claude-code-session-manager 0.39.1 → 0.39.2

package/src/main/scheduler.cjs

@@ -48,7 +48,7 @@ const fsp = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
 const { randomUUID } = require('node:crypto');
-const { execFile } = require('node:child_process');
+const { execFile, execFileSync } = require('node:child_process');
 const { ipcMain } = require('electron');
 const billing = require('./usage.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./lib/cleanEnv.cjs');
@@ -62,7 +62,9 @@ const { createBroadcastCoalescer } = require('./lib/broadcastCoalescer.cjs');
 const prdParser = require('./scheduler/prdParser.cjs');
 const sessionsStore = require('./sessionsStore.cjs');
 const { enqueueExternalPrompt } = require('./chatRunner.cjs');
+const { appendResponseEventIfKnown } = require('./promptSessionEvents.cjs');
 const { verifyRun } = require('./runVerify.cjs');
+const { latestTerminalOutcomeForSlug, COMPLETED_EQUIVALENT_VERDICTS } = require('./lib/terminalRunOutcome.cjs');
 const logs = require('./logs.cjs');
 const { schemas, validated } = require('./ipcSchemas.cjs');
 const { readBody, sendJson } = require('./lib/localAdminHttp.cjs');
@@ -86,6 +88,24 @@ const { sweep: sweepFeedback } = require('../../scripts/lib/watchdogHelpers.cjs'
 const { resolvePrdsDirs, resolvePrdWriteDir } = require('./lib/prdLocations.cjs');
 const { migratePrds } = require('./lib/prdMigration.cjs');
 
+// Captured once at module load so every run's meta sidecar can record how
+// stale the running process is relative to on-disk source (incident: PRD
+// 812-commit-guard-retry — the scheduler process was booted ~52 min before
+// an exemption it should have applied landed on disk, and nothing in the
+// run record showed that; this is the fix).
+const SCHEDULER_BOOTED_AT = new Date().toISOString();
+const SCHEDULER_CODE_SHA = (() => {
+  try {
+    return execFileSync('git', ['-C', __dirname, 'rev-parse', '--short', 'HEAD'], {
+      timeout: 5000,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return null;
+  }
+})();
+
 const MAX_INVESTIGATION_DURATION_MS = 30 * 60_000;
 
 // After the agent emits a `result` event in its JSONL stream, the parent
@@ -261,9 +281,23 @@ async function committedInWindow(cwd, startedAt, finishedAt) {
 // checks out other branches, commits real work on each, then checks its
 // starting branch back out before exit leaves HEAD unchanged even though
 // commits landed — the fallback catches that case. Never throws.
+//
+// Both signals are known to race against ref/object visibility at the exact
+// moment of process exit — a job that commits in a throwaway linked worktree
+// and removes it before exiting can have committedInWindow() return false
+// even though the commit is real and already pushed (confirmed incidents:
+// pass-no-commit-worktree-commit-invisible-at-exit, RCA 770-pr269). When both
+// signals say "no commit", wait a short bounded delay and retry once before
+// giving up — a replayed identical call moments later reliably finds it.
+const COMMIT_GUARD_RETRY_DELAY_MS = 2000;
+
 async function computeCommittedDuringRun(cwd, headBefore, headAfter, startedAt, untilIso) {
   if (headBefore && headAfter && headBefore !== headAfter) return true;
-  return committedInWindow(cwd, startedAt, untilIso);
+  // Call via module.exports (not the bare local binding) so tests can
+  // vi.spyOn(scheduler, 'committedInWindow') to drive the retry deterministically.
+  if (await module.exports.committedInWindow(cwd, startedAt, untilIso)) return true;
+  await new Promise((resolve) => { setTimeout(resolve, COMMIT_GUARD_RETRY_DELAY_MS); });
+  return module.exports.committedInWindow(cwd, startedAt, untilIso);
 }
 
 /**
@@ -476,6 +510,34 @@ async function safeSlugPath(slug) {
   return safeSlugPathIn(dir, slug);
 }
 
+/**
+ * Move a completed job's `<slug>.md` out of its PRD dir into that dir's
+ * sibling `prds-archived/`, so a finished slug can't be re-fired by the
+ * scheduler. Sibling-of-source (not the hard-coded legacy PRDS_ARCHIVE_DIR)
+ * so a per-project PRD (`<cwd>/session-manager-operations/scheduler/prds/`)
+ * archives into that SAME project's `prds-archived/`, not the global legacy
+ * one — PRDS_ARCHIVE_DIR only happens to coincide with this for the legacy
+ * PRDS_DIR. Mirrors the `schedule:clear-queue` archive logic (same
+ * containment check). Non-throwing: a missing source file (already archived
+ * or already gone) is a silent no-op, and any other error is logged as a
+ * warning — an archive failure must never break job-completion bookkeeping.
+ */
+async function archiveCompletedPrd(slug, cwd) {
+  try {
+    const srcDir = (await findPrdDir(slug)) ?? prdDirForCwd(cwd);
+    const src = safeSlugPathIn(srcDir, slug);
+    if (!src) return;
+    const archiveDir = path.join(srcDir, '..', 'prds-archived');
+    await fsp.mkdir(archiveDir, { recursive: true });
+    const dst = path.join(archiveDir, `${slug}.md`);
+    await fsp.rename(src, dst);
+  } catch (e) {
+    if (e?.code !== 'ENOENT') {
+      logs.writeLine({ level: 'warn', scope: 'scheduler', message: 'archiveCompletedPrd: rename failed', meta: { slug, error: e?.message } });
+    }
+  }
+}
+
 // Bundled authoring guide seeded into the scheduler dir so the session-manager-dev
 // plugin's /develop and /prd skills — which reference this stable `~`-absolute
 // path — work on any user's machine, not just the author's.
@@ -625,22 +687,63 @@ function appendHeartbeat(entry) {
   }
 }
 
+// An empty queue and an unreadable queue are NOT the same thing, and
+// conflating them is destructive: reconcile() treats every PRD .md with no
+// matching jobs[] row as a brand-new goal and re-mints it as 'pending', so a
+// single failed read that yields `jobs: []` re-queues the entire archive of
+// already-completed work — then mutate() writes that empty array back and the
+// real statuses are gone. (2026-07-31: 189 completed jobs resurrected and
+// fired into an ENOENT retry storm.)
+//
+// So: a MISSING file is a legitimately empty queue (first boot). A file that
+// exists but won't read or parse is `unreadable` — a poison state that must
+// never reach reconcile() or writeQueue(). Callers get the flag, not a lie.
+const EMPTY_QUEUE = () => ({
+  config: { ...DEFAULT_CONFIG }, jobs: [], scheduledFor: null, lastRunAt: null, paused: null,
+});
+
+function shapeQueue(raw) {
+  const data = JSON.parse(raw);
+  return {
+    config: { ...DEFAULT_CONFIG, ...(data.config || {}) },
+    jobs: Array.isArray(data.jobs) ? data.jobs : [],
+    scheduledFor: data.scheduledFor ?? null,
+    lastRunAt: data.lastRunAt ?? null,
+    paused: data.paused ?? null,
+  };
+}
+
+// Quarantine a corrupt queue.json alongside itself (once per process — the
+// first copy is the one that matters; later ticks would just overwrite it
+// with the same bytes) so a human can diff it against the .bak-* snapshots.
+let quarantined = false;
+function unreadableQueue(e) {
+  const state = EMPTY_QUEUE();
+  state.unreadable = e?.message ?? 'queue.json read failed';
+  if (!quarantined) {
+    quarantined = true;
+    try {
+      fs.copyFileSync(QUEUE_PATH, `${QUEUE_PATH}.corrupt-${Date.now()}`);
+    } catch { /* best-effort: the read already failed, the copy may too */ }
+  }
+  console.error(`[scheduler] queue.json unreadable — refusing to treat as empty: ${state.unreadable}`);
+  logs.writeLine({
+    level: 'error', scope: 'scheduler',
+    message: 'queue.json unreadable — scheduling halted until it reads clean',
+    meta: { path: QUEUE_PATH, error: state.unreadable },
+  });
+  return state;
+}
+
 // Sync queue read — passed to the supervisor module (which calls it from
 // supervisorTick / applyAction with no await) and the heartbeat interval.
 // IPC handlers and mutate() use readQueue (async) below.
 function readQueueSync() {
   try {
-    const raw = fs.readFileSync(QUEUE_PATH, 'utf8');
-    const data = JSON.parse(raw);
-    return {
-      config: { ...DEFAULT_CONFIG, ...(data.config || {}) },
-      jobs: Array.isArray(data.jobs) ? data.jobs : [],
-      scheduledFor: data.scheduledFor ?? null,
-      lastRunAt: data.lastRunAt ?? null,
-      paused: data.paused ?? null,
-    };
-  } catch {
-    return { config: { ...DEFAULT_CONFIG }, jobs: [], scheduledFor: null, lastRunAt: null, paused: null };
+    return shapeQueue(fs.readFileSync(QUEUE_PATH, 'utf8'));
+  } catch (e) {
+    if (e?.code === 'ENOENT') return EMPTY_QUEUE();
+    return unreadableQueue(e);
   }
 }
 
@@ -649,21 +752,18 @@ function readQueueSync() {
 // hands control back to the renderer while the kernel paginates the file.
 async function readQueue() {
   try {
-    const raw = await fsp.readFile(QUEUE_PATH, 'utf8');
-    const data = JSON.parse(raw);
-    return {
-      config: { ...DEFAULT_CONFIG, ...(data.config || {}) },
-      jobs: Array.isArray(data.jobs) ? data.jobs : [],
-      scheduledFor: data.scheduledFor ?? null,
-      lastRunAt: data.lastRunAt ?? null,
-      paused: data.paused ?? null,
-    };
-  } catch {
-    return { config: { ...DEFAULT_CONFIG }, jobs: [], scheduledFor: null, lastRunAt: null, paused: null };
+    return shapeQueue(await fsp.readFile(QUEUE_PATH, 'utf8'));
+  } catch (e) {
+    if (e?.code === 'ENOENT') return EMPTY_QUEUE();
+    return unreadableQueue(e);
   }
 }
 
 async function writeQueue(state) {
+  // Last line of defence: never persist a state derived from a failed read.
+  if (state && state.unreadable) {
+    throw new Error(`refusing to write queue.json from an unreadable read (${state.unreadable})`);
+  }
   ensureDirs();
   await config.writeJson(QUEUE_PATH, state);
 }
@@ -679,6 +779,12 @@ let mutateTail = Promise.resolve();
 function mutate(fn) {
   const next = mutateTail.then(async () => {
     const state = await readQueue();
+    // Bail BEFORE fn runs: a mutator handed an unreadable (therefore empty)
+    // state would compute its result from a queue that isn't there, and
+    // writeQueue would then persist that fiction over the real file.
+    if (state.unreadable) {
+      throw new Error(`queue mutation skipped: queue.json unreadable (${state.unreadable})`);
+    }
     const ret = await fn(state);
     await writeQueue(state);
     return ret;
@@ -811,6 +917,12 @@ function validatePromptForSpawn(body, srcLabel) {
  * Newly-discovered PRDs land as `pending`.
  */
 async function reconcile(state) {
+  // Defence in depth — tickQueue already gates on this, but reconcile is the
+  // function that would do the damage (every unmatched PRD .md becomes a
+  // fresh 'pending' row), so it refuses the poison state itself.
+  if (state && state.unreadable) {
+    throw new Error(`reconcile skipped: queue.json unreadable (${state.unreadable})`);
+  }
   const files = await listPrdFiles();
   const onDisk = new Map();
   for (const f of files) {
@@ -828,7 +940,22 @@ async function reconcile(state) {
   const seen = new Set();
   for (const job of state.jobs) {
     const p = onDisk.get(job.slug);
-    if (!p) continue;
+    if (!p) {
+      // A terminal job whose .md is gone was archived on purpose — dropping
+      // its row is the intended end of the auto-archive flow.
+      //
+      // A PENDING or RUNNING job whose .md is merely not VISIBLE is a
+      // different thing entirely, and dropping it destroys queued work: the
+      // file may be unreadable, on a project whose dir failed to enumerate,
+      // or mid-move. "I can't see it" is not "the user deleted it", so the
+      // row survives — worst case it re-resolves on the next pass.
+      if (job.status === 'pending' || job.status === 'running') {
+        seen.add(job.slug);
+        next.push({ ...job });
+        console.warn(`[scheduler] reconcile: keeping ${job.status} job ${job.slug} — PRD source not visible in any candidate dir`);
+      }
+      continue;
+    }
     seen.add(job.slug);
     next.push({
       ...job,
@@ -876,6 +1003,18 @@ async function reconcile(state) {
       // review and failed PRD files are NEVER auto-archived."
       continue;
     }
+    // history.jsonl may not exist yet (nothing has crossed HISTORY_RETENTION_MS
+    // since the feature shipped), which leaves historyBySlug empty and the
+    // guard above inert. Fall back to reading the slug's own newest run
+    // sidecars straight off disk — same "don't resurrect an already-terminal
+    // slug" intent, independent of history.jsonl's existence.
+    const fallback = latestTerminalOutcomeForSlug(slug, { runsDir: RUNS_DIR });
+    if (fallback) {
+      if (fallback.status === 'completed') {
+        historyArchiveCandidates.push({ slug, status: fallback.status, finishedAt: fallback.finishedAt });
+      }
+      continue;
+    }
     const entry = {
       slug,
       title: p.title,
@@ -1223,8 +1362,21 @@ async function clearPause(source) {
   if (wasPaused) await broadcast({ flush: true });
 }
 
-/** Mutate a job in place to "pending" with cleared run metadata. */
-function resetJobFields(job, errorMsg) {
+/**
+ * Mutate a job in place to "pending" with cleared run metadata.
+ *
+ * Refuses (no-ops, returns false) on a job already in a terminal success
+ * state ('completed') unless opts.force is true — resetting a completed job
+ * re-fires the PRD and re-executes already-shipped work (the false-failure
+ * class PRD 812-workbench-review-nits-cleanup demonstrated: a completed job
+ * was reset to pending and re-ran a correct no-op that then got flagged
+ * needs_review). All internal call sites operate on jobs that are still
+ * 'running'/'failed' at the point they call this, so the guard is a no-op
+ * for them; only an external reset request (IPC/admin API) can target an
+ * already-'completed' job, and that path is exactly what this guards.
+ */
+function resetJobFields(job, errorMsg, opts = {}) {
+  if (job.status === 'completed' && opts.force !== true) return false;
   job.status = 'pending';
   job.runId = null;
   job.startedAt = null;
@@ -1233,6 +1385,10 @@ function resetJobFields(job, errorMsg) {
   job.error = errorMsg ?? null;
   delete job.runtime;
   delete job.verifierVerdict;
+  // Deliberately NOT deleting job.landedCommit: it must outlive a reset so a
+  // re-fired run of this same slug can pass it to verifyRun as
+  // priorLandedCommit (pass_no_commit_prior_run_verified exemption).
+  return true;
 }
 
 // Grace period between a boot orphan's SIGTERM and reading its log to
@@ -1325,24 +1481,41 @@ function isNotifiableTerminalStatus(effectiveStatus) {
  * notifyOriginatingTab(job) → void
  *
  * On a true terminal transition (completed/failed — never the benign
- * rateLimited auto-pause, which resets the job to pending instead), push a
- * short status prompt into the chat tab that queued this PRD via
- * enqueueExternalPrompt (PRD 753). Resolution order: (1) the PRD's own
- * `sourceTabId` frontmatter, captured at creation time; (2) the first open
- * tab (per sessionsStore's persisted tabs.json) whose cwd matches the job's
- * cwd — first match only, no fan-out to multiple matching tabs; (3) no-op.
- * Never throws to the caller (fire-and-forget from spawnJob). Deps are
- * injectable (mirrors partitionBootOrphans's isAlive param) so unit tests can
- * exercise the resolution logic without touching disk/electron.
+ * rateLimited auto-pause, which resets the job to pending instead), publish
+ * a short status notification for the PRD that queued this job.
+ *
+ * Resolution order (PRD 814): (1) if the PRD's `sourcePromptId` resolves to
+ * a known, still-active PromptSession (minted for a dev-work dispatch, PRD
+ * 813) under the job's cwd, append a 'response' PromptSessionEvent to THAT
+ * session's own event chain — its own scoped PromptSessionConversation, not
+ * whatever tab happens to be active — and stop; (2) otherwise, fall back to
+ * today's behavior: push a short status prompt into the chat tab that queued
+ * this PRD via enqueueExternalPrompt (PRD 753), resolved via the PRD's own
+ * `sourceTabId` frontmatter, then the first open tab (per sessionsStore's
+ * persisted tabs.json) whose cwd matches the job's cwd — first match only,
+ * no fan-out to multiple matching tabs; (3) no-op. Never throws to the
+ * caller (fire-and-forget from spawnJob). Deps are injectable (mirrors
+ * partitionBootOrphans's isAlive param) so unit tests can exercise the
+ * resolution logic without touching disk/electron.
  */
 async function notifyOriginatingTab(job, {
   parsePrdRaw = prdParser.parsePrdRaw,
   loadSessions = sessionsStore.load,
   sendPrompt = enqueueExternalPrompt,
+  appendResponseEvent = appendResponseEventIfKnown,
 } = {}) {
   try {
     const prdPath = prdPathForJob(job);
     const prd = await parsePrdRaw(prdPath).catch(() => null);
+    const message = `PRD ${job.slug} finished: ${job.status}. Check Scheduler for details.`;
+
+    if (prd?.sourcePromptId) {
+      const routed = await appendResponseEvent(job.cwd || null, prd.sourcePromptId, message).catch((e) => {
+        console.error('[scheduler] notifyOriginatingTab appendResponseEvent error', job?.slug, e);
+        return false;
+      });
+      if (routed) return;
+    }
 
     let targetTabId = prd?.sourceTabId || null;
     if (!targetTabId) {
@@ -1358,7 +1531,7 @@ async function notifyOriginatingTab(job, {
       return;
     }
 
-    sendPrompt(targetTabId, `PRD ${job.slug} finished: ${job.status}. Check Scheduler for details.`);
+    sendPrompt(targetTabId, message);
   } catch (e) {
     console.error('[scheduler] notifyOriginatingTab error', job?.slug, e);
   }
@@ -1442,6 +1615,36 @@ function classifyFailureOutcome({ exitCode, networkError, durationMs, transientR
   return { action: 'retry', transientKind, retries };
 }
 
+/**
+ * Commit-guard verdict decision. Pure/no I/O so the false-positive defenses
+ * can be unit-tested directly rather than only through a live spawnJob run.
+ * Returns the flagged verifyResult replacement, or null if the guard should
+ * not fire (any of the four defenses applies).
+ *
+ * The fourth defense (legitimateNoOp) exists because runVerify.cjs's own
+ * pass_no_commit exemptions (COMPLETED_EQUIVALENT_VERDICTS members like
+ * pass_no_commit_already_shipped) already independently proved a truthful
+ * PASS-with-no-commit is correct; without this check the commit-guard
+ * double-punishes that same honest no-op for dirt a concurrent interactive
+ * session left behind (incidents: 655-needs-review-rca-feedback-hook,
+ * 672-fix-feedback-session-manager, 2026-07-31).
+ */
+function commitGuardVerdict({ newlyDirty, siblingRunning, jobSelfCommitted, legitimateNoOp, verifyResult }) {
+  if (!newlyDirty || newlyDirty.length === 0) return null;
+  if (siblingRunning || jobSelfCommitted || legitimateNoOp) return null;
+  const sample = newlyDirty.slice(0, 3).join(', ');
+  const carried = [...(verifyResult?.annotations ?? [])];
+  if (verifyResult && verifyResult.verdict !== 'clean') {
+    carried.push({ verdict: verifyResult.verdict, reason: verifyResult.reason });
+  }
+  return {
+    verdict: 'uncommitted_changes',
+    reason: `finish protocol incomplete: ${newlyDirty.length} uncommitted file(s) left in working tree (e.g. ${sample})`,
+    downgradeTo: 'needs_review',
+    annotations: carried.length ? carried : undefined,
+  };
+}
+
 // ---------- execution ----------
 
 function pickRunDir() {
@@ -1490,16 +1693,35 @@ async function executeJob(job, runDir, defaultCwd, onPid) {
 
   // Read full PRD body fresh from disk (queue stored only the preview).
   let prompt;
-  const prdPath = prdPathForJob(job);
+  let prdPath = prdPathForJob(job);
   try {
     const parsed = await parsePrd(prdPath);
     // Centrally enforce the review → security-review → verify → commit finish
     // sequence on every job, regardless of what the PRD body says.
     prompt = parsed.body + FINISH_PROTOCOL;
   } catch (e) {
-    safeLog(`[scheduler] failed to read PRD: ${e?.message}\n`);
-    closeFd();
-    return { exitCode: -1, durationMs: 0, error: e?.message };
+    // The project-scoped dir isn't the only place a PRD source can live — a
+    // writer that hasn't migrated to prdLocations.cjs yet (or a not-yet-run
+    // boot migration) can leave it in the legacy global dir. Fall back to
+    // findPrdDir's full candidate search before failing the job outright.
+    const fallbackDir = await findPrdDir(job.slug);
+    if (fallbackDir) {
+      const fallbackPath = path.join(fallbackDir, `${job.slug}.md`);
+      safeLog(`[scheduler] PRD not in project dir; found ${job.slug}.md in ${fallbackDir}\n`);
+      try {
+        const parsed = await parsePrd(fallbackPath);
+        prompt = parsed.body + FINISH_PROTOCOL;
+        prdPath = fallbackPath;
+      } catch (e2) {
+        safeLog(`[scheduler] failed to read PRD: ${e2?.message}\n`);
+        closeFd();
+        return { exitCode: -1, durationMs: 0, error: e2?.message };
+      }
+    } else {
+      safeLog(`[scheduler] failed to read PRD: ${e?.message}\n`);
+      closeFd();
+      return { exitCode: -1, durationMs: 0, error: e?.message };
+    }
   }
 
   const promptCheck = validatePromptForSpawn(prompt, prdPath);
@@ -1655,7 +1877,7 @@ async function executeJob(job, runDir, defaultCwd, onPid) {
           sl(`\n[scheduler] ${errMsg}\n`);
           // Sync write: inside a Promise executor callback; must flush meta
           // before resolve() so the spawnJob mutate() that follows sees it.
-          config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs });
+          config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs, schedulerBootedAt: SCHEDULER_BOOTED_AT, schedulerCodeSha: SCHEDULER_CODE_SHA });
           resolve({ exitCode: -1, durationMs, error: errMsg, sessionId });
           return;
         }
@@ -1685,6 +1907,7 @@ async function executeJob(job, runDir, defaultCwd, onPid) {
           slug: job.slug, cwd, sessionId, exitCode: effectiveCode, rateLimited, networkError,
           startedAt, finishedAt: Date.now(), durationMs,
           agentResultSubtype, mappedFromSignal: mappedToSuccess ? signal || `code=${exitCode}` : null,
+          schedulerBootedAt: SCHEDULER_BOOTED_AT, schedulerCodeSha: SCHEDULER_CODE_SHA,
         });
         resolve({ exitCode: effectiveCode, durationMs, rateLimited, networkError, sessionId });
       },
@@ -1813,6 +2036,36 @@ ${logTail}
 DO NOT attempt the fix. ONLY write the file. When the file exists, exit immediately.`;
 }
 
+/**
+ * Pure predicate: a run whose meta.json shows a clean exit (exitCode 0) and
+ * whose verdicts.json verdict is completed-equivalent (clean / the
+ * pass_no_commit exemptions) has nothing left to diagnose — spawning an
+ * Opus investigation for it just manufactures a depth+1 fix-of-a-fix PRD for
+ * already-shipped work. Any missing/malformed input is treated as "don't
+ * skip" (fail-open: never let a missing artifact suppress a real
+ * investigation). Exported for tests.
+ */
+function shouldSkipInvestigationForCleanRun({ meta, verdicts }) {
+  if (!meta || meta.exitCode !== 0) return false;
+  if (!verdicts || !COMPLETED_EQUIVALENT_VERDICTS.has(verdicts.verdict)) return false;
+  return true;
+}
+
+/**
+ * Reads <runDir>/<slug>.meta.json + <slug>.verdicts.json off disk for the
+ * shouldSkipInvestigationForCleanRun guard. Fails safe to {} on any read/parse
+ * error (never suppresses an investigation on a missing artifact).
+ */
+function readRunOutcomeSidecars(runDir, slug) {
+  const readJson = (p) => {
+    try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
+  };
+  return {
+    meta: readJson(path.join(runDir, `${slug}.meta.json`)),
+    verdicts: readJson(path.join(runDir, `${slug}.verdicts.json`)),
+  };
+}
+
 /**
  * Spawn an Opus investigation session for a failed job. The investigator's job
  * is to read the failure log + original PRD, identify the root cause, and write
@@ -1821,13 +2074,22 @@ DO NOT attempt the fix. ONLY write the file. When the file exists, exit immediat
  * run out-of-band, so they don't consume the concurrency cap. They DO consume
  * tokens, which the when-available throttle will reflect on the next poll.
  *
- * Skipped if the failed job is itself a fix-plan (avoids infinite recursion).
+ * Skipped if the failed job is itself a fix-plan (avoids infinite recursion),
+ * or if the run being investigated actually verified clean (nothing to fix —
+ * see shouldSkipInvestigationForCleanRun).
  */
 async function spawnInvestigation(failedJob, runDir) {
   if (isFixPlanBeyondDepthCap(failedJob.slug, failedJob.investigationDepth)) {
     console.log(`[scheduler] skip investigation: ${failedJob.slug} is a fix plan at/beyond depth cap (depth=${failedJob.investigationDepth ?? 'none'})`);
     return { deferred: false };
   }
+  {
+    const { meta, verdicts } = readRunOutcomeSidecars(runDir, failedJob.slug);
+    if (shouldSkipInvestigationForCleanRun({ meta, verdicts })) {
+      console.log(`[scheduler] skip investigation: ${failedJob.slug} last run verified ${verdicts.verdict} (exit 0) — nothing to diagnose`);
+      return { deferred: false };
+    }
+  }
   if (investigationsInFlight >= MAX_CONCURRENT_INVESTIGATIONS) {
     // Queue for retry when a slot frees rather than dropping — otherwise a failed
     // job (never 'needs_review', so reverifyNeedsReview won't retry it) would
@@ -2030,6 +2292,11 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     // in its tool output (see incidents: PRD 39, 44, 56 on 2026-05-23→24).
     // Called outside mutate() so the queue lock is not held during I/O.
     let verifyResult = null;
+    // Persisted onto the job row (see the mutate() block below) whenever
+    // this run's own HEAD advances, so a LATER re-fire of the same slug can
+    // pass it back into verifyRun as priorLandedCommit (see the
+    // pass_no_commit_prior_run_verified exemption in runVerify.cjs).
+    let jobLandedCommitThisRun = null;
     if (res.exitCode === 0 && !res.rateLimited) {
       // Detect whether the job self-committed by comparing HEAD before/after.
       // Used by the sentinel override: SCHEDULER_VERDICT: PASS + a landed
@@ -2042,15 +2309,30 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
         job.startedAt,
         new Date().toISOString(),
       );
+      if (guardHeadBefore && headAtExit && headAtExit !== guardHeadBefore) {
+        jobLandedCommitThisRun = headAtExit;
+      }
 
       const prdPath = prdPathForJob(job);
       const stateForDeps = await readQueue();
+      // priorLandedCommit: the commit a PREVIOUS run of this same slug landed,
+      // if any — prefer the live jobs[] row (survives a resetJob, see
+      // resetJobFields), fall back to history.jsonl for a slug that already
+      // left jobs[]. Never the commit THIS run just made (committedDuringRun
+      // already covers that case).
+      const liveRow = stateForDeps.jobs.find((j) => j.slug === job.slug);
+      let priorLandedCommit = liveRow?.landedCommit ?? null;
+      if (!priorLandedCommit) {
+        const hist = await queueHistory.historyTerminalBySlug().catch(() => null);
+        priorLandedCommit = hist?.get(job.slug)?.landedCommit ?? null;
+      }
       verifyResult = await verifyRun({
         runDir,
         prdPath,
         queueEntry: job,
         allJobs: stateForDeps.jobs,
         committedDuringRun,
+        priorLandedCommit,
       }).catch((e) => ({
         verdict: 'verify_unavailable',
         reason: `verifier threw: ${e?.message ?? String(e)}`,
@@ -2076,6 +2358,17 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     //     deliverable; leftover dirt is presumptively a concurrent external edit
     //     (e.g. an interactive session editing the same repo), not the job's
     //     unsaved work — so skip rather than false-flag a completed job.
+    //   - legitimate-no-op skip: if the verifier already independently proved
+    //     this run's PASS-with-no-commit is truthful (verdict is one of
+    //     COMPLETED_EQUIVALENT_VERDICTS — pass_no_commit_target_verified,
+    //     _prior_run_verified, _already_shipped), the run itself did nothing
+    //     wrong; dirt left by a concurrent interactive session (e.g.
+    //     /process-feedback writing new PRD .md files into the same repo
+    //     while this job's own AC turned out to already be satisfied) is not
+    //     this job's unfinished work. Without this skip, runVerify.cjs's
+    //     exemption and this guard double-punish the same honest no-op from
+    //     two different code paths (incidents: 655-needs-review-rca-feedback-hook,
+    //     672-fix-feedback-session-manager, 2026-07-31).
     // Non-git cwds resolve to null and are skipped (the guard is best-effort).
     //
     // Runs even when a transcript-pattern verdict already fired: the commit-guard
@@ -2086,7 +2379,8 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     // annotation, so a real "finish protocol incomplete" is distinguishable from
     // transcript noise in the queue (feedback 2026-06-10 addendum).
     const guardWillRefire = verifyResult && verifyResult.downgradeTo === 'pending';
-    if (res.exitCode === 0 && !res.rateLimited && !guardWillRefire) {
+    const guardIsLegitimateNoOp = verifyResult && COMPLETED_EQUIVALENT_VERDICTS.has(verifyResult.verdict);
+    if (res.exitCode === 0 && !res.rateLimited && !guardWillRefire && !guardIsLegitimateNoOp) {
       const after = await uncommittedChanges(guardCwd);
       if (after && after.length > 0) {
         const baseSet = new Set(guardBaseline || []);
@@ -2097,19 +2391,15 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
         );
         const guardHeadAfter = await gitHead(guardCwd);
         const jobSelfCommitted = guardHeadBefore && guardHeadAfter && guardHeadAfter !== guardHeadBefore;
-        if (newlyDirty.length > 0 && !siblingRunning && !jobSelfCommitted) {
-          const sample = newlyDirty.slice(0, 3).join(', ');
-          // Carry any prior transcript verdict + its annotations forward as notes.
-          const carried = [...(verifyResult?.annotations ?? [])];
-          if (verifyResult && verifyResult.verdict !== 'clean') {
-            carried.push({ verdict: verifyResult.verdict, reason: verifyResult.reason });
-          }
-          verifyResult = {
-            verdict: 'uncommitted_changes',
-            reason: `finish protocol incomplete: ${newlyDirty.length} uncommitted file(s) left in working tree (e.g. ${sample})`,
-            downgradeTo: 'needs_review',
-            annotations: carried.length ? carried : undefined,
-          };
+        const guardVerdict = commitGuardVerdict({
+          newlyDirty,
+          siblingRunning,
+          jobSelfCommitted,
+          legitimateNoOp: guardIsLegitimateNoOp,
+          verifyResult,
+        });
+        if (guardVerdict) {
+          verifyResult = guardVerdict;
           console.log(`[scheduler] commit-guard: ${job.slug} left ${newlyDirty.length} files uncommitted → needs_review`);
         }
       }
@@ -2138,6 +2428,7 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     let investigationJobSnapshot = null;
     let needsReviewRcaSnapshot = null;
     let terminalNotifySnapshot = null;
+    const newlyCompletedPrds = [];
     await mutate((s) => {
       const i2 = s.jobs.findIndex((x) => x.slug === job.slug);
       if (i2 >= 0) {
@@ -2158,11 +2449,7 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
             effectiveStatus = 'failed';
           } else if (
             !verifyResult
-            || verifyResult.verdict === 'clean'
-            // pass_no_commit_target_verified: -merge-main postcondition exemption
-            // (runVerify.cjs) — an independently gh-confirmed clean merge target,
-            // not a plain unsubstantiated PASS. Completed, same as 'clean'.
-            || verifyResult.verdict === 'pass_no_commit_target_verified'
+            || COMPLETED_EQUIVALENT_VERDICTS.has(verifyResult.verdict)
           ) {
             effectiveStatus = 'completed';
           } else if (verifyResult.downgradeTo === 'pending') {
@@ -2180,6 +2467,13 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           s.jobs[i2].error = effectiveStatus === 'needs_review'
             ? (verifyResult?.reason ?? sigtermOverrideReason ?? null)
             : (res.error || null);
+          // Persist the commit THIS run landed (if HEAD advanced) so a later
+          // re-fire of the same slug can prove its own no-op re-run is
+          // truthful via the pass_no_commit_prior_run_verified exemption.
+          // Survives resetJobFields — see that function's comment.
+          if (jobLandedCommitThisRun) {
+            s.jobs[i2].landedCommit = jobLandedCommitThisRun;
+          }
           // Persist the verifier's verdict string so the renderer can show it.
           if (verifyResult?.verdict && verifyResult.verdict !== 'clean') {
             s.jobs[i2].verifierVerdict = verifyResult.verdict;
@@ -2201,6 +2495,9 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           if (isNotifiableTerminalStatus(effectiveStatus)) {
             terminalNotifySnapshot = { ...s.jobs[i2] };
           }
+          if (effectiveStatus === 'completed') {
+            newlyCompletedPrds.push({ slug: s.jobs[i2].slug, cwd: s.jobs[i2].cwd });
+          }
           if (effectiveStatus === 'failed') {
             actuallyFailed = true;
             failedJobSnapshot = { ...s.jobs[i2] };
@@ -2252,11 +2549,15 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
               if (priorStatus === 'needs_review') {
                 delete orig.verifierVerdict;
               }
+              newlyCompletedPrds.push({ slug: orig.slug, cwd: orig.cwd });
             }
           }
         }
       }
     });
+    for (const { slug, cwd } of newlyCompletedPrds) {
+      await archiveCompletedPrd(slug, cwd);
+    }
     await broadcast({ flush: true });
 
     if (terminalNotifySnapshot) {
@@ -2377,6 +2678,12 @@ let tickTail = Promise.resolve();
 function tickQueue() {
   const next = tickTail.then(async () => {
     const state = await readQueue();
+    // Never reconcile against an unreadable queue: reconcile() would see zero
+    // job rows for every PRD on disk and resurrect the lot as 'pending'.
+    if (state.unreadable) {
+      console.error('[scheduler] tickQueue skipped: queue.json unreadable');
+      return { fired: false, reason: 'unreadable' };
+    }
     if (state.paused) {
       console.log('[scheduler] tickQueue skipped: paused');
       return { fired: false, reason: 'paused' };
@@ -2462,6 +2769,8 @@ function forceTickOutcome(result) {
       return { ok: true, kind: 'info', message: `Already running — ${result.runningCount} job(s) in flight` };
     case 'paused':
       return { ok: true, kind: 'warn', message: 'Scheduler is paused' };
+    case 'unreadable':
+      return { ok: false, kind: 'error', message: 'queue.json is unreadable — scheduling halted; a .corrupt-<ts> copy was saved next to it' };
     case 'cancelled':
       return { ok: true, kind: 'warn', message: 'Batch cancelled — try again' };
     case 'memory-deferred':
@@ -2477,6 +2786,10 @@ function forceTickOutcome(result) {
 
 async function runDueJobs() {
   const state = await readQueue();
+  if (state.unreadable) {
+    console.error('[scheduler] runDueJobs skipped: queue.json unreadable');
+    return { fired: false, reason: 'unreadable' };
+  }
   if (state.paused) {
     console.log('[scheduler] runDueJobs skipped: paused');
     return { fired: false, reason: 'paused' };
@@ -2730,7 +3043,7 @@ function selectHistoryJobs(jobs, limit, historyEntries = []) {
 // investigation jobs correctly found "nothing to fix" but were flagged
 // anyway). For non-fix-plan jobs the exemption never applies, so rescanning
 // their pass_no_commit verdict is a harmless no-op (same facts, same verdict).
-const RESCANNABLE_VERDICTS = new Set(['transcript_errors', 'verify_unavailable', 'no_verdict_sentinel', 'pass_no_commit']);
+const RESCANNABLE_VERDICTS = new Set(['transcript_errors', 'verify_unavailable', 'no_verdict_sentinel', 'pass_no_commit', 'pass_no_commit_already_shipped']);
 
 // Bounds fix-plan recursion: depth 1 = the original job, depth 2 = its fix
 // (gets exactly one follow-up investigation if it also lands in
@@ -2882,6 +3195,13 @@ async function reverifyNeedsReview() {
     // commit-guard uses gitHead() (before/after HEAD diff); here the run is
     // already over so we query git log filtered to [startedAt, finishedAt+60s].
     const committedDuringRun = await committedInWindow(job.cwd, job.startedAt, job.finishedAt);
+    // priorLandedCommit: same lookup as spawnJob's post-run verify — the live
+    // jobs[] row first (survives a resetJob), else history.jsonl.
+    let priorLandedCommit = job.landedCommit ?? null;
+    if (!priorLandedCommit) {
+      const hist = await queueHistory.historyTerminalBySlug().catch(() => null);
+      priorLandedCommit = hist?.get(job.slug)?.landedCommit ?? null;
+    }
     let v = null;
     try {
       v = await verifyRun({
@@ -2891,12 +3211,10 @@ async function reverifyNeedsReview() {
         allJobs: snap.jobs,
         committedDuringRun,
         allowPreSentinelHeal: true,
+        priorLandedCommit,
       });
     } catch { leftForReview.push({ slug: job.slug, reason: 'verifyRun threw' }); continue; }
-    // pass_no_commit_target_verified: -merge-main postcondition exemption
-    // (runVerify.cjs) — same "heal it" treatment as 'clean', see spawnJob's
-    // effectiveStatus branch above for the primary-path equivalent.
-    if (v && (v.verdict === 'clean' || v.verdict === 'pass_no_commit_target_verified')) {
+    if (v && COMPLETED_EQUIVALENT_VERDICTS.has(v.verdict)) {
       healed.push(job.slug);
     } else {
       leftForReview.push({ slug: job.slug, reason: v ? `${v.verdict}: ${v.reason}` : 'null verdict' });
@@ -2904,15 +3222,20 @@ async function reverifyNeedsReview() {
   }
   if (healed.length) {
     const healSet = new Set(healed);
+    const healedPrds = [];
     await mutate((s) => {
       for (const j of s.jobs) {
         if (j.status === 'needs_review' && healSet.has(j.slug)) {
           j.status = 'completed';
           j.error = null;
           delete j.verifierVerdict;
+          healedPrds.push({ slug: j.slug, cwd: j.cwd });
         }
       }
     });
+    for (const { slug, cwd } of healedPrds) {
+      await archiveCompletedPrd(slug, cwd);
+    }
     console.log(`[scheduler] boot reverify: healed ${healed.length} stale needs_review → completed (${healed.join(', ')})`);
     await broadcast();
   }
@@ -2934,6 +3257,7 @@ async function reverifyNeedsReview() {
   // boot/tick, because the promotion only ran inside `if (healed.length)`
   // scoped to that single pass's fresh heals.)
   const promoted = [];
+  const promotedPrds = [];
   await mutate((s) => {
     for (const job of s.jobs) {
       if (job.status !== 'completed' || !isFixPlanSlug(job.slug)) continue;
@@ -2946,8 +3270,12 @@ async function reverifyNeedsReview() {
       orig.completedBy = job.slug;
       if (priorStatus === 'needs_review') delete orig.verifierVerdict;
       promoted.push(`${orig.slug} (was ${priorStatus}, via ${job.slug})`);
+      promotedPrds.push({ slug: orig.slug, cwd: orig.cwd });
     }
   });
+  for (const { slug, cwd } of promotedPrds) {
+    await archiveCompletedPrd(slug, cwd);
+  }
   if (promoted.length) {
     console.log(`[scheduler] boot reverify: auto-promoted ${promoted.length} original(s): ${promoted.join(', ')}`);
     await broadcast();
@@ -3094,13 +3422,21 @@ function registerScheduleHandlers() {
 
   ipcMain.handle('schedule:reset-job', validated(schemas.scheduleSlug, async ({ slug }) => {
     if (!(await safeSlugPath(slug))) return { ok: false, error: 'invalid slug' };
-    const found = await mutate((state) => {
+    const outcome = await mutate((state) => {
       const idx = state.jobs.findIndex((j) => j.slug === slug);
-      if (idx < 0) return false;
-      resetJobFields(state.jobs[idx]);
-      return true;
+      if (idx < 0) return 'not-found';
+      // Guard is in resetJobFields: refuses to reset an already-'completed'
+      // job, which would otherwise re-fire a PRD whose deliverable already
+      // landed (see resetJobFields' doc comment for the incident).
+      return resetJobFields(state.jobs[idx]) ? 'ok' : 'refused';
     });
-    if (!found) return { ok: false, error: 'not found' };
+    if (outcome === 'not-found') return { ok: false, error: 'not found' };
+    if (outcome === 'refused') {
+      return {
+        ok: false,
+        error: 'job already completed — resetting it would re-execute shipped work; archive the PRD instead',
+      };
+    }
     await broadcast({ flush: true });
     return { ok: true };
   }));
@@ -3315,6 +3651,7 @@ async function init() {
     const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
     bootOutcomes.set(j.slug, logPath ? classifyRunOutcome(logPath) : 'unknown');
   }
+  const bootReconciledCompletions = [];
   await mutate((state) => {
     for (const j of state.jobs) {
       if (j.status !== 'running' || !immediateSlugs.includes(j.slug)) continue;
@@ -3322,9 +3659,13 @@ async function init() {
       const pid = j.runtime?.pid;
       const killNote = pid ? ` (orphan pid=${pid}: dead)` : '';
       applyOrphanOutcome(j, outcome, killNote);
+      if (j.status === 'completed') bootReconciledCompletions.push({ slug: j.slug, cwd: j.cwd });
       console.log(`[scheduler] boot reconcile: slug=${j.slug} outcome=${outcome} → status=${j.status}`);
     }
   });
+  for (const { slug, cwd } of bootReconciledCompletions) {
+    await archiveCompletedPrd(slug, cwd);
+  }
 
   // Still-alive orphans: SIGTERM (+ killOrphanClaudePid's own deferred SIGKILL
   // follow-up) now, but classification waits until BOOT_ORPHAN_KILL_GRACE_MS
@@ -3344,6 +3685,7 @@ async function init() {
     setTimeout(() => {
       const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
       const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
+      let deferredCompletedCwd;
       mutate((state) => {
         const cur = state.jobs.find((x) => x.slug === slug);
         // Race guard: bail if the job already resolved, OR if it's already been
@@ -3353,6 +3695,9 @@ async function init() {
         if (!cur || cur.status !== 'running' || cur.runId !== bootRunId) return;
         applyOrphanOutcome(cur, outcome, killNote);
         console.log(`[scheduler] boot reconcile (deferred): slug=${slug} outcome=${outcome} → status=${cur.status}`);
+        deferredCompletedCwd = cur.status === 'completed' ? cur.cwd : undefined;
+      }).then(() => {
+        if (deferredCompletedCwd !== undefined) return archiveCompletedPrd(slug, deferredCompletedCwd);
       }).catch((e) => console.error(`[scheduler] deferred boot reconcile failed for ${slug}:`, e?.message));
     }, BOOT_ORPHAN_KILL_GRACE_MS).unref?.();
   }
@@ -3551,15 +3896,25 @@ const remote = {
     }
   },
 
-  async resetJob(slug) {
+  async resetJob(slug, opts = {}) {
     if (!(await safeSlugPath(slug))) return { ok: false, error: 'invalid slug' };
-    const found = await mutate((state) => {
+    const outcome = await mutate((state) => {
       const idx = state.jobs.findIndex((j) => j.slug === slug);
-      if (idx < 0) return false;
-      resetJobFields(state.jobs[idx]);
-      return true;
+      if (idx < 0) return { kind: 'not-found' };
+      // Terminal-status guard lives in resetJobFields itself; force:true
+      // threads through to override it.
+      if (!resetJobFields(state.jobs[idx], null, { force: opts.force === true })) {
+        return { kind: 'refused' };
+      }
+      return { kind: 'ok' };
     });
-    if (!found) return { ok: false, error: 'not found' };
+    if (outcome.kind === 'not-found') return { ok: false, error: 'not found' };
+    if (outcome.kind === 'refused') {
+      return {
+        ok: false,
+        error: 'job already completed — resetting it would re-execute shipped work; archive the PRD instead, or pass force:true',
+      };
+    }
     await broadcast({ flush: true });
     return { ok: true, slug, status: 'pending' };
   },
@@ -3625,9 +3980,10 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
       sendJson(res, 400, { ok: false, error: 'missing slug' });
       return;
     }
-    const result = await remoteObj.resetJob(slug);
+    const force = parsed.force === true;
+    const result = await remoteObj.resetJob(slug, { force });
     sendJson(res, 200, result);
   });
 }
 
-module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, feedbackSweepDue, FEEDBACK_SWEEP_TICK_INTERVAL, sweepFeedback, registerAdminRoutes, notifyOriginatingTab, isNotifiableTerminalStatus, candidatePrdsDirs, prdDirForCwd, prdPathForJob, findPrdDir, runPrdMigration };
+module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, writeQueue, reconcile, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, feedbackSweepDue, FEEDBACK_SWEEP_TICK_INTERVAL, sweepFeedback, registerAdminRoutes, notifyOriginatingTab, isNotifiableTerminalStatus, candidatePrdsDirs, prdDirForCwd, prdPathForJob, findPrdDir, runPrdMigration, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields };