immune-brain 4.5.0 → 5.0.0

package/plugins/immune-brain/runtime/unattended/batch_runner.ts

@@ -6,7 +6,6 @@ import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import {
-	BatchAuthorizationExpiryError,
 	type BatchAuthorityRegistry,
 	type ValidatedBatchAuthorization,
 	computeBatchPlanDigest,
@@ -25,12 +24,10 @@ export function batchQaFailureFacts(record: Pick<TaskRecord, "history"> & { find
 import type { BatchPlanChild } from "./types";
 import { ownUnpersistedBatchHead, takeReconfirmation } from "./batch_reconfirmation";
 import {
+	createDefaultBatchGitPort,
 	type BatchRunnerGitPort,
-	type BatchGitPreflightResult,
-	runBatchGitPreflight,
-	commitBatchChild,
-	lookupBatchCommit,
 } from "./batch_git";
+import { classifyBatchLineage, expectedBatchHead } from "./batch_preflight";
 import {
 	type BatchRunStateRecord,
 	type BatchChildRun,
@@ -43,7 +40,9 @@ import {
 	writeBatchRunReport,
 } from "./batch_state";
 
-/** Kernel-facing ports the driver needs. Host adapters supply these. */
+/** Kernel-facing ports the driver needs. Host adapters supply these. Git
+ * operations are not Kernel-port members: the runner drives them through
+ * BatchRunnerGitPort alone (D5 of docs/specs/deepen-authority-seams.spec.md). */
 export interface BatchRunnerKernelPort {
 	/** Enroll one child through the batch-derived capability. */
 	enrollTask(input: {
@@ -57,31 +56,6 @@ export interface BatchRunnerKernelPort {
 	}): Promise<{ record_revision: string }>;
 	/** Drive one enrolled child toward its own Kernel terminal settlement. */
 	advanceTask(root: string, taskId: string): Promise<BatchChildAdvanceResult>;
-	/** Scope-bound commit after Kernel reports a child done. */
-	commitChild?(
-		root: string,
-		taskId: string,
-		batchId: string,
-		head: string,
-		branch?: string,
-		intentPath?: string,
-	): Promise<{ commit: string }>;
-	/** review-3(5th round): read the already-created batch commit for a child,
-	 * or null when none exists. Lets crash recovery adopt an existing commit
-	 * instead of replaying the commitChild mutation. */
-	lookupBatchCommit?(
-		root: string,
-		taskId: string,
-		batchId: string,
-		expectedHead?: string,
-		branch?: string,
-	): Promise<{ commit: string } | null>;
-	/** Optional Git preflight check. */
-	gitPreflight?(input: {
-		root: string;
-		initiative_slug: string;
-		base_head: string;
-	}): Promise<BatchGitPreflightResult> | BatchGitPreflightResult;
 	/** review-2(5th round): read-only claim projection for enrollment
 	 * reconciliation after an interruption between enrollTask and its state
 	 * persistence. Uses the real AssuranceProjectionResult contract; batch
@@ -92,15 +66,15 @@ export interface BatchRunnerKernelPort {
 	 * is held under this batch's derived capability (consumed child slot). */
 	ownsTaskClaim(taskId: string): boolean;
 	/** review-8(4th rework): Kernel-side proof that a replacement parked-batch
-	 * authorization is genuine, unexpired, and bound to this exact batch_id,
+	 * authorization is genuine and bound to this exact batch_id,
 	 * plan_digest, and base_head, validated against the Kernel's authoritative
-	 * binding state. Throws on fabrication, mismatch, or expiry; the driver
+	 * binding state. Throws on fabrication or mismatch; the driver
 	 * must call this before accepting a parked-batch resume. */
 	validateBatchAuthorization(input: {
 		registry: BatchAuthorityRegistry;
 		capability: object;
 		binding: Pick<ValidatedBatchAuthorization,
-			"batch_id" | "plan_digest" | "base_head" | "initiative_slug" | "budget" | "expires_at">;
+			"batch_id" | "plan_digest" | "base_head" | "initiative_slug" | "budget">;
 	}): ValidatedBatchAuthorization;
 }
 
@@ -123,13 +97,18 @@ export interface StartBatchInput {
 	plan_digest: string;
 	base_head: string;
 	confirmation_time: string;
-	authorization_expires_at: string;
-	budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
+	budget: { max_children: number; qa_failure_limit: number };
 	now: string;
 	kernel: BatchRunnerKernelPort;
 	git?: BatchRunnerGitPort;
 }
 
+/** One git seam: the injected BatchRunnerGitPort, or the default adapter over
+ * the real repository operations when the Host supplies none. */
+function batchGitPortOf(input: StartBatchInput): BatchRunnerGitPort {
+	return input.git ?? createDefaultBatchGitPort();
+}
+
 export type { BatchRunReport } from "./batch_state";
 
 function dependentsOf(record: BatchRunStateRecord, taskId: string): BatchChildRun[] {
@@ -155,7 +134,7 @@ function skipDependents(record: BatchRunStateRecord, taskId: string, reason: str
 	);
 }
 
-function budgetStopReason(record: BatchRunStateRecord, now: number): string | null {
+function budgetStopReason(record: BatchRunStateRecord): string | null {
 	// review-3: budget counts enrollments consumed (children that left
 	// pending), not commits, so parked children still consume authorization.
 	const enrolledCount = record.children.filter(
@@ -163,22 +142,9 @@ function budgetStopReason(record: BatchRunStateRecord, now: number): string | nu
 	).length;
 	if (enrolledCount >= record.budget.max_children)
 		return `max_children budget exhausted (${record.budget.max_children})`;
-	const deadline = Date.parse(record.budget.deadline_at);
-	if (!Number.isNaN(deadline) && now >= deadline)
-		return `deadline_at reached (${record.budget.deadline_at})`;
 	return null;
 }
 
-/** review-7(3rd rework): the typed expiry marker now lives at the Kernel
- * boundary (kernel/batch_authority.ts) so a real enrollment-time expiry is
- * structurally classifiable as an intentional budget stop; re-exported here
- * for driver API compatibility. */
-export { BatchAuthorizationExpiryError };
-
-function isAuthorizationExpiryError(error: unknown): boolean {
-	return error instanceof BatchAuthorizationExpiryError;
-}
-
 function requireFreshProjection<T extends AssuranceProjectionResult>(
 	result: T,
 	taskId: string,
@@ -203,7 +169,7 @@ function nextEnrollableChild(record: BatchRunStateRecord): BatchChildRun | null
 
 const TERMINAL_NEXT_ACTIONS: Record<string, string> = {
 	completed: "The batch settled every enrollable child; review the commits and the tracker.",
-	budget_stopped: "Budget, deadline, or authorization expiry stopped new enrollments; re-confirm to continue under a new authorization.",
+	budget_stopped: "The child budget stopped new enrollments; re-confirm to continue under a new authorization.",
 	failed: "A commit or lineage failure stopped the batch; inspect the failing child and the branch state.",
 	rejected: "The batch was rejected before any enrollment; correct the stated reason and re-confirm.",
 	needs_human: "A parked child needs a human decision; resolve it, then re-confirm to continue.",
@@ -298,35 +264,47 @@ function failPersistedLineage(
 	return writeBatchRunState(root, record);
 }
 
-/** review round 11: detect external HEAD movement or branch switch against a
- * persisted record's expected lineage; returns the failure message or null. */
-function externalHeadDriftMessage(root: string, record: BatchRunStateRecord): string | null {
-	if (!existsSync(join(root, ".git"))) return null;
-	const head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
-	const headCheck = spawnSync("git", ["-C", root, "rev-parse", "HEAD"], {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
-	});
-	if (headCheck.status === 0 && headCheck.stdout.trim() && headCheck.stdout.trim() !== head) {
-		return `batch_head_lineage_broken: current HEAD ${headCheck.stdout.trim()} does not match expected batch head ${head}`;
-	}
-	const branchCheck = spawnSync("git", ["-C", root, "symbolic-ref", "--short", "HEAD"], {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
+/** A HEAD that fast-forwards on the batch branch is the user's own work: adopt
+ * it as the new expected head and record it. Any other movement is the fatal
+ * lineage break, returned as the failure message with the record unchanged. */
+function reconcileLineage(
+	root: string,
+	record: BatchRunStateRecord,
+): { record: BatchRunStateRecord; failure: string | null } {
+	if (!existsSync(join(root, ".git"))) return { record, failure: null };
+	const expected = expectedBatchHead(record);
+	const lineage = classifyBatchLineage({
+		root,
+		branch: record.branch ?? "",
+		expectedHead: expected,
+		childCommits: record.commits,
+		batchId: record.batch_id,
 	});
-	const currentBranch = branchCheck.stdout.trim();
-	if (branchCheck.status !== 0 || currentBranch !== record.branch) {
-		return `batch_head_lineage_broken: current branch ${currentBranch} does not match expected batch branch ${record.branch}`;
-	}
-	return null;
+	if (lineage.kind === "broken") return { record, failure: lineage.message };
+	if (lineage.kind === "equal") return { record, failure: null };
+	return {
+		record: writeBatchRunState(root, {
+			...record,
+			adopted_heads: [...(record.adopted_heads ?? []), { from: expected, to: lineage.head }],
+		}),
+		failure: null,
+	};
 }
 
 async function validatePersistedRun(input: StartBatchInput, record: BatchRunStateRecord): Promise<void> {
 	if (!record.commits.length && record.children[0]?.state === "settled" && existsSync(join(input.root, ".git"))) {
 		const head = spawnSync("git", ["-C", input.root, "rev-parse", "HEAD"], { encoding: "utf8" });
-		if (head.status !== 0 || (head.stdout.trim() !== record.base_head && !ownUnpersistedBatchHead(input.root, record, head.stdout.trim())))
+		const live = head.stdout.trim();
+		const expected = expectedBatchHead(record);
+		const adoptable = () =>
+			classifyBatchLineage({
+				root: input.root,
+				branch: record.branch ?? "",
+				expectedHead: expected,
+				childCommits: record.commits,
+				batchId: record.batch_id,
+			}).kind === "fast_forward";
+		if (head.status !== 0 || (live !== expected && !ownUnpersistedBatchHead(input.root, record, live) && !adoptable()))
 			throw new Error("first unpersisted batch commit provenance is invalid");
 	}
 	const plan = input.registry.children(input.capability);
@@ -342,16 +320,10 @@ async function validatePersistedRun(input: StartBatchInput, record: BatchRunStat
 			if (child.commit !== null) throw new Error("uncommitted batch child has a commit");
 			continue;
 		}
-		const evidence = input.git?.lookupBatchCommit
-			? await input.git.lookupBatchCommit(input.root, child.task_id, record.batch_id, undefined, record.branch)
-			: input.kernel.lookupBatchCommit
-				? await input.kernel.lookupBatchCommit(input.root, child.task_id, record.batch_id, undefined, record.branch)
-				: await lookupBatchCommit({
-					root: input.root,
-					taskId: child.task_id,
-					batchId: record.batch_id,
-					branch: record.branch,
-				});
+		const git = batchGitPortOf(input);
+		const evidence = await git.lookupBatchCommit(
+			input.root, child.task_id, record.batch_id, undefined, record.branch,
+		);
 		if (!evidence || evidence.commit !== child.commit) {
 			// Distinguish an unreachable recorded commit (external HEAD regression)
 			// from a fabricated record: reachability is only checkable in a real repo.
@@ -401,7 +373,6 @@ function validateRunAuthorization(input: StartBatchInput, existing: BatchRunStat
 			base_head: existing?.base_head ?? input.base_head,
 			initiative_slug: existing?.initiative_slug ?? input.initiative_slug,
 			budget: input.budget,
-			expires_at: input.authorization_expires_at,
 		},
 	});
 	if (authorized.issued_at !== input.confirmation_time ||
@@ -422,7 +393,7 @@ function validateRunAuthorization(input: StartBatchInput, existing: BatchRunStat
 function applyPlanReconfirmation(input: StartBatchInput, existing: BatchRunStateRecord): BatchRunStateRecord {
 	if (existing.plan_digest === input.plan_digest) return existing;
 	const next = { ...existing, plan_digest: input.plan_digest, confirmation_time: input.confirmation_time,
-		authorization_expires_at: input.authorization_expires_at, budget: input.budget };
+		budget: input.budget };
 	if (!existing.branch || input.batch_id !== existing.batch_id || input.initiative_slug !== existing.initiative_slug || input.base_head !== existing.base_head ||
 		input.budget.max_children !== existing.budget.max_children || input.budget.qa_failure_limit !== existing.budget.qa_failure_limit)
 		throw new Error("plan_digest mismatch: reconfirmation binding changed");
@@ -516,12 +487,9 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 	if (existing?.batch_state === "needs_human") {
 		const priorConfirmation = Date.parse(existing.confirmation_time);
 		const nextConfirmation = Date.parse(input.confirmation_time);
-		const nextExpiry = Date.parse(input.authorization_expires_at);
 		const freshAuthorization =
 			Number.isFinite(nextConfirmation) &&
-			nextConfirmation > priorConfirmation &&
-			Number.isFinite(nextExpiry) &&
-			nextExpiry > Date.now();
+			nextConfirmation > priorConfirmation;
 		if (!freshAuthorization && !reconfirmed) {
 			return finalize(
 				input.root,
@@ -573,7 +541,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			existing = writeBatchRunState(input.root, {
 				...reparked,
 				confirmation_time: input.confirmation_time,
-				authorization_expires_at: input.authorization_expires_at,
 				budget: input.budget,
 				batch_state: "needs_human",
 			});
@@ -592,42 +559,12 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 		existing = writeBatchRunState(input.root, {
 			...existing,
 			confirmation_time: input.confirmation_time,
-			authorization_expires_at: input.authorization_expires_at,
 			budget: input.budget,
 			batch_state: "running",
 			children: resumedChildren,
 		});
 	}
 
-	// A running batch can outlive its authorization while it waits on a child's
-	// reserved foreground Review. The driver owns every batch state transition,
-	// so the renewal the Host bound into the capability must be adopted here;
-	// otherwise the record keeps the expired stamp and the next child enrollment
-	// stops the batch as budget_stopped even though the literal user just
-	// re-confirmed it. Renewal requires the same proof the parked path requires:
-	// a strictly newer literal-user confirmation and a later, still-valid expiry.
-	if (existing?.batch_state === "running") {
-		const nextConfirmation = Date.parse(input.confirmation_time);
-		const nextExpiry = Date.parse(input.authorization_expires_at);
-		const priorConfirmation = Date.parse(existing.confirmation_time);
-		const persistedExpiry = Date.parse(existing.authorization_expires_at);
-		const renewedAuthorization =
-			Number.isFinite(nextConfirmation) &&
-			nextConfirmation > priorConfirmation &&
-			Number.isFinite(nextExpiry) &&
-			nextExpiry > Date.now() &&
-			nextExpiry > persistedExpiry;
-		if (renewedAuthorization) {
-			validateRunAuthorization(input, existing);
-			existing = writeBatchRunState(input.root, {
-				...existing,
-				confirmation_time: input.confirmation_time,
-				authorization_expires_at: input.authorization_expires_at,
-				budget: input.budget,
-			});
-		}
-	}
-
 	// review-2(6th round): an enrolled or settled child from an interrupted
 	// run must be driven to its own terminal settlement and commit before any
 	// new child is selected, or startBatch would double-claim the task or
@@ -657,23 +594,11 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 		}
 
 		// Mandatory batch branch preflight: run before any child is enrolled.
-		const preflightResult = input.git?.preflight
-			? await input.git.preflight({
-				root: input.root,
-				initiative_slug: input.initiative_slug,
-				base_head: input.base_head,
-			})
-			: input.kernel.gitPreflight
-				? await input.kernel.gitPreflight({
-					root: input.root,
-					initiative_slug: input.initiative_slug,
-					base_head: input.base_head,
-				})
-				: runBatchGitPreflight({
-					root: input.root,
-					initiative_slug: input.initiative_slug,
-					base_head: input.base_head,
-				});
+		const preflightResult = await batchGitPortOf(input).preflight({
+			root: input.root,
+			initiative_slug: input.initiative_slug,
+			base_head: input.base_head,
+		});
 
 		if (!preflightResult.ok) {
 			const rejected = prepareBatchRunState({ ...input, now: input.now });
@@ -693,7 +618,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			plan_digest: input.plan_digest,
 			base_head: input.base_head,
 			confirmation_time: input.confirmation_time,
-			authorization_expires_at: input.authorization_expires_at,
 			budget: input.budget,
 			now: input.now,
 		});
@@ -707,17 +631,15 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 		persist();
 	}
 
-	let head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
-
 	// Validate current Git HEAD and branch against the expected head/branch before continuing (review rounds 7+11)
-	const driftMessage = externalHeadDriftMessage(input.root, record);
-	if (driftMessage) {
+	const lineage = reconcileLineage(input.root, record);
+	record = lineage.record;
+	if (lineage.failure) {
 		record.batch_state = "failed";
 		persist();
-		return finalize(input.root, record, driftMessage, "");
+		return finalize(input.root, record, lineage.failure, "");
 	}
+	let head = expectedBatchHead(record);
 
 	while (record.batch_state === "running") {
 		const child = nextEnrollableChild(record);
@@ -780,9 +702,8 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			);
 			persist();
 		} else {
-		// Re-read the clock after projection; an adopted claim is not a new enrollment.
-		const now = Date.now();
-		if (now >= Date.parse(record.authorization_expires_at) || budgetStopReason(record, now)) {
+		// An adopted claim is not a new enrollment.
+		if (budgetStopReason(record)) {
 			record.batch_state = record.children.some(
 				(c) => c.state === "needs_human" || c.state === "skipped_blocked",
 			) ? "needs_human" : "budget_stopped";
@@ -799,7 +720,7 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 				binding: {
 					batch_id: record.batch_id, plan_digest: record.plan_digest,
 					base_head: record.base_head, initiative_slug: record.initiative_slug,
-					budget: record.budget, expires_at: record.authorization_expires_at,
+					budget: record.budget,
 				},
 			});
 			for (const committed of record.children) {
@@ -821,17 +742,6 @@ async function startBatchLocked(input: StartBatchInput): Promise<BatchRunReport>
 			persist();
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			// Only a typed BatchAuthorizationExpiryError is an intentional
-			// budget stop; free-form message matching misclassified
-			// infrastructure and validation failures as intentional stops.
-			if (isAuthorizationExpiryError(error)) {
-				record.children = record.children.map((c) =>
-					c.task_id === child.task_id ? { ...c, state: "pending", reason: message } : c,
-				);
-				record.batch_state = "budget_stopped";
-				persist();
-				break;
-			}
 			// review round 10: external HEAD movement after the pre-loop check
 			// (including between children) fails the batch, it never parks.
 			if (isLineageBreakError(message)) {
@@ -869,8 +779,8 @@ function stopReasonFor(record: BatchRunStateRecord): string | null {
 	switch (record.batch_state) {
 		case "budget_stopped":
 			return (
-				budgetStopReason(record, Date.now()) ??
-				"budget, deadline, or authorization expiry stopped new enrollments"
+				budgetStopReason(record) ??
+				"the child budget stopped new enrollments"
 			);
 		case "failed": {
 			const failedChild = record.children.find((c) => c.state === "needs_human" && c.reason);
@@ -888,10 +798,9 @@ function stopReasonFor(record: BatchRunStateRecord): string | null {
 /**
  * review-1: resume the interrupted child first. A persisted enrolled child
  * is driven through the Kernel obligation surface to its own terminal
- * settlement and commit before any new enrollment or expiry check, so an
- * interrupted run can never falsely complete or enroll a sibling while a
- * child claim is still open. Never replays a committed mutation; refuses an
- * expired authorization by requiring a new literal-user confirmation.
+ * settlement and commit before any new enrollment, so an interrupted run can
+ * never falsely complete or enroll a sibling while a child claim is still
+ * open. Never replays a committed mutation.
  */
 export async function resumeBatch(
 	input: StartBatchInput,
@@ -915,8 +824,8 @@ export async function resumeBatch(
 		return replayTerminal(input.root, existing);
 
 	// An enrolled-but-unsettled child must reach its own Kernel terminal
-	// settlement before anything else, even under an expired authorization:
-	// its claim is already held and the Kernel owns its remaining obligations.
+	// settlement before anything else: its claim is already held and the
+	// Kernel owns its remaining obligations.
 	// review-1(2nd round): an `enrolled` child is verified against a fresh
 	// Kernel projection; a projection that finds no active claim means the
 	// persisted `enrolled` flag predates a successful enrollment, so the child
@@ -933,10 +842,11 @@ export async function resumeBatch(
 			// defers to driveInterruptedChild's lookupBatchCommit verification,
 			// which adopts a verified own commit (crash before committed-persist)
 			// instead of misjudging it as external drift.
-			const drivenDrift = externalHeadDriftMessage(input.root, existing);
-			if (drivenDrift) {
-				const failed = failPersistedLineage(input.root, existing, drivenDrift);
-				return finalize(input.root, failed, drivenDrift, "");
+			const drivenLineage = reconcileLineage(input.root, existing);
+			existing = drivenLineage.record;
+			if (drivenLineage.failure) {
+				const failed = failPersistedLineage(input.root, existing, drivenLineage.failure);
+				return finalize(input.root, failed, drivenLineage.failure, "");
 			}
 			const fresh = requireFreshProjection(
 				await input.kernel.projectTask(input.root, driven.task_id),
@@ -1067,9 +977,7 @@ async function driveInterruptedChild(
 		record.batch_state = "running";
 		persist();
 	}
-	let head = record.commits.length
-		? record.commits[record.commits.length - 1]!
-		: record.base_head;
+	let head = expectedBatchHead(record);
 	while (child.state === "enrolled" || child.state === "settled") {
 		if (child.state === "settled") {
 			// review-2(2nd round): a persisted settled child must not replay
@@ -1081,23 +989,9 @@ async function driveInterruptedChild(
 			// review-1(6th round): a lookup failure must fail closed, not fall
 			// through to commitChild, which could replay an existing commit.
 			try {
-				existing = input.git?.lookupBatchCommit
-					? await input.git.lookupBatchCommit(input.root, child.task_id, input.batch_id, head, record.branch)
-					: input.kernel.lookupBatchCommit
-						? await input.kernel.lookupBatchCommit(
-							input.root,
-							child.task_id,
-							input.batch_id,
-							head,
-							record.branch,
-						)
-						: await lookupBatchCommit({
-							root: input.root,
-							taskId: child.task_id,
-							batchId: input.batch_id,
-							expectedHead: head,
-							branch: record.branch,
-						});
+				existing = await batchGitPortOf(input).lookupBatchCommit(
+					input.root, child.task_id, input.batch_id, head, record.branch,
+				);
 			} catch (error: unknown) {
 				const message =
 					error instanceof Error ? error.message : String(error);
@@ -1120,24 +1014,19 @@ async function driveInterruptedChild(
 				persist();
 				throw new BatchCommitAbortError(`commit lookup failed: ${message}`);
 			}
+			if (!existing) {
+				// No own commit exists yet: a fast-forward since settlement is the
+				// user's work. Adopt it so this child's commit parents on it; a broken
+				// lineage is left for commitChild to refuse with its own message.
+				record = reconcileLineage(input.root, record).record;
+				head = expectedBatchHead(record);
+			}
 			const planChild = input.children.find((c) => c.task_id === child.task_id);
 			const intentPath = planChild?.intent_path ?? undefined;
-			const doCommit = async () => {
-				if (input.git?.commitChild) {
-					return input.git.commitChild(input.root, child.task_id, input.batch_id, head, record.branch, intentPath);
-				}
-				if (input.kernel.commitChild) {
-					return input.kernel.commitChild(input.root, child.task_id, input.batch_id, head, record.branch, intentPath);
-				}
-				return commitBatchChild({
-					root: input.root,
-					taskId: child.task_id,
-					batchId: input.batch_id,
-					expectedHead: head,
-					branch: record.branch,
-					intentPath,
-				});
-			};
+			const doCommit = async () =>
+				batchGitPortOf(input).commitChild(
+					input.root, child.task_id, input.batch_id, head, record.branch, intentPath,
+				);
 			if (existing && !record.commits.length && existsSync(join(input.root, ".git")) && !ownUnpersistedBatchHead(input.root, record, existing.commit))
 				throw new Error("first unpersisted batch commit provenance is invalid");
 			const adopted =

package/plugins/immune-brain/runtime/unattended/batch_state.ts

@@ -45,11 +45,8 @@ export interface BatchRunStateRecord {
 	branch?: string;
 	/** Timestamp of the literal-user batch confirmation. */
 	confirmation_time: string;
-	/** Authorization expiry from the batch capability binding. */
-	authorization_expires_at: string;
 	budget: {
 		max_children: number;
-		deadline_at: string;
 		qa_failure_limit: number;
 	};
 	batch_state: BatchRunState;
@@ -58,6 +55,11 @@ export interface BatchRunStateRecord {
 	consecutive_qa_failures: number;
 	/** Commit heads produced by this batch, in child order. */
 	commits: string[];
+	/**
+	 * Fast-forward commits the user made on the batch branch, adopted as the new
+	 * expected head. Never attributed to a child and never rewritten.
+	 */
+	adopted_heads?: Array<{ from: string; to: string }>;
 	created_at: string;
 	updated_at: string;
 }
@@ -101,8 +103,19 @@ function statePath(batchId: string): string {
 	return join(".imm", "state", "batches", `${batchId}.json`);
 }
 
+/**
+ * A record persisted while batch authorization still carried a clock holds
+ * `authorization_expires_at` and `budget.deadline_at`. They are ignored on read
+ * and never written back.
+ */
+function withoutRetiredClock(record: BatchRunStateRecord): BatchRunStateRecord {
+	const { authorization_expires_at: _expiry, ...rest } = record as BatchRunStateRecord & { authorization_expires_at?: unknown };
+	const { deadline_at: _deadline, ...budget } = rest.budget as BatchRunStateRecord["budget"] & { deadline_at?: unknown };
+	return { ...rest, budget };
+}
+
 function canonicalBytes(record: BatchRunStateRecord): string {
-	return `${JSON.stringify(record, null, 2)}\n`;
+	return `${JSON.stringify(withoutRetiredClock(record), null, 2)}\n`;
 }
 
 function validateRecordShape(value: unknown, batchId: string): asserts value is BatchRunStateRecord {
@@ -121,8 +134,6 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		throw new Error(`batch run state ${batchId} has an invalid branch`);
 	if (!isCanonicalTimestamp(record.confirmation_time))
 		throw new Error(`batch run state ${batchId} has an invalid confirmation_time`);
-	if (!isCanonicalTimestamp(record.authorization_expires_at))
-		throw new Error(`batch run state ${batchId} has an invalid authorization_expires_at`);
 	if (!isCanonicalTimestamp(record.created_at) || !isCanonicalTimestamp(record.updated_at))
 		throw new Error(`batch run state ${batchId} has invalid state timestamps`);
 	if (!Array.isArray(record.children) || record.children.length === 0)
@@ -142,7 +153,6 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		typeof budget.max_children !== "number" ||
 		!Number.isInteger(budget.max_children) ||
 		budget.max_children <= 0 ||
-		!isCanonicalTimestamp(budget.deadline_at) ||
 		typeof budget.qa_failure_limit !== "number" ||
 		!Number.isInteger(budget.qa_failure_limit) ||
 		budget.qa_failure_limit <= 0
@@ -150,6 +160,20 @@ function validateRecordShape(value: unknown, batchId: string): asserts value is
 		throw new Error(`batch run state ${batchId} has an invalid budget`);
 	if (!Array.isArray(record.commits) || record.commits.some((c) => typeof c !== "string"))
 		throw new Error(`batch run state ${batchId} has an invalid commits list`);
+	if (
+		record.adopted_heads !== undefined &&
+		(!Array.isArray(record.adopted_heads) ||
+			record.adopted_heads.some(
+				(a: unknown) =>
+					typeof a !== "object" ||
+					a === null ||
+					typeof (a as { from?: unknown }).from !== "string" ||
+					!(a as { from: string }).from ||
+					typeof (a as { to?: unknown }).to !== "string" ||
+					!(a as { to: string }).to,
+			))
+	)
+		throw new Error(`batch run state ${batchId} has an invalid adopted_heads list`);
 	const seenTaskIds = new Set<string>();
 	for (const child of record.children) {
 		if (
@@ -211,8 +235,7 @@ export function prepareBatchRunState(input: {
 	base_head: string;
 	branch?: string;
 	confirmation_time: string;
-	authorization_expires_at: string;
-	budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
+	budget: { max_children: number; qa_failure_limit: number };
 	now: string;
 }): BatchRunStateRecord {
 	validateBatchId(input.batch_id);
@@ -224,7 +247,6 @@ export function prepareBatchRunState(input: {
 		base_head: input.base_head,
 		branch: input.branch ?? `imm/${input.initiative_slug}`,
 		confirmation_time: input.confirmation_time,
-		authorization_expires_at: input.authorization_expires_at,
 		budget: input.budget,
 		batch_state: "prepared",
 		children: input.children.map((child) => ({
@@ -248,7 +270,7 @@ export function parseBatchRunState(raw: string, batchId: string): BatchRunStateR
 	validateBatchId(batchId);
 	const parsed: unknown = JSON.parse(raw);
 	validateRecordShape(parsed, batchId);
-	return parsed;
+	return withoutRetiredClock(parsed);
 }
 
 export function readBatchRunState(root: string, batchId: string): BatchRunStateRecord | null {
@@ -300,7 +322,7 @@ export function replaceBatchRunState(root: string, expected: Buffer, next: Batch
 	return withKernelStoreLock(root, () => {
 		if (!readSecureProjectBytes(root, path).equals(expected)) throw new Error("batch state CAS mismatch");
 		validate();
-		const stored = { ...next, updated_at: new Date().toISOString() };
+		const stored = withoutRetiredClock({ ...next, updated_at: new Date().toISOString() });
 		writeFileAtomically(root, path, canonicalBytes(stored));
 		return stored;
 	});
@@ -315,10 +337,10 @@ export function writeBatchRunState(
 	return withKernelStoreLock(root, () => {
 		const existing = existsSync(join(root, path)) ? readSecureProjectFile(root, path) : null;
 		if (existing !== null && existing === canonicalBytes(record)) return record;
-		const stored: BatchRunStateRecord = {
+		const stored = withoutRetiredClock({
 			...record,
 			updated_at: new Date().toISOString(),
-		};
+		});
 		// review-4: secure directory + atomic no-symlink write.
 		ensureSecureDirectory(root, join(".imm", "state", "batches"));
 		writeFileAtomically(root, path, canonicalBytes(stored));