§1 — Why

A run's lifecycle — dispatch, spawn, observe, stop, resume, recover — has verified defects at each transition (fleet review §4). The costliest is silent: dispatching a second node to a roster member whose session is still held by a live run kills the newcomer with no stream, no manifest and a phase that reads orphaned. Since the roster is the fleet's de-facto concurrency ceiling, this defect is exactly what a wider fleet trips first.

✓ landed 2026-08-16

§2 — Deliverables

All seven deliverables landed in commits c193f19, 421be97 and 9cc6fff: double-dispatch to a busy member refuses with MemberInFlight, failed dispatches roll back to zero processes/dirs/pointers/worktrees, stop→observe→recover round-trips as stopped, manifests classify by recorded status, killpg verifies pid identity, the live view re-checks liveness, resume preserves and numerically orders streams, and both demonstrated timestamp crashes are regressions. 13 tests added; full suite 1886 passed, 0 failed on the integrated tree. Full record: landed record.

§ Followups

Implement the lifecycle guards

All seven deliverables in §2. The member-collision guard lands first — it is one consult of existing data and removes the silent-node-loss failure mode.

/reckon-ship dispatch-lifecycle-safety

All seven §2 deliverables landed and demonstrated under test across commits c193f19, 421be97 and 9cc6fff: member-collision refusal, transactional dispatch rollback, stopped-phase truth, manifest-status classification, pid-identity signal safety, honest live-view liveness, resume stream correctness and the two timestamp-crash regressions. Sprint gate measures all produced. done — no followup

dispatch-guards landed — commit c193f19 (merge ff5bd3c); gate passed; measures: double-dispatch to a busy member refuses with MemberInFlight naming the in-flight run before any worktree is created (terminal phases exempt); injected post-spawn pointer-write failure left 0 processes, 0 run dirs, 0 pointers, 0 worktrees; 2 tests added, full suite 1867 passed. Evidence: docs/evidence/archive/dispatch-lifecycle-safety-landed.html#dispatch-guards
observe-truth landed — commit 421be97; gate passed; measures: stop→observe→recover round-trips as stopped; in-harness blocked/failed manifests keep their recorded status; killpg refuses a changed pid identity (start ticks recorded at dispatch/resume) and process_alive treats PermissionError as not-ours; live view re-checks liveness so a killed worker reads abandoned without an observe; 6 tests added, full suite 1881 passed. Evidence: docs/evidence/archive/dispatch-lifecycle-safety-landed.html#observe-truth
resume-correctness landed — commit 9cc6fff; gate passed; measures: original stream.jsonl preserved and resume streams ordered numerically through the tenth resume with the full set measured at completion; resume refuses while the prior pid is alive; millisecond/out-of-range reset epochs yield null readings and naive --completed-at promotes as UTC (both demonstrated crashes now regressions); 5 tests added, full suite 1886 passed. Evidence: docs/evidence/archive/dispatch-lifecycle-safety-landed.html#resume-correctness