claude-code-session-manager 0.121.0 → 0.122.0

package/src/main/runVerify.cjs

@@ -2,8 +2,9 @@
  * runVerify.cjs — post-run reconciliation verifier.
  *
  * Called by scheduler.cjs after every agent exit=0, before marking a job
- * "completed". Pattern-matches tool_result content from the run log and checks
- * dependency prerequisites to catch false-positives (clean-exit ≠ done).
+ * "completed". The verdict depends only on outcomes — sentinel, commit
+ * evidence, exit code, log readability, dependency prerequisites. Transcript
+ * content is NEVER scanned for error text (pattern scan retired).
  *
  * Pure: no IPC, no queue writes. Writes a verdicts.json sidecar to runDir as
  * a by-product so the renderer and any offline tooling can read the result
@@ -13,7 +14,7 @@
  *   verifyRun({ runDir, prdPath, queueEntry, allJobs }) → Promise<Verdict>
  *
  * Verdict shape:
- *   { verdict: 'clean'|'halt'|'deps_unmet'|'transcript_errors'|'verify_unavailable'
+ *   { verdict: 'clean'|'halt'|'deps_unmet'|'verify_unavailable'
  *       |'no_verdict_sentinel'|'abandoned_background_task',
  *     reason: string,
  *     downgradeTo: 'pending'|'needs_review'|null }
@@ -22,8 +23,8 @@
  *   clean           → null        (caller stamps 'completed')
  *   halt            → 'pending'   (re-fires automatically next slot)
  *   deps_unmet      → 'pending'   (re-fires when deps clear)
- *   transcript_errors → 'needs_review' (requires human flip)
- *   verify_unavailable → 'needs_review'
+ *   transcript_errors → historical rows only; no longer emitted
+ *   verify_unavailable → 'needs_review' (unreadable log / verifier threw)
  *   no_verdict_sentinel → 'needs_review'
  *   abandoned_background_task → 'needs_review'
  *
@@ -48,29 +49,7 @@ const VERDICTS_SCHEMA_VERSION = 1;
 // Bound on the `gh pr view` postcondition check below (§ merge-main exemption).
 const GH_CHECK_TIMEOUT_MS = 15_000;
 
-// ─── content pattern detectors ───────────────────────────────────────────────
-
-/**
- * Detect high-signal error patterns in a single tool_result content string.
- * Returns { verdict, pattern } on match, null if clean.
- *
- * Checked in priority order (cheapest first):
- *   1. FAIL/FATAL at line start
- *   2. Traceback + Error within 10 lines (Python exception)
- *   3. ModuleNotFoundError / ImportError (missing venv / broken deps)
- */
-/**
- * True when a tool_result content is a Claude Code harness tool error rather
- * than task output — emitted when the model calls a tool that doesn't exist or
- * isn't allowed (e.g. `<tool_use_error>Error: No such tool available: bash`).
- * The harness rejects the call; the model recovers by retrying with a valid
- * tool. Never a task failure, so the verifier must not downgrade on it.
- */
-function isHarnessToolError(content) {
-  if (typeof content !== 'string' || !content) return false;
-  return content.includes('<tool_use_error>')
-    || /\bNo such tool available\b/.test(content);
-}
+// ─── policy-denial detector ──────────────────────────────────────────────────
 
 /**
  * A PreToolUse hook denial (`guard-destructive-git.cjs`, `guard-prd-writes.cjs`,
@@ -85,51 +64,6 @@ function isPolicyDenial(content) {
   return /^(?:Error:\s*)?Blocked:/.test(content);
 }
 
-function detectPattern(content) {
-  if (typeof content !== 'string' || !content) return null;
-
-  // (1) FAIL/FATAL at the start of a line (case-sensitive, multiline).
-  if (/^FAIL\b/m.test(content) || /^FATAL\b/m.test(content)) {
-    return { verdict: 'transcript_errors', pattern: 'FAIL/FATAL at line start' };
-  }
-
-  // (2) Python Traceback + exception line within next 10 lines. Both anchored
-  // to line starts: reviewer prose quoting "will crash with ImportError" or
-  // embedding "...Error:" mid-sentence must not match (feedback 2026-06-10-01).
-  //
-  // The TERMINATING exception decides the class: a Traceback ending in
-  // ModuleNotFoundError/ImportError is the missing-dependency class ("the
-  // verification couldn't run", same as detector 3), NOT a logic failure — so
-  // it routes through the weaker verify_unavailable path (env-recovery escape
-  // hatch + success demotion). A Traceback ending in any other exception
-  // (KeyError, AssertionError, …) stays transcript_errors — that is the real
-  // false-PASS class the verifier exists to catch (2026-05-23 incident).
-  // (feedback 2026-06-10 addendum: interpreter-search setup probes that ended
-  // in ModuleNotFoundError were 3/3 false positives.)
-  const lines = content.split('\n');
-  for (let i = 0; i < lines.length; i++) {
-    if (/^\s*Traceback \(most recent call last\):/.test(lines[i])) {
-      for (let j = i + 1; j < Math.min(i + 11, lines.length); j++) {
-        const m = lines[j].match(/^\s*([A-Za-z_][\w.]*(?:Error|Exception))\s*:/);
-        if (m) {
-          if (m[1] === 'ModuleNotFoundError' || m[1] === 'ImportError') {
-            return { verdict: 'verify_unavailable', pattern: `Traceback → ${m[1]}` };
-          }
-          return { verdict: 'transcript_errors', pattern: 'Traceback + Error within 10 lines' };
-        }
-      }
-    }
-  }
-
-  // (3) Import / module errors (verification was skipped). Line-anchored:
-  // real interpreter output starts the line with the exception name
-  // ("ModuleNotFoundError: No module named 'x'"); prose never does.
-  if (/^\s*(?:ModuleNotFoundError|ImportError)\s*(?::|$)/m.test(content)) {
-    return { verdict: 'verify_unavailable', pattern: 'ModuleNotFoundError/ImportError' };
-  }
-
-  return null;
-}
 
 // ─── log parser ───────────────────────────────────────────────────────────────
 
@@ -274,166 +208,17 @@ function hasAbandonedBackgroundTask(events) {
   return false;
 }
 
-// ─── self-recovery helpers ────────────────────────────────────────────────────
-
-/**
- * Return the description of the tool_use that produced a given tool_result
- * (matched by tool_use_id). Returns '' if not found.
- */
-function toolUseDesc(events, toolUseId) {
-  if (!toolUseId) return '';
-  for (const ev of events) {
-    if (ev.kind === 'tool_use' && ev.toolUseId === toolUseId) return ev.description ?? '';
-  }
-  return '';
-}
-
-/**
- * Return the tool name of the tool_use that produced a given tool_result.
- * Returns '' if not found.
- */
-function toolUseName(events, toolUseId) {
-  if (!toolUseId) return '';
-  for (const ev of events) {
-    if (ev.kind === 'tool_use' && ev.toolUseId === toolUseId) return ev.toolName ?? '';
-  }
-  return '';
-}
-
-/**
- * Check whether the next ≤5 tool_use calls after `fromSeq` include a package
- * install command (pip install, pip3 install, uv sync, uv pip install).
- */
-function hasInstallRecovery(events, fromSeq) {
-  let count = 0;
-  for (const ev of events) {
-    if (ev.seq <= fromSeq) continue;
-    if (ev.kind !== 'tool_use') continue;
-    if (++count > 5) break;
-    const combined = `${ev.command ?? ''} ${ev.description ?? ''}`;
-    if (/pip\d*\s+install/i.test(combined) || /uv\s+(?:sync|pip\s+install)/i.test(combined)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-// Matches a leading `sleep <N> &&` or `sleep <N> ;` wrapper (the shell idiom
-// used to poll a still-pending remote job) so a retry that only drops/changes
-// its own timing wrapper still counts as the same underlying command. Narrow
-// on purpose: it strips nothing else, so two genuinely different commands
-// never collapse into a false pairing (incident: RCA 745-pr188-ci-lint-docs-integrity).
-const SLEEP_PREFIX_RE = /^\s*sleep\s+\d+\s*(&&|;)\s*/;
-
-/**
- * Strip a leading `sleep <N> (&&|;)` wrapper from a tool_use description so
- * self-recovery comparisons ignore only that timing-poll idiom.
- */
-function normalizeDescForRecovery(desc) {
-  return (desc ?? '').replace(SLEEP_PREFIX_RE, '');
-}
-
-/**
- * Check whether the error at `errorSeq` is self-recovered within the next 30
- * events.
- *
- * Recovery heuristic: another tool_use with the same non-empty `description`
- * (after stripping a leading `sleep N &&`/`sleep N;` wrapper from both sides)
- * appears within 30 events of the error, AND its corresponding tool_result is
- * free of error patterns AND is not is_error=true.
- */
-function isSelfRecovered(events, errorSeq, desc) {
-  if (!desc) return false;
-  const normalizedDesc = normalizeDescForRecovery(desc);
-  if (!normalizedDesc) return false;
-
-  // Build a quick lookup from tool_use_id → tool_result event.
-  const resultByUseId = new Map();
-  for (const ev of events) {
-    if (ev.kind === 'tool_result') resultByUseId.set(ev.toolUseId, ev);
-  }
-
-  let seen = 0;
-  for (const ev of events) {
-    if (ev.seq <= errorSeq) continue;
-    if (++seen > 30) break;
-    if (ev.kind !== 'tool_use' || normalizeDescForRecovery(ev.description) !== normalizedDesc) continue;
-    const result = resultByUseId.get(ev.toolUseId);
-    if (result && !result.isError && !detectPattern(result.content)) return true;
-  }
-  return false;
-}
-
-// ─── soak / deps parsing ─────────────────────────────────────────────────────
-
-/**
- * Extract soak days from a text string.
- *
- * Accepted forms (case-insensitive):
- *   "30+ days", "30 days", "≥ 180 days", "180-day soak",
- *   "N days of soak", "N days each", "soak of N days"
- *
- * Returns { soakDays, soakPhrase } or null.
- * Refuses to parse if the unit is not days (surfaces as verify_unavailable
- * at the dep-check call site).
- */
-function extractSoakFromBody(body) {
-  const PATTERNS = [
-    /(\d+)\+?\s*-?day\s+soak/i,
-    /soak\s+of\s+(\d+)\+?\s*days?/i,
-    /≥\s*(\d+)\s+days?/i,
-    /(\d+)\+?\s*days?\s+(?:of\s+)?soak/i,
-    /(\d+)\+?\s*days?\s+each/i,
-    /only\s+after\s+\S+.*?(?:run\s+)?(\d+)\+?\s*days?/i,
-  ];
-  for (const re of PATTERNS) {
-    const m = body.match(re);
-    if (m && m[1]) {
-      const n = parseInt(m[1], 10);
-      if (!isNaN(n) && n > 0 && n <= 3650) return { soakDays: n, soakPhrase: m[0].trim() };
-    }
-  }
-  return null;
-}
-
-/**
- * Parse dependency slug fragments from a PRD body:
- *   - Lines under "# Dependencies", "# Depends on", "# Pre-condition", "# Blocked on"
- *   - Inline "This PRD is blocked on: - M2 — ..."
- *
- * Returns a deduplicated array of lowercase fragment strings.
- */
-function parsePrdBodyDepFragments(body) {
-  const frags = [];
-
-  const SECTION_RE = /^#+\s*(?:depends?\s+on|dependencies|pre-?conditions?|blocked\s+on)[^\n]*\n([\s\S]*?)(?=\n#|$)/im;
-  const INLINE_RE = /(?:this\s+prd\s+is\s+blocked\s+on|depends?\s+on)\s*:?\s+([\s\S]*?)(?=\n\n|$)/i;
-
-  const sections = [];
-  const sm = body.match(SECTION_RE);
-  if (sm) sections.push(sm[1]);
-  const im = body.match(INLINE_RE);
-  if (im) sections.push(im[1]);
-
-  for (const section of sections) {
-    for (const m of section.matchAll(/^\s*[-*]\s*([A-Za-z][A-Za-z0-9._-]+)/gm)) {
-      const frag = m[1].toLowerCase();
-      if (frag.length >= 2) frags.push(frag);
-    }
-  }
-  return [...new Set(frags)];
-}
+// ─── dependency check ────────────────────────────────────────────────────────
 
 /**
  * Verify that all declared dependencies for `queueEntry` are satisfied.
  *
- * Two layers:
- *   1. queue.json's `dependsOn` array (explicit slug list, often empty).
- *   2. PRD body deps section (prose slug fragments + optional soak period).
+ * One layer: queue.json's `dependsOn` array — the same and only dependency
+ * signal the dispatcher (findBlockingDep) uses. PRD body prose is NOT parsed.
  *
- * @returns {{ ok: boolean, reason?: string, floorDate?: string }}
+ * @returns {{ ok: boolean, reason?: string }}
  */
-function checkDeps(queueEntry, allJobs, prdBody) {
+function checkDeps(queueEntry, allJobs) {
   const bySlug = new Map(allJobs.map((j) => [j.slug, j]));
   // A PRD's filename carries the allocator's `NN-` prefix, but `dependsOn:` is
   // authored with the bare name (the author cannot know the number that will
@@ -477,49 +262,6 @@ function checkDeps(queueEntry, allJobs, prdBody) {
     }
   }
 
-  // 2. PRD body deps (prose).
-  if (prdBody) {
-    const frags = parsePrdBodyDepFragments(prdBody);
-    const soak = extractSoakFromBody(prdBody);
-    let latestFinishedMs = null;
-
-    for (const frag of frags) {
-      // Substring match: "m7" matches "44-signal-builder-m7-final-cutover".
-      const matches = allJobs.filter(
-        (j) => j.slug !== queueEntry.slug && j.slug.toLowerCase().includes(frag),
-      );
-      if (matches.length === 0) continue; // unresolvable fragment — skip
-
-      for (const dep of matches) {
-        if (!isSatisfiedDepRow(dep)) {
-          return {
-            ok: false,
-            reason: `PRD body dep "${frag}" → "${dep.slug}" is ${dep.status} (need completed)`,
-          };
-        }
-        if (dep.finishedAt) {
-          const t = new Date(dep.finishedAt).getTime();
-          if (!isNaN(t) && (latestFinishedMs === null || t > latestFinishedMs)) {
-            latestFinishedMs = t;
-          }
-        }
-      }
-    }
-
-    // Soak period check.
-    if (soak && latestFinishedMs !== null) {
-      const floorMs = latestFinishedMs + soak.soakDays * 86_400_000;
-      if (Date.now() < floorMs) {
-        const floorDate = new Date(floorMs).toISOString().slice(0, 10);
-        return {
-          ok: false,
-          reason: `Soak not elapsed: "${soak.soakPhrase}" requires waiting until ${floorDate}`,
-          floorDate,
-        };
-      }
-    }
-  }
-
   return { ok: true };
 }
 
@@ -895,12 +637,7 @@ function artifactsCheck({ cwd, paths, startedAt, finishedAt, fsImpl = fs }) {
  * @param {boolean}  [params.committedDuringRun] True when HEAD moved during the run,
  *                                            confirming the job's commit landed.
  *                                            Default false for back-compat.
- * @param {boolean}  [params.allowPreSentinelHeal] When true, a commit-in-window
- *                                            with no SCHEDULER_VERDICT: FAIL is
- *                                            sufficient to override weak verdicts
- *                                            (transcript_errors/verify_unavailable)
- *                                            even without a PASS sentinel. Only
- *                                            set by the boot reverify self-heal
+ * (`allowPreSentinelHeal` is still passed by one caller but is ignored: the pattern verdicts it healed no longer exist.)
  *                                            pass for pre-sentinel legacy runs.
  * @param {Function} [params.ghExecImpl]      Test-only override for the `gh pr view`
  *                                            subprocess call used by the -merge-main
@@ -931,7 +668,7 @@ function artifactsCheck({ cwd, paths, startedAt, finishedAt, fsImpl = fs }) {
  * @returns {Promise<{verdict:string, reason:string, downgradeTo:string|null}>}
  */
 async function verifyRun({
-  runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false,
+  runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false,
   ghExecImpl, priorLandedCommit = null, jobLandedCommitThisRun = null, exitCode = null, worktreeDir = null,
 }) {
   const { slug } = queueEntry;
@@ -971,11 +708,9 @@ async function verifyRun({
 
     // ── 1. Dependency check ────────────────────────────────────────────────
     // Run first: if deps are unmet we can skip the expensive log parse.
-    const depsResult = checkDeps(queueEntry, allJobs, prdBody);
+    const depsResult = checkDeps(queueEntry, allJobs);
     if (!depsResult.ok) {
-      return conclude('deps_unmet', depsResult.reason, 'pending', {
-        soakFloorDate: depsResult.floorDate ?? null,
-      });
+      return conclude('deps_unmet', depsResult.reason, 'pending');
     }
 
     // ── 2. Parse log ───────────────────────────────────────────────────────
@@ -1021,108 +756,20 @@ async function verifyRun({
       }
     }
 
-    // ── 4. Tool-result error scan ─────────────────────────────────────────
-    const total = events.length;
-    const last20pctStart = Math.floor(total * 0.8);
+    // ── 4. Policy-denial annotations ──────────────────────────────────────
+    // The verdict depends only on outcomes (sentinel, commit evidence, exit,
+    // log readability) — transcript content is never scanned for error text.
+    // A PreToolUse denial is still recorded as a non-blocking annotation.
     const issues = [];
-    // Non-blocking notes: signals worth recording but not strong enough to
-    // downgrade (e.g. a missing-dependency probe in a run that still succeeded).
     const annotations = [];
-    const runSucceeded = !!resultEvent && resultEvent.subtype === 'success';
-
     for (let i = 0; i < events.length; i++) {
       const ev = events[i];
-      if (ev.kind !== 'tool_result') continue;
-
-      // Harness tool errors (`<tool_use_error>…`) are emitted when the model
-      // requests a tool that isn't available — e.g. a wrong-case name like
-      // "bash" instead of "Bash", or a tool outside the allowlist. The harness
-      // rejects the call and the model retries with a valid tool; the task is
-      // unaffected. These are never task failures, so they are exempt from both
-      // the is_error scan and the content pattern scan (false-positive class
-      // seen in 58-web-remote-correctness-batch, 2026-06-10).
-      if (isHarnessToolError(ev.content)) continue;
-
-      // A PreToolUse policy denial (a guard hook blocked the call before it
-      // ran) is exempt from both the is_error scan and the content-pattern
-      // scan for the same reason as a harness tool error above — the denied
-      // call never executed. Unlike a harness tool error, record it as an
-      // annotation so the denial stays visible in the verdict record instead
-      // of vanishing silently.
+      if (ev.kind !== 'tool_result' || ev.parentToolUseId) continue;
       if (isPolicyDenial(ev.content)) {
         annotations.push({
           verdict: 'policy_denial',
           reason: `PreToolUse policy denial at event ${i}: ${ev.content.slice(0, 200)}`,
         });
-        continue;
-      }
-
-      // A tool_result carrying a non-null parent_tool_use_id happened INSIDE a Task
-      // subagent's own execution, not in the main agent's. Subagents do ordinary
-      // exploratory work (greps that exit 1 on no-match, ls on a path that may not
-      // exist) whose failures say nothing about whether the parent run succeeded —
-      // the same false-positive class the Task exemption below already covers for the
-      // content-pattern scan, which sits after this branch and so never reached
-      // is_error. The subagent's OWN final Task tool_result has parentToolUseId ===
-      // null and is still scanned, so a genuinely failed subagent still surfaces.
-      // (Incident: 955-route-epic-create-through-ipc, 2026-08-03 — a fully green,
-      // committed run parked in needs_review over a code-reviewer subagent's
-      // no-match grep at event 450/499.)
-      if (ev.parentToolUseId) continue;
-
-      // is_error:true in the final 20% of the transcript.
-      if (ev.isError && i >= last20pctStart) {
-        const desc = toolUseDesc(events, ev.toolUseId);
-        if (!isSelfRecovered(events, ev.seq, desc)) {
-          issues.push({
-            verdict: 'transcript_errors',
-            reason: `is_error=true in final 20% of transcript (event ${i}/${total})`,
-            priority: 2,
-          });
-          continue; // is_error already covers any content patterns
-        }
-      }
-
-      if (!ev.content) continue;
-
-      // Subagent (Task) results are structured prose — review findings that
-      // *describe* exceptions ("will crash with ImportError") are the dominant
-      // false-positive source (feedback 2026-06-10-01). Real runtime errors
-      // surface through Bash/test tool_results, which are still scanned.
-      if (toolUseName(events, ev.toolUseId) === 'Task') continue;
-
-      const hit = detectPattern(ev.content);
-      if (!hit) continue;
-
-      const desc = toolUseDesc(events, ev.toolUseId);
-
-      if (hit.verdict === 'verify_unavailable') {
-        // ModuleNotFoundError/ImportError: first check for pip/uv install in
-        // the next ≤5 tool_use calls (the agent may have self-healed).
-        if (!hasInstallRecovery(events, ev.seq) && !isSelfRecovered(events, ev.seq, desc)) {
-          const note = `${hit.pattern} at event ${i}, no install recovery found`;
-          if (runSucceeded) {
-            // "Verification couldn't run" is the weakest signal. When the run
-            // still reached a genuine result:success, the agent resolved its
-            // environment (often an interpreter/venv search the recovery
-            // heuristics above don't model) and finished — record it as an
-            // annotation, do NOT downgrade. transcript_errors (real logic/test
-            // failures) are never demoted this way, so the false-PASS guard is
-            // intact. (feedback 2026-06-10 addendum.)
-            annotations.push({ verdict: 'verify_unavailable', reason: note });
-          } else {
-            issues.push({ verdict: 'verify_unavailable', reason: note, priority: 1 });
-          }
-        }
-      } else {
-        // transcript_errors (FAIL/FATAL/Traceback): self-recovery escape hatch.
-        if (!isSelfRecovered(events, ev.seq, desc)) {
-          issues.push({
-            verdict: 'transcript_errors',
-            reason: `${hit.pattern} at event ${i} (no self-recovery)`,
-            priority: 2,
-          });
-        }
       }
     }
 
@@ -1156,37 +803,6 @@ async function verifyRun({
       );
     }
 
-    // Ground truth outranks heuristics: an exit-0 run that landed a commit
-    // ATTRIBUTABLE TO THIS RUN (spawnJob's own guardHeadBefore/headAtExit
-    // delta, or the repo-wide committedDuringRun window scan) and never
-    // printed an explicit SCHEDULER_VERDICT: FAIL demotes every
-    // transcript_errors/verify_unavailable hit from `issues` to `annotations`
-    // — a tool error the agent already recovered from three calls later, or
-    // an environment probe, says nothing once the work is materially proven
-    // to have landed. Deliberately narrower than the sentinel-override below:
-    // it needs no PASS claim at all, only the ABSENCE of an explicit FAIL, so
-    // it also catches the majority no-sentinel-at-all park class that the
-    // PASS+commitEvidence override (further below) can never reach. Never
-    // demotes pass_no_commit/no_verdict_sentinel/abandoned_background_task —
-    // those are added below this point and are about the ABSENCE of a
-    // sentinel/commit, which this same evidence does not resolve.
-    // (Incident: 1218-fo-01 — a `git apply` "patch does not apply" tool error
-    // at event 179/209 was retried and succeeded 3 events later, the run
-    // landed commit d1edf15, and the row was parked needs_review anyway,
-    // spawning a $3.74 fix-plan investigation into work that needed no fix.)
-    const groundTruthOutranksHeuristics = exitCode === 0 && commitEvidence && sentinel !== 'fail';
-    if (groundTruthOutranksHeuristics) {
-      for (let k = issues.length - 1; k >= 0; k--) {
-        if (issues[k].verdict === 'transcript_errors' || issues[k].verdict === 'verify_unavailable') {
-          annotations.push({
-            verdict: issues[k].verdict,
-            reason: `${issues[k].reason} (demoted: exit 0 + commit landed this run outranks transcript heuristics)`,
-          });
-          issues.splice(k, 1);
-        }
-      }
-    }
-
     const sentinelFields = sentinel ? { sentinel } : {};
     const extras = (annotations.length || sentinel)
       ? { ...(annotations.length ? { annotations } : {}), ...sentinelFields }
@@ -1384,51 +1000,10 @@ async function verifyRun({
       return conclude('clean', reason, null, extras);
     }
 
-    // Pick highest-priority issue (transcript_errors > verify_unavailable ==
-    // no_verdict_sentinel; ties keep the loop's original order via stable sort).
+    // Highest-priority outcome issue wins (stable sort keeps loop order on ties).
     issues.sort((a, b) => b.priority - a.priority);
     const top = issues[0];
 
-    // Sentinel override: SCHEDULER_VERDICT: PASS + a commit that landed during
-    // the run is authoritative evidence the job succeeded. Suppresses incidental
-    // transcript noise (grep results with "Error", TDD red-phase reproductions,
-    // Traceback in debug output) for the two weakest verdict classes.
-    // MUST NOT apply to halt or deps_unmet — those keep their existing semantics.
-    if (
-      sentinel === 'pass'
-      && commitEvidence
-      && (top.verdict === 'transcript_errors' || top.verdict === 'verify_unavailable')
-    ) {
-      return conclude('clean',
-        `SCHEDULER_VERDICT: PASS + commit landed overrides ${top.verdict}`,
-        null,
-        {
-          ...(annotations.length ? { annotations } : {}),
-          sentinel,
-          sentinelOverride: top.verdict,
-          ...(commitEvidenceSource ? { commitEvidenceSource } : {}),
-        },
-      );
-    }
-
-    // Pre-sentinel heal: job predates SCHEDULER_VERDICT emission. A commit in
-    // the run window with no explicit FAIL sentinel is weak but sufficient to
-    // override the two weakest verdict classes during the self-heal pass.
-    // Only applies when the caller opts in (allowPreSentinelHeal=true) — live
-    // runs never set this, so only the boot reverify self-heal uses it.
-    if (
-      allowPreSentinelHeal
-      && committedDuringRun
-      && sentinel !== 'fail'
-      && (top.verdict === 'transcript_errors' || top.verdict === 'verify_unavailable')
-    ) {
-      return conclude('clean',
-        `pre-sentinel heal: committed in run window, no SCHEDULER_VERDICT: FAIL, overrides ${top.verdict}`,
-        null,
-        { ...(annotations.length ? { annotations } : {}), preSentinelHeal: top.verdict },
-      );
-    }
-
     return conclude(top.verdict, top.reason, 'needs_review', extras);
 
   } catch (e) {
@@ -1443,14 +1018,7 @@ async function verifyRun({
 module.exports = {
   verifyRun,
   // Exposed for unit tests.
-  detectPattern,
-  isHarnessToolError,
   isPolicyDenial,
-  isSelfRecovered,
-  normalizeDescForRecovery,
-  toolUseName,
-  extractSoakFromBody,
-  parsePrdBodyDepFragments,
   checkDeps,
   parseLog,
   scanSentinel,

package/src/main/scheduler/reviewLadder.cjs

@@ -35,6 +35,13 @@ const { DEFAULT_PROJECT_CWD } = require('../lib/scheduler/schedulerBatch.cjs');
  * exactly (always returns null), mirroring SM_RCA_DISABLE/SM_DOD_DISABLE.
  */
 /** A row parked on a question only the human can answer — no automatic rung may touch it. */
+// PRD refire-cap: a row parked by the post-run re-fire cap stays parked for the
+// Epic's grouped notice. Every automated rung (reset, re-verify, auto-fix,
+// auto-skip) consults this ONE predicate.
+function isRefireCapped(job) {
+  return !!job && job.verifierVerdict === 'refire_capped';
+}
+
 function isNeedsHuman(job) {
   return !!job && job.verifierVerdict === 'needs_human';
 }
@@ -399,6 +406,7 @@ function isStrandedAutoFixPark(job, jobsInProject) {
  * Exported for tests.
  */
 function isEligibleForNeedsReviewAutoResolve(job, jobsInProject = []) {
+  if (isRefireCapped(job)) return false;
   return isExhaustedAutoFix(job) || isGuardParkedWithoutAutoFix(job) || isStrandedAutoFixPark(job, jobsInProject);
 }
 
@@ -534,7 +542,7 @@ function isFailedUnverifiedShaped(job) {
 }
 
 function isRescanCandidate(job) {
-  if (!job || isCancelledJob(job)) return false;
+  if (!job || isCancelledJob(job) || isRefireCapped(job)) return false;
   // Default-ELIGIBLE: every needs_review row is a heal candidate unless its
   // verdict is in RESCAN_EXCLUDED_VERDICTS. No runId requirement here — a row
   // without one still gets the evidence rung and the unresolvable annotation.
@@ -645,7 +653,7 @@ const STUCK_FAILED_ESCALATE_MS = process.env.SM_STUCK_FAILED_ESCALATE_HOURS
 /**
  * Kill-switch gate for the stuck-failed escalation below
  * (SM_STUCK_FAILED_ESCALATE_DISABLE=1), mirroring the
- * SM_REVERIFY_PERIODIC_DISABLE / SM_RCA_DISABLE convention. A tiny wrapper
+ * SM_RCA_DISABLE convention. A tiny wrapper
  * so the disable path is unit-testable without invoking the 10-minute
  * setInterval body directly.
  */
@@ -862,6 +870,7 @@ function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRu
   const slugsInQueue = new Set(jobs.map((j) => j.slug));
   return jobs.filter((job) => {
     if (isCancelledJob(job)) return false;
+    if (isRefireCapped(job)) return false;
     if (job.status !== 'needs_review') return false;
     if (isNeedsHuman(job)) return false;
     // A job parked here because it was blocked by a sibling's foreign WIP
@@ -1005,6 +1014,7 @@ function selectGateShadowTarget(jobs, headByCwd, { authorityDisabled = false, ba
 
 module.exports = {
   isNeedsHuman,
+  isRefireCapped,
   isCancelledJob,
   selectResumeRecoveryTarget,
   MECHANICALLY_RESOLVABLE_VERDICTS,