claude-code-session-manager 0.35.16 → 0.35.18

package/src/main/lib/prdCreate.cjs

@@ -0,0 +1,73 @@
+/**
+ * prdCreate.cjs — PRD-body builder for the create-prd admin route (PRD 549,
+ * gh-issue-6). Pure functions only: no filesystem writes, no NN allocation,
+ * no HTTP. adminServer.cjs owns orchestration (auth, cwd validation via
+ * config.cjs's validatePath, NN allocation via the injected remote,
+ * writing via remote.writePrd -> config.cjs's writeTextAtomic) so this
+ * module stays trivially unit-testable.
+ *
+ * Standards are read fresh from disk on every call (no in-process caching)
+ * so a live edit to standards.md is picked up by the next create-prd call
+ * without an app restart — same one-concept-one-implementation reasoning
+ * that keeps the /develop skill re-reading it fresh per PRD (see SKILL.md).
+ */
+'use strict';
+
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+const { PRD_CREATE_SLUG_RE } = require('../ipcSchemas.cjs');
+const { kebabCase } = require('./kebabCase.cjs');
+
+const STANDARDS_PATH = path.join(
+  __dirname, '..', '..', '..',
+  'plugins', 'session-manager-dev', 'skills', 'develop', 'standards.md',
+);
+
+async function readStandards() {
+  return fsp.readFile(STANDARDS_PATH, 'utf8');
+}
+
+/** Lowercase, kebab-case, strip anything outside [a-z0-9-], cap at 60 chars. */
+function deriveSlugFromTitle(title) {
+  return kebabCase(String(title), { maxLen: 60 });
+}
+
+/**
+ * Build the full PRD markdown body (frontmatter + required sections +
+ * verbatim engineering standards), matching the structure `/develop`'s
+ * SKILL.md documents: frontmatter, then Goal / Acceptance criteria /
+ * Implementation notes / Out of scope / Engineering standards, in order.
+ */
+function buildPrdBody(input, standardsText) {
+  const {
+    title, cwd, estimateMinutes, goal, acceptanceCriteria,
+    implementationNotes, outOfScope,
+  } = input;
+
+  // No `parallelGroup` frontmatter key by convention (SKILL.md) — the NN-
+  // filename prefix is the single source of truth for grouping; adding a
+  // second one here would let the two drift out of sync.
+  const fmLines = ['---', `title: ${title}`, `cwd: ${cwd}`, `estimateMinutes: ${estimateMinutes}`, '---', ''];
+
+  const acLines = acceptanceCriteria.map((line) => `- [ ] ${line}`).join('\n');
+  const oosSource = outOfScope && outOfScope.length ? outOfScope : ['(none)'];
+  const oosLines = oosSource.map((line) => `- ${line}`).join('\n');
+
+  const bodyLines = [
+    '# Goal', '', goal, '',
+    '# Acceptance criteria', '', acLines, '',
+    '# Implementation notes', '', implementationNotes, '',
+    '# Out of scope', '', oosLines, '',
+    '## Engineering standards', '', standardsText.trimEnd(), '',
+  ];
+
+  return `${fmLines.join('\n')}${bodyLines.join('\n')}`;
+}
+
+module.exports = {
+  PRD_CREATE_SLUG_RE,
+  STANDARDS_PATH,
+  readStandards,
+  deriveSlugFromTitle,
+  buildPrdBody,
+};

package/src/main/memoryAggregate.cjs

@@ -27,10 +27,10 @@ const { encodeCwd } = require('./lib/encodeCwd.cjs');
 const { extractJson } = require('./lib/extractJson.cjs');
 const { writeJson } = require('./config.cjs');
 const config = require('./config.cjs');
+const { MEMORY_SLUG_RE } = require('./lib/memorySlug.cjs');
 
 const HOME = os.homedir();
 const CLUSTERS_DIR = path.join(HOME, '.claude', 'session-manager', 'memory-clusters');
-const MEMORY_SLUG_RE = /^[a-z0-9-_]+\.md$/;
 
 function memoryDir(workspace) {
   return path.join(HOME, '.claude', 'projects', workspace, 'memory');

package/src/main/memoryTool.cjs

@@ -30,9 +30,10 @@ const path = require('node:path');
 const os = require('node:os');
 const config = require('./config.cjs');
 
+const { MEMORY_SLUG_RE: SLUG_RE } = require('./lib/memorySlug.cjs');
+
 const MAX_FILE_BYTES = 1024 * 1024; // 1 MiB
 const MAX_ENTRIES = 1000;
-const SLUG_RE = /^[a-z0-9-_]+\.md$/;
 
 const { encodeCwd: encodeWorkspace } = require('./lib/encodeCwd.cjs');
 

package/src/main/pty.cjs

@@ -188,19 +188,19 @@ class PtyManager {
       // Tab was removed or never existed — tell the renderer so it can surface
       // "skipped" feedback rather than silently dropping the write.
       sendIfAlive(this.window, 'pty:write-error', { tabId, reason: 'no-pty' });
-      return;
+      return { ok: false, reason: 'no-pty' };
     }
     try {
       s.proc.write(data);
+      return { ok: true };
     } catch (err) {
       // node-pty throws synchronously (or the underlying net.Socket emits an
       // error that node-pty re-throws) when writing to an exited process.
       // Catch here so the uncaught-exception handler never sees it, and notify
       // the renderer to surface "skipped" feedback.
-      sendIfAlive(this.window, 'pty:write-error', {
-        tabId,
-        reason: String(err?.message || 'write-failed'),
-      });
+      const reason = String(err?.message || 'write-failed');
+      sendIfAlive(this.window, 'pty:write-error', { tabId, reason });
+      return { ok: false, reason };
     }
   }
 
@@ -245,8 +245,9 @@ function registerPtyHandlers() {
   ipcMain.on('pty:resize', (_e, payload) => { try { manager.resize(s.ptyResize.parse(payload)); } catch { /* ignore */ } });
   ipcMain.on('pty:kill', (_e, tabId) => {
     if (typeof tabId !== 'string') return;
+    // manager.kill() already drops superagent run state for tabId — see kill()
+    // above. Do not duplicate that call here.
     manager.kill(tabId);
-    try { require('./superagent.cjs').dropTab(tabId); } catch { /* superagent module not initialized (e2e) */ }
   });
 }
 

package/src/main/runVerify.cjs

@@ -36,9 +36,13 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const { execFileSync } = require('node:child_process');
 
 const VERDICTS_SCHEMA_VERSION = 1;
 
+// Bound on the `gh pr view` postcondition check below (§ merge-main exemption).
+const GH_CHECK_TIMEOUT_MS = 15_000;
+
 // ─── content pattern detectors ───────────────────────────────────────────────
 
 /**
@@ -445,6 +449,69 @@ function scanSentinel(resultEvent, events) {
   return null;
 }
 
+// ─── merge-main postcondition exemption ──────────────────────────────────────
+
+/**
+ * True for the `NN-prXXX-merge-main` / `NN-fix-prXXX-merge-main` slug
+ * convention already used dozens of times in this queue (merge-current-main
+ * PRDs targeting a shared repo's PR branch). Narrow, mechanical string check —
+ * this is the only slug shape exempted from the `pass_no_commit` flag below.
+ */
+function isMergeMainSlug(slug) {
+  return typeof slug === 'string' && /-merge-main$/.test(slug);
+}
+
+/**
+ * Extract the target PR number for a `-merge-main` PRD. The convention embeds
+ * it two ways: in the frontmatter title/body as "PR #<n>" (preferred — the
+ * human-authored, unambiguous source), and in the slug itself as "prNNN"
+ * (fallback, for PRD text that doesn't spell it out). Returns null if neither
+ * source yields a number.
+ */
+function extractMergeMainPrNumber(slug, prdFullText) {
+  if (typeof prdFullText === 'string') {
+    const m = prdFullText.match(/PR\s*#(\d+)/i);
+    if (m) return parseInt(m[1], 10);
+  }
+  const sm = typeof slug === 'string' ? slug.match(/pr(\d+)-merge-main$/) : null;
+  if (sm) return parseInt(sm[1], 10);
+  return null;
+}
+
+/**
+ * Independently re-check a PR's mergeable state via `gh pr view`. Used only to
+ * decide whether a `-merge-main` PRD's unsubstantiated PASS (no commit landed
+ * during the run) reflects a target that was already satisfied by an
+ * out-of-band actor before this run started — see the 2026-07-18 false-positive
+ * feedback item.
+ *
+ * Bounded (15s) and fully fail-safe: ANY error (gh missing/unauthed, network,
+ * timeout, malformed JSON, non-existent PR) resolves `{ ok: false }` rather
+ * than throwing, so a failure here only ever falls back to today's behavior —
+ * it can never turn a real failure into a false "verified".
+ *
+ * `execImpl` is injectable (defaults to `child_process.execFileSync`) so unit
+ * tests can stub the subprocess call without shelling out to a real `gh`.
+ *
+ * @returns {{ ok: boolean, data?: { mergeable: string, mergeStateStatus: string }, error?: string }}
+ */
+function checkMergeablePr({ cwd, prNumber, timeoutMs = GH_CHECK_TIMEOUT_MS, execImpl = execFileSync }) {
+  try {
+    const out = execImpl(
+      'gh',
+      ['pr', 'view', String(prNumber), '--json', 'mergeable,mergeStateStatus'],
+      { cwd, timeout: timeoutMs, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] },
+    );
+    const data = JSON.parse(out);
+    if (data && data.mergeable === 'MERGEABLE' && data.mergeStateStatus !== 'CONFLICTING') {
+      return { ok: true, data };
+    }
+    return { ok: false, data };
+  } catch (e) {
+    return { ok: false, error: e?.message ?? String(e) };
+  }
+}
+
 // ─── main verifier ────────────────────────────────────────────────────────────
 
 /**
@@ -467,9 +534,13 @@ function scanSentinel(resultEvent, events) {
  *                                            even without a PASS sentinel. Only
  *                                            set by the boot reverify self-heal
  *                                            pass for pre-sentinel legacy runs.
+ * @param {Function} [params.ghExecImpl]      Test-only override for the `gh pr view`
+ *                                            subprocess call used by the -merge-main
+ *                                            postcondition exemption. Defaults to
+ *                                            child_process.execFileSync.
  * @returns {Promise<{verdict:string, reason:string, downgradeTo:string|null}>}
  */
-async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false }) {
+async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false, ghExecImpl }) {
   const { slug } = queueEntry;
   const logPath = path.join(runDir, `${slug}.log`);
   const verdictsPath = path.join(runDir, `${slug}.verdicts.json`);
@@ -491,8 +562,10 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
   try {
     // ── Read PRD body (strip frontmatter) ──────────────────────────────────
     let prdBody = '';
+    let prdFullText = '';
     try {
       const prdText = fs.readFileSync(prdPath, 'utf8');
+      prdFullText = prdText;
       if (prdText.startsWith('---\n')) {
         const end = prdText.indexOf('\n---', 4);
         prdBody = end !== -1 ? prdText.slice(end + 4).trim() : prdText;
@@ -650,11 +723,48 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
     // signal and stays covered by this check.
     const isFixPlanJob = /^\d+-fix-/.test(queueEntry?.slug || '');
     if (sentinel === 'pass' && !committedDuringRun && !isFixPlanJob) {
-      issues.push({
-        verdict: 'pass_no_commit',
-        reason: 'SCHEDULER_VERDICT: PASS but no commit landed during the run window — the run claims success but produced no code change',
-        priority: 1,
-      });
+      // EXEMPTION: `-merge-main` PRDs (see isMergeMainSlug) can genuinely and
+      // correctly find nothing left to do when an out-of-band actor (a human,
+      // another agent, a sibling scheduler job) already merged/updated the
+      // target PR branch before this run started. Before flagging, independently
+      // re-check the PR's real mergeable state via `gh` — if it confirms the
+      // target is already clean, this is not a false PASS, it's a correct one.
+      // Fails safe: any `gh` error falls straight through to the pass_no_commit
+      // flag below, exactly as before this exemption existed.
+      let mergeMainVerified = false;
+      if (isMergeMainSlug(slug)) {
+        const prNumber = extractMergeMainPrNumber(slug, prdFullText);
+        if (prNumber != null) {
+          const ghResult = checkMergeablePr({
+            cwd: queueEntry?.cwd,
+            prNumber,
+            ...(ghExecImpl ? { execImpl: ghExecImpl } : {}),
+          });
+          if (ghResult.ok) {
+            mergeMainVerified = true;
+            return conclude(
+              'pass_no_commit_target_verified',
+              `SCHEDULER_VERDICT: PASS with no commit, but independently verified PR #${prNumber} is mergeable `
+                + `(mergeStateStatus: ${ghResult.data.mergeStateStatus}) — target was already satisfied by an `
+                + 'out-of-band actor before this run started',
+              null,
+              {
+                ...(annotations.length ? { annotations } : {}),
+                sentinel,
+                verifiedPrNumber: prNumber,
+                ghMergeState: ghResult.data,
+              },
+            );
+          }
+        }
+      }
+      if (!mergeMainVerified) {
+        issues.push({
+          verdict: 'pass_no_commit',
+          reason: 'SCHEDULER_VERDICT: PASS but no commit landed during the run window — the run claims success but produced no code change',
+          priority: 1,
+        });
+      }
     }
 
     if (issues.length === 0) {
@@ -726,4 +836,7 @@ module.exports = {
   checkDeps,
   parseLog,
   scanSentinel,
+  isMergeMainSlug,
+  extractMergeMainPrNumber,
+  checkMergeablePr,
 };

package/src/main/scheduler/prdParser.cjs

@@ -141,10 +141,98 @@ function _resetCache() {
   prdFileCache.clear();
 }
 
+// ────────────────────────────────────────────── group allocation
+//
+// `NN` (the filename prefix, parsed above by groupFromName) is both the
+// authoring counter AND the parallel-group key the scheduler groups by.
+// Two authors computing "max NN in prds/" concurrently can allocate the
+// same NN for unrelated PRDs, which silently merges two projects' work
+// into one parallel group (incident 2026-07-14/2026-07-15, PRDs 05-11 vs
+// 06-09, then 545 collided again). allocateParallelGroup() closes that
+// race with an O(n) full-directory scan (not a caller-narrowed glob — see
+// PRD_AUTHORING.md's `'^10[0-9]'` cautionary example) plus an O_EXCL
+// reservation file, so two concurrent callers can never walk away with
+// the same new NN.
+//
+// A reservation is a zero-byte `.reserved-<NN>` file created with the
+// 'wx' (O_CREAT|O_EXCL) flag — the OS guarantees only one of two racing
+// `open()` calls for the same path succeeds. Reservations are counted
+// alongside real `NN-slug.md` files when computing the next max, so a
+// crash between "reserve NN" and "author NN-slug.md" just permanently
+// retires that one NN rather than wedging future allocations. This keeps
+// the filesystem itself as the single source of truth (no separate
+// `.next-nn`/registry file that could drift out of sync with prds/).
+//
+// Callers who want an EXISTING group (deliberate parallel siblings, e.g.
+// three PRDs sharing 545) never call this — they just write the shared
+// `NN-` prefix directly, same as today. This function only mints NEW
+// group numbers.
+
+const RESERVATION_RE = /^\.reserved-(\d+)$/;
+const GROUP_PREFIX_RE = /^(\d+)-/;
+const MAX_RESERVE_ATTEMPTS = 1000;
+
+/**
+ * Highest `NN` currently in use under prdsDir, across real `NN-slug.md`
+ * PRD files (any digit count, unpadded or not — matches groupFromName
+ * above) AND in-flight `.reserved-NN` markers. Full directory scan, no
+ * narrowed glob. Returns 0 if the directory is empty/missing.
+ */
+async function maxParallelGroupInUse(prdsDir) {
+  let entries;
+  try {
+    entries = await fsp.readdir(prdsDir);
+  } catch {
+    return 0;
+  }
+  let max = 0;
+  for (const name of entries) {
+    if (name.startsWith('.')) {
+      const rm = name.match(RESERVATION_RE);
+      if (rm) max = Math.max(max, Number(rm[1]));
+      continue;
+    }
+    if (!name.endsWith('.md')) continue;
+    const m = name.match(GROUP_PREFIX_RE);
+    if (m) max = Math.max(max, Number(m[1]));
+  }
+  return max;
+}
+
+/**
+ * Atomically allocate a brand-new parallel-group number under prdsDir.
+ * Returns the reserved NN. Reservation survives a crash mid-allocation
+ * (the `.reserved-NN` marker just sits there forever, retiring that one
+ * number) and never wedges future callers, since each attempt only needs
+ * the marker for its OWN candidate to not already exist.
+ */
+async function allocateParallelGroup(prdsDir) {
+  await fsp.mkdir(prdsDir, { recursive: true });
+  let candidate = (await maxParallelGroupInUse(prdsDir)) + 1;
+  for (let attempt = 0; attempt < MAX_RESERVE_ATTEMPTS; attempt += 1) {
+    const markerPath = path.join(prdsDir, `.reserved-${candidate}`);
+    let fh;
+    try {
+      fh = await fsp.open(markerPath, 'wx');
+    } catch (e) {
+      if (e && e.code === 'EEXIST') {
+        candidate += 1;
+        continue;
+      }
+      throw e;
+    }
+    await fh.close();
+    return candidate;
+  }
+  throw new Error(`allocateParallelGroup: exhausted ${MAX_RESERVE_ATTEMPTS} reservation attempts starting at ${candidate}`);
+}
+
 module.exports = {
   parsePrdRaw,
   parsePrd,
   listPrdFiles,
+  allocateParallelGroup,
+  maxParallelGroupInUse,
   PRD_READ_MAX_BYTES,
   _resetCache,
 };

package/src/main/scheduler.cjs

@@ -500,6 +500,17 @@ async function listPrdFiles() {
   return prdParser.listPrdFiles(PRDS_DIR);
 }
 
+/**
+ * Atomically mint a brand-new parallel-group NN for a PRD about to be
+ * authored under PRDS_DIR. See prdParser.allocateParallelGroup for the
+ * collision-proof mechanics. Callers wanting to join an EXISTING group
+ * (deliberate parallel siblings) skip this and just reuse the NN prefix.
+ */
+async function allocateParallelGroup() {
+  ensureDirs();
+  return prdParser.allocateParallelGroup(PRDS_DIR);
+}
+
 /**
  * Best-effort kill of a child claude PID that the previous app instance spawned
  * but never reaped. Used by init() to clean up the orphan tree on boot.
@@ -709,6 +720,37 @@ let cancelToken = { cancelled: false };
 // Last memory-gate observation; included in snapshot for renderer visibility.
 let lastMemGate = null;
 
+/**
+ * Pure: applies clearPause()'s effect on the tick cancel-token.
+ *
+ * ROOT CAUSE (2026-07-14 stall, PRD 543/544): setPaused() cancels the
+ * in-flight tick batch by setting cancelToken.cancelled = true (e.g. when a
+ * job's run is rate-limited). That flag was previously only ever reset back
+ * to false inside runDueJobs() (used by the force-tick/run-now IPC handlers
+ * and the resume-timer callback). clearPause() itself — the function the
+ * poll-loop's auth/network auto-recovery and the manual "Resume" button
+ * actually call — never reset it. So once ANY pause fired and was later
+ * cleared through one of THOSE paths instead of runDueJobs(), cancelToken
+ * .cancelled stayed permanently true, and tickQueue()'s very first guard
+ * (`if (cancelToken.cancelled) return {fired:false, reason:'cancelled'}`)
+ * silently short-circuited every future tick — from spawnJob's own
+ * post-completion tick, from the when-available poll, and from the
+ * dead-process reaper — forever, even though queue.json's `paused` field
+ * was correctly null and every other gate (enabled, concurrency, memory)
+ * said go. This explains the full incident: lastRunAt froze at the last
+ * tick that got past the guard, new PRDs kept appearing as `pending`
+ * because reconcile() also runs independently from the `schedule:state` IPC
+ * read (unrelated to tickQueue), and only a manual force-tick (which goes
+ * through runDueJobs()) could ever unwedge it.
+ *
+ * Exported so this regression is unit-testable without touching the real
+ * scheduler's fs-backed queue.json.
+ */
+function applyPauseCleared(wasPaused, token) {
+  if (wasPaused) token.cancelled = false;
+  return token;
+}
+
 function attachWindow(w) { mainWindow = w; }
 
 /**
@@ -839,6 +881,8 @@ async function clearPause(source) {
     s.paused = null;
     return true;
   });
+  // Un-cancel the tick guard on every recovery path, not just runDueJobs().
+  applyPauseCleared(wasPaused, cancelToken);
   // Track manual clears for the auto-pause cooldown.
   if (source === 'manual' || source === 'run-now') {
     pauseClearedManuallyAt = Date.now();
@@ -883,6 +927,69 @@ function detectRateLimitInLog(logPath) {
   }
 }
 
+/** Scan the tail of a job's log for a network-outage signal: the structured
+ *  `terminal_reason":"api_error"` field alongside a network-class error
+ *  string. This is NOT a real code defect — spawning an auto-fix
+ *  investigation for it just burns a second run diagnosing an outage (PRD
+ *  543's ENOTFOUND incident, 2026-07-14). Deliberately narrow: only fires on
+ *  the structured terminal_reason field, never on ad-hoc "error" text that
+ *  legitimately appears in TDD red-phase transcripts. */
+function detectNetworkErrorInLog(logPath) {
+  try {
+    const text = readTail(logPath, 16384);
+    if (!text) return false;
+    if (!/"terminal_reason":"api_error"/.test(text)) return false;
+    return /ENOTFOUND/.test(text)
+      || /ECONNREFUSED/.test(text)
+      || /ETIMEDOUT/.test(text)
+      || /EAI_AGAIN/.test(text)
+      || /network is unreachable/i.test(text);
+  } catch {
+    return false;
+  }
+}
+
+// Bounded retry cap for transient (signal-kill or network-outage) failures.
+// A small constant, not a config knob: the point is that it is impossible to
+// loop unboundedly (queueOps.cjs lints for unbounded loops; see the fizzpop
+// poll-hang in PRD_AUTHORING.md for why an unbounded retry is a real hazard).
+const TRANSIENT_RETRY_CAP = 2;
+
+/**
+ * Classify a failed job's outcome as one of: retry it (transient, bounded),
+ * fail it without auto-fix (transient but unsafe to retry, or the retry cap
+ * is exhausted), or investigate it (a genuine code failure). Pure/no I/O so
+ * the transient-vs-terminal boundary can be unit-tested directly rather than
+ * only through a live spawnJob run.
+ *
+ * A 143/137 exit within the idle-watchdog window is a signal-kill transient
+ * (external kill, not a real failure — see the call site's long-form
+ * rationale). A `terminal_reason:"api_error"` + network-class error
+ * (ENOTFOUND etc., detected by detectNetworkErrorInLog) is an outage
+ * transient (PRD 543/545 incident) — same bounded-retry treatment, not a
+ * second parallel classifier.
+ */
+function classifyFailureOutcome({ exitCode, networkError, durationMs, transientRetries, newlyDirtyCount }) {
+  const signalTransient = (exitCode === 143 || exitCode === 137) && durationMs < IDLE_OUTPUT_KILL_MS;
+  const networkTransient = networkError === true;
+  const transient = signalTransient || networkTransient;
+  if (!transient) return { action: 'investigate' };
+
+  const transientKind = networkTransient ? 'network' : `exit=${exitCode}`;
+  const retries = transientRetries ?? 0;
+  // A transient failure can still leave partial work on disk (the 543
+  // ENOTFOUND run wrote its renderer, then died before committing). Requeuing
+  // over that dirt would either re-implement on top of it or conflict with
+  // it — refuse and fail instead of silently re-running over orphaned edits.
+  if (newlyDirtyCount > 0) {
+    return { action: 'fail-dirty', transientKind, newlyDirtyCount };
+  }
+  if (retries >= TRANSIENT_RETRY_CAP) {
+    return { action: 'fail-cap', transientKind, retries };
+  }
+  return { action: 'retry', transientKind, retries };
+}
+
 // ---------- execution ----------
 
 function pickRunDir() {
@@ -1119,14 +1226,15 @@ async function executeJob(job, runDir, defaultCwd, onPid) {
         sl(`\n[scheduler] exit code=${effectiveCode} (raw code=${exitCode} signal=${signal}) ` +
           `duration=${Math.round(durationMs / 1000)}s\n`);
         const rateLimited = effectiveCode !== 0 && detectRateLimitInLog(logPath);
+        const networkError = effectiveCode !== 0 && !rateLimited && detectNetworkErrorInLog(logPath);
         // Sync write: child 'exit' handler must flush meta before resolve()
         // so the spawnJob mutate() that follows sees the persisted exit code.
         config.writeJsonSync(metaPath, {
-          slug: job.slug, cwd, sessionId, exitCode: effectiveCode, rateLimited,
+          slug: job.slug, cwd, sessionId, exitCode: effectiveCode, rateLimited, networkError,
           startedAt, finishedAt: Date.now(), durationMs,
           agentResultSubtype, mappedFromSignal: mappedToSuccess ? signal || `code=${exitCode}` : null,
         });
-        resolve({ exitCode: effectiveCode, durationMs, rateLimited, sessionId });
+        resolve({ exitCode: effectiveCode, durationMs, rateLimited, networkError, sessionId });
       },
     });
 
@@ -1538,7 +1646,14 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           let effectiveStatus;
           if (res.exitCode !== 0) {
             effectiveStatus = 'failed';
-          } else if (!verifyResult || verifyResult.verdict === 'clean') {
+          } else if (
+            !verifyResult
+            || verifyResult.verdict === 'clean'
+            // pass_no_commit_target_verified: -merge-main postcondition exemption
+            // (runVerify.cjs) — an independently gh-confirmed clean merge target,
+            // not a plain unsubstantiated PASS. Completed, same as 'clean'.
+            || verifyResult.verdict === 'pass_no_commit_target_verified'
+          ) {
             effectiveStatus = 'completed';
           } else if (verifyResult.downgradeTo === 'pending') {
             // HALT or deps_unmet: reset to pending so the job re-fires.
@@ -1641,15 +1756,58 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
       // 67 s.) Genuine watchdog kills (idle ≥20 min, deadman 4 h) run longer than
       // the threshold and still fall through to investigation.
       const ec = failedJobSnapshot.exitCode;
-      const transient = (ec === 143 || ec === 137) && res.durationMs < IDLE_OUTPUT_KILL_MS;
       const retries = failedJobSnapshot.transientRetries ?? 0;
-      if (transient && retries < 2) {
-        console.log(`[scheduler] transient failure (exit=${ec} dur=${res.durationMs}ms) — auto-retry ${retries + 1}/2 for ${job.slug}`);
+      // Only pay for the extra git status call when the failure is plausibly
+      // transient — a real code failure never needs the dirty-tree check.
+      const maybeTransient = (ec === 143 || ec === 137) || res.networkError === true;
+      let newlyDirtyCount = 0;
+      let dirtySample = '';
+      if (maybeTransient) {
+        const afterFailure = await uncommittedChanges(guardCwd);
+        const baseSet = new Set(guardBaseline || []);
+        const newlyDirty = (afterFailure || []).filter((p) => !baseSet.has(p));
+        newlyDirtyCount = newlyDirty.length;
+        dirtySample = newlyDirty.slice(0, 3).join(', ');
+      }
+      const decision = classifyFailureOutcome({
+        exitCode: ec,
+        networkError: res.networkError,
+        durationMs: res.durationMs,
+        transientRetries: retries,
+        newlyDirtyCount,
+      });
+
+      if (decision.action === 'retry') {
+        console.log(`[scheduler] transient failure (${decision.transientKind} dur=${res.durationMs}ms) — auto-retry ${decision.retries + 1}/${TRANSIENT_RETRY_CAP} for ${job.slug}`);
         await mutate((s) => {
           const i = s.jobs.findIndex((x) => x.slug === job.slug);
           if (i >= 0) {
             resetJobFields(s.jobs[i], null);
-            s.jobs[i].transientRetries = retries + 1;
+            s.jobs[i].transientRetries = decision.retries + 1;
+          }
+        });
+        await broadcast();
+      } else if (decision.action === 'fail-dirty') {
+        console.log(`[scheduler] transient failure (${decision.transientKind}) for ${job.slug} left ${newlyDirtyCount} uncommitted file(s) (e.g. ${dirtySample}) — not auto-requeuing`);
+        await mutate((s) => {
+          const i = s.jobs.findIndex((x) => x.slug === job.slug);
+          if (i >= 0) {
+            s.jobs[i].status = 'failed';
+            s.jobs[i].error = `transient failure (${decision.transientKind}) left ${newlyDirtyCount} uncommitted file(s) in working tree (e.g. ${dirtySample}) — not auto-requeued to avoid overwriting partial work; review and commit or discard manually`;
+          }
+        });
+        await broadcast();
+        // No auto-fix investigation: this isn't a code defect, and the
+        // dirty tree needs a human, not a diagnosis run.
+      } else if (decision.action === 'fail-cap') {
+        // Retry cap exhausted: fail terminally, but a transient classification
+        // never spawns an auto-fix investigation — there is no code defect to
+        // diagnose, only a recurring outage.
+        console.log(`[scheduler] transient failure (${decision.transientKind}) for ${job.slug} exhausted retry cap (${decision.retries}/${TRANSIENT_RETRY_CAP}) — failing without auto-fix`);
+        await mutate((s) => {
+          const i = s.jobs.findIndex((x) => x.slug === job.slug);
+          if (i >= 0) {
+            s.jobs[i].error = `transient failure (${decision.transientKind}) exhausted retry cap (${decision.retries}/${TRANSIENT_RETRY_CAP}) — marking failed without auto-fix investigation`;
           }
         });
         await broadcast();
@@ -2184,7 +2342,10 @@ async function reverifyNeedsReview() {
         allowPreSentinelHeal: true,
       });
     } catch { leftForReview.push({ slug: job.slug, reason: 'verifyRun threw' }); continue; }
-    if (v && v.verdict === 'clean') {
+    // pass_no_commit_target_verified: -merge-main postcondition exemption
+    // (runVerify.cjs) — same "heal it" treatment as 'clean', see spawnJob's
+    // effectiveStatus branch above for the primary-path equivalent.
+    if (v && (v.verdict === 'clean' || v.verdict === 'pass_no_commit_target_verified')) {
       healed.push(job.slug);
     } else {
       leftForReview.push({ slug: job.slug, reason: v ? `${v.verdict}: ${v.reason}` : 'null verdict' });
@@ -2818,6 +2979,12 @@ const remote = {
     return state.jobs.map((j) => ({ slug: j.slug, title: j.title, status: j.status, cwd: j.cwd }));
   },
 
+  // Exposes the module-level allocateParallelGroup (PRD 548) to callers that
+  // only hold the `remote` object (adminServer.cjs's create-prd route) —
+  // reuses the same allocator the file-based /develop authoring path relies
+  // on implicitly, rather than re-deriving NN here.
+  allocateParallelGroup,
+
   async runNow() {
     await clearPause('run-now');
     runDueJobs().catch((e) => logs.writeLine({
@@ -2841,4 +3008,4 @@ const remote = {
   },
 };
 
-module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome };
+module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, TRANSIENT_RETRY_CAP };