claude-code-session-manager 0.75.3 → 0.77.0

package/src/main/scheduler.cjs

@@ -53,9 +53,13 @@ const { ipcMain } = require('electron');
 const billing = require('./usage.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./lib/cleanEnv.cjs');
 const supervisor = require('./supervisor.cjs');
-const { resolveClaudeBin } = require('./lib/claudeBin.cjs');
+const { resolveClaudeBin, probeClaudeVersion } = require('./lib/claudeBin.cjs');
+const launchFailure = require('./lib/launchFailure.cjs');
+const { appendError } = require('./lib/opsErrorLog.cjs');
 const { readTail } = require('./lib/fileTail.cjs');
-const { claudePidAlive, classifyRunOutcome, ORPHAN_REQUEUE_CAP } = require('./lib/reaperHelpers.cjs');
+const { claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs } = require('./lib/reaperHelpers.cjs');
+const { computeQueueHealth } = require('./lib/queueHealth.cjs');
+const { createLoadGate, topCpuConsumers } = require('./lib/loadGate.cjs');
 const { openLog, withChildAndLog } = require('./lib/childWithLog.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { createBroadcastCoalescer } = require('./lib/broadcastCoalescer.cjs');
@@ -67,8 +71,10 @@ const { maybeEnqueueValidationPrompt } = require('./lib/epicValidationHook.cjs')
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
 const { verifyRun } = require('./runVerify.cjs');
 const { latestTerminalOutcomeForSlug, COMPLETED_EQUIVALENT_VERDICTS } = require('./lib/terminalRunOutcome.cjs');
+const { landedSinceRun } = require('./lib/landedSinceRun.cjs');
+const { declaredPathsForPrd } = require('./lib/prdDeclaredPaths.cjs');
 const logs = require('./logs.cjs');
-const { schemas, validated } = require('./ipcSchemas.cjs');
+const { schemas, validated, SCHEDULE_SLUG_RE } = require('./ipcSchemas.cjs');
 const { readBody, sendJson } = require('./lib/localAdminHttp.cjs');
 const {
   POLL_INTERVAL_MS,
@@ -78,6 +84,9 @@ const {
   QUARANTINE_ESCALATE_MS: QUARANTINE_ESCALATE_MS_DEFAULT,
   JOB_OVERRUN_FACTOR: JOB_OVERRUN_FACTOR_DEFAULT,
   JOB_OVERRUN_FLOOR_MS: JOB_OVERRUN_FLOOR_MS_DEFAULT,
+  PIDLESS_SPAWN_GRACE_MS,
+  INVESTIGATION_MAX_MS,
+  STARVATION_ESCALATE_MS,
 } = require('./lib/schedulerConfig.cjs');
 const QUARANTINE_ESCALATE_MS = process.env.SM_QUARANTINE_ESCALATE_HOURS
   ? Number(process.env.SM_QUARANTINE_ESCALATE_HOURS) * 60 * 60_000
@@ -88,7 +97,7 @@ const JOB_OVERRUN_FACTOR = process.env.SM_JOB_OVERRUN_FACTOR
 const JOB_OVERRUN_FLOOR_MS = process.env.SM_JOB_OVERRUN_FLOOR_MINUTES
   ? Number(process.env.SM_JOB_OVERRUN_FLOOR_MINUTES) * 60_000
   : JOB_OVERRUN_FLOOR_MS_DEFAULT;
-const { pickForProject, pickNextBatch, DEFAULT_PROJECT_CWD } = require('./lib/schedulerBatch.cjs');
+const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD } = require('./lib/schedulerBatch.cjs');
 const { runDefinitionOfDoneOnDrain } = require('./lib/dodDrainHook.cjs');
 const { writeRcaReport, extractRcaBlock } = require('./lib/rcaReport.cjs');
 const queueHistory = require('./lib/queueHistory.cjs');
@@ -100,7 +109,8 @@ const queueOps = require('./queueOps.cjs');
 // home-dir layout.
 const { resolvePrdsDirs, resolveArchivedPrdsDirs, resolvePrdWriteDir, listEpicPrdDirs, listArchivedPrdDirs } = require('./lib/prdLocations.cjs');
 const { ensureEpic, appendPrdCreatedEvent, readActiveIndex } = require('./lib/epicMint.cjs');
-const { transitionJob, STATUS_HISTORY_CAP } = require('./lib/scheduleJobTransitions.cjs');
+const agentModelResolve = require('./lib/agentModelResolve.cjs');
+const { transitionJob, STATUS_HISTORY_CAP, LEGAL_TRANSITIONS } = require('./lib/scheduleJobTransitions.cjs');
 const { buildContextDigest, composeExecutorPrompt } = require('./lib/epicContextDigest.cjs');
 const { JOB_STATUSES } = require('./lib/scheduleJobSchema.cjs');
 const { appendAuditEvent } = require('./lib/auditLog.cjs');
@@ -123,6 +133,7 @@ function resolveOriginSessionId(cwd, epicId) {
   return session && typeof session.claudeSessionId === 'string' ? session.claudeSessionId : null;
 }
 const sessionSlots = require('./lib/sessionSlots.cjs');
+const quietMachineLease = require('./lib/quietMachineLease.cjs');
 const jobWorktree = require('./lib/jobWorktree.cjs');
 const { reconcileEpicWorktreesOnBoot } = require('./lib/epicWorktreeBoot.cjs');
 const queueStore = require('./lib/queueStore.cjs');
@@ -180,6 +191,21 @@ const RESULT_TEXT_TAIL_BYTES = 64 * 1024;
 const IDLE_OUTPUT_KILL_MS = 20 * 60_000;
 const IDLE_CHECK_INTERVAL_MS = 60_000;
 
+// Foreground Bash budget for every spawned `claude -p` job (executor +
+// investigation). The Claude Code harness auto-backgrounds any foreground
+// Bash command past its own default (120s) or max (600s) timeout and returns
+// a tool result promising a later notification — but a headless single-shot
+// run has no later turn, so that notification can never arrive and the run
+// dead-ends mid-verification with no commit and no verdict. Raising these
+// via the child's env moves that trap out of reach of normal gate commands
+// (test suites, builds). BASH_MAX_TIMEOUT_MS MUST stay strictly below
+// IDLE_OUTPUT_KILL_MS with real margin: a long foreground Bash emits no
+// stream-json events while it runs, so the log mtime stalls and the
+// idle-tail watchdog above would SIGTERM the job mid-gate if the two ever
+// crossed — trading one silent failure for another.
+const BASH_DEFAULT_TIMEOUT_MS = 600_000; // 10 min
+const BASH_MAX_TIMEOUT_MS = 900_000; // 15 min — must stay below IDLE_OUTPUT_KILL_MS
+
 // Boot reconciliation: a job left 'running' by an app restart/crash whose log
 // shows neither success nor a real failure result was merely interrupted — the
 // host died, the PRD didn't. Re-queue it up to this many times before giving up
@@ -205,6 +231,20 @@ const FINISH_PROTOCOL = `
 Once every acceptance-criteria line above is satisfied, finish in this EXACT
 sequence. Do not stop before the commit lands; committing is part of the job.
 
+RUN VERIFICATION IN THE FOREGROUND — this applies to the whole run, not just
+step 3 below: every test/typecheck/lint/build command you run, whether while
+implementing the AC or during VERIFY, must run SYNCHRONOUSLY and you must wait
+for it to return. Never start a verification command as a background task
+(no background Bash) and then call Monitor, TaskOutput, or ScheduleWakeup to
+pick up its result later — a headless \`claude -p\` run has no later turn, so
+nothing ever delivers that notification and the run dies mid-verification with
+no commit and no verdict. Your foreground Bash budget for this run is
+${BASH_DEFAULT_TIMEOUT_MS / 1000}s by default, up to ${BASH_MAX_TIMEOUT_MS / 1000}s max
+— size your own \`timeout <n>\` wrapper (e.g. \`timeout ${Math.floor(BASH_MAX_TIMEOUT_MS / 1000)} npm test\`)
+to fit inside that ceiling; if a gate command still cannot finish inside
+budget, stop and emit SCHEDULER_VERDICT: FAIL with the reason instead of
+deferring it.
+
 1. CODE REVIEW — run \`/code-review --fix\` on your changes and apply the fixes it
    surfaces (correctness first). For any finding you judge a false positive, say
    why in your result; do not silently skip it. If \`/code-review\` is not
@@ -287,6 +327,156 @@ function gitHead(cwd) {
   });
 }
 
+// Return the current `git stash list` entries in cwd as raw lines
+// "<hash> <ref> <subject>" (hash is stable even as ref indices shift when a
+// new entry is pushed on top), or null when the guard does not apply (cwd is
+// not a git work tree, git is missing, or the call errors). Never throws.
+function stashList(cwd) {
+  return new Promise((resolve) => {
+    if (!cwd) { resolve(null); return; }
+    execFile(
+      'git',
+      ['-C', cwd, 'stash', 'list', '--format=%H %gd %gs'],
+      { timeout: 10_000, windowsHide: true },
+      (err, stdout) => {
+        if (err) { resolve(null); return; }
+        resolve(String(stdout || '').split('\n').filter(Boolean));
+      },
+    );
+  });
+}
+
+// Parse one `stashList()` line into { hash, ref, subject }. Pure, exported
+// for unit testing. Returns null for a malformed line.
+function parseStashLine(line) {
+  const m = /^(\S+)\s+(\S+)\s+(.*)$/.exec(String(line || ''));
+  return m ? { hash: m[1], ref: m[2], subject: m[3] } : null;
+}
+
+// Paths touched by any commit landed in cwd strictly between headBefore and
+// headAfter. Returns [] when no commit landed (headBefore === headAfter, or
+// either is missing) — used by the shared-tree guard below to tell a path
+// the job legitimately committed apart from a path that just silently went
+// quiet with nothing to explain it. Never throws.
+function pathsChangedSince(cwd, headBefore, headAfter) {
+  return new Promise((resolve) => {
+    if (!cwd || !headBefore || !headAfter || headBefore === headAfter) { resolve([]); return; }
+    execFile(
+      'git',
+      ['-C', cwd, 'diff', '--name-only', `${headBefore}..${headAfter}`],
+      { timeout: 10_000, windowsHide: true },
+      (err, stdout) => { resolve(err ? [] : String(stdout || '').split('\n').filter(Boolean)); },
+    );
+  });
+}
+
+// Restore ONE specific stash ref (never a blanket pop of "whatever is on
+// top") into cwd: apply, then drop only on a clean apply. On conflict the
+// entry is left in place — never dropped, never forced — so the operator's
+// own `git stash pop`/`apply` still works afterward. Never throws.
+function restoreSpecificStash(cwd, ref) {
+  return new Promise((resolve) => {
+    execFile('git', ['-C', cwd, 'stash', 'apply', ref], { timeout: 10_000, windowsHide: true }, (applyErr, _stdout, applyStderr) => {
+      if (applyErr) {
+        resolve({ ok: false, error: String(applyStderr || applyErr.message || applyErr).trim().split('\n')[0] });
+        return;
+      }
+      execFile('git', ['-C', cwd, 'stash', 'drop', ref], { timeout: 10_000, windowsHide: true }, () => {
+        resolve({ ok: true });
+      });
+    });
+  });
+}
+
+// Diff a before/after `stashList()` pair plus a before/after dirty-path pair
+// to find what an in-place job silently discarded from a tree it shares with
+// something else (Incident: social-signals-trader 2026-09-01, a blanket
+// `git stash` reverted a live operator config edit with no error anywhere).
+// Two independent signals, either of which means the job discarded state it
+// did not create:
+//   - newStashes: a stash entry now present that wasn't in the baseline —
+//     the job ran `git stash` itself.
+//   - reverted: a path that was dirty in the baseline, is clean now, and was
+//     not touched by any commit landed during the run — the job reset/
+//     checked-out over pre-existing uncommitted work without stashing it.
+// Pure/no I/O — the guard's git calls happen at the call site
+// (checkSharedTreeGuard). Exported for unit testing.
+function evaluateSharedTreeGuard({ stashBefore, stashAfter, dirtyBefore, dirtyAfter, pathsCommittedDuringRun }) {
+  const beforeHashes = new Set((stashBefore || []).map((l) => parseStashLine(l)?.hash).filter(Boolean));
+  const newStashes = (stashAfter || [])
+    .map(parseStashLine)
+    .filter((e) => e && !beforeHashes.has(e.hash));
+  const dirtyAfterSet = new Set(dirtyAfter || []);
+  const committedSet = new Set(pathsCommittedDuringRun || []);
+  const reverted = (dirtyBefore || []).filter((p) => !dirtyAfterSet.has(p) && !committedSet.has(p));
+  return { newStashes, reverted };
+}
+
+// Post-run shared-tree guard for an IN-PLACE job (worktree.ok === false —
+// callers must gate on that; a worktree-isolated run's git state can never
+// leak into guardCwd, so there is nothing here to check). Best-effort: never
+// throws, never changes the job's exit code. Restores exactly one
+// executor-created stash (never guesses when there are 2+); reports anything
+// it can't safely resolve on the returned object so the caller can surface it
+// on the job row instead of finishing silently green.
+async function checkSharedTreeGuard({ cwd, stashBaseline, dirtyBaseline, headBefore, slug }) {
+  try {
+    const [stashAfter, headAfter] = await Promise.all([
+      module.exports.stashList(cwd),
+      module.exports.gitHead(cwd),
+    ]);
+    const pathsCommittedDuringRun = await module.exports.pathsChangedSince(cwd, headBefore, headAfter);
+    // First pass: which stashes are new. Decided before charging anything
+    // against dirtyBaseline — a path this run's own stash covers must not be
+    // judged "reverted" using dirty state captured before the restore below
+    // has had a chance to bring it back.
+    const { newStashes } = module.exports.evaluateSharedTreeGuard({
+      stashBefore: stashBaseline,
+      stashAfter,
+      dirtyBefore: [],
+      dirtyAfter: [],
+      pathsCommittedDuringRun,
+    });
+
+    const result = {};
+    if (newStashes.length === 1) {
+      const [entry] = newStashes;
+      const restore = await module.exports.restoreSpecificStash(cwd, entry.ref);
+      if (restore.ok) {
+        result.restoredStash = entry.ref;
+        console.log(`[scheduler] ${slug}: restored a stash the job created in the shared tree (${entry.ref})`);
+      } else {
+        result.restoreFailed = `${entry.ref}: ${restore.error || 'apply failed'}`;
+        console.error(`[scheduler] ${slug}: shared-tree guard could not restore ${entry.ref}: ${restore.error}`);
+      }
+    } else if (newStashes.length > 1) {
+      result.ambiguousStashes = newStashes.map((e) => e.ref);
+      console.error(`[scheduler] ${slug}: shared-tree guard found ${newStashes.length} stashes the job created — ambiguous, not auto-restoring (${result.ambiguousStashes.join(', ')})`);
+    }
+
+    // Second pass: recompute "reverted" against the tree's dirty state AFTER
+    // any restore attempt above, so a path that came back via a successfully
+    // restored stash is not ALSO reported as an unexplained revert (it was
+    // explained — by the stash this guard just restored).
+    const dirtyAfter = await module.exports.uncommittedChanges(cwd);
+    const { reverted } = module.exports.evaluateSharedTreeGuard({
+      stashBefore: stashBaseline,
+      stashAfter,
+      dirtyBefore: dirtyBaseline,
+      dirtyAfter,
+      pathsCommittedDuringRun,
+    });
+    if (reverted.length) {
+      result.reverted = reverted;
+      console.error(`[scheduler] ${slug}: shared-tree guard: ${reverted.length} path(s) reverted in the shared tree with no commit to explain it (${reverted.slice(0, 3).join(', ')})`);
+    }
+    return (result.restoredStash || result.restoreFailed || result.ambiguousStashes || result.reverted) ? result : null;
+  } catch (e) {
+    console.error(`[scheduler] ${slug}: shared-tree guard error`, e);
+    return null;
+  }
+}
+
 // True when cwd is inside a git repository. Used to keep a non-git cwd (e.g.
 // a scratch dir like /tmp) from ever being handed to an investigation's
 // fix-plan as its cwd — the commit guard, worktree isolation, and
@@ -690,6 +880,43 @@ async function safeSlugPath(slug) {
   return safeSlugPathIn(dir, slug);
 }
 
+/**
+ * The two distinct failure modes safeSlugPath collapses into one nullable
+ * return (the defect this fixes — see the PRD that added this helper's
+ * Goal): a slug that fails SCHEDULE_SLUG_RE is a caller mistake ("invalid
+ * slug"), while a well-formed slug that exists in no candidate PRD dir is a
+ * lookup miss ("unknown slug") — an agent retrying the first as if it were
+ * the second (or vice versa) burns a turn on the wrong fix. Returns
+ * `{ ok: true, path }` or `{ ok: false, reason: 'invalid-slug' | 'not-found' }`.
+ * `cwd`, if given, narrows the search to that one project's own PRD dirs
+ * (prdDirForCwd + its Epic-scoped dirs — same pattern as getPrdParsed);
+ * omitted, it searches every candidate dir machine-wide via findPrdDir.
+ */
+async function resolveSlugOrReason(slug, cwd) {
+  if (!SCHEDULE_SLUG_RE.test(slug)) return { ok: false, reason: 'invalid-slug' };
+  if (cwd) {
+    for (const dir of [prdDirForCwd(cwd), ...listEpicPrdDirs(cwd)]) {
+      const p = safeSlugPathIn(dir, slug);
+      if (!p) continue;
+      try {
+        await fsp.access(p);
+        return { ok: true, path: p };
+      } catch { /* not in this dir — try the next candidate */ }
+    }
+    return { ok: false, reason: 'not-found' };
+  }
+  const dir = await findPrdDir(slug);
+  if (!dir) return { ok: false, reason: 'not-found' };
+  const p = safeSlugPathIn(dir, slug);
+  if (!p) return { ok: false, reason: 'not-found' };
+  return { ok: true, path: p };
+}
+
+/** Actionable message for `resolveSlugOrReason`'s 'not-found' reason. */
+function unknownSlugMessage(slug) {
+  return `unknown slug "${slug}": no PRD file with that name in any known project — call scheduler_list_prds (optionally with cwd) to see what exists`;
+}
+
 /**
  * Move a completed job's `<slug>.md` out of its PRD dir into that dir's
  * sibling `prds-archived/`, so a finished slug can't be re-fired by the
@@ -1098,6 +1325,73 @@ function findOverrunningJobs(jobs, now, { factor, floorMs } = {}) {
   return out;
 }
 
+/**
+ * findStrandedInvestigations(jobs, now, maxMs, isAlive = claudePidAlive)
+ *   → [{ slug, cwd, ageMs, restoreStatus }]
+ *
+ * Pure (besides the warn-log side effect on the two unprovable-age cases
+ * below), no other IO. spawnInvestigation's own restore of a job's
+ * pre-investigation status runs entirely inside the process that spawned the
+ * probe (its withChildAndLog onExit handler, or the synchronous-throw catch
+ * path) — so a job left 'investigating' when the app itself dies or restarts
+ * has NOTHING left to restore it. The comment at spawnInvestigation's onExit
+ * asserts "'investigating' must never be the job's resting state"; this is
+ * the sweep that makes that true across a restart, not just within one.
+ *
+ * A row qualifies only when ALL of:
+ *  - status is 'investigating'
+ *  - its most recent transition INTO 'investigating' (statusHistory's last
+ *    `to === 'investigating'` entry — a job can be investigated more than
+ *    once across its life, e.g. a retried auto-fix) is older than `maxMs`
+ *  - it has no live probe process behind it (checked via runtime.pid, set by
+ *    spawnInvestigation once its child spawns and cleared on every restore
+ *    path, the same shape reapDeadRunningJobs already uses for 'running' rows)
+ *
+ * `restoreStatus` is that transition entry's `from` — the exact value
+ * spawnInvestigation itself would have restored to (`failedJob.status ||
+ * 'failed'`), which for a row that already finished and recorded
+ * finishedAt+exitCode (the burrow-834 shape) is whatever terminal status was
+ * computed for that outcome BEFORE the probe was spawned — this sweep never
+ * re-derives it from exitCode, only replays the already-recorded decision.
+ *
+ * A row with no recoverable transition timestamp cannot have its age proven,
+ * so it is warn-logged and left alone rather than guessed at — same posture
+ * as findStaleQuarantinedJobs/findOverrunningJobs.
+ *
+ * `restoreStatus` is validated against LEGAL_TRANSITIONS['investigating']
+ * before being returned — `statusHistory`'s `from` should only ever be
+ * 'failed' or 'needs_review' (the only two states LEGAL_TRANSITIONS allows
+ * into 'investigating'), but a corrupted/unexpected value must not be handed
+ * straight to transitionJob: an illegal target is refused outright (row stays
+ * stuck at 'investigating', re-detected as stranded every sweep with no path
+ * out), so an out-of-set `from` falls back to 'failed' here instead.
+ */
+const INVESTIGATING_RESTORE_TARGETS = new Set(LEGAL_TRANSITIONS.investigating);
+function findStrandedInvestigations(jobs, now, maxMs, isAlive = claudePidAlive) {
+  const out = [];
+  for (const j of jobs ?? []) {
+    if (j.status !== 'investigating') continue;
+    const entries = (j.statusHistory || []).filter((h) => h.to === 'investigating');
+    const entry = entries[entries.length - 1];
+    if (!entry) {
+      console.warn(`[scheduler] findStrandedInvestigations: ${j.slug} is 'investigating' with no statusHistory entry recording the transition — cannot prove age, leaving alone`);
+      continue;
+    }
+    const since = Date.parse(entry.at ?? '');
+    if (Number.isNaN(since)) {
+      console.warn(`[scheduler] findStrandedInvestigations: ${j.slug} has an unparseable investigating-transition timestamp (${entry.at}) — cannot prove age, leaving alone`);
+      continue;
+    }
+    const ageMs = now - since;
+    if (ageMs < maxMs) continue; // a live probe must not be yanked out from under itself
+    const pid = j.runtime?.pid;
+    if (pid && isAlive(pid)) continue; // probe genuinely still running — not stranded
+    const restoreStatus = INVESTIGATING_RESTORE_TARGETS.has(entry.from) ? entry.from : 'failed';
+    out.push({ slug: j.slug, cwd: j.cwd ?? null, ageMs, restoreStatus });
+  }
+  return out;
+}
+
 // An empty queue and an unreadable queue are NOT the same thing, and
 // conflating them is destructive: reconcile() treats every PRD .md with no
 // matching jobs[] row as a brand-new goal and re-mints it as 'pending', so a
@@ -1443,9 +1737,11 @@ async function reconcile(state) {
       // membership, so moving the file between Epic dirs must re-point the row.
       epicId: p.epicId ?? job.epicId ?? null,
       dependsOn: p.dependsOn,
+      quietMachine: p.quietMachine === true,
       originSessionId: job.originSessionId
         ?? resolveOriginSessionId(p.cwd, p.epicId ?? reconcileSourcePromptId(job, p.sourcePromptId)),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
+      agentType: p.agentType ?? job.agentType ?? null,
     };
     // Adopt path: a row parked 'quarantined' (no createdVia provenance when
     // discovered) whose PRD file now carries a stamp — written via the
@@ -1554,8 +1850,10 @@ async function reconcile(state) {
       sourceTabId: p.sourceTabId ?? inv.row?.sourceTabId ?? null,
       epicId: p.epicId ?? inv.row?.epicId ?? null,
       dependsOn: p.dependsOn,
+      quietMachine: p.quietMachine === true,
       originSessionId: inv.row?.originSessionId ?? resolveOriginSessionId(p.cwd, p.epicId ?? p.sourcePromptId),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
+      agentType: p.agentType ?? inv.row?.agentType ?? null,
     };
     const reason = `reconcile: repaired invalid status ${JSON.stringify(oldStatus)}`;
     // A repair is not a lifecycle transition — the corrupted `status` was
@@ -1674,9 +1972,15 @@ async function reconcile(state) {
       sourceTabId: p.sourceTabId,
       epicId: p.epicId ?? null,
       dependsOn: p.dependsOn,
+      quietMachine: p.quietMachine === true,
       originSessionId: resolveOriginSessionId(p.cwd, p.epicId ?? p.sourcePromptId),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
+      agentType: p.agentType ?? null,
       status: 'pending',
+      // Enqueue time (PRD 1086/1087): the cross-project fairness tiebreak and
+      // the starvation escalation both need a provable age for a pending row;
+      // before this stamp a freshly minted row carried no timestamp at all.
+      queuedAt: new Date().toISOString(),
       runId: null,
       startedAt: null,
       finishedAt: null,
@@ -1864,6 +2168,9 @@ function drainDeferredInvestigation() {
 let cancelToken = { cancelled: false };
 // Last memory-gate observation; included in snapshot for renderer visibility.
 let lastMemGate = null;
+// CPU-load launch gate (PRD 1085, lib/loadGate.cjs) — innermost launch
+// predicate after pool → project cap → memory. Withholds launches only.
+const loadGate = createLoadGate();
 
 // Last tickQueue outcome, kept for the UI. tickQueue already computes a precise
 // reason for every way a batch can come back empty (dependency holds, slot
@@ -1924,6 +2231,10 @@ function buildScheduleStatePayload(state, { withPaths = false } = {}) {
     lastRunAt: state.lastRunAt,
     nextReset: getNextResetCached(),
     paused: state.paused,
+    // Launch circuit breaker (issue #11): which personas cannot launch right
+    // now and why, plus any degraded-mode env in force. Empty objects when healthy.
+    launchBlocks: state.launchBlocks ?? {},
+    launchMitigations: state.launchMitigations ?? {},
     utilization: cachedUtilization,
     pollHealth: {
       lastPollAt,
@@ -1932,6 +2243,8 @@ function buildScheduleStatePayload(state, { withPaths = false } = {}) {
       lastFailureKind,
     },
     memGate: lastMemGate,
+    // Why nothing is launching when the box is CPU-saturated (PRD 1085).
+    loadGate: loadGate.snapshot(),
     lastTick,
     // The machine-wide slot pool IS the concurrency limit — there is no
     // separate scheduler cap any more. `source` distinguishes the
@@ -2065,7 +2378,17 @@ async function setPaused(reason, resumeAtIso) {
 
 async function clearPause(source) {
   if (resumeTimer) { clearTimeout(resumeTimer); resumeTimer = null; }
+  const humanOverride = source === 'manual' || source === 'run-now';
   const wasPaused = await mutate((s) => {
+    // A human Resume / Run now also re-closes every launch circuit breaker:
+    // the operator is asserting the environment is fixed (CLI updated,
+    // re-logged-in). The next dispatch of each persona is its probe; if the
+    // environment is still broken the breaker simply re-arms.
+    if (humanOverride && s.launchBlocks && Object.keys(s.launchBlocks).length) {
+      console.log(`[scheduler] clearPause (${source}): clearing launch blocks [${Object.keys(s.launchBlocks).join(', ')}]`);
+      for (const j of s.jobs) if (j.status === 'pending' && j.heldReason && /^launch blocked/.test(j.heldReason)) delete j.heldReason;
+      s.launchBlocks = {};
+    }
     if (!s.paused) return false;
     console.log(`[scheduler] clearPause (${source || 'manual'})`);
     s.paused = null;
@@ -2113,6 +2436,29 @@ function resetJobFields(job, errorMsg, opts = {}) {
   job.error = errorMsg ?? null;
   delete job.runtime;
   delete job.verifierVerdict;
+  delete job.uncommittedPaths;
+  delete job.resumeRecoveryAttempted;
+  // Same "this run's outcome, not durable across a reset" category as the
+  // fields above — a stale 'archive' recoveryAction from a prior life of this
+  // slug must never survive a reset and silently exclude a genuinely-new
+  // needs_review episode from selectAutoFixTargets (applyRcaClassification
+  // only overwrites these on a successful RCA write, so without this they
+  // can otherwise linger forever when RCA is disabled or errors).
+  delete job.rcaFailureClass;
+  delete job.rcaRecoveryAction;
+  // Like exitCode: this run's outcome, not durable across a reset — a stale
+  // leak badge from a prior attempt must not linger once the job re-fires.
+  delete job.leakedDescendants;
+  // A pending row is about to re-run fresh — a stale leftover badge or a
+  // stale pre-run baseline from the attempt that just ended must not linger
+  // and be mistaken for THIS (not-yet-run) attempt's own output. spawnJob
+  // persists a brand-new guardBaseline at the next dispatch.
+  delete job.guardBaseline;
+  delete job.guardHeadBefore;
+  delete job.leftoverPaths;
+  delete job.leftoverCount;
+  delete job.leftoverPathsTruncated;
+  delete job.preRunDirtyPaths;
   // Deliberately NOT deleting job.landedCommit: it must outlive a reset so a
   // re-fired run of this same slug can pass it to verifyRun as
   // priorLandedCommit (pass_no_commit_prior_run_verified exemption).
@@ -2609,9 +2955,15 @@ function classifyFailureOutcome({ exitCode, networkError, durationMs, transientR
  * tree was dirty — closed by widening that call site's condition, not by
  * changing this function's four defenses below, which still apply to both
  * shapes identically:
- *   - siblingRunning: a concurrent job in the same cwd makes working-tree
- *     evidence unreliable in both directions (extra dirt OR a clean tree
- *     that isn't this job's doing).
+ *   - siblingRunning: on a SHARED tree only — a concurrent job in the same
+ *     cwd makes working-tree evidence unreliable in both directions (extra
+ *     dirt OR a clean tree that isn't this job's doing). Suppressed by
+ *     ranInWorktree: when this job ran in its own git worktree, the
+ *     newly-dirty set and the integrated HEAD are attributable to this job
+ *     alone regardless of what siblings were doing concurrently in their own
+ *     worktrees, so the excuse does not apply (PRD 109 shipped 'completed'
+ *     with nothing committed specifically because this carve-out fired
+ *     unconditionally during a high-concurrency run).
  *   - jobSelfCommitted: HEAD moved during the run, so the job's deliverable
  *     landed even if dirt (from a concurrent actor) remains.
  *   - legitimateNoOp (COMPLETED_EQUIVALENT_VERDICTS): runVerify.cjs's own
@@ -2631,8 +2983,8 @@ function classifyFailureOutcome({ exitCode, networkError, durationMs, transientR
  *     still a genuine finish-protocol violation (incident:
  *     523-fix-bounded-fix-plan-retry, 2026-07-12).
  */
-function commitGuardVerdict({ newlyDirty, siblingRunning, jobSelfCommitted, legitimateNoOp, isFixPlanJob, verifyResult }) {
-  if (siblingRunning || jobSelfCommitted || legitimateNoOp) return null;
+function commitGuardVerdict({ newlyDirty, siblingRunning, ranInWorktree, jobSelfCommitted, legitimateNoOp, isFixPlanJob, verifyResult, salvagePatch }) {
+  if ((siblingRunning && !ranInWorktree) || jobSelfCommitted || legitimateNoOp) return null;
   const dirty = newlyDirty || [];
   if (dirty.length === 0 && isFixPlanJob) return null;
 
@@ -2651,12 +3003,196 @@ function commitGuardVerdict({ newlyDirty, siblingRunning, jobSelfCommitted, legi
   }
 
   const sample = dirty.slice(0, 3).join(', ');
+  const salvageNote = salvagePatch ? ` — recoverable from salvage patch ${salvagePatch}` : '';
   return {
     verdict: 'uncommitted_changes',
-    reason: `finish protocol incomplete: ${dirty.length} uncommitted file(s) left in working tree (e.g. ${sample})`,
+    reason: `finish protocol incomplete: ${dirty.length} uncommitted file(s) left in working tree (e.g. ${sample})${salvageNote}`,
     downgradeTo: 'needs_review',
     annotations: carried.length ? carried : undefined,
+    // The exact dirty-path list, persisted on the job row (see the
+    // commit-guard call site) so a later resume-recovery attempt
+    // (selectResumeRecoveryTarget) can name these paths without re-running
+    // `git status` against a tree that may have moved on since.
+    dirtyPaths: dirty,
+  };
+}
+
+// Every path list this job leaves attributed on the row is capped here so a
+// pathological run (thousands of newly-dirty files) never bloats queue.json
+// or history.jsonl — the count is still recorded in full via leftoverCount,
+// only the displayed sample is capped.
+const LEFTOVER_PATHS_CAP = 50;
+
+/**
+ * Pure: turn a newly-dirty path list (or null, meaning "couldn't tell" —
+ * never "left nothing") into the `leftoverPaths`/`leftoverCount`/
+ * `leftoverPathsTruncated` triple stamped on a terminal job row, or null when
+ * there is nothing to attribute (empty list, or the list itself is
+ * unavailable). One shape for both the worktree-leftover path and the
+ * in-place baseline-delta path — see this function's callers in spawnJob and
+ * reapDeadRunningJobs, both of which diff against a persisted pre-run
+ * baseline so a human's or a sibling's pre-existing WIP is never
+ * misattributed to this job.
+ */
+function leftoverFieldsFrom(paths) {
+  if (!Array.isArray(paths) || paths.length === 0) return null;
+  const fields = {
+    leftoverPaths: paths.slice(0, LEFTOVER_PATHS_CAP),
+    leftoverCount: paths.length,
   };
+  if (paths.length > LEFTOVER_PATHS_CAP) fields.leftoverPathsTruncated = true;
+  return fields;
+}
+
+/** Stamps (or clears) the leftover-attribution fields on a job row in place. */
+function applyLeftoverFields(row, paths) {
+  delete row.leftoverPaths;
+  delete row.leftoverCount;
+  delete row.leftoverPathsTruncated;
+  const fields = leftoverFieldsFrom(paths);
+  if (fields) Object.assign(row, fields);
+}
+
+// Same bloat concern as LEFTOVER_PATHS_CAP, applied to the PRE-run dirty
+// snapshot (foreign WIP the job did not create) instead of the post-run
+// leftover delta.
+const PRE_RUN_DIRTY_PATHS_CAP = 200;
+
+/**
+ * Pure: cap a dirty-path list at PRE_RUN_DIRTY_PATHS_CAP, appending a
+ * `+N more` marker entry when truncated, so queue.json/history.jsonl never
+ * take on an unbounded row for a pathologically dirty shared tree. Returns
+ * [] for null/empty input (never null) — callers gate storage/prompt
+ * injection on `.length` the same way carriedPaths already does.
+ */
+function capDirtyPaths(paths, cap = PRE_RUN_DIRTY_PATHS_CAP) {
+  if (!Array.isArray(paths) || paths.length === 0) return [];
+  if (paths.length <= cap) return paths.slice();
+  return [...paths.slice(0, cap), `+${paths.length - cap} more`];
+}
+
+// Stable, machine-greppable delimiter — a downstream PRD (verifier scoring
+// foreign-WIP test failures separately) greps the executor log for this
+// exact marker, so its text must never be reworded casually.
+const FOREIGN_WIP_DELIMITER = '--- FOREIGN WORKING-TREE STATE (not your work) ---';
+const FOREIGN_WIP_END_DELIMITER = '--- END FOREIGN WORKING-TREE STATE ---';
+
+/**
+ * Pure: build the executor-prompt section warning about pre-existing dirty
+ * paths this job does not own — either base WIP carried into an isolated
+ * worktree (PRD 1094's carriedPaths, checked first since it's the more
+ * specific/authoritative case) or the raw pre-run dirty snapshot of a shared
+ * (non-isolated) tree. Returns '' when both lists are empty so a clean spawn
+ * produces a byte-identical prompt to before this section existed.
+ */
+function buildForeignWipSection({ preRunDirtyPaths, carriedPaths } = {}) {
+  const carried = Array.isArray(carriedPaths) ? carriedPaths.filter(Boolean) : [];
+  if (carried.length) {
+    return [
+      FOREIGN_WIP_DELIMITER,
+      'This job is running in an isolated git worktree, but the following paths carry uncommitted base-tree work-in-progress that was carried into this checkout so the tree is self-consistent. The authoritative copy of these files lives in the MAIN tree, not this worktree.',
+      'These files were already modified before this job started. They are NOT this job\'s work:',
+      ...carried.map((p) => `  ${p}`),
+      'Do not stage, commit, revert, or stash these paths. A test failure confined to these paths is not this job\'s regression.',
+      FOREIGN_WIP_END_DELIMITER,
+    ].join('\n');
+  }
+  const dirty = Array.isArray(preRunDirtyPaths) ? preRunDirtyPaths.filter(Boolean) : [];
+  if (dirty.length) {
+    return [
+      FOREIGN_WIP_DELIMITER,
+      'This job is running in a SHARED working tree (not isolated in its own worktree). The following paths were already modified when this job started:',
+      ...dirty.map((p) => `  ${p}`),
+      'These files are NOT this job\'s work. Do not stage, commit, revert, or stash them. A test failure confined to these paths is not this job\'s regression.',
+      FOREIGN_WIP_END_DELIMITER,
+    ].join('\n');
+  }
+  return '';
+}
+
+/**
+ * Resume-first recovery (PRD 1111). A job parked in needs_review with verdict
+ * 'uncommitted_changes' has a live claude session (job.sessionId, minted by
+ * spawnJob's `--session-id`) that already has full context of the work it
+ * left uncommitted — resuming it via `claude -p --resume <sessionId>` lets it
+ * finish its own finish-protocol COMMIT step, instead of spawnInvestigation
+ * cold-reading the log to author a fix-plan PRD that a FRESH session then has
+ * to re-derive that same context for. Pure/no I/O so the eligibility rule can
+ * be unit-tested directly, matching classifyFailureOutcome/commitGuardVerdict.
+ *
+ * Bounded to exactly one attempt via job.resumeRecoveryAttempted, stamped
+ * atomically with the 'running' transition inside spawnJob's own dispatch
+ * mutate (see spawnJob) — never here — so a crash between this function
+ * returning a target and the resume child actually spawning cannot leave the
+ * job re-eligible.
+ *
+ * Kill-switch: SM_RESUME_RECOVERY_DISABLE=1 restores today's behaviour
+ * exactly (always returns null), mirroring SM_RCA_DISABLE/SM_DOD_DISABLE.
+ */
+function selectResumeRecoveryTarget(job) {
+  if (process.env.SM_RESUME_RECOVERY_DISABLE === '1') return null;
+  if (!job || job.status !== 'needs_review') return null;
+  if (job.verifierVerdict !== 'uncommitted_changes') return null;
+  if (typeof job.sessionId !== 'string' || job.sessionId.length === 0) return null;
+  if (job.resumeRecoveryAttempted === true) return null;
+  const dirtyPaths = Array.isArray(job.uncommittedPaths)
+    ? job.uncommittedPaths.filter((p) => typeof p === 'string' && p.length > 0)
+    : [];
+  if (!dirtyPaths.length) return null;
+  return { slug: job.slug, sessionId: job.sessionId, dirtyPaths, salvagePatch: job.salvagePatch || null };
+}
+
+/**
+ * Short deterministic preamble for a resume-recovery dispatch — NEVER the
+ * original PRD body (the resumed session already has that in its own
+ * conversation history; re-embedding it would just waste context and risk
+ * contradicting whatever state the session actually left behind). Names the
+ * exact paths recorded on the parked job row so the resumed run can verify
+ * them on disk before trusting them, rather than re-deriving them itself.
+ */
+function buildResumeRecoveryPreamble({ dirtyPaths, salvagePatch }) {
+  const pathList = dirtyPaths.map((p) => `- ${p}`).join('\n');
+  const salvageLine = salvagePatch
+    ? `\nA salvage patch of this work was also captured at: ${salvagePatch} — apply it if any of the paths above are missing from the working tree.\n`
+    : '';
+  return `RESUME RECOVERY: your previous run in this same session left uncommitted work on disk and exited before the finish protocol's COMMIT step ran. This is a continuation of that same session, not a new task — do not restart from scratch.
+
+The following path(s) were recorded as uncommitted when this job was parked for review:
+${pathList}
+${salvageLine}
+Do the following now:
+1. Run \`git status\` and verify each path above is present on disk and reflects your intended work. If a path is missing, investigate before recreating it — don't blindly redo work that may already be committed or salvaged elsewhere.
+2. Run the project's verification gate (typecheck/lint/tests) in the FOREGROUND — wait for it to finish and read its real exit code before proceeding. Do not background it.
+3. If the gate is green, stage exactly the paths you created or modified for this work and commit them: \`git add <path> [<path>...] && git commit -m "<type>(<scope>): <summary>"\`.
+4. If the gate is red, fix it, then commit.
+
+As the LAST LINE of your final result text, emit exactly one of:
+  SCHEDULER_VERDICT: PASS
+  SCHEDULER_VERDICT: FAIL <one-line reason>
+Print PASS only once the commit above has actually landed.`;
+}
+
+/**
+ * Pure argv builder for a `claude -p` child spawn, shared so the
+ * resume-vs-fresh-session choice is made in exactly one place. `resume`
+ * selects `--resume <sessionId>` (reconnect) INSTEAD of `--session-id
+ * <sessionId>` (mint) — the two flags are mutually exclusive, never both.
+ * `--model` is always explicit (never left to the CLI's drifting default —
+ * see conventions.md). `systemPrompt`, when given (the PRD's `agentType`
+ * persona body, resolved by agentModelResolve.cjs's resolvePrdPersonaForSpawn),
+ * is passed as `--append-system-prompt` so the executor IS that persona at
+ * launch rather than being asked in prose to adopt one.
+ */
+function buildClaudeSpawnArgs({ prompt, model, sessionId, resume, systemPrompt }) {
+  return [
+    '-p', prompt,
+    '--model', model,
+    ...(systemPrompt ? ['--append-system-prompt', systemPrompt] : []),
+    '--dangerously-skip-permissions',
+    '--output-format', 'stream-json',
+    '--verbose',
+    ...(resume ? ['--resume', sessionId] : ['--session-id', sessionId]),
+  ];
 }
 
 // ---------- execution ----------
@@ -2677,7 +3213,7 @@ function pickRunDir() {
  * Watchdogs are declared as an array; the result-tailer's exit-code mapping
  * (success+killedBySignal → 0) is scheduler-specific and lives in onExit.
  */
-async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
+async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget = null, foreignWip = null, launchEnv = null) {
   const logPath = path.join(runDir, `${job.slug}.log`);
   const metaPath = path.join(runDir, `${job.slug}.meta.json`);
   // `cwd` stays the MAIN tree throughout — PRD lookup (findPrdDir/prdPathForJob)
@@ -2687,7 +3223,10 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
   const cwd = job.cwd || defaultCwd;
   const spawnCwd = execCwd || cwd;
   const startedAt = Date.now();
-  const sessionId = randomUUID();
+  // Resume mode (PRD 1111) reconnects to the SAME session that left the
+  // uncommitted work — reusing its id via `--resume` instead of minting a
+  // fresh one via `--session-id` is the entire point of the recovery.
+  const sessionId = resumeTarget ? resumeTarget.sessionId : randomUUID();
 
   // Phase 1: open log fd so we can emit pre-spawn diagnostics (early-exit
   // error paths) before the child is created. withChildAndLog takes ownership
@@ -2712,14 +3251,23 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
     return { exitCode: -1, durationMs: 0, error: errMsg, sessionId };
   }
 
+  let prompt;
+  let prdPath = null;
+  if (resumeTarget) {
+    // Resume mode (PRD 1111): a short deterministic preamble naming the
+    // recorded dirty paths, NEVER the original PRD body — the resumed
+    // session already has that in its own conversation history via
+    // --resume, and re-embedding it here would just contradict whatever
+    // state the session actually left on disk.
+    prompt = buildResumeRecoveryPreamble({ dirtyPaths: resumeTarget.dirtyPaths, salvagePatch: resumeTarget.salvagePatch });
+  } else {
   // Read full PRD body fresh from disk (queue stored only the preview).
   // Resolve through findPrdDir's full candidate search (legacy flat dir +
   // every project's Epic-scoped dirs) first, so the common case — a live
   // Epic-scoped PRD — is a first-try hit instead of probing the retired flat
   // dir and only then falling back.
-  let prompt;
   const resolvedDir = await findPrdDir(job.slug);
-  let prdPath = resolvedDir ? path.join(resolvedDir, `${job.slug}.md`) : prdPathForJob(job);
+  prdPath = resolvedDir ? path.join(resolvedDir, `${job.slug}.md`) : prdPathForJob(job);
   try {
     const parsed = await parsePrd(prdPath);
     // The review → security-review → verify → commit finish sequence is
@@ -2775,14 +3323,17 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
       return { exitCode: -1, durationMs: 0, error: e?.message };
     }
   }
+  } // end resumeTarget ? preamble : normal-PRD-read
 
+  let contextDigestApplied = false;
+  let originSessionId = null;
+  if (!resumeTarget) {
   // Prepend the Epic's own session digest (PRD 950/958) when this job traces
   // back to a known Epic — additive only, never mutates the PRD body itself.
   // A missing/unresolved epicId or a digest build failure is a silent no-op:
   // the PRD's own body must remain sufficient to complete the job on its own.
   const digestEpicId = job.epicId ?? job.sourcePromptId ?? null;
-  const originSessionId = resolveOriginSessionId(cwd, digestEpicId);
-  let contextDigestApplied = false;
+  originSessionId = resolveOriginSessionId(cwd, digestEpicId);
   let digestText = '';
   if (originSessionId) {
     try {
@@ -2793,12 +3344,39 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
       digestText = '';
     }
   }
+  // Quiet-machine degraded dispatch (PRD 1107): this job opted into
+  // `quietMachine: true` but waited past quietMachineWaitMs() without the
+  // machine ever going quiet, so pickNextBatch dispatched it anyway rather
+  // than wedge the queue forever. Told to the executor as a plain prompt
+  // line — its own wall-clock/timing acceptance criteria were measured (or
+  // will be measured) under CPU contention from sibling jobs, not on a
+  // quiet machine, so it should not report a timing result as trustworthy
+  // without saying so.
+  if (job.quietLeaseDegraded === true) {
+    prompt = `NOTE: this job requested \`quietMachine: true\` but the machine never went idle within the `
+      + `configured wait window, so it was dispatched anyway (degraded). Any timing/frame-rate/performance `
+      + `measurement in this run may be affected by CPU contention from other concurrent jobs — say so explicitly `
+      + `in your result rather than reporting it as a clean measurement.\n\n${prompt}`;
+  }
   // Always route through composeExecutorPrompt (even with an empty digest)
   // so the finish protocol is appended in the prompt's tail exactly once,
   // after any digest fence rather than concatenated ahead of it.
   prompt = composeExecutorPrompt({ prdBody: prompt, digestText, finishProtocol: FINISH_PROTOCOL });
 
-  const promptCheck = validatePromptForSpawn(prompt, prdPath);
+  // Foreign-WIP manifest (starry-night-ships PRD 148 postmortem): the
+  // scheduler already knows, at spawn time, which dirty paths this job did
+  // not create — either a shared tree's pre-existing dirty set or worktree
+  // WIP carried in from the base tree (PRD 1094). Telling the executor
+  // explicitly here means it never has to bisect by content to prove a test
+  // failure isn't its own regression. '' (clean spawn) leaves prompt
+  // byte-identical to before this section existed.
+  const foreignWipSection = buildForeignWipSection(foreignWip || {});
+  if (foreignWipSection) {
+    prompt = `${prompt}\n\n${foreignWipSection}`;
+  }
+  } // end !resumeTarget digest/finish-protocol composition
+
+  const promptCheck = validatePromptForSpawn(prompt, resumeTarget ? `<resume recovery preamble for ${job.slug}>` : prdPath);
   if (!promptCheck.ok) {
     safeLog(`[scheduler] ${promptCheck.error}\n`);
     closeFd();
@@ -2806,6 +3384,15 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
     return { exitCode: -1, durationMs: 0, error: promptCheck.error, sessionId };
   }
 
+  // PRD agentType → persona + model (PRD 1115): resolved for both fresh and
+  // resume dispatches, keyed off job.agentType (persisted on the queue row
+  // by reconcile()) rather than re-reading the PRD file — a resumed session
+  // must keep launching as the SAME persona it started as. Never throws;
+  // a dangling/absent agentType falls back to no persona + FALLBACK_MODEL
+  // and is logged once by resolvePrdPersonaForSpawn itself.
+  const personaResolution = await agentModelResolve.resolvePrdPersonaForSpawn({ cwd, agentType: job.agentType });
+  safeLog(`[scheduler] agentType=${job.agentType || '(none)'} persona=${personaResolution.personaPath || '(fallback — no persona applied)'} model=${personaResolution.model}\n`);
+
   return await new Promise((resolve) => {
     const claudeBin = resolveClaudeBin();
     // Strip Claude Code env and secrets that leak in when session-manager is
@@ -2813,7 +3400,31 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
     // overrides `--model sonnet`, so scheduled jobs burn Opus credits silently.
     // PATH must include Homebrew/user bins or the job's node/git children ENOENT
     // when Electron was launched from Finder/Dock on macOS (stripped PATH).
-    const childEnv = cleanChildEnv({ PATH: pathWithUserBins() });
+    // SM_PROJECT_ROOT is the main-tree cwd (never spawnCwd, which may be a
+    // job/epic worktree) — forwarded by scheduler-mcp-server.cjs as
+    // originProjectRoot so a job running inside its own worktree can still
+    // resolve the real project for create-prd/open-session/readiness. See
+    // projectRootResolve.cjs.
+    // SM_SCHEDULER_JOB_SLUG marks the child (and the MCP servers it
+    // inherits its env to) as a headless scheduled executor, so
+    // scheduler-mcp-server.cjs can refuse scheduler_create_prd from inside a
+    // run (issue #11 list C1 — the PRD 460 self-queue incident). Only a
+    // persona whose whole job is decomposition may still queue.
+    // `launchEnv` is the launch circuit breaker's degraded-mode env (e.g.
+    // MAX_THINKING_TOKENS=0 while an outdated CLI's thinking parameter is
+    // being rejected — lib/launchFailure.cjs); applied last so it wins.
+    const childEnv = cleanChildEnv({
+      PATH: pathWithUserBins(),
+      SM_PROJECT_ROOT: cwd,
+      SM_SCHEDULER_JOB_SLUG: job.slug,
+      SM_SCHEDULER_JOB_MAY_QUEUE: job.agentType === 'architect' ? '1' : '0',
+      BASH_DEFAULT_TIMEOUT_MS: String(BASH_DEFAULT_TIMEOUT_MS),
+      BASH_MAX_TIMEOUT_MS: String(BASH_MAX_TIMEOUT_MS),
+      ...(launchEnv && typeof launchEnv === 'object' ? launchEnv : {}),
+    });
+    if (launchEnv && Object.keys(launchEnv).length) {
+      safeLog(`[scheduler] launch mitigation env applied: ${Object.entries(launchEnv).map(([k, v]) => `${k}=${v}`).join(' ')}\n`);
+    }
 
     // Track whether the agent has emitted a `result` event in its JSONL stream.
     // null until seen; then one of "success" | "error_max_turns" | … per the
@@ -2920,14 +3531,16 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
       closeFd,
       spawn: {
         command: claudeBin,
-        args: [
-          '-p', prompt,
-          '--model', 'sonnet',
-          '--dangerously-skip-permissions',
-          '--output-format', 'stream-json',
-          '--verbose',
-          '--session-id', sessionId,
-        ],
+        // Resume mode passes `--resume <sessionId>` (reconnect to the SAME
+        // session) INSTEAD of `--session-id <sessionId>` (mint a new one) —
+        // never both, see buildClaudeSpawnArgs.
+        args: buildClaudeSpawnArgs({
+          prompt,
+          model: personaResolution.model,
+          sessionId,
+          resume: !!resumeTarget,
+          systemPrompt: personaResolution.systemPrompt,
+        }),
         options: {
           cwd: spawnCwd,
           env: childEnv,
@@ -2940,8 +3553,13 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
         },
       },
       watchdogs: [resultTailWatchdog, deadmanWatchdog, idleTailWatchdog],
-      onExit({ exitCode, signal, killedByWatchdog: _kbw, error, spawnFailed, safeLog: sl }) {
+      onExit({ exitCode, signal, killedByWatchdog: _kbw, error, spawnFailed, leakedDescendants, safeLog: sl }) {
         const durationMs = Date.now() - startedAt;
+        const leaked = leakedDescendants ?? [];
+        if (leaked.length > 0) {
+          sl(`\n[scheduler] leaked ${leaked.length} descendant(s) swept from job process group: ` +
+            `${leaked.map((p) => `pid=${p.pid} comm=${p.comm} pcpu=${p.pcpu} etimes=${p.etimes}s`).join(', ')}\n`);
+        }
 
         if (error) {
           // Covers both synchronous spawn failure and child 'error' events.
@@ -2951,8 +3569,8 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
           sl(`\n[scheduler] ${errMsg}\n`);
           // Sync write: inside a Promise executor callback; must flush meta
           // before resolve() so the spawnJob mutate() that follows sees it.
-          config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs, schedulerBootedAt: SCHEDULER_BOOTED_AT, schedulerCodeSha: SCHEDULER_CODE_SHA, originSessionId, contextDigestApplied });
-          resolve({ exitCode: -1, durationMs, error: errMsg, sessionId });
+          config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs, leakedDescendants: leaked, schedulerBootedAt: SCHEDULER_BOOTED_AT, schedulerCodeSha: SCHEDULER_CODE_SHA, originSessionId, contextDigestApplied });
+          resolve({ exitCode: -1, durationMs, error: errMsg, leakedDescendants: leaked, sessionId });
           return;
         }
 
@@ -2975,16 +3593,33 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd) {
           `duration=${Math.round(durationMs / 1000)}s\n`);
         const rateLimited = effectiveCode !== 0 && detectRateLimitInLog(logPath);
         const networkError = effectiveCode !== 0 && !rateLimited && detectNetworkErrorInLog(logPath);
+        // Non-run detection (issue #11 lists A1–A3): the harness's `result`
+        // event tells us whether the model ever got a turn. A first-request
+        // API rejection (num_turns ≤ 1, output_tokens 0, `API Error:` text)
+        // is a broken ENVIRONMENT, not a failed PRD — spawnJob routes it to
+        // the launch circuit breaker instead of failed/investigation.
+        const resultStats = launchFailure.readResultEvent(logPath);
+        const launchFailed = (effectiveCode !== 0 && !rateLimited && !networkError)
+          ? launchFailure.classifyLaunchFailure(resultStats)
+          : null;
+        if (launchFailed) {
+          sl(`\n[scheduler] LAUNCH FAILURE (${launchFailed.kind}${launchFailed.httpStatus ? ` HTTP ${launchFailed.httpStatus}` : ''}): ` +
+            `${launchFailed.message} — no turn was taken; this is not a PRD failure\n`);
+        }
         // Sync write: child 'exit' handler must flush meta before resolve()
         // so the spawnJob mutate() that follows sees the persisted exit code.
         config.writeJsonSync(metaPath, {
           slug: job.slug, cwd, sessionId, exitCode: effectiveCode, rateLimited, networkError,
-          startedAt, finishedAt: Date.now(), durationMs,
+          launchFailure: launchFailed,
+          numTurns: resultStats?.numTurns ?? null, outputTokens: resultStats?.outputTokens ?? null,
+          totalCostUsd: resultStats?.totalCostUsd ?? null, terminalReasonFromHarness: resultStats?.terminalReason ?? null,
+          launchEnvApplied: launchEnv && Object.keys(launchEnv).length ? Object.keys(launchEnv) : [],
+          startedAt, finishedAt: Date.now(), durationMs, leakedDescendants: leaked,
           agentResultSubtype, mappedFromSignal: mappedToSuccess ? signal || `code=${exitCode}` : null,
           schedulerBootedAt: SCHEDULER_BOOTED_AT, schedulerCodeSha: SCHEDULER_CODE_SHA,
           originSessionId, contextDigestApplied,
         });
-        resolve({ exitCode: effectiveCode, durationMs, rateLimited, networkError, sessionId });
+        resolve({ exitCode: effectiveCode, durationMs, rateLimited, networkError, launchFailure: launchFailed, resultStats, leakedDescendants: leaked, sessionId });
       },
     });
 
@@ -3049,7 +3684,27 @@ function healTargetForFix(fixSlug, jobs) {
  * spawnInvestigation computes.
  */
 function buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group }) {
-  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.
+  const abandonedBackgroundTaskNote = failedJob.verifierVerdict === 'abandoned_background_task' ? `
+
+# Known failure class: abandoned background task
+This job's verifier verdict is \`abandoned_background_task\`: the transcript shows a Bash command
+auto-backgrounded past its foreground timeout, and the run ended waiting for a "you will be
+notified when it completes" callback a headless run structurally cannot receive. This is NOT
+evidence the work failed — it is evidence the run stopped short of its finish protocol. The work is
+usually already written and correct; only the commit is missing.
+
+By the time this investigation runs, the failed job's isolated worktree (if it ran in one) has
+already been cleaned up — \`${cwd}\` is the BASE repo, not that worktree, so a plain \`git status\`/
+\`git diff\` there will usually show nothing even though real work was produced. The scheduler
+salvages any uncommitted diff from a killed job's worktree BEFORE deleting it${
+    failedJob.salvagePatch ? `, and this job's salvage patch was captured at:\n\n   ${failedJob.salvagePatch}` : ', to a `.uncommitted.patch` file next to the run log — check the run dir for one'
+  }.
+
+The fix-plan PRD you write for this MUST instruct its executor to, in order:
+1. Check for a salvage patch (named \`<slug>.uncommitted.patch\` in the run directory${failedJob.salvagePatch ? `, e.g. \`${failedJob.salvagePatch}\`` : ''}) and, if found, apply it to the working tree BEFORE inspecting \`git status\`/\`git diff\` in ${cwd} for uncommitted changes matching the original PRD's acceptance criteria.
+2. If the work is present (via the applied patch or already in the tree) and satisfies the acceptance criteria, run the project's verify commands and COMMIT it — do not re-implement or re-plan the PRD from scratch.
+3. Only fall back to re-implementing whatever acceptance criteria are genuinely missing after applying any salvage patch, not the whole PRD.` : '';
+  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.${abandonedBackgroundTaskNote}
 
 # Failed job
 - Slug: ${failedJob.slug}
@@ -3167,7 +3822,37 @@ function readRunOutcomeSidecars(runDir, slug) {
  * or if the run being investigated actually verified clean (nothing to fix —
  * see shouldSkipInvestigationForCleanRun).
  */
+const INVESTIGATION_LAUNCH_KEY = 'investigation';
+
 async function spawnInvestigation(failedJob, runDir) {
+  // The probe launches with the same CLI as the job it diagnoses. While
+  // that CLI cannot launch at all (launch circuit breaker, issue #11 list
+  // B1: probes e4f82da2/d374e6bf died on the same HTTP 400 as the runs
+  // they were investigating) there is nothing to diagnose — skip, loudly.
+  {
+    const state = await readQueue().catch(() => null);
+    const block = state?.launchBlocks?.[INVESTIGATION_LAUNCH_KEY];
+    const jobBlock = state?.launchBlocks?.[launchFailure.launchBlockKeyFor(failedJob)];
+    const gate = launchFailure.evaluateLaunchGate(block || jobBlock, { now: Date.now(), claudeVersion: await probeClaudeVersion() });
+    if (gate.state === 'blocked') {
+      console.log(`[scheduler] skip investigation: ${failedJob.slug} — ${gate.reason}`);
+      await mutate((s) => {
+        const j = s.jobs.find((x) => x.slug === failedJob.slug);
+        if (j) { j.autoFixOutcome = 'launch-blocked'; j.autoFixNote = gate.reason; }
+      }).catch(() => {});
+      return { deferred: false };
+    }
+  }
+  // Resume-first recovery (PRD 1111) always gets first refusal — a job
+  // eligible for a bounded `--resume` dispatch must never also get a
+  // cold-read fix-plan PRD authored in the same pass. selectResumeRecoveryTarget
+  // returns null for every job shape spawnInvestigation is normally called
+  // with (e.g. plain 'failed' jobs never carry verifierVerdict
+  // 'uncommitted_changes'), so this is a no-op for the common case.
+  if (selectResumeRecoveryTarget(failedJob)) {
+    console.log(`[scheduler] skip investigation: ${failedJob.slug} is resume-recovery eligible`);
+    return { deferred: false };
+  }
   if (isFixPlanBeyondDepthCap(failedJob.slug, failedJob.investigationDepth)) {
     console.log(`[scheduler] skip investigation: ${failedJob.slug} is a fix plan at/beyond depth cap (depth=${failedJob.investigationDepth ?? 'none'})`);
     return { deferred: false };
@@ -3277,7 +3962,11 @@ async function spawnInvestigation(failedJob, runDir) {
   await broadcast({ flush: true });
 
   const claudeBin = resolveClaudeBin();
-  const childEnv = cleanChildEnv({ PATH: pathWithUserBins() }); // Homebrew/user bins for macOS
+  const childEnv = cleanChildEnv({
+    PATH: pathWithUserBins(), // Homebrew/user bins for macOS
+    BASH_DEFAULT_TIMEOUT_MS: String(BASH_DEFAULT_TIMEOUT_MS),
+    BASH_MAX_TIMEOUT_MS: String(BASH_MAX_TIMEOUT_MS),
+  });
 
   // Investigation needs only a deadman watchdog — no idle-tail or result-tail
   // since investigations are short-running Opus probes with a hard ceiling.
@@ -3317,7 +4006,10 @@ async function spawnInvestigation(failedJob, runDir) {
       // 'investigating' must never be the job's resting state.
       mutate((s) => {
         const j = s.jobs.find((x) => x.slug === failedJob.slug);
-        if (j && j.status === 'investigating') transitionJob(j, failedJob.status || 'failed', { reason: 'investigation probe exited — restoring prior status', source: 'spawnInvestigation:onExit' });
+        if (j && j.status === 'investigating') {
+          transitionJob(j, failedJob.status || 'failed', { reason: 'investigation probe exited — restoring prior status', source: 'spawnInvestigation:onExit' });
+          delete j.runtime;
+        }
       })
         .then(() => broadcast({ flush: true }))
         .catch(() => {});
@@ -3336,6 +4028,23 @@ async function spawnInvestigation(failedJob, runDir) {
         return;
       }
       sl(`\n[scheduler] investigation exit code=${exitCode}\n`);
+      if (exitCode !== 0) {
+        const probeResult = launchFailure.readResultEvent(investigationLogPath);
+        const probeLaunchFailure = launchFailure.classifyLaunchFailure(probeResult);
+        if (probeLaunchFailure) {
+          sl(`\n[scheduler] investigation LAUNCH FAILURE (${probeLaunchFailure.kind}): ${probeLaunchFailure.message} — arming '${INVESTIGATION_LAUNCH_KEY}' launch block\n`);
+          probeClaudeVersion().then((claudeVersion) => mutate((s) => {
+            s.launchBlocks = s.launchBlocks || {};
+            s.launchBlocks[INVESTIGATION_LAUNCH_KEY] = launchFailure.armLaunchBlock(s.launchBlocks[INVESTIGATION_LAUNCH_KEY] || null, {
+              kind: probeLaunchFailure.kind, httpStatus: probeLaunchFailure.httpStatus, message: probeLaunchFailure.message,
+              now: Date.now(), claudeVersion, slug: failedJob.slug, runId: failedJob.runId ?? null,
+            });
+            const j = s.jobs.find((x) => x.slug === failedJob.slug);
+            if (j) { j.autoFixOutcome = 'launch-blocked'; j.autoFixNote = `investigation probe never ran: ${probeLaunchFailure.message}`; }
+          })).catch(() => {});
+          return;
+        }
+      }
       // Fold the investigation's <RCA> summary into the root-cause report already
       // written for this job (needs_review jobs only — writeRcaReport no-ops when
       // failedJob has no verifierVerdict, e.g. plain 'failed' jobs never got one).
@@ -3374,6 +4083,15 @@ async function spawnInvestigation(failedJob, runDir) {
 
   if (child) {
     safeLog(`[scheduler] investigation pid=${child.pid}\n\n`);
+    // Recorded so findStrandedInvestigations (a post-restart maintenance
+    // sweep — the live process has no other way to know a probe is still
+    // running) can tell a live probe apart from one whose owning process is
+    // long gone, the same way reapDeadRunningJobs checks a running job's
+    // runtime.pid.
+    mutate((s) => {
+      const j = s.jobs.find((x) => x.slug === failedJob.slug);
+      if (j && j.status === 'investigating') j.runtime = { pid: child.pid };
+    }).catch(() => {});
   }
   return { deferred: false };
   } catch (e) {
@@ -3383,7 +4101,10 @@ async function spawnInvestigation(failedJob, runDir) {
     releaseSlot();
     mutate((s) => {
       const j = s.jobs.find((x) => x.slug === failedJob.slug);
-      if (j && j.status === 'investigating') transitionJob(j, failedJob.status || 'failed', { reason: 'investigation spawn threw before exiting — restoring prior status', source: 'spawnInvestigation:catch' });
+      if (j && j.status === 'investigating') {
+        transitionJob(j, failedJob.status || 'failed', { reason: 'investigation spawn threw before exiting — restoring prior status', source: 'spawnInvestigation:catch' });
+        delete j.runtime;
+      }
     })
       .then(() => broadcast({ flush: true }))
       .catch(() => {});
@@ -3391,7 +4112,122 @@ async function spawnInvestigation(failedJob, runDir) {
   }
 }
 
-async function spawnJob(job, runId, runDir, defaultCwd) {
+/**
+ * computeLaunchHolds(state) → Map<slug, reason>
+ *
+ * The launch circuit breaker's per-tick view (lib/launchFailure.cjs, issue
+ * #11): every pending row whose persona is blocked is held with its reason;
+ * when a persona's backoff has elapsed exactly ONE of its pending rows is
+ * left pickable (the half-open probe) and the rest are held behind it. A
+ * CLI version change drops the block outright — that is the incident's real
+ * fix (`claude update`) and the queue must resume on the next tick.
+ * Mutates nothing; spawnJob makes the durable decision at dispatch.
+ */
+async function computeLaunchHolds(state, { now = Date.now(), claudeVersion } = {}) {
+  const held = new Map();
+  const blocks = state?.launchBlocks;
+  if (!blocks || typeof blocks !== 'object' || !Object.keys(blocks).length) return held;
+  const version = claudeVersion === undefined ? await probeClaudeVersion() : claudeVersion;
+  const probeAllowed = new Set();
+  for (const j of state.jobs || []) {
+    if (j.status !== 'pending') continue;
+    const key = launchFailure.launchBlockKeyFor(j);
+    const block = blocks[key];
+    if (!block) continue;
+    const gate = launchFailure.evaluateLaunchGate(block, { now, claudeVersion: version });
+    if (gate.state === 'open') continue;
+    if (gate.state === 'probe' && !probeAllowed.has(key)) {
+      probeAllowed.add(key);
+      continue;
+    }
+    held.set(j.slug, gate.state === 'probe'
+      ? `launch blocked (${block.kind}) — waiting for this tick's probe of '${key}'`
+      : gate.reason);
+  }
+  return held;
+}
+
+/**
+ * A run that never got a turn (res.launchFailure — see executeJob's onExit)
+ * is routed here instead of the failed/investigation path (issue #11 lists
+ * A1–A3, B1): the row goes back to `pending` carrying the API's own message
+ * as its error, no retry budget is consumed, no auto-fix probe is spawned
+ * (it would die the same way), and the persona's launch circuit breaker is
+ * armed so the queue stops re-dispatching identical doomed launches while
+ * still self-healing on backoff / CLI update / human Retry.
+ */
+/**
+ * Pure state mutation behind handleLaunchFailure (exported for tests): arms
+ * the persona's breaker and returns the job's `running` row to `pending`
+ * carrying the API message. Returns the armed block.
+ */
+function applyLaunchFailure(s, { job, lf, runId, launchKey, mitigationApplied, claudeVersion, now = Date.now() }) {
+  s.launchBlocks = s.launchBlocks || {};
+  s.launchMitigations = s.launchMitigations || {};
+  const prev = s.launchBlocks[launchKey] || null;
+  const armed = launchFailure.armLaunchBlock(prev, {
+    kind: lf.kind, httpStatus: lf.httpStatus, message: lf.message, now, claudeVersion,
+    slug: job.slug, runId, mitigationApplied,
+  });
+  s.launchBlocks[launchKey] = armed;
+  // A mitigation that was in force and still failed is no longer proven —
+  // drop it so the hint and the next probe are honest.
+  if (mitigationApplied && s.launchMitigations[launchKey]) delete s.launchMitigations[launchKey];
+  const i = (s.jobs || []).findIndex((x) => x.slug === job.slug);
+  if (i >= 0 && s.jobs[i].status === 'running') {
+    const prevCount = s.jobs[i].launchFailure?.count ?? 0;
+    const msg = `launch failure (${lf.kind}${lf.httpStatus ? ` HTTP ${lf.httpStatus}` : ''}): ${lf.message}`;
+    resetJobFields(s.jobs[i], msg, { source: 'spawnJob:launch-failure' });
+    s.jobs[i].launchFailure = {
+      kind: lf.kind, httpStatus: lf.httpStatus ?? null, message: lf.message,
+      at: new Date(now).toISOString(), runId, count: prevCount + 1, mitigationApplied,
+    };
+    s.jobs[i].terminalReason = `launch_failure:${lf.kind}`;
+    s.jobs[i].heldReason = armed.exhausted
+      ? `launch blocked (${lf.kind}) after ${armed.attempts} failed probe(s) — ${armed.hint}`
+      : `launch blocked (${lf.kind}) — re-probe at ${armed.until}. ${armed.hint}`;
+  }
+  return armed;
+}
+
+async function handleLaunchFailure({ job, res, runId, runDir, launchKey, launchEnv, claudeVersion }) {
+  const lf = res.launchFailure;
+  const now = Date.now();
+  const mitigationApplied = !!(launchEnv && Object.keys(launchEnv).length);
+  let armed = null;
+  await mutate((s) => {
+    armed = applyLaunchFailure(s, { job, lf, runId, launchKey, mitigationApplied, claudeVersion, now });
+  });
+  launchFailure.writeOutcomeSidecar(runDir, job.slug, {
+    runId,
+    exitCode: res.exitCode,
+    durationMs: res.durationMs ?? null,
+    numTurns: res.resultStats?.numTurns ?? null,
+    outputTokens: res.resultStats?.outputTokens ?? null,
+    totalCostUsd: res.resultStats?.totalCostUsd ?? null,
+    verdict: null,
+    status: 'pending',
+    terminalReason: `launch_failure:${lf.kind}`,
+    launchFailure: { kind: lf.kind, httpStatus: lf.httpStatus ?? null, message: lf.message },
+    launchEnvApplied: launchEnv ? Object.keys(launchEnv) : [],
+    filesChanged: 0,
+    landedCommit: null,
+  });
+  try {
+    appendError({
+      cwd: job.cwd || DEFAULT_PROJECT_CWD,
+      scope: 'scheduler',
+      level: 'error',
+      message: `launch failure (${lf.kind}) for ${job.slug}: ${lf.message} — persona '${launchKey}' blocked, attempt ${armed?.attempts}${armed?.exhausted ? ' (exhausted; needs CLI update or Retry)' : ''}`,
+      meta: { slug: job.slug, runId, kind: lf.kind, httpStatus: lf.httpStatus ?? null, claudeVersion: claudeVersion ?? null, mitigationApplied, hint: armed?.hint },
+    });
+  } catch { /* durable logging must never break the queue */ }
+  console.error(`[scheduler] ${job.slug}: LAUNCH FAILURE (${lf.kind}${lf.httpStatus ? ` HTTP ${lf.httpStatus}` : ''}) — ${lf.message}. ` +
+    `Persona '${launchKey}' blocked (attempt ${armed?.attempts}${armed?.until ? `, re-probe at ${armed.until}` : ', exhausted'}). ${armed?.hint}`);
+  await broadcast({ flush: true });
+}
+
+async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
   // Session-Manager owns the machine-wide `claude -p` pool (sessionSlots.cjs)
   // — the scheduler REQUESTS capacity, it doesn't own a private cap. A miss
   // leaves the job pending; the next tick retries when a slot frees up.
@@ -3401,13 +4237,108 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     return;
   }
   runningSet.add(job.slug);
+  // Exclusive quiet-machine lease (PRD 1107) — acquired here, in the same
+  // slot-acquire/dispatch step as sessionSlots, and released in this
+  // function's own finally below alongside sessionSlots.release, so every
+  // exit path (normal exit, timeout, SIGTERM, crash) that already frees the
+  // session slot also frees the lease. pickNextBatch only ever hands this
+  // function a quietMachine job when the lease was free at pick time, so
+  // acquire() here should never fail in practice — but check anyway rather
+  // than assume, since a lease held by a stale slug would otherwise wedge
+  // silently.
+  const quietLeaseAcquired = job.quietMachine === true && quietMachineLease.acquire(job.slug);
   try {
+    // Worktree isolation cap check (PRD 1112) — probed BEFORE the job is
+    // marked 'running', so a job that can't get isolation right now is a
+    // DEFERRAL, not a fallback: it stays 'pending' and is retried on the
+    // next dispatch pass, exactly like the sessionSlots miss above, instead
+    // of degrading into an in-place run in a tree a sibling job may be
+    // actively writing to (the shared-tree collision this cap exists to
+    // prevent). Every OTHER worktree.ok===false reason (not a git repo,
+    // disabled, carry-over failure) keeps the existing in-place fallback —
+    // only the cap-reached reason is a deferral, checked here via
+    // createJobWorktree's own reason string so the two paths never
+    // silently drift out of sync with gitWorktree.cjs's actual wording.
+    const preflightWorktree = resumeTarget
+      ? { ok: false, reason: 'resume-recovery: running in place to reuse the session\'s prior working tree' }
+      : await jobWorktree.createJobWorktree({ cwd: job.cwd || defaultCwd, slug: job.slug });
+    if (!preflightWorktree.ok && /^worktree cap reached\b/.test(preflightWorktree.reason || '')) {
+      console.log(`[scheduler] ${job.slug}: deferring — ${preflightWorktree.reason}`);
+      await mutate((s) => {
+        const idx = s.jobs.findIndex((x) => x.slug === job.slug);
+        if (idx >= 0) s.jobs[idx].heldReason = preflightWorktree.reason;
+      });
+      await broadcast({ flush: true });
+      return;
+    }
+    // Launch circuit breaker (lib/launchFailure.cjs, issue #11). Re-evaluated
+    // here, not just in tickQueue, because the block can change between the
+    // pick and this dispatch (another job's probe just failed). 'blocked' →
+    // hold the row; 'probe' → this job is the single half-open probe and is
+    // stamped as such so no sibling probes the same broken persona at once.
+    const launchKey = launchFailure.launchBlockKeyFor(job);
+    const claudeVersionNow = await probeClaudeVersion();
+    let launchEnv = null;
+    let launchProbe = false;
+    const launchGate = await mutate((s) => {
+      s.launchBlocks = s.launchBlocks || {};
+      s.launchMitigations = s.launchMitigations || {};
+      const mitigation = s.launchMitigations[launchKey];
+      if (mitigation && claudeVersionNow && mitigation.claudeVersion && mitigation.claudeVersion !== claudeVersionNow) {
+        console.log(`[scheduler] launch gate: CLI version changed (${mitigation.claudeVersion} → ${claudeVersionNow}) — dropping ${launchKey} mitigation to retry a clean launch`);
+        delete s.launchMitigations[launchKey];
+      }
+      const block = s.launchBlocks[launchKey];
+      const gate = launchFailure.evaluateLaunchGate(block, { now: Date.now(), claudeVersion: claudeVersionNow });
+      if (gate.state === 'open' && block) {
+        console.log(`[scheduler] launch gate: clearing ${launchKey} block (${gate.reason})`);
+        delete s.launchBlocks[launchKey];
+      }
+      if (gate.state === 'blocked') {
+        const idx = s.jobs.findIndex((x) => x.slug === job.slug);
+        if (idx >= 0) s.jobs[idx].heldReason = gate.reason;
+        return gate;
+      }
+      if (gate.state === 'probe') {
+        block.probing = { slug: job.slug, at: new Date().toISOString() };
+        launchProbe = true;
+        launchEnv = block.mitigationEnv || null;
+      } else if (s.launchMitigations[launchKey]?.env) {
+        launchEnv = { ...s.launchMitigations[launchKey].env };
+      }
+      return gate;
+    });
+    if (launchGate.state === 'blocked') {
+      console.log(`[scheduler] ${job.slug}: deferring — ${launchGate.reason}`);
+      await broadcast({ flush: true });
+      return;
+    }
+    if (launchProbe) {
+      console.log(`[scheduler] ${job.slug}: dispatching as launch probe for '${launchKey}'${launchEnv ? ` with mitigation ${JSON.stringify(launchEnv)}` : ''}`);
+    }
+
     await mutate((s) => {
       const idx = s.jobs.findIndex((x) => x.slug === job.slug);
       if (idx >= 0) {
-        transitionJob(s.jobs[idx], 'running', { reason: 'dispatched for execution', source: 'spawnJob:dispatch' });
+        transitionJob(s.jobs[idx], 'running', {
+          reason: resumeTarget ? 'dispatched for resume-recovery' : 'dispatched for execution',
+          source: 'spawnJob:dispatch',
+        });
+        delete s.jobs[idx].heldReason;
         s.jobs[idx].runId = runId;
         s.jobs[idx].startedAt = new Date().toISOString();
+        if (job.quietMachine === true) {
+          s.jobs[idx].quietMachine = true;
+          s.jobs[idx].quietLeaseDegraded = job.quietLeaseDegraded === true;
+        }
+        // Stamp the bounded one-attempt marker BEFORE the resume spawn, in
+        // the SAME mutate as the 'running' transition, so an app crash
+        // between here and the child actually spawning still leaves this
+        // job un-retriable (selectResumeRecoveryTarget returns null once
+        // this is true) rather than silently re-firing forever.
+        if (resumeTarget) {
+          s.jobs[idx].resumeRecoveryAttempted = true;
+        }
       }
     });
     await broadcast({ flush: true });
@@ -3417,19 +4348,74 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     const guardCwd = job.cwd || defaultCwd;
     const guardBaseline = await uncommittedChanges(guardCwd);
     const guardHeadBefore = await gitHead(guardCwd);
+    // Shared-tree stash guard baseline (incident 2026-09-01): captured
+    // unconditionally, before worktree isolation is even attempted, so an
+    // in-place run always has a true pre-run snapshot to diff against. See
+    // checkSharedTreeGuard below, gated to in-place runs only.
+    const stashBaseline = await stashList(guardCwd);
+
+    // Persist the pre-run baseline onto the row itself (not just the local
+    // variable) so a finalizer that never reaches the rest of THIS function
+    // — namely reapDeadRunningJobs, when the process vanishes mid-run — can
+    // still compute a truthful newly-dirty delta instead of having no
+    // baseline at all. `runtime` (unlike this) is deleted on finalize; this
+    // survives until the finalize mutate below explicitly clears it.
+    //
+    // preRunDirtyPaths is the SAME snapshot, capped and reworked into the
+    // executor-facing manifest (buildForeignWipSection) telling the job which
+    // paths it does not own — unlike guardBaseline/guardHeadBefore, it is
+    // deliberately left on the row through to history.jsonl (not deleted at
+    // finalize) so a post-hoc reader can tell whether a completed job ran
+    // against foreign WIP.
+    const preRunDirtyPaths = capDirtyPaths(guardBaseline);
+    await mutate((s) => {
+      const idx = s.jobs.findIndex((x) => x.slug === job.slug);
+      if (idx >= 0) {
+        s.jobs[idx].guardBaseline = guardBaseline || [];
+        s.jobs[idx].guardHeadBefore = guardHeadBefore || null;
+        if (preRunDirtyPaths.length) s.jobs[idx].preRunDirtyPaths = preRunDirtyPaths;
+        else delete s.jobs[idx].preRunDirtyPaths;
+      }
+    });
 
     // Worktree isolation (PRD 994): give this job its own linked `git worktree`
     // checkout so its edits/tests/commit never collide with a sibling job or
     // an interactive session in the SAME repo. `worktree.ok` is false (with a
-    // logged reason) for a non-git cwd, a dirty base tree, the cap being hit,
-    // or SM_JOB_WORKTREE_DISABLE=1 — every case falls back to running in place,
-    // never a hard failure. See jobWorktree.cjs's header comment for why
-    // job.cwd (guardCwd) itself is NEVER repointed at the worktree dir.
-    const worktree = await jobWorktree.createJobWorktree({ cwd: guardCwd, slug: job.slug });
+    // logged reason) for a non-git cwd, a dirty base tree, or
+    // SM_JOB_WORKTREE_DISABLE=1 — every case falls back to running in place,
+    // never a hard failure. (The cap-reached reason was already handled above
+    // as a pre-dispatch DEFERRAL — a job never reaches this point with that
+    // reason.) See jobWorktree.cjs's header comment for why job.cwd
+    // (guardCwd) itself is NEVER repointed at the worktree dir. Reuses
+    // `preflightWorktree` computed above the 'running' transition — it
+    // already IS this job's worktree attempt (or already-created checkout),
+    // so calling createJobWorktree a second time here would double-create
+    // (or double-count the cap) for the exact same job.
+    const worktree = preflightWorktree;
     if (worktree.ok) {
       console.log(`[scheduler] ${job.slug}: isolated in worktree ${worktree.dir} (branch ${worktree.branch})`);
     } else {
       console.log(`[scheduler] ${job.slug}: running in main tree (worktree not used: ${worktree.reason})`);
+      // Surface any degraded-isolation fallback on the job row itself so it's
+      // queryable from the queue instead of console-only — except the
+      // deliberate env-disable flag, which is an intentional opt-out, not a
+      // degradation worth flagging.
+      if (!jobWorktree.isWorktreeDisabled()) {
+        await mutate((s) => {
+          const idx = s.jobs.findIndex((x) => x.slug === job.slug);
+          if (idx >= 0) s.jobs[idx].worktreeFallbackReason = worktree.reason;
+        });
+      }
+    }
+    // Base-tree WIP carried into the worktree (createWorktree, PRD 1094) —
+    // recorded on the job row so integration can exclude these paths from
+    // the branch diff below, and so it's queryable from the queue.
+    const carriedPaths = (worktree.ok && Array.isArray(worktree.carriedPaths)) ? worktree.carriedPaths : [];
+    if (carriedPaths.length) {
+      await mutate((s) => {
+        const idx = s.jobs.findIndex((x) => x.slug === job.slug);
+        if (idx >= 0) s.jobs[idx].carriedPaths = carriedPaths;
+      });
     }
 
     // Integrate the job's branch back into guardCwd's own HEAD, THEN tear the
@@ -3448,6 +4434,17 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     let res;
     let worktreeLeftoverDirty = [];
     let worktreeIntegrationFailure = null;
+    // A job's uncommitted-work patch, whichever isolation mode produced it —
+    // set by EITHER branch below, never both (worktree.ok picks exactly one
+    // shape for the whole run). Named generically (not "worktree...") because
+    // an in-place run salvages one too (PRD 1098).
+    let salvagePatch = null;
+    // Which foreign-WIP shape applies to THIS run: an isolated worktree only
+    // ever needs to disclose carriedPaths (its checkout starts clean apart
+    // from those carried paths); an in-place/shared-tree run discloses the
+    // raw pre-run dirty snapshot instead. Never both — see
+    // buildForeignWipSection.
+    const foreignWip = worktree.ok ? { carriedPaths } : { preRunDirtyPaths };
     try {
       res = await executeJob(job, runDir, defaultCwd, async (pid, sessionId, cwd) => {
         await mutate((s) => {
@@ -3458,11 +4455,27 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           }
         });
         await broadcast({ flush: true });
-      }, worktree.ok ? worktree.dir : undefined);
+      }, worktree.ok ? worktree.dir : undefined, resumeTarget, foreignWip, launchEnv);
     } finally {
       if (worktree.ok) {
         worktreeLeftoverDirty = (await uncommittedChanges(worktree.dir)) || [];
-        const integration = await jobWorktree.integrateJobBranch({ cwd: guardCwd, branch: worktree.branch, slug: job.slug });
+        // Salvage the worktree's full diff (tracked + untracked) to the run
+        // dir BEFORE the checkout is removed below — otherwise a job killed
+        // before its finish-protocol commit loses that work outright, with
+        // no branch, no stash, no patch anywhere. Best-effort: never blocks
+        // integration/cleanup and never changes the job's verdict.
+        if (worktreeLeftoverDirty.length) {
+          const salvagePath = path.join(runDir, `${job.slug}.uncommitted.patch`);
+          const salvage = await jobWorktree.salvageJobWorktreeDiff({ dir: worktree.dir, outFile: salvagePath });
+          if (salvage && salvage.ok) {
+            salvagePatch = salvagePath;
+            console.log(`[scheduler] ${job.slug}: salvaged ${salvage.bytes} byte(s) of uncommitted worktree diff to ${salvagePath}`);
+          }
+        }
+        const integration = await jobWorktree.integrateJobBranch({ cwd: guardCwd, branch: worktree.branch, slug: job.slug, carriedPaths });
+        if (integration.ok && integration.reason === 'carried-wip-only') {
+          console.log(`[scheduler] ${job.slug}: worktree branch ${worktree.branch} touched only carried base WIP paths — skipping merge (carried-wip-only)`);
+        }
         if (!integration.ok) {
           worktreeIntegrationFailure = integration.reason;
           console.error(`[scheduler] ${job.slug}: worktree branch integration FAILED (${integration.reason}) — branch ${worktree.branch} preserved in ${guardCwd} for manual recovery`);
@@ -3475,9 +4488,86 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           branch: worktree.branch,
           keepBranch: !integration.ok,
         });
+      } else {
+        // In-place run (non-git cwd, cap reached, env-disabled, or a carry-over
+        // failure) — there is no throwaway checkout to diff, so salvage only
+        // the DELTA this job itself dirtied: paths in guardBaseline are a
+        // human's or a sibling job's pre-existing WIP and must never appear in
+        // this job's patch. Runs for every exit code (finally always fires
+        // once `res` resolves, success or not) including signal deaths and the
+        // rate-limited/halt path — a killed in-place run is exactly the case
+        // this exists to cover. Never mutates guardCwd's index or stashes:
+        // salvageDirtyDelta is read-only (git status + git diff only).
+        try {
+          const after = await uncommittedChanges(guardCwd);
+          if (after) {
+            const baseSet = new Set(guardBaseline || []);
+            const deltaPaths = after.filter((p) => !baseSet.has(p));
+            if (deltaPaths.length) {
+              const salvagePath = path.join(runDir, `${job.slug}.uncommitted.patch`);
+              const salvage = await jobWorktree.salvageJobDirtyDelta({ cwd: guardCwd, paths: deltaPaths, outFile: salvagePath });
+              if (salvage && salvage.ok) {
+                salvagePatch = salvagePath;
+                console.log(`[scheduler] ${job.slug}: salvaged ${salvage.bytes} byte(s) of uncommitted in-place diff (${deltaPaths.length} path(s)) to ${salvagePath}`);
+              }
+            }
+          }
+        } catch (e) {
+          console.error(`[scheduler] ${job.slug}: in-place salvage failed`, e);
+        }
       }
     }
 
+    // Newly-dirty leftover computation — hoisted OUT of the exit===0 branch
+    // (below) so it runs for every terminal outcome: exit 0, any non-zero
+    // exit including 137/143, and the rate-limited/halt path alike. This is
+    // the exact same shape the exit=0 commit-guard and the transient-failure
+    // classifier each used to compute independently (guardCwd's own
+    // baseline-delta UNION worktreeLeftoverDirty, which is already
+    // inherently-new since it came from a fresh worktree checkout with no
+    // baseline to diff against) — computed once here and reused by both
+    // below, plus by the terminal-finalize mutate for leftoverPaths/
+    // leftoverCount. null only when git-status itself is unavailable
+    // (non-git cwd / git errored) — NEVER treated as "left nothing", exactly
+    // like every other best-effort git-state check in this function.
+    const afterGuardCwd = await uncommittedChanges(guardCwd);
+    const newlyDirtyAll = afterGuardCwd === null
+      ? null
+      : [...new Set([
+          ...afterGuardCwd.filter((p) => !new Set(guardBaseline || []).has(p)),
+          ...worktreeLeftoverDirty,
+        ])];
+
+    if (res.launchFailure) {
+      await handleLaunchFailure({ job, res, runId, runDir, launchKey, launchEnv, claudeVersion: claudeVersionNow });
+      return;
+    }
+    if (launchFailure.resultShowsRealTurn(res.resultStats)) {
+      // The launch worked (whatever happens to the run next) — close the
+      // breaker for this persona. If the probe only got through thanks to a
+      // mitigation env, keep applying that env to every later launch of the
+      // persona until the CLI version changes; otherwise the very next job
+      // would fail the same way and re-arm the block (a flap per job).
+      await mutate((s) => {
+        const block = s.launchBlocks?.[launchKey];
+        if (!block) return;
+        delete s.launchBlocks[launchKey];
+        if (launchEnv && Object.keys(launchEnv).length) {
+          s.launchMitigations = s.launchMitigations || {};
+          s.launchMitigations[launchKey] = {
+            kind: block.kind,
+            env: { ...launchEnv },
+            since: new Date().toISOString(),
+            claudeVersion: claudeVersionNow ?? block.claudeVersion ?? null,
+            hint: launchFailure.launchFailureHint(block.kind, { claudeVersion: claudeVersionNow ?? block.claudeVersion }),
+          };
+          console.log(`[scheduler] launch gate: ${launchKey} recovered via mitigation ${JSON.stringify(launchEnv)} — kept in force until the CLI version changes`);
+        } else {
+          console.log(`[scheduler] launch gate: ${launchKey} recovered — block cleared after ${block.attempts} failed probe(s)`);
+        }
+      });
+    }
+
     if (res.rateLimited) {
       const resetIso = await refreshNextReset().catch(() => cachedNextReset);
       await setPaused('rate_limit', resetIso);
@@ -3519,6 +4609,7 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     // pass it back into verifyRun as priorLandedCommit (see the
     // pass_no_commit_prior_run_verified exemption in runVerify.cjs).
     let jobLandedCommitThisRun = null;
+    let sharedTreeGuard = null;
     if (res.exitCode === 0 && !res.rateLimited) {
       // Detect whether the job self-committed by comparing HEAD before/after.
       // Used by the sentinel override: SCHEDULER_VERDICT: PASS + a landed
@@ -3591,20 +4682,12 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     const guardWillRefire = verifyResult && verifyResult.downgradeTo === 'pending';
     const guardIsLegitimateNoOp = verifyResult && COMPLETED_EQUIVALENT_VERDICTS.has(verifyResult.verdict);
     if (res.exitCode === 0 && !res.rateLimited && !guardWillRefire && !guardIsLegitimateNoOp) {
-      const after = await uncommittedChanges(guardCwd);
-      // after === null means non-git cwd (or git errored) — best-effort skip,
-      // same as always; only a git-status result (even an empty one) counts
-      // as evidence for the zero-edit path.
-      if (after !== null) {
-        const baseSet = new Set(guardBaseline || []);
-        // worktreeLeftoverDirty was captured from a FRESH checkout (no baseline
-        // to diff against — every path in it is inherently new) right before
-        // the worktree was torn down, so it must be counted here or a job's
-        // uncommitted leftovers silently vanish with the worktree.
-        const newlyDirty = [...new Set([
-          ...after.filter((p) => !baseSet.has(p)),
-          ...worktreeLeftoverDirty,
-        ])];
+      // afterGuardCwd === null means non-git cwd (or git errored) —
+      // best-effort skip, same as always; only a git-status result (even an
+      // empty one) counts as evidence for the zero-edit path. newlyDirtyAll
+      // was computed once, above, right after the try/finally.
+      if (afterGuardCwd !== null) {
+        const newlyDirty = newlyDirtyAll;
         const guardState = await readQueue().catch(() => ({ jobs: [] }));
         const siblingRunning = (guardState.jobs || []).some(
           (j) => j.slug !== job.slug && j.status === 'running' && (j.cwd || defaultCwd) === guardCwd,
@@ -3614,10 +4697,12 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
         const guardVerdict = commitGuardVerdict({
           newlyDirty,
           siblingRunning,
+          ranInWorktree: worktree.ok,
           jobSelfCommitted,
           legitimateNoOp: guardIsLegitimateNoOp,
           isFixPlanJob: isFixPlanSlug(job.slug),
           verifyResult,
+          salvagePatch,
         });
         if (guardVerdict) {
           verifyResult = guardVerdict;
@@ -3641,6 +4726,36 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
       };
     }
 
+    // Shared-tree stash guard (incident 2026-09-01): only meaningful for an
+    // IN-PLACE run — worktree.ok isolates the job's git state into its own
+    // checkout, so nothing there can leak into guardCwd. Best-effort and run
+    // regardless of exit code: a job can discard shared state on its way to
+    // a non-zero exit just as easily as on a clean one.
+    if (!worktree.ok) {
+      sharedTreeGuard = await module.exports.checkSharedTreeGuard({
+        cwd: guardCwd,
+        stashBaseline,
+        dirtyBaseline: guardBaseline,
+        headBefore: guardHeadBefore,
+        slug: job.slug,
+      });
+      // A restored stash alone isn't silence — it's logged loudly above and
+      // surfaced on the job row below — but a path that's still missing
+      // (restore failed, or two-plus stashes we refused to guess between, or
+      // a revert with no stash to restore at all) must not finish green.
+      if (sharedTreeGuard && (sharedTreeGuard.restoreFailed || sharedTreeGuard.ambiguousStashes || sharedTreeGuard.reverted)) {
+        verifyResult = {
+          verdict: 'shared_tree_reverted',
+          reason: sharedTreeGuard.reverted
+            ? `job discarded pre-existing state in the shared tree: ${sharedTreeGuard.reverted.length} path(s) reverted with no commit to explain it (${sharedTreeGuard.reverted.slice(0, 3).join(', ')})`
+            : sharedTreeGuard.restoreFailed
+              ? `job stashed the shared tree and the stash could not be auto-restored: ${sharedTreeGuard.restoreFailed}`
+              : `job created ${sharedTreeGuard.ambiguousStashes.length} stashes in the shared tree — ambiguous, not auto-restored (${sharedTreeGuard.ambiguousStashes.join(', ')})`,
+          downgradeTo: 'needs_review',
+        };
+      }
+    }
+
     // SIGTERM commit check: reuse the same commit-window scan the exit=0
     // guard uses above (one commit-detection path, not two) to see whether a
     // 143 (SIGTERM) run still landed a deliverable before it died. Scoped
@@ -3663,6 +4778,8 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     let needsInvestigationNow = false;
     let investigationJobSnapshot = null;
     let needsReviewRcaSnapshot = null;
+    let resumeRecoveryJob = null;
+    let resumeRecoveryTarget = null;
     let terminalNotifySnapshot = null;
     const newlyCompletedPrds = [];
     await mutate((s) => {
@@ -3709,6 +4826,12 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           transitionJob(s.jobs[i2], effectiveStatus, { reason: sigtermOverrideReason ?? `run finished with exit ${res.exitCode}`, source: 'spawnJob:finalize' });
           s.jobs[i2].finishedAt = new Date().toISOString();
           s.jobs[i2].exitCode = res.exitCode;
+          s.jobs[i2].leakedDescendants = res.leakedDescendants ?? [];
+          if (salvagePatch) {
+            s.jobs[i2].salvagePatch = salvagePatch;
+          } else {
+            delete s.jobs[i2].salvagePatch;
+          }
           s.jobs[i2].error = effectiveStatus === 'needs_review'
             ? (verifyResult?.reason ?? sigtermOverrideReason ?? null)
             // A failed job (non-zero exit) never consults verifyResult above,
@@ -3731,6 +4854,26 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           } else {
             delete s.jobs[i2].verifierVerdict;
           }
+          // Closed-set outcome taxonomy (issue #11 list A2) so a queue row
+          // says WHY it ended without anyone opening the transcript.
+          s.jobs[i2].terminalReason = launchFailure.deriveTerminalReason({
+            effectiveStatus, exitCode: res.exitCode, verifyResult, sigtermOverride, worktreeIntegrationFailure,
+          });
+          delete s.jobs[i2].launchFailure;
+          delete s.jobs[i2].heldReason;
+          // Persist the commit-guard's exact dirty-path list (verdict
+          // 'uncommitted_changes' only) so a later resume-recovery attempt
+          // (selectResumeRecoveryTarget) can name these paths without
+          // re-running `git status` against a tree that may have moved on.
+          if (verifyResult?.verdict === 'uncommitted_changes' && Array.isArray(verifyResult.dirtyPaths)) {
+            // Capped the same way preRunDirtyPaths/leftoverPaths are — an
+            // uncapped list here would let a pathologically dirty tree bloat
+            // queue.json/history.jsonl and the resume-recovery prompt built
+            // from it (buildResumeRecoveryPreamble/selectResumeRecoveryTarget).
+            s.jobs[i2].uncommittedPaths = capDirtyPaths(verifyResult.dirtyPaths);
+          } else {
+            delete s.jobs[i2].uncommittedPaths;
+          }
           // Non-blocking notes (e.g. a recovered missing-dependency probe, or a
           // pattern hit demoted because a materially-checkable verdict outranked
           // it) — surfaced even on completed jobs so the signal isn't lost.
@@ -3741,7 +4884,29 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           } else {
             delete s.jobs[i2].verifierAnnotations;
           }
+          // Shared-tree guard outcome (restored stash / unresolved revert /
+          // ambiguous stashes) — visible on the row even when a restored
+          // stash left the run otherwise green, so it's never silent.
+          if (sharedTreeGuard) {
+            s.jobs[i2].sharedTreeGuard = sharedTreeGuard;
+          } else {
+            delete s.jobs[i2].sharedTreeGuard;
+          }
           delete s.jobs[i2].runtime;
+          // Pre-run baseline no longer needed once this run has finalized —
+          // its whole purpose (letting THIS finalize compute a truthful
+          // delta) is done; a fresh one is captured at the next dispatch.
+          delete s.jobs[i2].guardBaseline;
+          delete s.jobs[i2].guardHeadBefore;
+          // Leftover-attribution fields (PRD: capture+surface uncommitted
+          // work on every terminal path, not just exit=0) — set for EVERY
+          // terminal outcome above (completed/failed/needs_review alike),
+          // not just the exit=0 commit-guard branch, so a bare `failed` row
+          // is visually distinguishable from one that quietly left work
+          // behind. newlyDirtyAll is null when git-status was unavailable
+          // (non-git cwd) — applyLeftoverFields treats null like "nothing to
+          // attribute" via its Array.isArray guard, same as an empty array.
+          applyLeftoverFields(s.jobs[i2], newlyDirtyAll);
 
           if (isNotifiableTerminalStatus(effectiveStatus)) {
             terminalNotifySnapshot = { ...s.jobs[i2] };
@@ -3759,6 +4924,19 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
             // takes the treatAsPending branch above and never reaches here).
             needsReviewRcaSnapshot = { ...s.jobs[i2] };
 
+            // Resume-first recovery (PRD 1111): evaluated BEFORE the auto-fix
+            // eligibility check below — a job whose verdict is
+            // 'uncommitted_changes' with a live sessionId gets one bounded
+            // `--resume` dispatch instead of a cold-read fix-plan
+            // investigation. Snapshot only (no I/O inside mutate()); the
+            // actual dispatch happens outside mutate(), below. Never sets
+            // needsInvestigationNow — the two are mutually exclusive for the
+            // same tick, mirroring the `else if` used outside mutate().
+            const target = selectResumeRecoveryTarget(s.jobs[i2]);
+            if (target) {
+              resumeRecoveryJob = { ...s.jobs[i2] };
+              resumeRecoveryTarget = target;
+            } else {
             // Same-tick auto-fix (feedback 2026-07-12): rather than waiting up to
             // 10 min for reverifyNeedsReview()'s periodic pass, check right here
             // whether this job qualifies for auto-fix (same eligibility rule
@@ -3782,6 +4960,7 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
               needsInvestigationNow = true;
               investigationJobSnapshot = { ...s.jobs[i2] };
             }
+            }
           }
           // Auto-promote: when a fix-* PRD completes successfully, the original
           // failed PRD's work is logically done. Flip its status to 'completed'
@@ -3797,6 +4976,7 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
               orig.exitCode = 0;
               orig.error = null;
               orig.completedBy = job.slug;
+              delete orig.looksDone;
               if (priorStatus === 'needs_review') {
                 delete orig.verifierVerdict;
               }
@@ -3811,6 +4991,24 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     }
     await broadcast({ flush: true });
 
+    // Per-run outcome sidecar (issue #11 list B5): turns/tokens/verdict in one
+    // small JSON next to the log so fleet health never needs a transcript parse.
+    launchFailure.writeOutcomeSidecar(runDir, job.slug, {
+      runId,
+      exitCode: res.exitCode,
+      durationMs: res.durationMs ?? null,
+      numTurns: res.resultStats?.numTurns ?? null,
+      outputTokens: res.resultStats?.outputTokens ?? null,
+      totalCostUsd: res.resultStats?.totalCostUsd ?? null,
+      verdict: verifyResult?.verdict ?? (res.exitCode === 0 ? 'clean' : null),
+      status: terminalNotifySnapshot?.status ?? failedJobSnapshot?.status ?? null,
+      terminalReason: terminalNotifySnapshot?.terminalReason ?? failedJobSnapshot?.terminalReason ?? null,
+      launchFailure: null,
+      launchEnvApplied: launchEnv ? Object.keys(launchEnv) : [],
+      filesChanged: Array.isArray(newlyDirtyAll) ? newlyDirtyAll.length : null,
+      landedCommit: jobLandedCommitThisRun ?? null,
+    });
+
     if (terminalNotifySnapshot) {
       notifyOriginatingTab(terminalNotifySnapshot).catch((e) => {
         console.error('[scheduler] notifyOriginatingTab error', job.slug, e);
@@ -3826,12 +5024,28 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
         verdict: needsReviewRcaSnapshot.verifierVerdict,
         annotations: needsReviewRcaSnapshot.verifierAnnotations,
       })
-        .then((report) => notifyNeedsReview(needsReviewRcaSnapshot, report))
+        .then(async (report) => {
+          // Persist the classification onto the parked job row so the scheduler
+          // can route on it (e.g. selectAutoFixTargets excluding 'archive')
+          // without re-parsing the RCA markdown on every pass.
+          await mutate((s) => {
+            const j = s.jobs.find((x) => x.slug === needsReviewRcaSnapshot.slug);
+            applyRcaClassification(j, report);
+          }).catch(() => {});
+          return notifyNeedsReview(needsReviewRcaSnapshot, report);
+        })
         .catch((e) => {
           console.error('[scheduler] writeRcaReport error', job.slug, e);
         });
     }
 
+    if (resumeRecoveryJob && resumeRecoveryTarget) {
+      console.log(`[scheduler] needs_review ${job.slug} → resume-recovery (session ${resumeRecoveryTarget.sessionId}, ${resumeRecoveryTarget.dirtyPaths.length} dirty path(s))`);
+      spawnResumeRecovery(resumeRecoveryJob, resumeRecoveryTarget).catch((e) => {
+        console.error('[scheduler] spawnResumeRecovery error', job.slug, e);
+      });
+    }
+
     if (actuallyFailed && failedJobSnapshot) {
       // Transient-failure detector. A 143/137 exit is ALWAYS a signal kill — the
       // agent never self-exits with those — so the only question is WHO killed it.
@@ -3849,25 +5063,11 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
       // the threshold and still fall through to investigation.
       const ec = failedJobSnapshot.exitCode;
       const retries = failedJobSnapshot.transientRetries ?? 0;
-      // Only pay for the extra git status call when the failure is plausibly
-      // transient — a real code failure never needs the dirty-tree check.
       const maybeTransient = (ec === 143 || ec === 137) || res.networkError === true;
-      let newlyDirtyCount = 0;
-      let dirtySample = '';
-      if (maybeTransient) {
-        const afterFailure = await uncommittedChanges(guardCwd);
-        const baseSet = new Set(guardBaseline || []);
-        // See the commit-guard block above: worktreeLeftoverDirty was captured
-        // (and the checkout already torn down) before this point, so it must
-        // be folded in here too or a transiently-killed job's leftover WIP
-        // silently disappears with its worktree.
-        const newlyDirty = [...new Set([
-          ...(afterFailure || []).filter((p) => !baseSet.has(p)),
-          ...worktreeLeftoverDirty,
-        ])];
-        newlyDirtyCount = newlyDirty.length;
-        dirtySample = newlyDirty.slice(0, 3).join(', ');
-      }
+      // newlyDirtyAll was computed once, above, right after the try/finally —
+      // reused here rather than re-querying git status a third time.
+      const newlyDirtyCount = maybeTransient ? (newlyDirtyAll || []).length : 0;
+      const dirtySample = maybeTransient ? (newlyDirtyAll || []).slice(0, 3).join(', ') : '';
       const decision = classifyFailureOutcome({
         exitCode: ec,
         networkError: res.networkError,
@@ -3887,12 +5087,13 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
         });
         await broadcast({ flush: true });
       } else if (decision.action === 'fail-dirty') {
-        console.log(`[scheduler] transient failure (${decision.transientKind}) for ${job.slug} left ${newlyDirtyCount} uncommitted file(s) (e.g. ${dirtySample}) — not auto-requeuing`);
+        const salvageNote = salvagePatch ? ` — recoverable from salvage patch ${salvagePatch}` : '';
+        console.log(`[scheduler] transient failure (${decision.transientKind}) for ${job.slug} left ${newlyDirtyCount} uncommitted file(s) (e.g. ${dirtySample})${salvageNote} — not auto-requeuing`);
         await mutate((s) => {
           const i = s.jobs.findIndex((x) => x.slug === job.slug);
           if (i >= 0) {
             transitionJob(s.jobs[i], 'failed', { reason: `transient failure (${decision.transientKind}) left uncommitted work — not auto-requeued`, source: 'spawnJob:fail-dirty' });
-            s.jobs[i].error = `transient failure (${decision.transientKind}) left ${newlyDirtyCount} uncommitted file(s) in working tree (e.g. ${dirtySample}) — not auto-requeued to avoid overwriting partial work; review and commit or discard manually`;
+            s.jobs[i].error = `transient failure (${decision.transientKind}) left ${newlyDirtyCount} uncommitted file(s) in working tree (e.g. ${dirtySample})${salvageNote} — not auto-requeued to avoid overwriting partial work; review and commit or discard manually`;
           }
         });
         await broadcast({ flush: true });
@@ -3927,17 +5128,41 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
     runningSet.delete(job.slug);
     // Slot release notifies subscribed pumps (chat lane) machine-wide.
     sessionSlots.release(slotToken);
+    // Release the exclusive quiet-machine lease on EVERY exit path this
+    // finally covers (normal exit, timeout, SIGTERM, crash) — see the
+    // acquire-site comment above. Bounded: a lease this function never
+    // acquired is simply a no-op release.
+    if (quietLeaseAcquired) quietMachineLease.release(job.slug);
     // Each job completion is a signal to advance the queue.
     tickQueue().catch(() => {});
   }
 }
 
+/**
+ * Dispatch a resume-recovery attempt (PRD 1111) for a job already found
+ * eligible by selectResumeRecoveryTarget. Thin wrapper around spawnJob —
+ * reuses its entire slot-acquire/worktree/verify/commit-guard/finalize
+ * machinery unchanged, so a resume run that itself parks or fails falls
+ * through to the SAME spawnInvestigation fallback any other run would, with
+ * zero special-casing. `job` and `resumeTarget` must be snapshots taken
+ * BEFORE this call (this function does no eligibility re-check — spawnJob's
+ * own dispatch mutate is what stamps resumeRecoveryAttempted, atomically
+ * with the 'running' transition).
+ */
+async function spawnResumeRecovery(job, resumeTarget) {
+  const { runId, dir: runDir } = pickRunDir();
+  await spawnJob(job, runId, runDir, job.cwd || DEFAULT_PROJECT_CWD, resumeTarget);
+}
+
 // Serialized ticker: prevents two concurrent tickQueue() calls from racing
 // on the same pending jobs. A simple promise tail suffices since pickNextBatch
 // is synchronous and spawnJob is fire-and-forget.
 let tickTail = Promise.resolve();
 
-function tickQueue() {
+// `bypassLoadGate` is set only by the explicit human run-now / force-tick
+// paths (via runDueJobs): the human is asking, so the CPU-load gate yields
+// and logs that it did. Every automatic caller leaves it false.
+function tickQueue({ bypassLoadGate = false } = {}) {
   const next = tickTail.then(async () => {
     const state = await readQueue();
     // Never reconcile against an unreadable queue: reconcile() would see zero
@@ -3962,7 +5187,13 @@ function tickQueue() {
     // cap that sessionSlots.cjs was written to replace — which silently
     // ceilinged the queue at 3 while the pool the user configured said 5.
     const freeSlots = sessionSlots.available();
-    const { batch, reason: holdReason, holds } = pickNextBatch(state.jobs, runningSet, freeSlots);
+    const heldSlugs = await computeLaunchHolds(state);
+    const { batch, reason: holdReason, holds } = pickNextBatch(state.jobs, runningSet, freeSlots, {
+      leaseHeld: quietMachineLease.isHeld(),
+      machineInUse: sessionSlots.inUse(),
+      now: Date.now(),
+      heldSlugs,
+    });
     if (batch.length === 0 && freeSlots === 0) {
       const snap = sessionSlots.snapshot();
       const pendingCount = state.jobs.filter((j) => j.status === 'pending').length;
@@ -4025,6 +5256,35 @@ function tickQueue() {
       lastMemGate = null;
     }
 
+    // Load gate (PRD 1085) — the INNERMOST launch predicate, evaluated only
+    // once every outer gate (sessionSlots pool → per-project cap inside
+    // pickNextBatch → memory above) has already admitted `gatedBatch`. It
+    // never touches running jobs and never becomes a second pool: it only
+    // withholds this tick's launches while the 1-minute loadavg per core is
+    // over LOAD_GATE_PER_CORE. An explicit human Run now bypasses it.
+    const load = loadGate.evaluate({ bypass: bypassLoadGate });
+    if (load.bypassed) {
+      console.log(`[scheduler] load gate: BYPASSED by run-now (loadavg1=${load.loadavg1} cores=${load.cores} ratio=${load.ratio} > ${load.threshold})`);
+    } else if (load.gated) {
+      const line = `[scheduler] load gate: loadavg1=${load.loadavg1} cores=${load.cores} ratio=${load.ratio} > ${load.threshold} — holding ${gatedBatch.length} eligible job(s)`;
+      if (load.escalate) {
+        const top = topCpuConsumers(3);
+        console.warn(`${line} for ${Math.round(load.gatedSinceMs / 60_000)}m; top CPU: ${top.length ? top.join(' | ') : 'n/a'}`);
+      } else {
+        console.log(line);
+      }
+      if (load.shouldAudit) {
+        appendAuditEvent('launch_load_gated', {
+          loadavg1: load.loadavg1, cores: load.cores, ratio: load.ratio, threshold: load.threshold,
+          held: gatedBatch.map((j) => j.slug), gatedSinceMs: load.gatedSinceMs,
+        });
+      }
+      return recordTick(
+        { fired: false, reason: 'load-deferred', deferredCount: gatedBatch.length, ratio: load.ratio, threshold: load.threshold },
+        { detail: `load gate: ${load.loadavg1} / ${load.cores} cores = ${load.ratio} > ${load.threshold}`, holds },
+      );
+    }
+
     await mutate((s) => { s.lastRunAt = new Date().toISOString(); });
     await broadcast();
 
@@ -4072,7 +5332,7 @@ function forceTickOutcome(result) {
   }
 }
 
-async function runDueJobs() {
+async function runDueJobs({ bypassLoadGate = false } = {}) {
   const state = await readQueue();
   if (state.unreadable) {
     console.error('[scheduler] runDueJobs skipped: queue.json unreadable');
@@ -4083,7 +5343,7 @@ async function runDueJobs() {
     return { fired: false, reason: 'paused' };
   }
   cancelToken = { cancelled: false };
-  const result = await tickQueue();
+  const result = await tickQueue({ bypassLoadGate });
   // Clear the one-shot scheduledFor without waiting for jobs to settle.
   await mutate((s) => { s.scheduledFor = null; });
   await broadcast();
@@ -4108,12 +5368,38 @@ async function maybeLaunchWhenAvailable(state) {
 
 // ---------- dead-process reaper ----------
 
+// Queue-health sweep cadence: hangs off reapDeadRunningJobs's own cycle
+// counter (it already runs once per poll tick) rather than a second timer,
+// so its cadence can never drift from the poll cadence or double-fire
+// across a backoff reset.
+let queueHealthSweepCycle = 0;
+const QUEUE_HEALTH_SWEEP_EVERY_N_CYCLES = 20;
+
+/**
+ * runQueueHealthSweep(jobs) — read-only reporting pass over the queue
+ * snapshot reapDeadRunningJobs already read this cycle. Never transitions a
+ * job, never archives a PRD, never spawns anything; only logs and appends
+ * an audit event for any project with drift worth a human glance.
+ */
+function runQueueHealthSweep(jobs) {
+  try {
+    for (const { cwd, neverRan, looksDone, stuck } of computeQueueHealth(jobs)) {
+      console.log(`[scheduler] queue-health ${cwd}: ${neverRan} never_ran, ${looksDone} looks-done, ${stuck} stuck`);
+      appendAuditEvent('scheduler_queue_health', { cwd, neverRan, looksDone, stuck });
+    }
+  } catch (e) {
+    console.warn('[scheduler] queue-health sweep error', e?.message);
+  }
+}
+
 /**
- * Scan running jobs, identify those whose claude process is provably dead, and
- * finalize them to completed/failed by reading the run log. Called once per
- * poll cycle. Conservative: a job with no runtime.pid yet (spawn mid-flight)
- * is always skipped. A job whose pid is alive (claudePidAlive) is always skipped.
- * Exported so unit tests can invoke it directly.
+ * Scan running jobs, identify those whose claude process is provably dead OR
+ * whose spawn never got far enough to record a runtime.pid in the first
+ * place, and finalize them to completed/failed by reading the run log.
+ * Called once per poll cycle. A job whose pid is alive (claudePidAlive) is
+ * always skipped. A pidless job younger than PIDLESS_SPAWN_GRACE_MS is
+ * skipped too (spawn may still be mid-flight) — see selectReapableJobs for
+ * the full predicate. Exported so unit tests can invoke it directly.
  */
 async function reapDeadRunningJobs() {
   try {
@@ -4123,32 +5409,102 @@ async function reapDeadRunningJobs() {
     // status:"running" with no slug left in runningSet to trigger reconciliation.
     // queue.json is the source of truth for which jobs are actually running.
     const state = await readQueue();
+    const { reapable, warnings } = selectReapableJobs(state.jobs, Date.now(), {
+      pidAlive: claudePidAlive,
+      grace: PIDLESS_SPAWN_GRACE_MS,
+    });
+    for (const w of warnings) {
+      console.warn(`[scheduler] reapDeadRunningJobs: ${w.reason} slug=${w.slug} — leaving row alone`);
+    }
+
     const dead = [];
-    for (const j of state.jobs) {
-      if (j.status !== 'running') continue;
-      const pid = j.runtime?.pid;
-      if (!pid) continue; // spawn may be mid-flight; give it a cycle
-      if (claudePidAlive(pid)) continue;
-      const logPath = j.runId
+    for (const { slug, pid, pidless, reason } of reapable) {
+      const j = state.jobs.find((x) => x.slug === slug);
+      const logPath = j?.runId
         ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`)
         : null;
+      // Absent/empty run dir → classifyRunOutcome finds no result event →
+      // 'no_result' → non-success below → filed as failed, never completed.
       const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
-      dead.push({ slug: j.slug, pid, outcome });
+      // A pidless reap means the spawn never got far enough to record a
+      // pid — the gate could not possibly have run, regardless of what
+      // classifyRunOutcome makes of an absent/empty log.
+      const gateOutcome = pidless ? 'never_ran' : mapOutcomeToGateOutcome(outcome);
+      dead.push({ slug, pid, outcome, gateOutcome, pidless, reason });
     }
+
+    queueHealthSweepCycle += 1;
+    if (queueHealthSweepCycle % QUEUE_HEALTH_SWEEP_EVERY_N_CYCLES === 0) {
+      runQueueHealthSweep(state.jobs);
+    }
+
     if (dead.length === 0) return;
 
-    await mutate((s) => {
-      for (const { slug, pid, outcome } of dead) {
+    await mutate(async (s) => {
+      for (const { slug, pid, outcome, gateOutcome, pidless, reason } of dead) {
         const idx = s.jobs.findIndex((x) => x.slug === slug);
         if (idx < 0 || s.jobs[idx].status !== 'running') continue; // race guard
         const success = outcome === 'success';
-        transitionJob(s.jobs[idx], success ? 'completed' : 'failed', { reason: `reaped: process gone (outcome=${outcome})`, source: 'reapDeadRunningJobs' });
+
+        // Best-effort in-place leftover computation: a job whose owning
+        // process vanished without spawnJob()'s own finally block ever
+        // running (the exact case this reaper exists for) never got that
+        // block's salvage OR leftover-attribution pass either. Only
+        // attempted when the row carries a persisted pre-run baseline
+        // (guardBaseline, persisted by spawnJob at dispatch — see there).
+        // With no baseline there is no safe way to tell this job's own dirt
+        // from a human's or a sibling's pre-existing WIP, so this skips
+        // rather than ever dumping/attributing the whole tree.
+        let deltaPaths = null;
+        if (Array.isArray(s.jobs[idx].guardBaseline) && s.jobs[idx].runId) {
+          try {
+            const rowCwd = s.jobs[idx].cwd || s.config?.defaultCwd || DEFAULT_PROJECT_CWD;
+            const after = await uncommittedChanges(rowCwd);
+            if (after) {
+              const baseSet = new Set(s.jobs[idx].guardBaseline);
+              deltaPaths = after.filter((p) => !baseSet.has(p));
+              if (deltaPaths.length) {
+                const salvagePath = path.join(RUNS_DIR, s.jobs[idx].runId, `${slug}.uncommitted.patch`);
+                const salvage = await jobWorktree.salvageJobDirtyDelta({ cwd: rowCwd, paths: deltaPaths, outFile: salvagePath });
+                if (salvage && salvage.ok) {
+                  s.jobs[idx].salvagePatch = salvagePath;
+                  console.log(`[scheduler] reapDeadRunningJobs: salvaged ${salvage.bytes} byte(s) of uncommitted in-place diff for ${slug} to ${salvagePath}`);
+                }
+              }
+            }
+          } catch (e) {
+            console.error(`[scheduler] reapDeadRunningJobs: in-place salvage failed for ${slug}`, e);
+          }
+        }
+        const leftoverSuffix = deltaPaths && deltaPaths.length
+          ? ` — left ${deltaPaths.length} files uncommitted`
+          : '';
+        const transitionReason = (pidless ? reason : `reaped: process gone (outcome=${outcome})`) + leftoverSuffix;
+
+        transitionJob(s.jobs[idx], success ? 'completed' : 'failed', { reason: transitionReason, source: 'reapDeadRunningJobs' });
         s.jobs[idx].exitCode = success ? 0 : (s.jobs[idx].exitCode ?? 1);
         s.jobs[idx].finishedAt = new Date().toISOString();
-        s.jobs[idx].error = success ? null : `reaped: process gone, no success result in log (${outcome})`;
+        s.jobs[idx].error = success ? null : `${transitionReason} (outcome=${outcome})`;
+        s.jobs[idx].gateOutcome = gateOutcome;
         delete s.jobs[idx].runtime;
+        delete s.jobs[idx].guardBaseline;
+        delete s.jobs[idx].guardHeadBefore;
+        applyLeftoverFields(s.jobs[idx], deltaPaths);
         runningSet.delete(slug);
-        console.log(`[scheduler] reaped dead job slug=${slug} pid=${pid} outcome=${outcome}`);
+        // A dead job reaped here never reached spawnJob's own finally block
+        // (that's this reaper's whole reason to exist — see its header
+        // comment) — so if it held the quiet-machine lease, spawnJob never
+        // got the chance to release it. Release it here too, or a
+        // quietMachine job whose process silently vanished (OOM, a crash
+        // with no exit event) wedges the lease held forever and stalls
+        // dispatch for every project until the app restarts.
+        if (s.jobs[idx].quietMachine === true) quietMachineLease.release(slug);
+        if (pidless) {
+          console.log(`[scheduler] reaped pidless zombie job slug=${slug} outcome=${outcome}`);
+          appendAuditEvent('job_reaped_pidless', { slug, cwd: s.jobs[idx].cwd ?? null, outcome, graceMs: PIDLESS_SPAWN_GRACE_MS });
+        } else {
+          console.log(`[scheduler] reaped dead job slug=${slug} pid=${pid} outcome=${outcome}`);
+        }
       }
     });
 
@@ -4335,14 +5691,19 @@ function selectHistoryJobs(jobs, limit, historyEntries = []) {
 // investigation jobs correctly found "nothing to fix" but were flagged
 // anyway). For non-fix-plan jobs the exemption never applies, so rescanning
 // their pass_no_commit verdict is a harmless no-op (same facts, same verdict).
-const RESCANNABLE_VERDICTS = new Set(['transcript_errors', 'verify_unavailable', 'no_verdict_sentinel', 'pass_no_commit', 'pass_no_commit_already_shipped']);
-
-// Bounds fix-plan recursion: depth 1 = the original job, depth 2 = its fix
-// (gets exactly one follow-up investigation if it also lands in
-// needs_review), depth 3+ (a fix-of-a-fix-of-a-fix) is excluded. Shared by
-// selectAutoFixTargets and spawnInvestigation so both call sites agree on
-// one threshold.
-const MAX_INVESTIGATION_DEPTH = 2;
+const RESCANNABLE_VERDICTS = new Set(['transcript_errors', 'verify_unavailable', 'no_verdict_sentinel', 'abandoned_background_task', 'pass_no_commit', 'pass_no_commit_already_shipped']);
+
+// Bounds fix-plan recursion: cap N permits at most N+1 fix jobs per original
+// slug (depth 1 = the original job, depth 2 = its `-fix`, depth 3+ is
+// excluded). With N=1 that's `<slug>-fix` and `<slug>-fix-fix`, never a third
+// `-fix-fix-fix`. Lowered from 2 to 1 on 2026-08-31 (starry-night-ships):
+// three concurrent chains (115-fix-fix, 113-fix-fix, 111-fix-fix-fix) were
+// riding the old cap, and 115-fix-fix's own root-cause section read "The
+// code was already CORRECT. Only verification and commit failed." — a third
+// auto-retry re-runs an entire PRD and test battery to redo a `git commit`,
+// at near-zero marginal success probability. Shared by selectAutoFixTargets
+// and spawnInvestigation so both call sites agree on one threshold.
+const MAX_INVESTIGATION_DEPTH = 1;
 
 /**
  * True when a fix-plan job's investigationDepth is at or past the recursion
@@ -4467,22 +5828,48 @@ function isPlanUnqueued(job, queuedSlugs) {
  * Bias to needs_review: a false yellow costs a human glance, a false green
  * costs a silently-unfixed bug — which is exactly what happened.
  */
+// abandoned_background_task shares no_verdict_sentinel's exact rescan path
+// (same "sentinel === null && !commitEvidence" gate in runVerify, same
+// committedDuringRun repo-wide-not-per-job attribution problem) — the PRD 983
+// incident mechanism above applies identically, so it gets the same guard
+// rather than a carve-out that would silently reopen the same false-heal hole.
+const NO_ATTRIBUTABLE_COMMIT_VERDICTS = new Set(['no_verdict_sentinel', 'abandoned_background_task']);
+
 function healRefusalReason(job, verdict, committedDuringRun) {
   if (!job || !verdict) return null;
   if (!COMPLETED_EQUIVALENT_VERDICTS.has(verdict.verdict)) return null;
-  if (job.verifierVerdict !== 'no_verdict_sentinel') return null;
+  if (!NO_ATTRIBUTABLE_COMMIT_VERDICTS.has(job.verifierVerdict)) return null;
   // A commit this job actually recorded as its own is real evidence; the
   // repo-wide window scan is not.
   if (job.landedCommit) return null;
-  return 'no_verdict_sentinel with no job-attributable commit — refusing to heal'
+  return `${job.verifierVerdict} with no job-attributable commit — refusing to heal`
     + ` (committedInWindow=${committedDuringRun === true} is repo-wide, not proof this job delivered)`;
 }
 
+/**
+ * True when a `failed` job's failure is unverified-shaped — no result event
+ * was ever recorded for its run (classifyRunOutcome === 'no_result'), so no
+ * SCHEDULER_VERDICT sentinel could have been parsed either, OR it already
+ * carries a RESCANNABLE_VERDICTS verifierVerdict. A row that failed with a
+ * real result event (classifyRunOutcome === 'failed', i.e. a genuine red
+ * gate or a real non-zero-exit error) is excluded — that failure is
+ * evidence, not silence, and must never become a heal candidate (PRD 1102).
+ */
+function isFailedUnverifiedShaped(job) {
+  if (!job || job.status !== 'failed') return false;
+  if (job.verifierVerdict && RESCANNABLE_VERDICTS.has(job.verifierVerdict)) return true;
+  const runId = job.runId || resolveRunId(job);
+  if (!runId) return false;
+  const logPath = path.join(RUNS_DIR, runId, `${job.slug}.log`);
+  return classifyRunOutcome(logPath) === 'no_result';
+}
+
 function isRescanCandidate(job) {
-  return !!job
-    && job.status === 'needs_review'
-    && !!(job.runId || resolveRunId(job))
-    && RESCANNABLE_VERDICTS.has(job.verifierVerdict);
+  if (!job) return false;
+  if (!(job.runId || resolveRunId(job))) return false;
+  if (job.status === 'needs_review') return RESCANNABLE_VERDICTS.has(job.verifierVerdict);
+  if (job.status === 'failed') return isFailedUnverifiedShaped(job);
+  return false;
 }
 
 /**
@@ -4516,10 +5903,36 @@ function isRescanCandidate(job) {
  *     exhausted retry is excluded
  *   - no fix sibling on disk (fixSlugExists) or already in the queue
  */
+/**
+ * Persist a writeRcaReport() result onto its job row — job.rcaFailureClass /
+ * job.rcaRecoveryAction — so selectAutoFixTargets and future routing can read
+ * the classification straight off the queue row instead of re-parsing the RCA
+ * markdown. Pure mutation of the passed-in job object; no I/O. A no-op when
+ * the job is missing, has moved off needs_review (e.g. resumed and completed
+ * before this async write landed), or the report was never filed (disabled,
+ * error, etc). Returns whether it applied, for callers/tests that want to
+ * assert on it.
+ */
+function applyRcaClassification(job, report) {
+  if (!job || job.status !== 'needs_review' || !report?.filed) return false;
+  job.rcaFailureClass = report.failureClass;
+  job.rcaRecoveryAction = report.recoveryAction;
+  return true;
+}
+
 function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRunId }) {
   const slugsInQueue = new Set(jobs.map((j) => j.slug));
   return jobs.filter((job) => {
     if (job.status !== 'needs_review') return false;
+    // A stale re-run whose work already shipped (rcaReport's 'already-shipped'
+    // class) must never buy a fix-plan PRD — there is nothing to fix, and the
+    // correct recovery (archiving the PRD) is a human/reconcile action, not
+    // an investigation.
+    if (job.rcaRecoveryAction === 'archive') return false;
+    // Resume-first recovery (PRD 1111): a job still eligible for its one
+    // bounded `--resume` attempt must never also become a fix-plan target
+    // in the same pass — see spawnInvestigation's own identical guard.
+    if (selectResumeRecoveryTarget(job)) return false;
     const runId = job.runId || resolveJobRunId(job);
     if (!runId) return false;
     if (isFixPlanBeyondDepthCap(job.slug, job.investigationDepth)) return false;
@@ -4555,12 +5968,52 @@ function isEligibleForImmediateAutoFix(job, allJobs, fixSlugExists) {
   return targets.some((t) => t.slug === job.slug);
 }
 
+/**
+ * Widened evidence check (PRD 1102): does at least one commit land AFTER
+ * this job's run window that touches a path the PRD itself declares? Scoped
+ * to the PRD's own declared paths (never the whole repo) so a sibling job's
+ * unrelated commit is not credited to this one — see healRefusalReason's own
+ * rationale for why unscoped, repo-wide evidence is not attribution.
+ *
+ * Returns null (no annotation, never fabricated) when the PRD names no
+ * paths — the caller then has only the existing, already-computed
+ * committedInWindow signal to go on, same as before this PRD.
+ *
+ * @returns {Promise<{commits: string[], paths: string[], detectedAt: string} | null>}
+ */
+async function computeLooksDone(job) {
+  const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
+  const paths = declaredPathsForPrd(prdPath);
+  if (!paths.length) return null;
+  await fetchAllRefs(job.cwd);
+  const commits = await landedSinceRun(job.cwd, job.startedAt, paths);
+  if (!commits.length) return null;
+  return { commits, paths, detectedAt: new Date().toISOString() };
+}
+
 async function reverifyNeedsReview() {
   const snap = await readQueue();
   const candidates = snap.jobs.filter(isRescanCandidate);
   const healed = [];
   const leftForReview = [];
+  const looksDoneUpdates = [];
   for (const job of candidates) {
+    if (job.status === 'failed') {
+      // A failed row never runs the transcript-verifier rescan below — that
+      // machinery (verifyRun/COMPLETED_EQUIVALENT_VERDICTS) exists to
+      // auto-COMPLETE a stale needs_review row, and a failed row must never
+      // auto-complete through this pass (see the AC's conservative-in-the-
+      // completing-direction constraint). The only thing a failed candidate
+      // can gain here is a looksDone annotation + a failed → needs_review
+      // transition, for a human to confirm.
+      const looksDone = await computeLooksDone(job);
+      if (looksDone) {
+        looksDoneUpdates.push({ slug: job.slug, cwd: job.cwd, looksDone, fromFailed: true });
+      } else {
+        leftForReview.push({ slug: job.slug, reason: 'failed, unverified-shaped run — no post-window evidence on declared paths' });
+      }
+      continue;
+    }
     const runDir = path.join(RUNS_DIR, job.runId || resolveRunId(job));
     const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
     // Derive committedDuringRun from the recorded run window. The live
@@ -4587,13 +6040,45 @@ async function reverifyNeedsReview() {
       });
     } catch { leftForReview.push({ slug: job.slug, reason: 'verifyRun threw' }); continue; }
     const refusal = healRefusalReason(job, v, committedDuringRun);
+    let stillOpen = true;
     if (refusal) {
       leftForReview.push({ slug: job.slug, reason: refusal });
     } else if (v && COMPLETED_EQUIVALENT_VERDICTS.has(v.verdict)) {
       healed.push(job.slug);
+      stillOpen = false;
     } else {
       leftForReview.push({ slug: job.slug, reason: v ? `${v.verdict}: ${v.reason}` : 'null verdict' });
     }
+    // Still needs_review after the existing heal pass — widen the evidence
+    // window before giving up on it entirely (unchanged heal semantics for
+    // rows that already qualified above; this only adds an annotation).
+    if (stillOpen) {
+      const looksDone = await computeLooksDone(job);
+      if (looksDone) {
+        looksDoneUpdates.push({ slug: job.slug, cwd: job.cwd, looksDone, fromFailed: false });
+      }
+    }
+  }
+  if (looksDoneUpdates.length) {
+    const bySlug = new Map(looksDoneUpdates.map((u) => [u.slug, u]));
+    await mutate((s) => {
+      for (const j of s.jobs) {
+        const u = bySlug.get(j.slug);
+        if (!u) continue;
+        if (u.fromFailed) {
+          transitionJob(j, 'needs_review', {
+            reason: 'looks done — commit(s) since this run touch this PRD\'s declared paths; confirm before archiving',
+            source: 'reverifyNeedsReview:looksDone',
+          });
+        }
+        if (j.status !== 'needs_review') continue;
+        j.looksDone = u.looksDone;
+        const shaList = u.looksDone.commits.slice(0, 5).map((c) => c.slice(0, 7)).join(', ');
+        j.error = `looks done — ${u.looksDone.commits.length} commit(s) since this run touch this PRD's paths (${shaList}); confirm before archiving`;
+      }
+    });
+    console.log(`[scheduler] boot reverify: looksDone annotated for ${looksDoneUpdates.length} row(s): ${looksDoneUpdates.map((u) => u.slug).join(', ')}`);
+    await broadcast();
   }
   if (healed.length) {
     const healSet = new Set(healed);
@@ -4604,6 +6089,7 @@ async function reverifyNeedsReview() {
           transitionJob(j, 'completed', { reason: 'boot reverify: stale needs_review healed', source: 'reverifyNeedsReview:heal' });
           j.error = null;
           delete j.verifierVerdict;
+          delete j.looksDone;
           healedPrds.push({ slug: j.slug, cwd: j.cwd });
         }
       }
@@ -4643,6 +6129,7 @@ async function reverifyNeedsReview() {
       orig.exitCode = 0;
       orig.error = null;
       orig.completedBy = job.slug;
+      delete orig.looksDone;
       if (priorStatus === 'needs_review') delete orig.verifierVerdict;
       promoted.push(`${orig.slug} (was ${priorStatus}, via ${job.slug})`);
       promotedPrds.push({ slug: orig.slug, cwd: orig.cwd });
@@ -4709,14 +6196,40 @@ async function reverifyNeedsReview() {
     await broadcast();
   }
 
+  // The annotate mutate above only runs conditionally — when it didn't fire,
+  // afterHealForAnnotate is still the current on-disk state, so reuse it
+  // instead of re-reading queue.json twice more back-to-back for the
+  // resume-recovery and auto-fix passes below (neither of which mutates
+  // synchronously: spawnResumeRecovery/spawnJob's own writes land later).
+  const queueForResumeAndAutofix = (unresolvable.length || exhaustedAutoFix.length || planUnqueued.length)
+    ? await readQueue()
+    : afterHealForAnnotate;
+
+  // Resume-first recovery (PRD 1111): before any fix-plan investigation is
+  // authored below, offer the bounded one-attempt `--resume` dispatch to any
+  // needs_review job this periodic pass finds still eligible — e.g. one the
+  // same-tick check in spawnJob missed because the app restarted between
+  // that job parking and this pass running. selectAutoFixTargets below
+  // already excludes every job this loop dispatches, so a resumable job
+  // never also gets a fix-plan PRD authored in the same pass.
+  {
+    for (const job of queueForResumeAndAutofix.jobs) {
+      const target = selectResumeRecoveryTarget(job);
+      if (!target) continue;
+      console.log(`[scheduler] resume-recovery: needs_review ${job.slug} → resuming session ${target.sessionId}`);
+      spawnResumeRecovery(job, target).catch((e) => {
+        console.error('[scheduler] spawnResumeRecovery error', job.slug, e);
+      });
+    }
+  }
+
   // Auto-fix: spawn a fix-plan investigation for each job still in
   // needs_review after the heal pass (kill-switch: SM_AUTOFIX_DISABLE=1).
   // spawnInvestigation early-returns once investigationsInFlight reaches
   // MAX_CONCURRENT_INVESTIGATIONS (queues the rest for retry), so this loop
   // cannot fan out past the cap regardless of how many targets are selected.
   if (process.env.SM_AUTOFIX_DISABLE !== '1') {
-    const afterHeal = await readQueue();
-    const targets = selectAutoFixTargets(afterHeal.jobs, {
+    const targets = selectAutoFixTargets(queueForResumeAndAutofix.jobs, {
       fixSlugExists: (s) => candidatePrdsDirs().some((dir) => fs.existsSync(path.join(dir, `${s}.md`))),
     });
     for (const job of targets) {
@@ -4745,7 +6258,7 @@ async function reverifyNeedsReview() {
     }
   }
 
-  return { rescanned: candidates.length, healed, leftForReview };
+  return { rescanned: candidates.length, healed, leftForReview, looksDone: looksDoneUpdates.map((u) => u.slug) };
 }
 
 /**
@@ -4841,7 +6354,7 @@ function registerScheduleHandlers() {
     // Clears any existing pause first (same semantics as run-now).
     await clearPause('run-now');
     try {
-      const result = await runDueJobs();
+      const result = await runDueJobs({ bypassLoadGate: true });
       return forceTickOutcome(result);
     } catch (e) {
       logs.writeLine({ level: 'error', scope: 'scheduler', message: 'runDueJobs error (force-tick)', meta: { error: e?.message } });
@@ -4917,7 +6430,7 @@ function registerScheduleHandlers() {
   ipcMain.handle('schedule:run-now', async () => {
     // Manual run-now overrides any auto-pause. Clear it first.
     await clearPause('run-now');
-    runDueJobs().catch((e) => logs.writeLine({ level: 'error', scope: 'scheduler', message: 'runDueJobs error (run-now)', meta: { error: e?.message } }));
+    runDueJobs({ bypassLoadGate: true }).catch((e) => logs.writeLine({ level: 'error', scope: 'scheduler', message: 'runDueJobs error (run-now)', meta: { error: e?.message } }));
     return { ok: true };
   });
 
@@ -5286,6 +6799,49 @@ async function init() {
         slug: over.slug, cwd: over.cwd, estimateMinutes: over.estimateMinutes, ranMs: over.ranMs, ratio: over.ratio,
       });
     }
+
+    // Stranded-investigation restore. Unlike the two escalations above, this
+    // one ACTS: 'investigating' is a transient status whose restore
+    // (spawnInvestigation's onExit/catch) only runs inside the process that
+    // spawned the probe, so an app restart mid-probe leaves the row frozen
+    // there forever (see findStrandedInvestigations' header, and the
+    // "'investigating' must never be the job's resting state" comment at
+    // spawnInvestigation's onExit). This restores each stranded row to the
+    // exact terminal status it already carried before the probe was
+    // spawned — it never re-runs or re-investigates anything.
+    const stranded = findStrandedInvestigations(s.jobs, Date.now(), INVESTIGATION_MAX_MS);
+    if (stranded.length > 0) {
+      mutate((ms) => {
+        for (const st of stranded) {
+          const j = ms.jobs.find((x) => x.slug === st.slug);
+          if (!j || j.status !== 'investigating') continue; // race guard — may have resolved since the scan above
+          transitionJob(j, st.restoreStatus, { reason: `stranded investigation restored after ${Math.round(st.ageMs / 60_000)}m with no live probe behind it`, source: 'findStrandedInvestigations' });
+          delete j.runtime;
+          console.warn(
+            `[scheduler] STRANDED INVESTIGATION RESTORED: project=${st.cwd ?? '(unknown)'} slug=${st.slug} `
+            + `age=${Math.round(st.ageMs / 3_600_000)}h (>= ${Math.round(INVESTIGATION_MAX_MS / 3_600_000)}h threshold), no live probe — `
+            + `restored to '${st.restoreStatus}'`,
+          );
+          appendAuditEvent('investigation_stranded_restored', { slug: st.slug, cwd: st.cwd, ageMs: st.ageMs, restoreStatus: st.restoreStatus });
+        }
+      })
+        .then(() => broadcast({ flush: true }))
+        .catch(() => {});
+    }
+
+    // Per-project starvation (PRD 1087): a project with pending work that has
+    // been passed over on every tick while OTHER projects dispatch. Nothing
+    // else distinguishes "no pending work" from "pending work, never
+    // started" — the 2026-09-01 NN-ordering starvation ran 3.5 h unnoticed.
+    // Escalation only, same shape as the quarantine/overrun warnings above.
+    for (const sp of findStarvedProjects(s.jobs, Date.now(), STARVATION_ESCALATE_MS)) {
+      console.warn(
+        `[scheduler] PROJECT STARVED: project=${sp.cwd} pending=${sp.pendingCount} oldest=${sp.oldestPendingSlug} `
+        + `waiting=${Math.round(sp.ageMs / 60_000)}m (>= ${Math.round(STARVATION_ESCALATE_MS / 60_000)}m threshold) `
+        + `while other projects are running — check the cross-project fairness rule in pickNextBatch`,
+      );
+      appendAuditEvent('project_starved', { cwd: sp.cwd, pendingCount: sp.pendingCount, oldestPendingSlug: sp.oldestPendingSlug, ageMs: sp.ageMs });
+    }
   }, 10 * 60_000);
 
   // Self-rescheduling poll loop with exponential backoff. Replaces the
@@ -5412,8 +6968,8 @@ async function init() {
 // there" (parallelGroup/estimateMinutes/sourcePromptId/epicId/
 // archivedStatus); `fields=full` restores them.
 function toCompactPrdEntry(entry) {
-  const { slug, title, cwd, mtimeMs, archived, status } = entry;
-  return { slug, title, cwd, mtimeMs, archived, status };
+  const { slug, title, cwd, mtimeMs, archived, status, agentType } = entry;
+  return { slug, title, cwd, mtimeMs, archived, status, agentType };
 }
 
 /**
@@ -5460,6 +7016,7 @@ async function listPrdsInternal() {
           estimateMinutes: parsed.estimateMinutes,
           sourcePromptId: parsed.sourcePromptId,
           epicId: parsed.epicId ?? null,
+          agentType: parsed.agentType ?? null,
           mtimeMs: stat.mtimeMs,
           archived,
         };
@@ -5638,9 +7195,16 @@ const remote = {
   },
 
   async resetJob(slug, opts = {}) {
-    if (!(await safeSlugPath(slug))) return { ok: false, error: 'invalid slug' };
+    const resolved = await resolveSlugOrReason(slug, opts.cwd);
+    if (!resolved.ok) {
+      return { ok: false, error: resolved.reason === 'invalid-slug' ? 'invalid slug' : unknownSlugMessage(slug) };
+    }
     const outcome = await mutate((state) => {
-      const idx = state.jobs.findIndex((j) => j.slug === slug);
+      // Same cwd filter as resolveSlugOrReason's file lookup above — slugs are
+      // derived from title text with no cwd salt, so two different projects
+      // can independently produce the identical slug; an opts.cwd caller must
+      // reset THAT project's job, not just any queue row matching the string.
+      const idx = state.jobs.findIndex((j) => j.slug === slug && (!opts.cwd || j.cwd === opts.cwd));
       if (idx < 0) return { kind: 'not-found' };
       // Terminal-status guard lives in resetJobFields itself; force:true
       // threads through to override it.
@@ -5662,7 +7226,7 @@ const remote = {
 
   async listJobs() {
     const state = await readQueue();
-    return state.jobs.map((j) => ({ slug: j.slug, title: j.title, status: j.status, cwd: j.cwd }));
+    return state.jobs.map((j) => ({ slug: j.slug, title: j.title, status: j.status, cwd: j.cwd, agentType: j.agentType ?? null }));
   },
 
   // Single queue row lookup, used by cancelJob/updatePrd's status guards and
@@ -5828,10 +7392,16 @@ const remote = {
   // cancelled job lands in 'failed' with an error naming the cause,
   // consistent with every other non-success terminal outcome. Refuses a
   // slug that's already terminal — nothing left to cancel.
-  async cancelJob(slug) {
+  async cancelJob(slug, opts = {}) {
+    if (!SCHEDULE_SLUG_RE.test(slug)) return { ok: false, error: 'invalid slug' };
     const state = await readQueue();
-    const job = state.jobs.find((j) => j.slug === slug);
-    if (!job) return { ok: false, error: 'not found' };
+    const job = state.jobs.find((j) => j.slug === slug && (!opts.cwd || j.cwd === opts.cwd));
+    if (!job) {
+      return {
+        ok: false,
+        error: `unknown slug "${slug}": no queued job with that name${opts.cwd ? ` in cwd ${opts.cwd}` : ''} — call scheduler_list_jobs to see what exists`,
+      };
+    }
     if (job.status === 'completed' || job.status === 'failed' || job.status === 'needs_review' || job.status === 'skipped') {
       return { ok: false, error: `job already terminal (status: "${job.status}") — nothing to cancel` };
     }
@@ -5889,9 +7459,10 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
       return;
     }
     const force = parsed.force === true;
-    const result = await remoteObj.resetJob(slug, { force });
+    const cwd = typeof parsed.cwd === 'string' ? parsed.cwd : undefined;
+    const result = await remoteObj.resetJob(slug, { force, cwd });
     sendJson(res, 200, result);
   });
 }
 
-module.exports = { findOverrunningJobs, JOB_OVERRUN_FACTOR, JOB_OVERRUN_FLOOR_MS, registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, healRefusalReason, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, isExhaustedAutoFix, isPlanUnqueued, fixSlugFor, healTargetForFix, buildInvestigationPrompt, isGitRepoSync, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, resolveVerifyPrdPath, resolveFixPlanPath, resolveNotifyPrd, runPrdMigration, consolidateAllFlatPrds, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult, spawnJob, listPrdsInternal, computeStallSummary, findStaleQuarantinedJobs, QUARANTINE_ESCALATE_MS, applyClearQueueVictims };
+module.exports = { findOverrunningJobs, JOB_OVERRUN_FACTOR, JOB_OVERRUN_FLOOR_MS, registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, healRefusalReason, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, IDLE_OUTPUT_KILL_MS, BASH_DEFAULT_TIMEOUT_MS, BASH_MAX_TIMEOUT_MS, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isFailedUnverifiedShaped, computeLooksDone, isPromotableOriginal, selectAutoFixTargets, applyRcaClassification, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, isExhaustedAutoFix, isPlanUnqueued, fixSlugFor, healTargetForFix, buildInvestigationPrompt, isGitRepoSync, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, leftoverFieldsFrom, applyLeftoverFields, LEFTOVER_PATHS_CAP, capDirtyPaths, buildForeignWipSection, PRE_RUN_DIRTY_PATHS_CAP, FOREIGN_WIP_DELIMITER, FOREIGN_WIP_END_DELIMITER, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, resolveVerifyPrdPath, resolveFixPlanPath, resolveNotifyPrd, runPrdMigration, consolidateAllFlatPrds, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult, spawnJob, listPrdsInternal, computeStallSummary, findStaleQuarantinedJobs, QUARANTINE_ESCALATE_MS, applyClearQueueVictims, PIDLESS_SPAWN_GRACE_MS, findStrandedInvestigations, INVESTIGATION_MAX_MS, stashList, parseStashLine, pathsChangedSince, restoreSpecificStash, evaluateSharedTreeGuard, checkSharedTreeGuard, uncommittedChanges, gitHead, selectResumeRecoveryTarget, buildResumeRecoveryPreamble, buildClaudeSpawnArgs, spawnResumeRecovery, spawnInvestigation, computeLaunchHolds, handleLaunchFailure, applyLaunchFailure };