immune-brain 4.5.0 → 4.6.0

package/plugins/immune-brain/runtime/unattended/batch_runner.ts

@@ -6,7 +6,6 @@ import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import {
-	BatchAuthorizationExpiryError,
 	type BatchAuthorityRegistry,
 	type ValidatedBatchAuthorization,
 	computeBatchPlanDigest,
@@ -31,6 +30,7 @@ import {
 	commitBatchChild,
 	lookupBatchCommit,
 } from "./batch_git";
+import { classifyBatchLineage, expectedBatchHead } from "./batch_preflight";
 import {
 	type BatchRunStateRecord,
 	type BatchChildRun,
@@ -92,15 +92,15 @@ export interface BatchRunnerKernelPort {
 	 * is held under this batch's derived capability (consumed child slot). */
 	ownsTaskClaim(taskId: string): boolean;
 	/** review-8(4th rework): Kernel-side proof that a replacement parked-batch
-	 * authorization is genuine, unexpired, and bound to this exact batch_id,
+	 * authorization is genuine and bound to this exact batch_id,
 	 * plan_digest, and base_head, validated against the Kernel's authoritative
-	 * binding state. Throws on fabrication, mismatch, or expiry; the driver
+	 * binding state. Throws on fabrication or mismatch; the driver
 	 * must call this before accepting a parked-batch resume. */
 	validateBatchAuthorization(input: {
 		registry: BatchAuthorityRegistry;
 		capability: object;
 		binding: Pick<ValidatedBatchAuthorization,
-			"batch_id" | "plan_digest" | "base_head" | "initiative_slug" | "budget" | "expires_at">;
+			"batch_id" | "plan_digest" | "base_head" | "initiative_slug" | "budget">;
 	}): ValidatedBatchAuthorization;
 }
 
@@ -123,8 +123,7 @@ export interface StartBatchInput {
 	plan_digest: string;
 	base_head: string;
 	confirmation_time: string;
-	authorization_expires_at: string;
-	budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
+	budget: { max_children: number; qa_failure_limit: number };
 	now: string;
 	kernel: BatchRunnerKernelPort;
 	git?: BatchRunnerGitPort;
@@ -155,7 +154,7 @@ function skipDependents(record: BatchRunStateRecord, taskId: string, reason: str
 	);
 }
 
-function budgetStopReason(record: BatchRunStateRecord, now: number): string | null {
+function budgetStopReason(record: BatchRunStateRecord): string | null {
 	// review-3: budget counts enrollments consumed (children that left
 	// pending), not commits, so parked children still consume authorization.
 	const enrolledCount = record.children.filter(
@@ -163,22 +162,9 @@ function budgetStopReason(record: BatchRunStateRecord, now: number): string | nu
 	).length;
 	if (enrolledCount >= record.budget.max_children)
 		return `max_children budget exhausted (${record.budget.max_children})`;
-	const deadline = Date.parse(record.budget.deadline_at);
-	if (!Number.isNaN(deadline) && now >= deadline)
-		return `deadline_at reached (${record.budget.deadline_at})`;
 	return null;
 }
 
-/** review-7(3rd rework): the typed expiry marker now lives at the Kernel
- * boundary (kernel/batch_authority.ts) so a real enrollment-time expiry is
- * structurally classifiable as an intentional budget stop; re-exported here
- * for driver API compatibility. */
-export { BatchAuthorizationExpiryError };
-
-function isAuthorizationExpiryError(error: unknown): boolean {
-	return error instanceof BatchAuthorizationExpiryError;
-}
-
 function requireFreshProjection<T extends AssuranceProjectionResult>(
 	result: T,
 	taskId: string,
@@ -203,7 +189,7 @@ function nextEnrollableChild(record: BatchRunStateRecord): BatchChildRun | null
 
 const TERMINAL_NEXT_ACTIONS: Record<string, string> = {
 	completed: "The batch settled every enrollable child; review the commits and the tracker.",
-	budget_stopped: "Budget, deadline, or authorization expiry stopped new enrollments; re-confirm to continue under a new authorization.",
+	budget_stopped: "The child budget stopped new enrollments; re-confirm to continue under a new authorization.",
 	failed: "A commit or lineage failure stopped the batch; inspect the failing child and the branch state.",
 	rejected: "The batch was rejected before any enrollment; correct the stated reason and re-confirm.",
 	needs_human: "A parked child needs a human decision; resolve it, then re-confirm to continue.",
@@ -298,35 +284,47 @@ function failPersistedLineage(
 	return writeBatchRunState(root, record);
 }
 
-/** review round 11: detect external HEAD movement or branch switch against a
- * persisted record's expected lineage; returns the failure message or null. */
-function externalHeadDriftMessage(root: string, record: BatchRunStateRecord): string | null {
-	if (!existsSync(join(root, ".git"))) return null;
-	const head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
-	const headCheck = spawnSync("git", ["-C", root, "rev-parse", "HEAD"], {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
-	});
-	if (headCheck.status === 0 && headCheck.stdout.trim() && headCheck.stdout.trim() !== head) {
-		return `batch_head_lineage_broken: current HEAD ${headCheck.stdout.trim()} does not match expected batch head ${head}`;
-	}
-	const branchCheck = spawnSync("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
+/** A HEAD that fast-forwards on the batch branch is the user's own work: adopt
+ * it as the new expected head and record it. Any other movement is the fatal
+ * lineage break, returned as the failure message with the record unchanged. */
+function reconcileLineage(
+	root: string,
+	record: BatchRunStateRecord,
+): { record: BatchRunStateRecord; failure: string | null } {
+	if (!existsSync(join(root, ".git"))) return { record, failure: null };
+	const expected = expectedBatchHead(record);
+	const lineage = classifyBatchLineage({
+		root,
+		branch: record.branch ?? "",
+		expectedHead: expected,
+		childCommits: record.commits,
+		batchId: record.batch_id,
 	});
-	const currentBranch = branchCheck.stdout.trim();
-	if (branchCheck.status !== 0 || currentBranch !== record.branch) {
-		return `batch_head_lineage_broken: current branch ${currentBranch} does not match expected batch branch ${record.branch}`;
-	}
-	return null;
+	if (lineage.kind === "broken") return { record, failure: lineage.message };
+	if (lineage.kind === "equal") return { record, failure: null };
+	return {
+		record: writeBatchRunState(root, {
+			...record,
+			adopted_heads: [...(record.adopted_heads ?? []), { from: expected, to: lineage.head }],
+		}),
+		failure: null,
+	};
 }
 
 async function validatePersistedRun(input: StartBatchInput, record: BatchRunStateRecord): Promise<void> {
 	if (!record.commits.length && record.children[0]?.state === "settled" && existsSync(join(input.root, ".git"))) {
 		const head = spawnSync("git", ["-C", input.root, "rev-parse", "HEAD"], { encoding: "utf8" });
-		if (head.status !== 0 || (head.stdout.trim() !== record.base_head && !ownUnpersistedBatchHead(input.root, record, head.stdout.trim())))
+		const live = head.stdout.trim();
+		const expected = expectedBatchHead(record);
+		const adoptable = () =>
+			classifyBatchLineage({
+				root: input.root,
+				branch: record.branch ?? "",
+				expectedHead: expected,
+				childCommits: record.commits,
+				batchId: record.batch_id,
+			}).kind === "fast_forward";
+		if (head.status !== 0 || (live !== expected && !ownUnpersistedBatchHead(input.root, record, live) && !adoptable()))
 			throw new Error("first unpersisted batch commit provenance is invalid");
 	}
 	const plan = input.registry.children(input.capability);
@@ -401,7 +399,6 @@ function validateRunAuthorization(input: StartBatchInput, existing: BatchRunStat
 			base_head: existing?.base_head ?? input.base_head,
 			initiative_slug: existing?.initiative_slug ?? input.initiative_slug,
 			budget: input.budget,
-			expires_at: input.authorization_expires_at,
 		},
 	});
 	if (authorized.issued_at !== input.confirmation_time ||
@@ -422,7 +419,7 @@ function validateRunAuthorization(input: StartBatchInput, existing: BatchRunStat
 function applyPlanReconfirmation(input: StartBatchInput, existing: BatchRunStateRecord): BatchRunStateRecord {
 	if (existing.plan_digest === input.plan_digest) return existing;
 	const next = { ...existing, plan_digest: input.plan_digest, confirmation_time: input.confirmation_time,
-		authorization_expires_at: input.authorization_expires_at, budget: input.budget };
+		budget: input.budget };
 	if (!existing.branch || input.batch_id !== existing.batch_id || input.initiative_slug !== existing.initiative_slug || input.base_head !== existing.base_head ||
 		input.budget.max_children !== existing.budget.max_children || input.budget.qa_failure_limit !== existing.budget.qa_failure_limit)
 		throw new Error("plan_digest mismatch: reconfirmation binding changed");
@@ -516,12 +513,9 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 	if (existing?.batch_state === "needs_human") {
 		const priorConfirmation = Date.parse(existing.confirmation_time);
 		const nextConfirmation = Date.parse(input.confirmation_time);
-		const nextExpiry = Date.parse(input.authorization_expires_at);
 		const freshAuthorization =
 			Number.isFinite(nextConfirmation) &&
-			nextConfirmation > priorConfirmation &&
-			Number.isFinite(nextExpiry) &&
-			nextExpiry > Date.now();
+			nextConfirmation > priorConfirmation;
 		if (!freshAuthorization && !reconfirmed) {
 			return finalize(
 				input.root,
@@ -573,7 +567,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			existing = writeBatchRunState(input.root, {
 				...reparked,
 				confirmation_time: input.confirmation_time,
-				authorization_expires_at: input.authorization_expires_at,
 				budget: input.budget,
 				batch_state: "needs_human",
 			});
@@ -592,42 +585,12 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 		existing = writeBatchRunState(input.root, {
 			...existing,
 			confirmation_time: input.confirmation_time,
-			authorization_expires_at: input.authorization_expires_at,
 			budget: input.budget,
 			batch_state: "running",
 			children: resumedChildren,
 		});
 	}
 
-	// A running batch can outlive its authorization while it waits on a child's
-	// reserved foreground Review. The driver owns every batch state transition,
-	// so the renewal the Host bound into the capability must be adopted here;
-	// otherwise the record keeps the expired stamp and the next child enrollment
-	// stops the batch as budget_stopped even though the literal user just
-	// re-confirmed it. Renewal requires the same proof the parked path requires:
-	// a strictly newer literal-user confirmation and a later, still-valid expiry.
-	if (existing?.batch_state === "running") {
-		const nextConfirmation = Date.parse(input.confirmation_time);
-		const nextExpiry = Date.parse(input.authorization_expires_at);
-		const priorConfirmation = Date.parse(existing.confirmation_time);
-		const persistedExpiry = Date.parse(existing.authorization_expires_at);
-		const renewedAuthorization =
-			Number.isFinite(nextConfirmation) &&
-			nextConfirmation > priorConfirmation &&
-			Number.isFinite(nextExpiry) &&
-			nextExpiry > Date.now() &&
-			nextExpiry > persistedExpiry;
-		if (renewedAuthorization) {
-			validateRunAuthorization(input, existing);
-			existing = writeBatchRunState(input.root, {
-				...existing,
-				confirmation_time: input.confirmation_time,
-				authorization_expires_at: input.authorization_expires_at,
-				budget: input.budget,
-			});
-		}
-	}
-
 	// review-2(6th round): an enrolled or settled child from an interrupted
 	// run must be driven to its own terminal settlement and commit before any
 	// new child is selected, or startBatch would double-claim the task or
@@ -693,7 +656,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			plan_digest: input.plan_digest,
 			base_head: input.base_head,
 			confirmation_time: input.confirmation_time,
-			authorization_expires_at: input.authorization_expires_at,
 			budget: input.budget,
 			now: input.now,
 		});
@@ -707,17 +669,15 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 		persist();
 	}
 
-	let head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
-
 	// Validate current Git HEAD and branch against the expected head/branch before continuing (review rounds 7+11)
-	const driftMessage = externalHeadDriftMessage(input.root, record);
-	if (driftMessage) {
+	const lineage = reconcileLineage(input.root, record);
+	record = lineage.record;
+	if (lineage.failure) {
 		record.batch_state = "failed";
 		persist();
-		return finalize(input.root, record, driftMessage, "");
+		return finalize(input.root, record, lineage.failure, "");
 	}
+	let head = expectedBatchHead(record);
 
 	while (record.batch_state === "running") {
 		const child = nextEnrollableChild(record);
@@ -780,9 +740,8 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			);
 			persist();
 		} else {
-		// Re-read the clock after projection; an adopted claim is not a new enrollment.
-		const now = Date.now();
-		if (now >= Date.parse(record.authorization_expires_at) || budgetStopReason(record, now)) {
+		// An adopted claim is not a new enrollment.
+		if (budgetStopReason(record)) {
 			record.batch_state = record.children.some(
 				(c) => c.state === "needs_human" || c.state === "skipped_blocked",
 			) ? "needs_human" : "budget_stopped";
@@ -799,7 +758,7 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 				binding: {
 					batch_id: record.batch_id, plan_digest: record.plan_digest,
 					base_head: record.base_head, initiative_slug: record.initiative_slug,
-					budget: record.budget, expires_at: record.authorization_expires_at,
+					budget: record.budget,
 				},
 			});
 			for (const committed of record.children) {
@@ -821,17 +780,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			persist();
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			// Only a typed BatchAuthorizationExpiryError is an intentional
-			// budget stop; free-form message matching misclassified
-			// infrastructure and validation failures as intentional stops.
-			if (isAuthorizationExpiryError(error)) {
-				record.children = record.children.map((c) =>
-					c.task_id === child.task_id ? { ...c, state: "pending", reason: message } : c,
-				);
-				record.batch_state = "budget_stopped";
-				persist();
-				break;
-			}
 			// review round 10: external HEAD movement after the pre-loop check
 			// (including between children) fails the batch, it never parks.
 			if (isLineageBreakError(message)) {
@@ -869,8 +817,8 @@ function stopReasonFor(record: BatchRunStateRecord): string | null {
 	switch (record.batch_state) {
 		case "budget_stopped":
 			return (
-				budgetStopReason(record, Date.now()) ??
-				"budget, deadline, or authorization expiry stopped new enrollments"
+				budgetStopReason(record) ??
+				"the child budget stopped new enrollments"
 			);
 		case "failed": {
 			const failedChild = record.children.find((c) => c.state === "needs_human" && c.reason);
@@ -888,10 +836,9 @@ function stopReasonFor(record: BatchRunStateRecord): string | null {
 /**
  * review-1: resume the interrupted child first. A persisted enrolled child
  * is driven through the Kernel obligation surface to its own terminal
- * settlement and commit before any new enrollment or expiry check, so an
- * interrupted run can never falsely complete or enroll a sibling while a
- * child claim is still open. Never replays a committed mutation; refuses an
- * expired authorization by requiring a new literal-user confirmation.
+ * settlement and commit before any new enrollment, so an interrupted run can
+ * never falsely complete or enroll a sibling while a child claim is still
+ * open. Never replays a committed mutation.
  */
 export async function resumeBatch(
 	input: StartBatchInput,
@@ -915,8 +862,8 @@ export async function resumeBatch(
 		return replayTerminal(input.root, existing);
 
 	// An enrolled-but-unsettled child must reach its own Kernel terminal
-	// settlement before anything else, even under an expired authorization:
-	// its claim is already held and the Kernel owns its remaining obligations.
+	// settlement before anything else: its claim is already held and the
+	// Kernel owns its remaining obligations.
 	// review-1(2nd round): an `enrolled` child is verified against a fresh
 	// Kernel projection; a projection that finds no active claim means the
 	// persisted `enrolled` flag predates a successful enrollment, so the child
@@ -933,10 +880,11 @@ export async function resumeBatch(
 			// defers to driveInterruptedChild's lookupBatchCommit verification,
 			// which adopts a verified own commit (crash before committed-persist)
 			// instead of misjudging it as external drift.
-			const drivenDrift = externalHeadDriftMessage(input.root, existing);
-			if (drivenDrift) {
-				const failed = failPersistedLineage(input.root, existing, drivenDrift);
-				return finalize(input.root, failed, drivenDrift, "");
+			const drivenLineage = reconcileLineage(input.root, existing);
+			existing = drivenLineage.record;
+			if (drivenLineage.failure) {
+				const failed = failPersistedLineage(input.root, existing, drivenLineage.failure);
+				return finalize(input.root, failed, drivenLineage.failure, "");
 			}
 			const fresh = requireFreshProjection(
 				await input.kernel.projectTask(input.root, driven.task_id),
@@ -1067,9 +1015,7 @@ async function driveInterruptedChild(
 		record.batch_state = "running";
 		persist();
 	}
-	let head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
+	let head = expectedBatchHead(record);
 	while (child.state === "enrolled" || child.state === "settled") {
 		if (child.state === "settled") {
 			// review-2(2nd round): a persisted settled child must not replay
@@ -1120,6 +1066,13 @@ async function driveInterruptedChild(
 				persist();
 				throw new BatchCommitAbortError(`commit lookup failed: ${message}`);
 			}
+			if (!existing) {
+				// No own commit exists yet: a fast-forward since settlement is the
+				// user's work. Adopt it so this child's commit parents on it; a broken
+				// lineage is left for commitChild to refuse with its own message.
+				record = reconcileLineage(input.root, record).record;
+				head = expectedBatchHead(record);
+			}
 			const planChild = input.children.find((c) => c.task_id === child.task_id);
 			const intentPath = planChild?.intent_path ?? undefined;
 			const doCommit = async () => {

package/plugins/immune-brain/runtime/unattended/batch_state.ts

@@ -45,11 +45,8 @@ export interface BatchRunStateRecord {
 	branch?: string;
 	/** Timestamp of the literal-user batch confirmation. */
 	confirmation_time: string;
-	/** Authorization expiry from the batch capability binding. */
-	authorization_expires_at: string;
 	budget: {
 		max_children: number;
-		deadline_at: string;
 		qa_failure_limit: number;
 	};
 	batch_state: BatchRunState;
@@ -58,6 +55,11 @@ export interface BatchRunStateRecord {
 	consecutive_qa_failures: number;
 	/** Commit heads produced by this batch, in child order. */
 	commits: string[];
+	/**
+	 * Fast-forward commits the user made on the batch branch, adopted as the new
+	 * expected head. Never attributed to a child and never rewritten.
+	 */
+	adopted_heads?: Array<{ from: string; to: string }>;
 	created_at: string;
 	updated_at: string;
 }
@@ -101,8 +103,19 @@ function statePath(batchId: string): string {
 	return join(".imm", "state", "batches", `${batchId}.json`);
 }
 
+/**
+ * A record persisted while batch authorization still carried a clock holds
+ * `authorization_expires_at` and `budget.deadline_at`. They are ignored on read
+ * and never written back.
+ */
+function withoutRetiredClock(record: BatchRunStateRecord): BatchRunStateRecord {
+	const { authorization_expires_at: _expiry, ...rest } = record as BatchRunStateRecord & { authorization_expires_at?: unknown };
+	const { deadline_at: _deadline, ...budget } = rest.budget as BatchRunStateRecord["budget"] & { deadline_at?: unknown };
+	return { ...rest, budget };
+}
+
 function canonicalBytes(record: BatchRunStateRecord): string {
-	return `${JSON.stringify(record, null, 2)}\n`;
+	return `${JSON.stringify(withoutRetiredClock(record), null, 2)}\n`;
 }
 
 function validateRecordShape(value: unknown, batchId: string): asserts value is BatchRunStateRecord {
@@ -121,8 +134,6 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		throw new Error(`batch run state ${batchId} has an invalid branch`);
 	if (!isCanonicalTimestamp(record.confirmation_time))
 		throw new Error(`batch run state ${batchId} has an invalid confirmation_time`);
-	if (!isCanonicalTimestamp(record.authorization_expires_at))
-		throw new Error(`batch run state ${batchId} has an invalid authorization_expires_at`);
 	if (!isCanonicalTimestamp(record.created_at) || !isCanonicalTimestamp(record.updated_at))
 		throw new Error(`batch run state ${batchId} has invalid state timestamps`);
 	if (!Array.isArray(record.children) || record.children.length === 0)
@@ -142,7 +153,6 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		typeof budget.max_children !== "number" ||
 		!Number.isInteger(budget.max_children) ||
 		budget.max_children <= 0 ||
-		!isCanonicalTimestamp(budget.deadline_at) ||
 		typeof budget.qa_failure_limit !== "number" ||
 		!Number.isInteger(budget.qa_failure_limit) ||
 		budget.qa_failure_limit <= 0
@@ -150,6 +160,20 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		throw new Error(`batch run state ${batchId} has an invalid budget`);
 	if (!Array.isArray(record.commits) || record.commits.some((c) => typeof c !== "string"))
 		throw new Error(`batch run state ${batchId} has an invalid commits list`);
+	if (
+		record.adopted_heads !== undefined &&
+		(!Array.isArray(record.adopted_heads) ||
+			record.adopted_heads.some(
+				(a: unknown) =>
+					typeof a !== "object" ||
+					a === null ||
+					typeof (a as { from?: unknown }).from !== "string" ||
+					!(a as { from: string }).from ||
+					typeof (a as { to?: unknown }).to !== "string" ||
+					!(a as { to: string }).to,
+			))
+	)
+		throw new Error(`batch run state ${batchId} has an invalid adopted_heads list`);
 	const seenTaskIds = new Set<string>();
 	for (const child of record.children) {
 		if (
@@ -211,8 +235,7 @@ export function prepareBatchRunState(input: {
 	base_head: string;
 	branch?: string;
 	confirmation_time: string;
-	authorization_expires_at: string;
-	budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
+	budget: { max_children: number; qa_failure_limit: number };
 	now: string;
 }): BatchRunStateRecord {
 	validateBatchId(input.batch_id);
@@ -224,7 +247,6 @@ export function prepareBatchRunState(input: {
 		base_head: input.base_head,
 		branch: input.branch ?? `imm/${input.initiative_slug}`,
 		confirmation_time: input.confirmation_time,
-		authorization_expires_at: input.authorization_expires_at,
 		budget: input.budget,
 		batch_state: "prepared",
 		children: input.children.map((child) => ({
@@ -248,7 +270,7 @@ export function parseBatchRunState(raw: string, batchId: string): BatchRunStateR
 	validateBatchId(batchId);
 	const parsed: unknown = JSON.parse(raw);
 	validateRecordShape(parsed, batchId);
-	return parsed;
+	return withoutRetiredClock(parsed);
 }
 
 export function readBatchRunState(root: string, batchId: string): BatchRunStateRecord | null {
@@ -300,7 +322,7 @@ export function replaceBatchRunState(root: string, expected: Buffer, next: Batch
 	return withKernelStoreLock(root, () => {
 		if (!readSecureProjectBytes(root, path).equals(expected)) throw new Error("batch state CAS mismatch");
 		validate();
-		const stored = { ...next, updated_at: new Date().toISOString() };
+		const stored = withoutRetiredClock({ ...next, updated_at: new Date().toISOString() });
 		writeFileAtomically(root, path, canonicalBytes(stored));
 		return stored;
 	});
@@ -315,10 +337,10 @@ export function writeBatchRunState(
 	return withKernelStoreLock(root, () => {
 		const existing = existsSync(join(root, path)) ? readSecureProjectFile(root, path) : null;
 		if (existing !== null && existing === canonicalBytes(record)) return record;
-		const stored: BatchRunStateRecord = {
+		const stored = withoutRetiredClock({
 			...record,
 			updated_at: new Date().toISOString(),
-		};
+		});
 		// review-4: secure directory + atomic no-symlink write.
 		ensureSecureDirectory(root, join(".imm", "state", "batches"));
 		writeFileAtomically(root, path, canonicalBytes(stored));

package/plugins/immune-brain/runtime/unattended/types.ts

@@ -2,13 +2,11 @@ import type { GithubInitiativeObservation } from "../github_issue_tracker";
 
 export interface BatchPlanBudget {
 	max_children: number;
-	deadline_at: string;
 	qa_failure_limit: number;
 }
 
 export interface BatchPlanBudgetInput {
 	max_children?: number;
-	deadline_at?: string;
 	qa_failure_limit?: number;
 }
 

package/plugins/immune-brain/runtime/workspace_scope.ts

@@ -137,7 +137,9 @@ function fileFingerprint(root: string, relativePath: string): string {
 }
 
 function dirtyPaths(root: string): string[] | null {
-	const tracked = git(root, ["diff", "--name-only", "-z", "HEAD", "--"]);
+	// --no-renames, like the task-path derivations: rename detection would list
+	// only the destination and hide the source path's deletion.
+	const tracked = git(root, ["diff", "--name-only", "--no-renames", "-z", "HEAD", "--"]);
 	const untracked = git(root, [
 		"ls-files",
 		"--others",
@@ -390,6 +392,44 @@ function taskPathMatchesScope(path: string, scope: string[]): boolean {
 	return scope.some((scopePath) => pathMatchesScope(path, scopePath));
 }
 
+/**
+ * A staged in-scope path that still equals the Enrollment baseline predates the
+ * task. Dropping it silently let QA attest workspace bytes that the Review
+ * revision did not carry, so it is a hard stop instead: reverting and reapplying
+ * yields the same bytes, and only a fresh Enrollment from a clean scope recovers.
+ * The task's own planning sidecar is exempt, as it is in dirtyScopePaths:
+ * Enrollment requires it tracked, so it is routinely staged in the baseline.
+ */
+function assertNoPreEnrollmentScopeChanges(root: string, scopedStagedPaths: readonly string[], taskId?: string): void {
+	const baseline = readEnrollmentBaseline(root);
+	if (!baseline) return;
+	const current = captureGitWorkspaceSnapshot(root);
+	if (!current) throw new Error("enrollment baseline cannot be compared because Git is unavailable");
+	const withheld = [...new Set(scopedStagedPaths)]
+		.filter((path) => !isOwnPlanningSidecar(path, taskId))
+		.filter((path) => baseline.dirty_files[path] !== undefined && baseline.dirty_files[path] === current.dirty_files[path])
+		.sort(comparePaths);
+	if (withheld.length > 0)
+		throw new Error(
+			`task scope contains staged changes that predate Enrollment and cannot become task work: ${withheld.join(", ")}; stop the task and re-enroll from a clean scope`,
+		);
+}
+
+/**
+ * In-scope paths that are already staged, modified or untracked relative to
+ * HEAD. Enrollment refuses these: the baseline would record them as user dirt
+ * and they could never be delivered by the task.
+ */
+export function dirtyScopePaths(projectRoot: string, scopeHint: unknown, taskId?: string): string[] {
+	const root = realpathSync(resolve(projectRoot));
+	const scope = assertCanonicalTaskScope(scopeHint);
+	const paths = dirtyPaths(root);
+	if (!paths) throw new Error("cannot inspect the task scope outside a committed Git workspace");
+	return paths.filter(
+		(path) => !isNonDeliveryPath(path) && !isOwnPlanningSidecar(path, taskId) && taskPathMatchesScope(path, scope),
+	);
+}
+
 function taskSnapshotOnce(root: string, scope: string[], taskId?: string): GitTaskSnapshot {
 	const repositoryRoot = git(root, ["rev-parse", "--show-toplevel"])?.trim();
 	const head = git(root, ["rev-parse", "--verify", "HEAD^{commit}"])?.trim();
@@ -425,12 +465,10 @@ function taskSnapshotOnce(root: string, scope: string[], taskId?: string): GitTa
 	if (uncommittedInScope.length > 0)
 		throw new Error(`task scope contains unstaged or untracked changes: ${uncommittedInScope.join(", ")}`);
 
-	const baseline = readEnrollmentBaseline(root);
-	const current = baseline ? captureGitWorkspaceSnapshot(root) : null;
 	const taskPaths = [...new Set(stagedPaths)]
 		.filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope))
-		.filter((path) => !(baseline && current && baseline.dirty_files[path] === current.dirty_files[path] && baseline.dirty_files[path] !== undefined))
 		.sort(comparePaths);
+	assertNoPreEnrollmentScopeChanges(root, taskPaths, taskId);
 	const stagedFiles: Record<string, GitTaskIndexEntry> = {};
 	for (const path of taskPaths) {
 		const current = indexEntry(root, path);
@@ -559,10 +597,8 @@ function taskRevisionSnapshotOnce(
 		"untracked task revision paths",
 	);
 	assertNoEnvelopeEscape(root, stagedPaths, scope, taskId);
-	const baseline = readEnrollmentBaseline(root);
-	const current = baseline ? captureGitWorkspaceSnapshot(root) : null;
-	const scopedStagedPaths = stagedPaths.filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope))
-		.filter((path) => !(baseline && current && baseline.dirty_files[path] === current.dirty_files[path] && baseline.dirty_files[path] !== undefined));
+	const scopedStagedPaths = stagedPaths.filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope));
+	assertNoPreEnrollmentScopeChanges(root, scopedStagedPaths, taskId);
 	const scopedUnstagedPaths = unstagedPaths.filter((path) => taskPathMatchesScope(path, scope));
 	const scopedUntrackedPaths = untrackedPaths.filter((path) => taskPathMatchesScope(path, scope));
 	assertNoCaseFoldCollisions(

package/plugins/immune-brain/runtime/unattended/confirmation_deadline.ts

@@ -1,33 +0,0 @@
-// A native confirmation is bounded on both Hosts. Claude bounded its MCP
-// elicitation with IMMUNE_BRAIN_BATCH_TIMEOUT_MS and Pi waited indefinitely; the
-// bound, its default, and the "this deadline expired rather than the user
-// cancelling" distinction are shared here. Each Host still owns its transport:
-// this module only produces the signal to hand it and reports expiry.
-
-export const CONFIRMATION_TIMEOUT_DEFAULT_MS = 60_000;
-export const CONFIRMATION_TIMEOUT_ENV = "IMMUNE_BRAIN_BATCH_TIMEOUT_MS";
-
-export interface ConfirmationDeadline {
-	/** The caller's signal, combined with this deadline. */
-	signal: AbortSignal;
-	/** True when this deadline fired and the caller's own signal did not. */
-	timedOut(): boolean;
-	clear(): void;
-}
-
-export function startConfirmationDeadline(input: {
-	env?: Record<string, string | undefined>;
-	signal?: AbortSignal;
-}): ConfirmationDeadline {
-	const configured = Number(input.env?.[CONFIRMATION_TIMEOUT_ENV]);
-	const timeoutMs = Number.isFinite(configured) && configured > 0 ? configured : CONFIRMATION_TIMEOUT_DEFAULT_MS;
-	const controller = new AbortController();
-	const timer = setTimeout(() => {
-		controller.abort(new Error("native confirmation timed out waiting for user interaction"));
-	}, timeoutMs);
-	return {
-		signal: input.signal ? AbortSignal.any([input.signal, controller.signal]) : controller.signal,
-		timedOut: () => controller.signal.aborted && !input.signal?.aborted,
-		clear: () => clearTimeout(timer),
-	};
-}