child);
 }
-function budgetStopReason(record, now) {
+function budgetStopReason(record) {
   const enrolledCount = record.children.filter((child) => child.state !== "pending" && child.state !== "skipped_blocked").length;
   if (enrolledCount >= record.budget.max_children)
     return `max_children budget exhausted (${record.budget.max_children})`;
-  const deadline = Date.parse(record.budget.deadline_at);
-  if (!Number.isNaN(deadline) && now >= deadline)
-    return `deadline_at reached (${record.budget.deadline_at})`;
   return null;
 }
-function isAuthorizationExpiryError(error) {
-  return error instanceof BatchAuthorizationExpiryError;
-}
 function requireFreshProjection(result, taskId) {
   if (result.error !== null)
     throw new Error(`cannot reconcile Kernel projection for ${taskId}: ${result.error}`);
@@ -12071,7 +11975,7 @@ function nextEnrollableChild(record) {
 }
 var TERMINAL_NEXT_ACTIONS = {
   completed: "The batch settled every enrollable child; review the commits and the tracker.",
-  budget_stopped: "Budget, deadline, or authorization expiry stopped new enrollments; re-confirm to continue under a new authorization.",
+  budget_stopped: "The child budget stopped new enrollments; re-confirm to continue under a new authorization.",
   failed: "A commit or lineage failure stopped the batch; inspect the failing child and the branch state.",
   rejected: "The batch was rejected before any enrollment; correct the stated reason and re-confirm.",
   needs_human: "A parked child needs a human decision; resolve it, then re-confirm to continue.",
@@ -12126,31 +12030,42 @@ function failPersistedLineage(root, existing, message) {
   }
   return writeBatchRunState(root, record);
 }
-function externalHeadDriftMessage(root, record) {
+function reconcileLineage(root, record) {
   if (!existsSync9(join14(root, ".git")))
-    return null;
-  const head = record.commits.length ? record.commits[record.commits.length - 1] : record.base_head;
-  const headCheck = spawnSync8("git", ["-C", root, "rev-parse", "HEAD"], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  if (headCheck.status === 0 && headCheck.stdout.trim() && headCheck.stdout.trim() !== head) {
-    return `batch_head_lineage_broken: current HEAD ${headCheck.stdout.trim()} does not match expected batch head ${head}`;
-  }
-  const branchCheck = spawnSync8("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"]
+    return { record, failure: null };
+  const expected = expectedBatchHead(record);
+  const lineage = classifyBatchLineage({
+    root,
+    branch: record.branch ?? "",
+    expectedHead: expected,
+    childCommits: record.commits,
+    batchId: record.batch_id
   });
-  const currentBranch = branchCheck.stdout.trim();
-  if (branchCheck.status !== 0 || currentBranch !== record.branch) {
-    return `batch_head_lineage_broken: current branch ${currentBranch} does not match expected batch branch ${record.branch}`;
-  }
-  return null;
+  if (lineage.kind === "broken")
+    return { record, failure: lineage.message };
+  if (lineage.kind === "equal")
+    return { record, failure: null };
+  return {
+    record: writeBatchRunState(root, {
+      ...record,
+      adopted_heads: [...record.adopted_heads ?? [], { from: expected, to: lineage.head }]
+    }),
+    failure: null
+  };
 }
 async function validatePersistedRun(input, record) {
   if (!record.commits.length && record.children[0]?.state === "settled" && existsSync9(join14(input.root, ".git"))) {
-    const head = spawnSync8("git", ["-C", input.root, "rev-parse", "HEAD"], { encoding: "utf8" });
-    if (head.status !== 0 || head.stdout.trim() !== record.base_head && !ownUnpersistedBatchHead(input.root, record, head.stdout.trim()))
+    const head = spawnSync9("git", ["-C", input.root, "rev-parse", "HEAD"], { encoding: "utf8" });
+    const live = head.stdout.trim();
+    const expected = expectedBatchHead(record);
+    const adoptable = () => classifyBatchLineage({
+      root: input.root,
+      branch: record.branch ?? "",
+      expectedHead: expected,
+      childCommits: record.commits,
+      batchId: record.batch_id
+    }).kind === "fast_forward";
+    if (head.status !== 0 || live !== expected && !ownUnpersistedBatchHead(input.root, record, live) && !adoptable())
       throw new Error("first unpersisted batch commit provenance is invalid");
   }
   const plan = input.registry.children(input.capability);
@@ -12174,7 +12089,7 @@ async function validatePersistedRun(input, record) {
     });
     if (!evidence || evidence.commit !== child.commit) {
       if (evidence === null && typeof child.commit === "string" && child.commit.length > 0 && existsSync9(join14(input.root, ".git"))) {
-        const reach = spawnSync8("git", ["-C", input.root, "merge-base", "--is-ancestor", child.commit, "HEAD"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+        const reach = spawnSync9("git", ["-C", input.root, "merge-base", "--is-ancestor", child.commit, "HEAD"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
         if (reach.status !== 0) {
           throw new Error(`batch_head_lineage_broken: recorded commit ${child.commit} for ${child.task_id} is no longer reachable from HEAD`);
         }
@@ -12198,8 +12113,7 @@ function validateRunAuthorization(input, existing) {
       plan_digest: existing?.plan_digest ?? input.plan_digest,
       base_head: existing?.base_head ?? input.base_head,
       initiative_slug: existing?.initiative_slug ?? input.initiative_slug,
-      budget: input.budget,
-      expires_at: input.authorization_expires_at
+      budget: input.budget
     }
   });
   if (authorized.issued_at !== input.confirmation_time || existing && Date.parse(authorized.issued_at) <= Date.parse(existing.confirmation_time))
@@ -12221,7 +12135,6 @@ function applyPlanReconfirmation(input, existing) {
     ...existing,
     plan_digest: input.plan_digest,
     confirmation_time: input.confirmation_time,
-    authorization_expires_at: input.authorization_expires_at,
     budget: input.budget
   };
   if (!existing.branch || input.batch_id !== existing.batch_id || input.initiative_slug !== existing.initiative_slug || input.base_head !== existing.base_head || input.budget.max_children !== existing.budget.max_children || input.budget.qa_failure_limit !== existing.budget.qa_failure_limit)
@@ -12299,8 +12212,7 @@ async function startBatchLocked(input) {
   if (existing?.batch_state === "needs_human") {
     const priorConfirmation = Date.parse(existing.confirmation_time);
     const nextConfirmation = Date.parse(input.confirmation_time);
-    const nextExpiry = Date.parse(input.authorization_expires_at);
-    const freshAuthorization = Number.isFinite(nextConfirmation) && nextConfirmation > priorConfirmation && Number.isFinite(nextExpiry) && nextExpiry > Date.now();
+    const freshAuthorization = Number.isFinite(nextConfirmation) && nextConfirmation > priorConfirmation;
     if (!freshAuthorization && !reconfirmed) {
       return finalize(input.root, existing, "the parked batch requires a fresh literal-user confirmation", "Resolve the parked child, then re-confirm the batch to continue.");
     }
@@ -12327,7 +12239,6 @@ async function startBatchLocked(input) {
       existing = writeBatchRunState(input.root, {
         ...reparked,
         confirmation_time: input.confirmation_time,
-        authorization_expires_at: input.authorization_expires_at,
         budget: input.budget,
         batch_state: "needs_human"
       });
@@ -12337,28 +12248,11 @@ async function startBatchLocked(input) {
     existing = writeBatchRunState(input.root, {
       ...existing,
       confirmation_time: input.confirmation_time,
-      authorization_expires_at: input.authorization_expires_at,
       budget: input.budget,
       batch_state: "running",
       children: resumedChildren
     });
   }
-  if (existing?.batch_state === "running") {
-    const nextConfirmation = Date.parse(input.confirmation_time);
-    const nextExpiry = Date.parse(input.authorization_expires_at);
-    const priorConfirmation = Date.parse(existing.confirmation_time);
-    const persistedExpiry = Date.parse(existing.authorization_expires_at);
-    const renewedAuthorization = Number.isFinite(nextConfirmation) && nextConfirmation > priorConfirmation && Number.isFinite(nextExpiry) && nextExpiry > Date.now() && nextExpiry > persistedExpiry;
-    if (renewedAuthorization) {
-      validateRunAuthorization(input, existing);
-      existing = writeBatchRunState(input.root, {
-        ...existing,
-        confirmation_time: input.confirmation_time,
-        authorization_expires_at: input.authorization_expires_at,
-        budget: input.budget
-      });
-    }
-  }
   if (existing) {
     const interruptedChild = existing.children.find((child) => child.state === "enrolled" || child.state === "settled");
     if (interruptedChild) {
@@ -12396,7 +12290,6 @@ async function startBatchLocked(input) {
     plan_digest: input.plan_digest,
     base_head: input.base_head,
     confirmation_time: input.confirmation_time,
-    authorization_expires_at: input.authorization_expires_at,
     budget: input.budget,
     now: input.now
   });
@@ -12407,13 +12300,14 @@ async function startBatchLocked(input) {
     record.batch_state = "running";
     persist();
   }
-  let head = record.commits.length ? record.commits[record.commits.length - 1] : record.base_head;
-  const driftMessage = externalHeadDriftMessage(input.root, record);
-  if (driftMessage) {
+  const lineage = reconcileLineage(input.root, record);
+  record = lineage.record;
+  if (lineage.failure) {
     record.batch_state = "failed";
     persist();
-    return finalize(input.root, record, driftMessage, "");
+    return finalize(input.root, record, lineage.failure, "");
   }
+  let head = expectedBatchHead(record);
   while (record.batch_state === "running") {
     const child = nextEnrollableChild(record);
     if (!child) {
@@ -12440,8 +12334,7 @@ async function startBatchLocked(input) {
       record.children = record.children.map((c) => c.task_id === child.task_id ? { ...c, state: "enrolled", reason: "adopted existing batch claim after interruption" } : c);
       persist();
     } else {
-      const now = Date.now();
-      if (now >= Date.parse(record.authorization_expires_at) || budgetStopReason(record, now)) {
+      if (budgetStopReason(record)) {
         record.batch_state = record.children.some((c) => c.state === "needs_human" || c.state === "skipped_blocked") ? "needs_human" : "budget_stopped";
         persist();
         break;
@@ -12456,8 +12349,7 @@ async function startBatchLocked(input) {
             plan_digest: record.plan_digest,
             base_head: record.base_head,
             initiative_slug: record.initiative_slug,
-            budget: record.budget,
-            expires_at: record.authorization_expires_at
+            budget: record.budget
           }
         });
         for (const committed of record.children) {
@@ -12477,12 +12369,6 @@ async function startBatchLocked(input) {
         persist();
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        if (isAuthorizationExpiryError(error)) {
-          record.children = record.children.map((c) => c.task_id === child.task_id ? { ...c, state: "pending", reason: message } : c);
-          record.batch_state = "budget_stopped";
-          persist();
-          break;
-        }
         if (isLineageBreakError(message)) {
           record.children = record.children.map((c) => c.task_id === child.task_id ? { ...c, state: "needs_human", reason: message } : c);
           skipDependents(record, child.task_id, `dependency ${child.task_id} parked`);
@@ -12505,7 +12391,7 @@ async function startBatchLocked(input) {
 function stopReasonFor(record) {
   switch (record.batch_state) {
     case "budget_stopped":
-      return budgetStopReason(record, Date.now()) ?? "budget, deadline, or authorization expiry stopped new enrollments";
+      return budgetStopReason(record) ?? "the child budget stopped new enrollments";
     case "failed": {
       const failedChild = record.children.find((c) => c.state === "needs_human" && c.reason);
       return failedChild?.reason ?? "a commit or lineage failure stopped the batch";
@@ -12540,10 +12426,11 @@ async function resumeBatch(input, projection) {
   const driven = existing.children.find((child) => child.state === "enrolled" || child.state === "settled");
   if (driven) {
     if (driven.state === "enrolled") {
-      const drivenDrift = externalHeadDriftMessage(input.root, existing);
-      if (drivenDrift) {
-        const failed = failPersistedLineage(input.root, existing, drivenDrift);
-        return finalize(input.root, failed, drivenDrift, "");
+      const drivenLineage = reconcileLineage(input.root, existing);
+      existing = drivenLineage.record;
+      if (drivenLineage.failure) {
+        const failed = failPersistedLineage(input.root, existing, drivenLineage.failure);
+        return finalize(input.root, failed, drivenLineage.failure, "");
       }
       const fresh = requireFreshProjection(await input.kernel.projectTask(input.root, driven.task_id), driven.task_id);
       const holdsClaim = fresh.claim !== null && fresh.claim.task_id === driven.task_id && input.kernel.ownsTaskClaim(driven.task_id);
@@ -12622,7 +12509,7 @@ async function driveInterruptedChild(input, child) {
     record.batch_state = "running";
     persist();
   }
-  let head = record.commits.length ? record.commits[record.commits.length - 1] : record.base_head;
+  let head = expectedBatchHead(record);
   while (child.state === "enrolled" || child.state === "settled") {
     if (child.state === "settled") {
       let existing = null;
@@ -12643,6 +12530,10 @@ async function driveInterruptedChild(input, child) {
         persist();
         throw new BatchCommitAbortError(`commit lookup failed: ${message}`);
       }
+      if (!existing) {
+        record = reconcileLineage(input.root, record).record;
+        head = expectedBatchHead(record);
+      }
       const planChild = input.children.find((c) => c.task_id === child.task_id);
       const intentPath = planChild?.intent_path ?? undefined;
       const doCommit = async () => {
@@ -12938,7 +12829,6 @@ async function mintCapability(registry, input) {
     diff_hash: input.diff_hash,
     actor_id: input.actor_id,
     confirmation_ref: input.confirmation_ref,
-    expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
     findings_digest: input.action_kind === "request_rework" ? findingsDigestV2(input.findings) : null
   };
   return registry.issue(binding);
@@ -13075,7 +12965,6 @@ class ClaudeRuntime {
         preparation_digest: preparation.digest,
         actor_id: LITERAL_USER_ACTOR_ID,
         confirmation_ref: gate.confirmation_ref,
-        expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
         nonce
       };
       const capability = this.enrollmentRegistry.issue(binding);
@@ -13099,11 +12988,41 @@ class ClaudeRuntime {
       throw error;
     }
   }
-  async advance(taskId, signal) {
-    return this.withTerminalTracker(taskId, await this.coordinator.advance(taskId, { cwd: this.cwd }, signal));
+  async advance(taskId, signal, meta) {
+    return this.closeOutBatchChild(taskId, await this.withTerminalTracker(taskId, await this.coordinator.advance(taskId, { cwd: this.cwd }, signal)), meta);
+  }
+  async submitReview(taskId, verdictInput, meta) {
+    return this.closeOutBatchChild(taskId, await this.withTerminalTracker(taskId, await submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput)), meta);
   }
-  async submitReview(taskId, verdictInput) {
-    return this.withTerminalTracker(taskId, await submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput));
+  async closeOutBatchChild(taskId, result, meta) {
+    if (!meta || result === null || typeof result !== "object")
+      return result;
+    const lifecycle = result.record?.lifecycle;
+    if (result.state !== "completed" && lifecycle !== "done")
+      return result;
+    let slug;
+    try {
+      slug = findResumableBatchSlugForTask(this.cwd, taskId);
+    } catch {
+      return result;
+    }
+    if (!slug)
+      return result;
+    try {
+      if (existsSync10(join15(this.cwd, ".imm", "audit", taskId)))
+        execFileSync7("git", ["-C", this.cwd, "add", "--", `.imm/audit/${taskId}`], { stdio: "ignore" });
+      const batch = await this.startUnattendedBatch(slug, meta, { reuseOnly: true });
+      return { ...result, batch };
+    } catch (error) {
+      return {
+        ...result,
+        batch: {
+          state: "rejected",
+          reason: `batch continuation failed: ${error instanceof Error ? error.message : String(error)}`,
+          recovery_action: "call start_unattended_batch with the same Initiative to continue the batch"
+        }
+      };
+    }
   }
   async withTerminalTracker(taskId, result) {
     if (result === null || typeof result !== "object")
@@ -13405,15 +13324,16 @@ class ClaudeRuntime {
       throw error;
     }
   }
-  async startUnattendedBatch(initiativeSlug, meta) {
+  async startUnattendedBatch(initiativeSlug, meta, options = {}) {
     throwIfCancelled(meta.signal);
+    const reuseOnly = options.reuseOnly === true;
     const probe = probeHost(this.env, process.platform, this.hostVersion);
     if (!probe.ok)
       throw new NativeAuthorityError("unsupported_host", probe.reason);
     const interactive = meta.interactive ?? this.interactive;
-    if (!interactive)
+    if (!reuseOnly && !interactive)
       throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
-    if (!this.requestConfirmation)
+    if (!reuseOnly && !this.requestConfirmation)
       throw new NativeAuthorityError("interaction_not_opened", batchReason("confirmation_port_unavailable").reason);
     let now = new Date().toISOString();
     const preflight = await projectBatchPreflight({
@@ -13443,7 +13363,15 @@ class ClaudeRuntime {
       readInitiative: this.readInitiative ?? observeGithubInitiative,
       nonce: enrollmentNonce(),
       gate: async (facts) => {
-        const deadline = startConfirmationDeadline({ env: this.env, signal: meta.signal });
+        if (reuseOnly)
+          return {
+            kind: "host_rejection",
+            value: {
+              state: "blocked",
+              reason: `batch authorization cannot be reused (${facts.reuse_blockers.join(", ")})`,
+              recovery_action: "call start_unattended_batch with the same Initiative to confirm a fresh authorization"
+            }
+          };
         let confirmationResult;
         try {
           confirmationResult = await this.requestConfirmation({
@@ -13465,17 +13393,14 @@ class ClaudeRuntime {
                 reason: child.reason
               })),
               budget: facts.budget,
-              expires_at: facts.expires_at,
               ...facts.reuse_blockers.length > 0 ? {
                 re_confirmation_required: facts.reuse_blockers,
                 recovery: "confirm to issue a fresh authorization bound to the current plan and HEAD"
               } : {}
             },
-            signal: deadline.signal
+            signal: meta.signal
           });
         } catch (err) {
-          if (deadline.timedOut())
-            return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
           if (meta.signal?.aborted)
             return { kind: "host_rejection", value: batchReason("cancelled_before_execution") };
           if (err instanceof NativeAuthorityError) {
@@ -13496,11 +13421,7 @@ class ClaudeRuntime {
             kind: "host_rejection",
             value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err))
           };
-        } finally {
-          deadline.clear();
         }
-        if (deadline.timedOut())
-          return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
         if (confirmationResult.decision === "cancel" && meta.signal?.aborted)
           return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
         if (meta.signal?.aborted)
@@ -13526,12 +13447,10 @@ class ClaudeRuntime {
       return authorization.value;
     if (authorization.outcome === "rejected")
       return authorization.rejection;
-    const { binding, batch_id: batchId, expires_at: expiresAt } = authorization;
+    const { binding, batch_id: batchId } = authorization;
     if (meta.signal?.aborted)
       return batchReason("cancelled_before_execution");
     now = new Date().toISOString();
-    if (Date.parse(expiresAt) <= Date.parse(now))
-      return batchReason("confirmation_failed", "confirmed batch deadline expired before authorization issuance");
     const capability = this.batchRegistry.issue(binding, recoveryChildren, now);
     const basePort = this.createBatchKernelPort(this.batchRegistry, capability, binding);
     const kernelPort = {
@@ -13553,7 +13472,6 @@ class ClaudeRuntime {
       plan_digest: planDigest,
       base_head: binding.base_head,
       confirmation_time: now,
-      authorization_expires_at: expiresAt,
       budget,
       now,
       kernel: kernelPort,
@@ -13764,11 +13682,11 @@ function createMcpRuntime(options = {}) {
       if (name === "enroll")
         return runtime.enroll(taskId, toolMeta);
       if (name === "advance_assurance")
-        return runtime.advance(taskId, toolMeta.signal);
+        return runtime.advance(taskId, toolMeta.signal, toolMeta);
       if (name === "submit_review") {
         if (!Object.hasOwn(args, "verdict"))
           throw new Error("verdict is required");
-        return runtime.submitReview(taskId, args.verdict);
+        return runtime.submitReview(taskId, args.verdict, toolMeta);
       }
       if (name === "revise_intent") {
         if (!Object.hasOwn(args, "next_intent"))
@@ -13964,8 +13882,7 @@ ${b.children.map((c) => `  - ${c.task_id} (${c.slice_id}) [risk: ${c.risk ?? "un
       b?.excluded && b.excluded.length > 0 ? `Excluded children (${b.excluded.length}):
 ${b.excluded.map((e) => `  - ${e.task_id} (${e.slice_id}): ${e.reason}`).join(`
 `)}` : null,
-      b?.budget ? `Budget: max_children=${b.budget.max_children}, deadline_at=${b.budget.deadline_at}, qa_failure_limit=${b.budget.qa_failure_limit}` : null,
-      b?.expires_at ? `Expires at: ${b.expires_at}` : null
+      b?.budget ? `Budget: max_children=${b.budget.max_children}, qa_failure_limit=${b.budget.qa_failure_limit}` : null
     ].filter(Boolean);
     return {
       mode: "form",