claude-code-session-manager 0.35.15 → 0.35.17

package/src/main/health.cjs

@@ -9,10 +9,27 @@ const fsp = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
 const { execFileSync } = require('node:child_process');
+const { POLL_INTERVAL_MS } = require('./lib/schedulerConfig.cjs');
 
 const MAX_LOG_AGE_MS = 5 * 60_000; // 5 min — warn if no logs this old
 const PROJECT_ROOT = path.resolve(__dirname, '../..');
 
+// tickQueue() only fires (and updates lastRunAt) when a batch is actually
+// spawned — it does not tick on a fixed cadence — but the poll loop that
+// *invokes* tickQueue backs off starting from POLL_INTERVAL_MS (scheduler.cjs
+// pollLoop). 3x gives the poll loop three chances to notice free capacity +
+// pending work before we call it a stall, absorbing normal jitter (backoff,
+// memory-gate deferrals, boot warmup) without waiting so long that a real
+// outage goes unnoticed for hours (the 2026-07-14 incident sat stalled for
+// 16.5h before anything asserted on it).
+const TICK_STALL_MULTIPLIER = 3;
+const TICK_STALL_THRESHOLD_MS = TICK_STALL_MULTIPLIER * POLL_INTERVAL_MS;
+// A heartbeat line older than this is treated as "the app isn't running /
+// we can't observe live utilization" rather than "utilization is low" —
+// scheduler-heartbeat.log is only appended to while Electron is running, so
+// a stale line here is silent-on-purpose, not evidence of anything.
+const HEARTBEAT_STALE_MS = 5 * 60_000;
+
 function runCheck(cmd, cwd = PROJECT_ROOT) {
   try {
     execFileSync('bash', ['-c', cmd], {
@@ -26,6 +43,80 @@ function runCheck(cmd, cwd = PROJECT_ROOT) {
   }
 }
 
+// Reads the last line of scheduler-heartbeat.log, if fresh enough to trust.
+// Returns null when the file is missing, empty, unparseable, or stale — all
+// of which mean "can't observe live utilization right now", not "utilization
+// is low".
+function readFreshHeartbeat(heartbeatPath) {
+  let lines;
+  try {
+    lines = fs.readFileSync(heartbeatPath, 'utf8').split('\n').filter(Boolean);
+  } catch {
+    return null;
+  }
+  if (lines.length === 0) return null;
+  let entry;
+  try {
+    entry = JSON.parse(lines[lines.length - 1]);
+  } catch {
+    return null;
+  }
+  if (typeof entry.ts !== 'number' || Date.now() - entry.ts > HEARTBEAT_STALE_MS) return null;
+  return entry;
+}
+
+// Evaluates whether the scheduler tick looks stalled: pending work exists,
+// there's free capacity to run it, and nothing about the queue's own state
+// explains why it hasn't. Kept as a pure function of (queueState, heartbeat,
+// now) so it's testable without touching the filesystem.
+function evaluateTickLiveness(queueState, heartbeat, now, runningCount) {
+  const jobs = queueState.jobs || [];
+  const pending = jobs.filter((j) => j.status === 'pending');
+  const running = runningCount ?? jobs.filter((j) => j.status === 'running').length;
+  const config = queueState.config || {};
+  const concurrencyCap = config.concurrencyCap ?? Infinity;
+
+  if (pending.length === 0) return { stalled: false, reason: 'no-pending-jobs' };
+  if (queueState.paused) return { stalled: false, reason: 'paused' };
+  if (config.enabled === false) return { stalled: false, reason: 'disabled' };
+  if (running >= concurrencyCap) return { stalled: false, reason: 'at-capacity' };
+
+  const lastRunAt = queueState.lastRunAt ? Date.parse(queueState.lastRunAt) : null;
+  // No lastRunAt at all (fresh install, never ticked) — nothing to measure
+  // staleness against yet; don't manufacture a false positive.
+  if (lastRunAt == null || Number.isNaN(lastRunAt)) {
+    return { stalled: false, reason: 'no-lastRunAt', caveat: true };
+  }
+  const tickAgeMs = now - lastRunAt;
+  if (tickAgeMs <= TICK_STALL_THRESHOLD_MS) return { stalled: false, reason: 'recent-tick' };
+
+  // Candidate stall. The 'when-available' firePolicy legitimately holds
+  // pending jobs when billing utilization is at/above utilizationThreshold —
+  // rule that out before calling it a stall.
+  if (config.firePolicy === 'when-available' && typeof config.utilizationThreshold === 'number') {
+    if (!heartbeat) {
+      return {
+        stalled: false,
+        caveat: true,
+        reason: 'cannot-verify-utilization',
+        tickAgeMs,
+        oldestPendingSlug: pending[0]?.slug,
+      };
+    }
+    if (typeof heartbeat.utilization === 'number' && heartbeat.utilization >= config.utilizationThreshold) {
+      return { stalled: false, reason: 'utilization-at-threshold', utilization: heartbeat.utilization };
+    }
+  }
+
+  return {
+    stalled: true,
+    reason: 'stalled',
+    tickAgeMs,
+    oldestPendingSlug: pending[0]?.slug,
+    pendingCount: pending.length,
+  };
+}
+
 async function check() {
   const start = Date.now();
   const status = {
@@ -106,13 +197,33 @@ async function check() {
     const failedCount = Object.values(queueState.jobs || {}).filter(
       (j) => j.status === 'failed'
     ).length;
+    const heartbeatPath = path.join(
+      os.homedir(),
+      '.claude/session-manager/scheduler-heartbeat.log'
+    );
+    const heartbeat = readFreshHeartbeat(heartbeatPath);
+    const liveness = evaluateTickLiveness(queueState, heartbeat, Date.now(), runningCount);
     status.components.scheduler_queue = {
-      ok: true,
+      ok: !liveness.stalled,
       path: queuePath,
       jobs: Object.keys(queueState.jobs || {}).length,
       running: runningCount,
       failed: failedCount,
+      tickLiveness: liveness.reason,
     };
+    if (liveness.stalled) {
+      const ageMin = Math.round(liveness.tickAgeMs / 60_000);
+      status.components.scheduler_queue.stalledJob = liveness.oldestPendingSlug;
+      status.components.scheduler_queue.tickAgeMs = liveness.tickAgeMs;
+      status.issues.push(
+        `Scheduler tick appears stalled: "${liveness.oldestPendingSlug}" (and ${liveness.pendingCount - 1} other pending job(s)) has been waiting ~${ageMin}m with free capacity and no tick progress`
+      );
+    } else if (liveness.caveat) {
+      status.components.scheduler_queue.caveat =
+        liveness.reason === 'cannot-verify-utilization'
+          ? `Tick hasn't advanced in a while but scheduler-heartbeat.log is missing/stale, so current billing utilization can't be checked — cannot rule out a legitimate when-available hold`
+          : 'No lastRunAt recorded yet — cannot assess tick liveness';
+    }
   } catch (e) {
     if (e.code !== 'ENOENT') {
       status.issues.push(`Scheduler queue unreadable: ${e.message}`);
@@ -197,7 +308,7 @@ async function check() {
   // Critical: nodejs, config dir, typescript, build artifact, test infrastructure.
   // Non-fatal: scheduler/transcripts dirs may not exist on fresh install.
   // Informational: app log age (shows if app is running, but not blocking).
-  const criticalComponents = ['nodejs', 'config_dir', 'typescript', 'build_artifact', 'test_infrastructure'];
+  const criticalComponents = ['nodejs', 'config_dir', 'typescript', 'build_artifact', 'test_infrastructure', 'scheduler_queue'];
   status.ok = criticalComponents.every((c) => status.components[c]?.ok !== false);
 
   status.elapsedMs = Date.now() - start;
@@ -213,4 +324,4 @@ if (require.main === module) {
   })();
 }
 
-module.exports = { check };
+module.exports = { check, evaluateTickLiveness, readFreshHeartbeat, TICK_STALL_THRESHOLD_MS, HEARTBEAT_STALE_MS };

package/src/main/hives.cjs

@@ -33,6 +33,7 @@ const path = require('node:path');
 const os = require('node:os');
 const { z } = require('zod');
 const config = require('./config.cjs');
+const { kebabCase: sharedKebabCase } = require('./lib/kebabCase.cjs');
 
 // ──────────────────────────────────────────── caps
 const SLUG_RE = /^[a-z0-9-_]{1,64}$/;
@@ -89,7 +90,7 @@ async function ensureRoot() {
 
 // ──────────────────────────────────────────── helpers
 function kebabCase(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 64) || 'agent';
+  return sharedKebabCase(s, { maxLen: 64, fallback: 'agent' });
 }
 
 // ──────────────────────────────────────────── legacy migration

package/src/main/ipcSchemas.cjs

@@ -228,6 +228,33 @@ const scheduleWritePrd = z.object({
   ),
 });
 
+// PRD create (admin API — scheduler_create_prd, PRD 549). This slug is
+// deliberately STRICTER than SCHEDULE_SLUG_RE: it becomes a brand-new
+// filename segment written to disk by the create route, not a lookup key
+// for an existing file, so it excludes '.' and '_' too (matches
+// pluginInstall.cjs's slug precedent, minus '/' — this slug must never
+// introduce a subdirectory).
+const PRD_CREATE_SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+// title/cwd become frontmatter VALUES (`title: ${title}`) in prdCreate.cjs's
+// hand-rolled `key: value` serializer, which — unlike a real YAML
+// library — has no escaping. A title/cwd containing '\n' could inject a
+// bare `\n---\n` that terminates the frontmatter block early (per
+// prdFrontmatter.cjs's `indexOf('\n---')` parse) and smuggle extra
+// frontmatter-shaped lines into the body. Block newlines at the boundary
+// instead of trying to escape them later.
+const NO_NEWLINE_RE = /^[^\r\n]*$/;
+const schedulerCreatePrd = z.object({
+  title: z.string().min(1).max(200).regex(NO_NEWLINE_RE, 'must not contain newlines'),
+  cwd: z.string().min(1).max(4096).regex(NO_NEWLINE_RE, 'must not contain newlines'),
+  estimateMinutes: z.number().int().min(1).max(100000),
+  goal: z.string().min(1).max(20000),
+  acceptanceCriteria: z.array(z.string().min(1).max(2000)).min(1).max(100),
+  implementationNotes: z.string().min(1).max(20000),
+  outOfScope: z.array(z.string().min(1).max(2000)).max(100).optional(),
+  slug: z.string().min(1).max(60).regex(PRD_CREATE_SLUG_RE).optional(),
+  parallelGroup: z.number().int().min(1).max(999999).optional(),
+});
+
 // Bulk archive: slug list, capped to limit unbounded retag/archive payloads.
 const scheduleArchivePrd = z.object({
   slugs: z.array(z.string().regex(SCHEDULE_SLUG_RE)).min(1).max(500),
@@ -290,11 +317,11 @@ const setConfigSchema = z.object({
 }).strict();
 
 // ──────────────────────────────────────────── Memory tool (Bundle C, cycle 3)
-// Workspace-scoped markdown store at ~/.claude/session-manager/memories/<ws>/.
-// Slug regex must match memoryTool.cjs SLUG_RE; workspace regex matches its
-// encodeWorkspace() output (alphanumeric + dash) plus 'default'.
+// Workspace-scoped markdown store at ~/.claude/projects/<ws>/memory/.
+// Slug regex is shared with memoryTool.cjs/memoryAggregate.cjs via lib/memorySlug.cjs;
+// workspace regex matches encodeWorkspace() output (alphanumeric + dash) plus 'default'.
 const MEMORY_WORKSPACE_RE = /^[a-zA-Z0-9-_]{1,256}$/;
-const MEMORY_SLUG_RE = /^[a-z0-9-_]+\.md$/;
+const { MEMORY_SLUG_RE } = require('./lib/memorySlug.cjs');
 // 1 MiB hard cap — matches MAX_FILE_BYTES in memoryTool.cjs.
 const MEMORY_MAX_BYTES = 1024 * 1024;
 
@@ -613,6 +640,7 @@ module.exports = {
   // direct test()/match() containment checks alongside the zod parses.
   SCHEDULE_SLUG_RE,
   SCHEDULE_RUN_ID_RE,
+  PRD_CREATE_SLUG_RE,
   READ_COMMANDS,
   SAS_GATED_READS,
   MUTATE_COMMANDS,
@@ -651,6 +679,7 @@ module.exports = {
     scheduleSlug,
     scheduleReadLog,
     scheduleWritePrd,
+    schedulerCreatePrd,
     scheduleArchivePrd,
     scheduleRetagPrd,
     setConfigSchema,

package/src/main/lib/kebabCase.cjs

@@ -0,0 +1,12 @@
+/**
+ * kebabCase.cjs — shared lowercase/kebab-case slugify. Extracted from
+ * hives.cjs (private `kebabCase` helper) so prdCreate.cjs doesn't fork a
+ * second, subtly-different copy (API reuse: one concept, one implementation).
+ */
+'use strict';
+
+function kebabCase(s, { maxLen = 64, fallback = '' } = {}) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, maxLen) || fallback;
+}
+
+module.exports = { kebabCase };

package/src/main/lib/memorySlug.cjs

@@ -0,0 +1,10 @@
+'use strict';
+
+/**
+ * Shared workspace-memory filename regex. memoryTool.cjs (CRUD), memoryAggregate.cjs
+ * (clustering), and ipcSchemas.cjs (IPC validation) all gate on the same slug shape —
+ * single source of truth so the three don't drift.
+ */
+const MEMORY_SLUG_RE = /^[a-z0-9-_]+\.md$/;
+
+module.exports = { MEMORY_SLUG_RE };

package/src/main/lib/prdCreate.cjs

@@ -0,0 +1,73 @@
+/**
+ * prdCreate.cjs — PRD-body builder for the create-prd admin route (PRD 549,
+ * gh-issue-6). Pure functions only: no filesystem writes, no NN allocation,
+ * no HTTP. adminServer.cjs owns orchestration (auth, cwd validation via
+ * config.cjs's validatePath, NN allocation via the injected remote,
+ * writing via remote.writePrd -> config.cjs's writeTextAtomic) so this
+ * module stays trivially unit-testable.
+ *
+ * Standards are read fresh from disk on every call (no in-process caching)
+ * so a live edit to standards.md is picked up by the next create-prd call
+ * without an app restart — same one-concept-one-implementation reasoning
+ * that keeps the /develop skill re-reading it fresh per PRD (see SKILL.md).
+ */
+'use strict';
+
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+const { PRD_CREATE_SLUG_RE } = require('../ipcSchemas.cjs');
+const { kebabCase } = require('./kebabCase.cjs');
+
+const STANDARDS_PATH = path.join(
+  __dirname, '..', '..', '..',
+  'plugins', 'session-manager-dev', 'skills', 'develop', 'standards.md',
+);
+
+async function readStandards() {
+  return fsp.readFile(STANDARDS_PATH, 'utf8');
+}
+
+/** Lowercase, kebab-case, strip anything outside [a-z0-9-], cap at 60 chars. */
+function deriveSlugFromTitle(title) {
+  return kebabCase(String(title), { maxLen: 60 });
+}
+
+/**
+ * Build the full PRD markdown body (frontmatter + required sections +
+ * verbatim engineering standards), matching the structure `/develop`'s
+ * SKILL.md documents: frontmatter, then Goal / Acceptance criteria /
+ * Implementation notes / Out of scope / Engineering standards, in order.
+ */
+function buildPrdBody(input, standardsText) {
+  const {
+    title, cwd, estimateMinutes, goal, acceptanceCriteria,
+    implementationNotes, outOfScope,
+  } = input;
+
+  // No `parallelGroup` frontmatter key by convention (SKILL.md) — the NN-
+  // filename prefix is the single source of truth for grouping; adding a
+  // second one here would let the two drift out of sync.
+  const fmLines = ['---', `title: ${title}`, `cwd: ${cwd}`, `estimateMinutes: ${estimateMinutes}`, '---', ''];
+
+  const acLines = acceptanceCriteria.map((line) => `- [ ] ${line}`).join('\n');
+  const oosSource = outOfScope && outOfScope.length ? outOfScope : ['(none)'];
+  const oosLines = oosSource.map((line) => `- ${line}`).join('\n');
+
+  const bodyLines = [
+    '# Goal', '', goal, '',
+    '# Acceptance criteria', '', acLines, '',
+    '# Implementation notes', '', implementationNotes, '',
+    '# Out of scope', '', oosLines, '',
+    '## Engineering standards', '', standardsText.trimEnd(), '',
+  ];
+
+  return `${fmLines.join('\n')}${bodyLines.join('\n')}`;
+}
+
+module.exports = {
+  PRD_CREATE_SLUG_RE,
+  STANDARDS_PATH,
+  readStandards,
+  deriveSlugFromTitle,
+  buildPrdBody,
+};

package/src/main/memoryAggregate.cjs

@@ -27,10 +27,10 @@ const { encodeCwd } = require('./lib/encodeCwd.cjs');
 const { extractJson } = require('./lib/extractJson.cjs');
 const { writeJson } = require('./config.cjs');
 const config = require('./config.cjs');
+const { MEMORY_SLUG_RE } = require('./lib/memorySlug.cjs');
 
 const HOME = os.homedir();
 const CLUSTERS_DIR = path.join(HOME, '.claude', 'session-manager', 'memory-clusters');
-const MEMORY_SLUG_RE = /^[a-z0-9-_]+\.md$/;
 
 function memoryDir(workspace) {
   return path.join(HOME, '.claude', 'projects', workspace, 'memory');

package/src/main/memoryTool.cjs

@@ -30,9 +30,10 @@ const path = require('node:path');
 const os = require('node:os');
 const config = require('./config.cjs');
 
+const { MEMORY_SLUG_RE: SLUG_RE } = require('./lib/memorySlug.cjs');
+
 const MAX_FILE_BYTES = 1024 * 1024; // 1 MiB
 const MAX_ENTRIES = 1000;
-const SLUG_RE = /^[a-z0-9-_]+\.md$/;
 
 const { encodeCwd: encodeWorkspace } = require('./lib/encodeCwd.cjs');
 

package/src/main/pty.cjs

@@ -245,8 +245,9 @@ function registerPtyHandlers() {
   ipcMain.on('pty:resize', (_e, payload) => { try { manager.resize(s.ptyResize.parse(payload)); } catch { /* ignore */ } });
   ipcMain.on('pty:kill', (_e, tabId) => {
     if (typeof tabId !== 'string') return;
+    // manager.kill() already drops superagent run state for tabId — see kill()
+    // above. Do not duplicate that call here.
     manager.kill(tabId);
-    try { require('./superagent.cjs').dropTab(tabId); } catch { /* superagent module not initialized (e2e) */ }
   });
 }
 

package/src/main/runVerify.cjs

@@ -36,9 +36,13 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const { execFileSync } = require('node:child_process');
 
 const VERDICTS_SCHEMA_VERSION = 1;
 
+// Bound on the `gh pr view` postcondition check below (§ merge-main exemption).
+const GH_CHECK_TIMEOUT_MS = 15_000;
+
 // ─── content pattern detectors ───────────────────────────────────────────────
 
 /**
@@ -445,6 +449,69 @@ function scanSentinel(resultEvent, events) {
   return null;
 }
 
+// ─── merge-main postcondition exemption ──────────────────────────────────────
+
+/**
+ * True for the `NN-prXXX-merge-main` / `NN-fix-prXXX-merge-main` slug
+ * convention already used dozens of times in this queue (merge-current-main
+ * PRDs targeting a shared repo's PR branch). Narrow, mechanical string check —
+ * this is the only slug shape exempted from the `pass_no_commit` flag below.
+ */
+function isMergeMainSlug(slug) {
+  return typeof slug === 'string' && /-merge-main$/.test(slug);
+}
+
+/**
+ * Extract the target PR number for a `-merge-main` PRD. The convention embeds
+ * it two ways: in the frontmatter title/body as "PR #<n>" (preferred — the
+ * human-authored, unambiguous source), and in the slug itself as "prNNN"
+ * (fallback, for PRD text that doesn't spell it out). Returns null if neither
+ * source yields a number.
+ */
+function extractMergeMainPrNumber(slug, prdFullText) {
+  if (typeof prdFullText === 'string') {
+    const m = prdFullText.match(/PR\s*#(\d+)/i);
+    if (m) return parseInt(m[1], 10);
+  }
+  const sm = typeof slug === 'string' ? slug.match(/pr(\d+)-merge-main$/) : null;
+  if (sm) return parseInt(sm[1], 10);
+  return null;
+}
+
+/**
+ * Independently re-check a PR's mergeable state via `gh pr view`. Used only to
+ * decide whether a `-merge-main` PRD's unsubstantiated PASS (no commit landed
+ * during the run) reflects a target that was already satisfied by an
+ * out-of-band actor before this run started — see the 2026-07-18 false-positive
+ * feedback item.
+ *
+ * Bounded (15s) and fully fail-safe: ANY error (gh missing/unauthed, network,
+ * timeout, malformed JSON, non-existent PR) resolves `{ ok: false }` rather
+ * than throwing, so a failure here only ever falls back to today's behavior —
+ * it can never turn a real failure into a false "verified".
+ *
+ * `execImpl` is injectable (defaults to `child_process.execFileSync`) so unit
+ * tests can stub the subprocess call without shelling out to a real `gh`.
+ *
+ * @returns {{ ok: boolean, data?: { mergeable: string, mergeStateStatus: string }, error?: string }}
+ */
+function checkMergeablePr({ cwd, prNumber, timeoutMs = GH_CHECK_TIMEOUT_MS, execImpl = execFileSync }) {
+  try {
+    const out = execImpl(
+      'gh',
+      ['pr', 'view', String(prNumber), '--json', 'mergeable,mergeStateStatus'],
+      { cwd, timeout: timeoutMs, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] },
+    );
+    const data = JSON.parse(out);
+    if (data && data.mergeable === 'MERGEABLE' && data.mergeStateStatus !== 'CONFLICTING') {
+      return { ok: true, data };
+    }
+    return { ok: false, data };
+  } catch (e) {
+    return { ok: false, error: e?.message ?? String(e) };
+  }
+}
+
 // ─── main verifier ────────────────────────────────────────────────────────────
 
 /**
@@ -467,9 +534,13 @@ function scanSentinel(resultEvent, events) {
  *                                            even without a PASS sentinel. Only
  *                                            set by the boot reverify self-heal
  *                                            pass for pre-sentinel legacy runs.
+ * @param {Function} [params.ghExecImpl]      Test-only override for the `gh pr view`
+ *                                            subprocess call used by the -merge-main
+ *                                            postcondition exemption. Defaults to
+ *                                            child_process.execFileSync.
  * @returns {Promise<{verdict:string, reason:string, downgradeTo:string|null}>}
  */
-async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false }) {
+async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false, ghExecImpl }) {
   const { slug } = queueEntry;
   const logPath = path.join(runDir, `${slug}.log`);
   const verdictsPath = path.join(runDir, `${slug}.verdicts.json`);
@@ -491,8 +562,10 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
   try {
     // ── Read PRD body (strip frontmatter) ──────────────────────────────────
     let prdBody = '';
+    let prdFullText = '';
     try {
       const prdText = fs.readFileSync(prdPath, 'utf8');
+      prdFullText = prdText;
       if (prdText.startsWith('---\n')) {
         const end = prdText.indexOf('\n---', 4);
         prdBody = end !== -1 ? prdText.slice(end + 4).trim() : prdText;
@@ -650,11 +723,48 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
     // signal and stays covered by this check.
     const isFixPlanJob = /^\d+-fix-/.test(queueEntry?.slug || '');
     if (sentinel === 'pass' && !committedDuringRun && !isFixPlanJob) {
-      issues.push({
-        verdict: 'pass_no_commit',
-        reason: 'SCHEDULER_VERDICT: PASS but no commit landed during the run window — the run claims success but produced no code change',
-        priority: 1,
-      });
+      // EXEMPTION: `-merge-main` PRDs (see isMergeMainSlug) can genuinely and
+      // correctly find nothing left to do when an out-of-band actor (a human,
+      // another agent, a sibling scheduler job) already merged/updated the
+      // target PR branch before this run started. Before flagging, independently
+      // re-check the PR's real mergeable state via `gh` — if it confirms the
+      // target is already clean, this is not a false PASS, it's a correct one.
+      // Fails safe: any `gh` error falls straight through to the pass_no_commit
+      // flag below, exactly as before this exemption existed.
+      let mergeMainVerified = false;
+      if (isMergeMainSlug(slug)) {
+        const prNumber = extractMergeMainPrNumber(slug, prdFullText);
+        if (prNumber != null) {
+          const ghResult = checkMergeablePr({
+            cwd: queueEntry?.cwd,
+            prNumber,
+            ...(ghExecImpl ? { execImpl: ghExecImpl } : {}),
+          });
+          if (ghResult.ok) {
+            mergeMainVerified = true;
+            return conclude(
+              'pass_no_commit_target_verified',
+              `SCHEDULER_VERDICT: PASS with no commit, but independently verified PR #${prNumber} is mergeable `
+                + `(mergeStateStatus: ${ghResult.data.mergeStateStatus}) — target was already satisfied by an `
+                + 'out-of-band actor before this run started',
+              null,
+              {
+                ...(annotations.length ? { annotations } : {}),
+                sentinel,
+                verifiedPrNumber: prNumber,
+                ghMergeState: ghResult.data,
+              },
+            );
+          }
+        }
+      }
+      if (!mergeMainVerified) {
+        issues.push({
+          verdict: 'pass_no_commit',
+          reason: 'SCHEDULER_VERDICT: PASS but no commit landed during the run window — the run claims success but produced no code change',
+          priority: 1,
+        });
+      }
     }
 
     if (issues.length === 0) {
@@ -726,4 +836,7 @@ module.exports = {
   checkDeps,
   parseLog,
   scanSentinel,
+  isMergeMainSlug,
+  extractMergeMainPrNumber,
+  checkMergeablePr,
 };

package/src/main/scheduler/prdParser.cjs

@@ -141,10 +141,98 @@ function _resetCache() {
   prdFileCache.clear();
 }
 
+// ────────────────────────────────────────────── group allocation
+//
+// `NN` (the filename prefix, parsed above by groupFromName) is both the
+// authoring counter AND the parallel-group key the scheduler groups by.
+// Two authors computing "max NN in prds/" concurrently can allocate the
+// same NN for unrelated PRDs, which silently merges two projects' work
+// into one parallel group (incident 2026-07-14/2026-07-15, PRDs 05-11 vs
+// 06-09, then 545 collided again). allocateParallelGroup() closes that
+// race with an O(n) full-directory scan (not a caller-narrowed glob — see
+// PRD_AUTHORING.md's `'^10[0-9]'` cautionary example) plus an O_EXCL
+// reservation file, so two concurrent callers can never walk away with
+// the same new NN.
+//
+// A reservation is a zero-byte `.reserved-<NN>` file created with the
+// 'wx' (O_CREAT|O_EXCL) flag — the OS guarantees only one of two racing
+// `open()` calls for the same path succeeds. Reservations are counted
+// alongside real `NN-slug.md` files when computing the next max, so a
+// crash between "reserve NN" and "author NN-slug.md" just permanently
+// retires that one NN rather than wedging future allocations. This keeps
+// the filesystem itself as the single source of truth (no separate
+// `.next-nn`/registry file that could drift out of sync with prds/).
+//
+// Callers who want an EXISTING group (deliberate parallel siblings, e.g.
+// three PRDs sharing 545) never call this — they just write the shared
+// `NN-` prefix directly, same as today. This function only mints NEW
+// group numbers.
+
+const RESERVATION_RE = /^\.reserved-(\d+)$/;
+const GROUP_PREFIX_RE = /^(\d+)-/;
+const MAX_RESERVE_ATTEMPTS = 1000;
+
+/**
+ * Highest `NN` currently in use under prdsDir, across real `NN-slug.md`
+ * PRD files (any digit count, unpadded or not — matches groupFromName
+ * above) AND in-flight `.reserved-NN` markers. Full directory scan, no
+ * narrowed glob. Returns 0 if the directory is empty/missing.
+ */
+async function maxParallelGroupInUse(prdsDir) {
+  let entries;
+  try {
+    entries = await fsp.readdir(prdsDir);
+  } catch {
+    return 0;
+  }
+  let max = 0;
+  for (const name of entries) {
+    if (name.startsWith('.')) {
+      const rm = name.match(RESERVATION_RE);
+      if (rm) max = Math.max(max, Number(rm[1]));
+      continue;
+    }
+    if (!name.endsWith('.md')) continue;
+    const m = name.match(GROUP_PREFIX_RE);
+    if (m) max = Math.max(max, Number(m[1]));
+  }
+  return max;
+}
+
+/**
+ * Atomically allocate a brand-new parallel-group number under prdsDir.
+ * Returns the reserved NN. Reservation survives a crash mid-allocation
+ * (the `.reserved-NN` marker just sits there forever, retiring that one
+ * number) and never wedges future callers, since each attempt only needs
+ * the marker for its OWN candidate to not already exist.
+ */
+async function allocateParallelGroup(prdsDir) {
+  await fsp.mkdir(prdsDir, { recursive: true });
+  let candidate = (await maxParallelGroupInUse(prdsDir)) + 1;
+  for (let attempt = 0; attempt < MAX_RESERVE_ATTEMPTS; attempt += 1) {
+    const markerPath = path.join(prdsDir, `.reserved-${candidate}`);
+    let fh;
+    try {
+      fh = await fsp.open(markerPath, 'wx');
+    } catch (e) {
+      if (e && e.code === 'EEXIST') {
+        candidate += 1;
+        continue;
+      }
+      throw e;
+    }
+    await fh.close();
+    return candidate;
+  }
+  throw new Error(`allocateParallelGroup: exhausted ${MAX_RESERVE_ATTEMPTS} reservation attempts starting at ${candidate}`);
+}
+
 module.exports = {
   parsePrdRaw,
   parsePrd,
   listPrdFiles,
+  allocateParallelGroup,
+  maxParallelGroupInUse,
   PRD_READ_MAX_BYTES,
   _resetCache,
 };