claude-code-session-manager 0.78.0 → 0.80.0

package/src/main/lib/__tests__/reaperHelpers.test.cjs

@@ -16,7 +16,11 @@
 // vitest, NOT node:test — this repo's suite is vitest-only (CLAUDE.md).
 import { test } from 'vitest';
 const assert = require('node:assert/strict');
-const { selectReapableJobs, mapOutcomeToGateOutcome } = require('../reaperHelpers.cjs');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { selectReapableJobs, mapOutcomeToGateOutcome, classifyRunOutcome } = require('../reaperHelpers.cjs');
+const { detectRateLimitInLog } = require('../rateLimitDetect.cjs');
 
 const NOW = Date.parse('2026-09-01T12:00:00.000Z');
 const agoMin = (m) => new Date(NOW - m * 60_000).toISOString();
@@ -131,3 +135,88 @@ test('mapOutcomeToGateOutcome: no_result -> never_ran', () => {
 test('mapOutcomeToGateOutcome: unknown -> unknown', () => {
   assert.strictEqual(mapOutcomeToGateOutcome('unknown'), 'unknown');
 });
+
+// detectRateLimitInLog / classifyRunOutcome — PRD 1117: the reaper's
+// rate-limit detection must be the SAME single source of truth spawnJob
+// uses (detectRateLimitInLog, shared via lib/rateLimitDetect.cjs), and a
+// rate-limited death must classify as a NEW, distinct 'rate_limited'
+// outcome — never collapsed into 'failed', and never re-labelling
+// 'success'/'failed'/'no_result' (which keep their prior meanings, per the
+// mapOutcomeToGateOutcome tests above, unmodified).
+
+function writeTmpLog(contents) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-reaper-rate-limit-test-'));
+  const p = path.join(dir, 'run.log');
+  fs.writeFileSync(p, contents);
+  return p;
+}
+
+test('detectRateLimitInLog: rateLimitType":"five_hour" variant', () => {
+  const p = writeTmpLog('{"type":"result","rate_limit_info":{"rateLimitType":"five_hour"}}\n');
+  assert.strictEqual(detectRateLimitInLog(p), true);
+});
+
+test('detectRateLimitInLog: rateLimitType":"seven_day" variant (missed pre-PRD-1117)', () => {
+  const p = writeTmpLog('{"type":"rate_limit_event","rate_limit_info":{"rateLimitType":"seven_day","unifiedWindows":{"five_hour":{"utilization":0}}}}\n');
+  assert.strictEqual(detectRateLimitInLog(p), true);
+});
+
+test('detectRateLimitInLog: api_error_status":429 variant', () => {
+  const p = writeTmpLog('{"type":"result","is_error":true,"api_error_status":429,"result":"nope"}\n');
+  assert.strictEqual(detectRateLimitInLog(p), true);
+});
+
+test('detectRateLimitInLog: "You\'ve reached your <model> limit" variant (missed pre-PRD-1117)', () => {
+  const p = writeTmpLog('{"type":"result","result":"You\'ve reached your Fable limit. Switch to another model."}\n');
+  assert.strictEqual(detectRateLimitInLog(p), true);
+});
+
+test('detectRateLimitInLog: real evidence log (2026-09-05 204-mercury-steam-horse 429)', () => {
+  const evidencePath = '/home/bilko/.claude/session-manager/scheduled-plans/runs/2026-09-05T16-32-18-381Z/204-mercury-steam-horse.log';
+  if (!fs.existsSync(evidencePath)) return; // machine-local fixture; skip elsewhere
+  assert.strictEqual(detectRateLimitInLog(evidencePath), true);
+});
+
+test('classifyRunOutcome: a 429 log tail classifies as the new distinct rate_limited outcome, not failed', () => {
+  const p = writeTmpLog('{"type":"result","subtype":"success","is_error":true,"api_error_status":429,"rateLimitType":"seven_day","result":"You\'ve reached your Fable limit."}\n');
+  assert.strictEqual(classifyRunOutcome(p), 'rate_limited');
+});
+
+test('classifyRunOutcome: a genuine error with no rate-limit signal still classifies as failed', () => {
+  const p = writeTmpLog('{"type":"result","subtype":"error","is_error":true,"result":"Error: expected 2 but got 3"}\n');
+  assert.strictEqual(classifyRunOutcome(p), 'failed');
+});
+
+// REGRESSION GUARD (2026-09-05). The rate-limit check originally ran as the
+// FIRST statement of classifyRunOutcome, before the result event was parsed.
+// Because the CLI emits an informational rate_limit_event with
+// status:"allowed_warning" on nearly every run once utilization is non-zero,
+// that misclassified genuinely successful runs as 'rate_limited' — which in
+// reapDeadRunningJobs re-queues finished work and spuriously pauses the whole
+// machine. The fixture below is the shape of a REAL successful run log, not a
+// synthetic one-liner: the allowed_warning event that every run carries, then
+// a clean result. If someone moves the check back to the top, this goes red.
+test('classifyRunOutcome: a SUCCESSFUL run whose tail carries an allowed_warning rate_limit_event is still success', () => {
+  const p = writeTmpLog([
+    '{"type":"rate_limit_event","rate_limit_info":{"status":"allowed_warning","resetsAt":1788643800,"rateLimitType":"five_hour","utilization":0.42,"isUsingOverage":false}}',
+    '{"type":"rate_limit_event","rate_limit_info":{"status":"allowed_warning","resetsAt":1789059600,"rateLimitType":"seven_day","utilization":0.59,"isUsingOverage":false}}',
+    '{"type":"result","subtype":"success","is_error":false,"num_turns":55,"result":"SCHEDULER_VERDICT: PASS"}',
+  ].join('\n') + '\n');
+  assert.strictEqual(classifyRunOutcome(p), 'success');
+  assert.strictEqual(mapOutcomeToGateOutcome(classifyRunOutcome(p)), 'passed');
+});
+
+// The same tail, but the run actually errored: NOW the rate-limit signal is
+// what it claims to be, and the outcome must be the retryable one.
+test('classifyRunOutcome: the same allowed_warning tail on an ERRORED run classifies as rate_limited', () => {
+  const p = writeTmpLog([
+    '{"type":"rate_limit_event","rate_limit_info":{"status":"allowed_warning","rateLimitType":"seven_day","utilization":0.59}}',
+    '{"type":"result","subtype":"success","is_error":true,"api_error_status":429,"result":"You\'ve reached your Fable limit."}',
+  ].join('\n') + '\n');
+  assert.strictEqual(classifyRunOutcome(p), 'rate_limited');
+});
+
+test('classifyRunOutcome: a clean success log still classifies as success', () => {
+  const p = writeTmpLog('{"type":"result","subtype":"success","is_error":false,"result":"done"}\n');
+  assert.strictEqual(classifyRunOutcome(p), 'success');
+});

package/src/main/lib/__tests__/schedulerBatchDepends.test.cjs

@@ -11,7 +11,7 @@
 
 // vitest globals (test) — same convention as the other .cjs tests.
 const assert = require('node:assert/strict');
-const { pickForProject, DEFAULT_PROJECT_CWD } = require('../schedulerBatch.cjs');
+const { pickForProject, findBlockingDep, DEFAULT_PROJECT_CWD, DEP_HISTORY_FAIL_OPEN } = require('../schedulerBatch.cjs');
 
 const CWD = DEFAULT_PROJECT_CWD;
 
@@ -74,14 +74,66 @@ test('still resolves an exact-slug dep (dep written WITH the NN- prefix)', () =>
   assert.deepEqual(batch.map((j) => j.slug), ['873-leftnav-two-face-framework']);
 });
 
-test('a dep with no row at all is treated as already done (archived/retired)', () => {
+// PRD 1122 — a dep slug with no live row is no longer auto-satisfied by
+// absence alone. It must show up in the caller's precomputed
+// history/archive Set (5th arg, built once per tick by
+// scheduler.cjs's computeDepHistorySatisfaction) or it HOLDS as
+// 'unresolved'. Observed live on starry-night-ships: a typo'd/format-
+// mismatched dep slug used to be silently indistinguishable from one
+// genuinely retired to history.
+test('a dep with no row IS treated as done when the caller supplies it as history/archive-satisfied', () => {
   const jobs = [
     job('874-nav-face-project-home', 'pending', { dependsOn: ['some-long-archived-prd'] }),
   ];
-  const { batch } = pick(jobs);
+  const { batch } = pickForProject(jobs, new Set(), 3, new Map(), new Set(['some-long-archived-prd']));
+  assert.deepEqual(batch.map((j) => j.slug), ['874-nav-face-project-home']);
+});
+
+test('a dep with no row and NOT in the history/archive set HOLDS as unresolved, with a named actionable reason', () => {
+  const jobs = [
+    job('874-nav-face-project-home', 'pending', { dependsOn: ['some-typo-d-prd'] }),
+  ];
+  const { batch, reason, holds } = pick(jobs);
+  assert.deepEqual(batch, []);
+  assert.match(reason, /depends-gate/);
+  assert.match(reason, /unresolvable dependencies/);
+  assert.match(reason, /874-nav-face-project-home <- some-typo-d-prd/);
+  assert.match(reason, /fix the dependsOn entry or archive the dependent/);
+  const hold = holds.find((h) => h.slug === '874-nav-face-project-home');
+  assert.equal(hold.depStatus, 'unresolved');
+});
+
+test('the double-prefixed-row regression: a row named 253-253-x referenced as bare x holds as unresolved', () => {
+  // bareSlug strips exactly ONE leading `NN-` run, so '253-253-x' bares to
+  // '253-x' — it does NOT bare-match dependsOn's 'x'. The double-prefixed row
+  // is therefore genuinely invisible to both exact and bare matching, the
+  // same as a typo — this is the exact 2026-09-06 starry-night-ships report.
+  const jobs = [
+    job('253-253-x', 'running'),
+    job('254-next', 'pending', { dependsOn: ['x'] }),
+  ];
+  const { batch, holds, reason } = pick(jobs);
+  assert.deepEqual(batch.map((j) => j.slug), []);
+  assert.match(reason, /unresolvable dependencies/);
+  const hold = holds.find((h) => h.slug === '254-next');
+  assert.equal(hold.dep, 'x');
+  assert.equal(hold.depStatus, 'unresolved');
+});
+
+test('DEP_HISTORY_FAIL_OPEN preserves the pre-1122 fail-open behaviour for a read failure', () => {
+  const jobs = [
+    job('874-nav-face-project-home', 'pending', { dependsOn: ['some-long-archived-prd'] }),
+  ];
+  const { batch } = pickForProject(jobs, new Set(), 3, new Map(), DEP_HISTORY_FAIL_OPEN);
   assert.deepEqual(batch.map((j) => j.slug), ['874-nav-face-project-home']);
 });
 
+test('findBlockingDep: bare-name resolution against satisfiedSlugs matches the live-row bare-name rule', () => {
+  const dependent = job('254-next', 'pending', { dependsOn: ['x'] });
+  assert.equal(findBlockingDep(dependent, [dependent], new Set(['253-x'])), undefined);
+  assert.equal(findBlockingDep(dependent, [dependent], new Set()), 'x');
+});
+
 test('a FAILED bare-named dep holds the dependent and reports an explicit reason', () => {
   const jobs = [
     job('873-leftnav-two-face-framework', 'failed'),
@@ -203,7 +255,7 @@ test('reports a per-job hold record naming the blocking dep and its status', ()
   const { batch, holds } = pick(jobs, new Set(), 5);
   assert.deepEqual(batch.map((j) => j.slug), ['985-foundation']);
   assert.deepEqual(holds, [
-    { slug: '986-dependent', dep: 'foundation', depStatus: 'pending' },
+    { slug: '986-dependent', dep: 'foundation', depStatus: 'pending', rootSlug: '985-foundation', rootStatus: 'pending' },
   ]);
 });
 
@@ -214,7 +266,7 @@ test('hold record carries a running dep status', () => {
   ];
   const { holds } = pick(jobs, new Set(['985-foundation']), 5);
   assert.deepEqual(holds, [
-    { slug: '986-dependent', dep: 'foundation', depStatus: 'running' },
+    { slug: '986-dependent', dep: 'foundation', depStatus: 'running', rootSlug: '985-foundation', rootStatus: 'running' },
   ]);
 });
 
@@ -227,7 +279,7 @@ test('hold record carries a failed dep status alongside the depends-gate reason'
   assert.deepEqual(batch, []);
   assert.match(reason, /depends-gate/);
   assert.deepEqual(holds, [
-    { slug: '986-dependent', dep: 'foundation', depStatus: 'failed' },
+    { slug: '986-dependent', dep: 'foundation', depStatus: 'failed', rootSlug: '985-foundation', rootStatus: 'failed' },
   ]);
 });
 
@@ -241,7 +293,7 @@ test('hold record carries a skipped dep status alongside the depends-gate reason
   assert.match(reason, /depends-gate/);
   assert.match(reason, /never-ran dependencies/);
   assert.deepEqual(holds, [
-    { slug: '986-dependent', dep: 'foundation', depStatus: 'skipped' },
+    { slug: '986-dependent', dep: 'foundation', depStatus: 'skipped', rootSlug: '985-foundation', rootStatus: 'skipped' },
   ]);
 });
 

package/src/main/lib/depSlugResolve.cjs

@@ -0,0 +1,72 @@
+'use strict';
+
+/**
+ * depSlugResolve.cjs — the single `dependsOn` slug-resolution rule (PRD 832),
+ * shared by schedulerBatch.cjs's findBlockingDep (run-time gating: does a
+ * queue row exist for this dep) and prdCreate.cjs's write-time validation
+ * (does a PRD exist for this dep at all). Both must agree on what a
+ * `dependsOn` entry resolves to, or a dep that validates at PRD-create time
+ * could still fail to block at run time (or vice versa) — so the matching
+ * rule lives here once, not copied into each caller.
+ *
+ * Resolution rule: exact slug match first; else bare-name match after
+ * stripping one leading `NN-` prefix — a human-authored `dependsOn:` can't
+ * know the `NN-` prefix the allocator will hand a sibling PRD.
+ */
+
+/** Strip one leading `NN-` prefix, if present. */
+function bareSlug(slug) {
+  return String(slug ?? '').replace(/^\d+-/, '');
+}
+
+/**
+ * Resolve `depSlug` against `candidateSlugs`: exact match wins outright;
+ * otherwise every candidate whose bare name matches. Returns a (possibly
+ * empty) array of matching candidate slugs.
+ */
+function resolveDepSlug(depSlug, candidateSlugs) {
+  if (candidateSlugs.includes(depSlug)) return [depSlug];
+  const bare = bareSlug(depSlug);
+  return candidateSlugs.filter((slug) => bareSlug(slug) === bare);
+}
+
+/**
+ * Levenshtein edit distance. O(n*m) in the two strings' lengths — fine here
+ * since it only ever runs over short slug strings (<= 60 chars, PRD_CREATE_SLUG_RE's
+ * cap) at PRD-create time, never in a hot/per-tick path.
+ */
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  const prevRow = new Array(n + 1);
+  const curRow = new Array(n + 1);
+  for (let j = 0; j <= n; j++) prevRow[j] = j;
+  for (let i = 1; i <= m; i++) {
+    curRow[0] = i;
+    for (let j = 1; j <= n; j++) {
+      curRow[j] = a[i - 1] === b[j - 1]
+        ? prevRow[j - 1]
+        : 1 + Math.min(prevRow[j - 1], prevRow[j], curRow[j - 1]);
+    }
+    for (let j = 0; j <= n; j++) prevRow[j] = curRow[j];
+  }
+  return prevRow[n];
+}
+
+/**
+ * Nearest existing slugs to `depSlug` by bare-name edit distance, closest
+ * first, capped at `limit` — used to build an actionable "did you mean"
+ * error when a dependsOn entry resolves to nothing.
+ */
+function findNearMatches(depSlug, candidateSlugs, limit = 3) {
+  const depBare = bareSlug(depSlug);
+  return candidateSlugs
+    .map((slug) => ({ slug, dist: levenshtein(depBare, bareSlug(slug)) }))
+    .sort((a, b) => a.dist - b.dist)
+    .slice(0, limit)
+    .map((entry) => entry.slug);
+}
+
+module.exports = { bareSlug, resolveDepSlug, findNearMatches };

package/src/main/lib/epicWorktreeMerge.cjs

@@ -37,9 +37,9 @@ const { validatePath } = require('../config.cjs');
  * real conflict — never throws (integrateEpicBranch/cleanupEpicWorktree
  * never do either).
  */
-async function mergeEpicToMainViaIpc(cwd, epicId, branch, dir) {
+async function mergeEpicToMainViaIpc(cwd, epicId, branch, dir, carriedPaths) {
   validatePath(cwd);
-  const outcome = await integrateEpicBranch({ cwd, branch, epicId });
+  const outcome = await integrateEpicBranch({ cwd, branch, epicId, carriedPaths });
   if (!outcome.ok) {
     console.log(`[epicWorktreeMerge] ${epicId}: needs manual resolution (${outcome.reason})`);
     return { ok: false, status: 'needs_merge_resolution', reason: outcome.reason };
@@ -56,7 +56,7 @@ function registerEpicWorktreeMergeHandlers() {
   const { schemas: s, validated: v } = require('../ipcSchemas.cjs');
   ipcMain.handle(
     'promptSessions:merge-to-main',
-    v(s.promptSessionsMergeToMain, ({ cwd, epicId, branch, dir }) => mergeEpicToMainViaIpc(cwd, epicId, branch, dir)),
+    v(s.promptSessionsMergeToMain, ({ cwd, epicId, branch, dir, carriedPaths }) => mergeEpicToMainViaIpc(cwd, epicId, branch, dir, carriedPaths)),
   );
 }
 

package/src/main/lib/epicWorktreeMint.cjs

@@ -30,10 +30,10 @@ const { validatePath } = require('../config.cjs');
 /**
  * createEpicWorktreeViaIpc(cwd, epicId) → Promise<EpicWorktree | null>
  *
- * Returns the `worktree` field shape (`{ dir, branch, baseCwd, status }`)
- * ready to persist onto the Epic record on success, or `null` on any
- * failure — createEpicWorktree/createWorktree never throw, so this never
- * does either.
+ * Returns the `worktree` field shape (`{ dir, branch, baseCwd, status,
+ * carriedPaths }`) ready to persist onto the Epic record on success, or
+ * `null` on any failure — createEpicWorktree/createWorktree never throw, so
+ * this never does either.
  */
 async function createEpicWorktreeViaIpc(cwd, epicId) {
   validatePath(cwd);
@@ -42,7 +42,19 @@ async function createEpicWorktreeViaIpc(cwd, epicId) {
     console.log(`[epicWorktreeMint] ${epicId}: not isolated (${result.reason})`);
     return null;
   }
-  return { dir: result.dir, branch: result.branch, baseCwd: result.baseCwd, status: 'active' };
+  // carriedPaths (base-tree WIP carried into this worktree — PRD 1094) MUST
+  // survive onto the persisted record: it's the only way integrateEpicBranch
+  // (via epicWorktreeMerge.cjs) can later apply the carried-wip-only skip
+  // instead of attempting a doomed merge against the base tree's still-dirty
+  // paths. Dropping it here silently (as this used to) meant that skip never
+  // fired for Epics, only for scheduler jobs.
+  return {
+    dir: result.dir,
+    branch: result.branch,
+    baseCwd: result.baseCwd,
+    status: 'active',
+    ...(Array.isArray(result.carriedPaths) && result.carriedPaths.length ? { carriedPaths: result.carriedPaths } : {}),
+  };
 }
 
 function registerEpicWorktreeMintHandlers() {

package/src/main/lib/fixPlanSlug.cjs

@@ -0,0 +1,62 @@
+/**
+ * fixPlanSlug.cjs — single source of truth for recognizing a scheduler-
+ * authored fix-plan PRD (PRD 1131).
+ *
+ * `isFixPlanSlug`'s `/^\d+-fix-/` name test used to be treated as sufficient
+ * evidence on its own. But any PRD an agent or human authors through
+ * `scheduler_create_prd` whose title happens to kebab-case into a
+ * `fix-`-leading slug silently inherited every fix-plan special case
+ * (depth-capped auto-investigation, `commitGuardVerdict`'s zero-edit
+ * exemption) it never asked for — PRD 1126
+ * (`126-fix-plan-death-reopens-parent`, `createdVia: scheduler-api`) was
+ * wrongly stamped `investigationDepth: 2` before it ever ran and had to be
+ * withdrawn and re-slugged.
+ *
+ * A genuine fix plan is authored directly by scheduler.cjs's
+ * `spawnInvestigation` — a raw `Write`, never through `scheduler_create_prd`
+ * (see `guard-prd-writes.cjs`'s exemption) — so it never carries a
+ * `createdVia` stamp. Its prompt template also stamps an explicit
+ * `isFixPlan: true` frontmatter key so classification has a positive
+ * signal to check, not just an absence.
+ *
+ * `classifyDiscoveredFixPlan` is the ONE place a freshly-parsed PRD file
+ * (which has real `createdVia`/`isFixPlan` frontmatter) is turned into a
+ * boolean fix-plan verdict — `reconcile()` calls it once per newly
+ * discovered PRD and persists the verdict onto the queue row's `isFixPlan`
+ * field, so every later consumer reads that stamp instead of re-deriving it
+ * from the name. `resolveIsFixPlan` is what those consumers call: an
+ * explicit `true`/`false` on the row wins; a row with the field entirely
+ * absent (any queue.json row persisted before this change shipped) falls
+ * back to the legacy slug-only heuristic so live history is never
+ * re-classified.
+ */
+'use strict';
+
+function isFixPlanSlug(slug) {
+  return /^\d+-fix-/.test(slug);
+}
+
+/**
+ * Classify a freshly-parsed PRD file (real `createdVia`/`isFixPlan`
+ * frontmatter available). `createdVia` is checked FIRST and always wins —
+ * proof the PRD was authored through the sanctioned scheduler_create_prd API
+ * (a lower-trust path than spawnInvestigation's own raw write) must never be
+ * overridable by an `isFixPlan: true` stamp in the same file, even though no
+ * current write path can produce both on one file (see prdCreate.cjs's
+ * slug-refusal + guard-prd-writes.cjs's write-guard). Structural belt, not
+ * just relying on those two other files staying in sync.
+ */
+function classifyDiscoveredFixPlan({ isFixPlan, createdVia } = {}, slug) {
+  if (createdVia) return false;
+  if (isFixPlan === true) return true;
+  return isFixPlanSlug(slug);
+}
+
+/** Classify a queue-row job, honoring an already-persisted `isFixPlan` stamp over the slug. */
+function resolveIsFixPlan(slug, isFixPlan) {
+  if (isFixPlan === true) return true;
+  if (isFixPlan === false) return false;
+  return isFixPlanSlug(slug);
+}
+
+module.exports = { isFixPlanSlug, classifyDiscoveredFixPlan, resolveIsFixPlan };

package/src/main/lib/gitWorktree.cjs

@@ -544,6 +544,69 @@ async function createWorktree({ kind, cwd, key }) {
   return { ok: true, dir, branch, baseCwd: cwd, carriedPaths };
 }
 
+/**
+ * True iff every path in `paths` has working-tree content in `cwd`
+ * byte-identical to its committed blob on `branch`. Used both by the
+ * carried-wip-only shortcut above and by integrateBranch's auto-resolve of a
+ * "would be overwritten by merge" refusal below — in both cases discarding a
+ * working-tree copy is only safe BECAUSE identity with the incoming commit is
+ * proven, never assumed. Fails toward false (not identical) on ANY read
+ * error — a `git show` failure or an unreadable working-tree file is never
+ * proof of identity.
+ */
+async function pathsIdenticalToBranch({ cwd, branch, paths }) {
+  if (!Array.isArray(paths) || !paths.length) return false;
+  for (const p of paths) {
+    try {
+      const branchContent = await execGit(['show', `${branch}:${p}`], { cwd, timeout: 10_000 });
+      const baseContent = await fsp.readFile(path.join(cwd, p), 'utf8');
+      if (branchContent !== baseContent) return false;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * Parses the path lists out of git's refusal to merge over dirty working-tree
+ * files. Git emits up to two distinct blocks — tracked paths under "local
+ * changes ... would be overwritten" (restorable via `git checkout --`, which
+ * needs an index entry) and untracked paths under "untracked working tree
+ * files ... would be overwritten" (no index entry, so `git checkout --`
+ * cannot touch them — they must be removed instead). Each block is a run of
+ * TAB-indented path lines terminated by the next non-indented line (a
+ * "Please ..." sentence or the next block's own header). Returns null when
+ * neither block is present — stderr from a genuine content conflict has no
+ * such block.
+ */
+function parseBlockingMergePaths(stderrText) {
+  if (!stderrText) return null;
+  const tracked = [];
+  const untracked = [];
+  let mode = null;
+  for (const rawLine of stderrText.split('\n')) {
+    if (/would be overwritten by merge:\s*$/.test(rawLine) && /local changes/.test(rawLine)) {
+      mode = 'tracked';
+      continue;
+    }
+    if (/would be overwritten by merge:\s*$/.test(rawLine) && /untracked working tree files/.test(rawLine)) {
+      mode = 'untracked';
+      continue;
+    }
+    if (mode) {
+      if (/^\t/.test(rawLine)) {
+        const p = rawLine.trim();
+        if (p) (mode === 'tracked' ? tracked : untracked).push(p);
+        continue;
+      }
+      mode = null;
+    }
+  }
+  if (!tracked.length && !untracked.length) return null;
+  return { tracked: Array.from(new Set(tracked)), untracked: Array.from(new Set(untracked)) };
+}
+
 /**
  * Integrate a branch back into `cwd`'s current HEAD — fast-forward when
  * possible, a real merge commit when the main tree advanced underneath (a
@@ -600,17 +663,7 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths }) {
         // committed exactly the carried WIP and nothing more. Any mismatch
         // (including a read failure — fail toward the safer default) falls
         // through to the normal merge attempt below instead of skipping.
-        let allIdentical = true;
-        for (const p of changed) {
-          try {
-            const branchContent = await execGit(['show', `${branch}:${p}`], { cwd, timeout: 10_000 });
-            const baseContent = await fsp.readFile(path.join(cwd, p), 'utf8');
-            if (branchContent !== baseContent) { allIdentical = false; break; }
-          } catch {
-            allIdentical = false;
-            break;
-          }
-        }
+        const allIdentical = await pathsIdenticalToBranch({ cwd, branch, paths: changed });
         if (allIdentical) {
           return { ok: true, integrated: false, reason: 'carried-wip-only' };
         }
@@ -637,9 +690,40 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths }) {
     await execGit(['merge', '--no-ff', '--no-edit', '-m', mergeMessage, branch], { cwd, timeout: 30_000 });
     return { ok: true, integrated: true, mergeCommit: true };
   } catch (e) {
+    const stderrText = (e && (e.stderrText || e.message)) || String(e);
+    // git refuses this class of merge before ever touching MERGE_HEAD, so
+    // there is nothing yet to abort here — only the retry below (if it also
+    // fails) can leave a half-applied merge behind.
+    const blocking = parseBlockingMergePaths(stderrText);
+    if (blocking) {
+      const allPaths = [...blocking.tracked, ...blocking.untracked];
+      const identical = await pathsIdenticalToBranch({ cwd, branch, paths: allPaths });
+      if (identical) {
+        try {
+          if (blocking.tracked.length) {
+            await execGit(['checkout', '--', ...blocking.tracked], { cwd, timeout: 30_000 });
+          }
+          for (const p of blocking.untracked) {
+            await fsp.rm(path.join(cwd, p), { force: true });
+          }
+          await execGit(['merge', '--no-ff', '--no-edit', '-m', mergeMessage, branch], { cwd, timeout: 30_000 });
+          return {
+            ok: true,
+            integrated: true,
+            mergeCommit: true,
+            autoResolved: 'identical_working_tree_duplicates',
+            resolvedPaths: allPaths,
+          };
+        } catch (retryErr) {
+          try { await execGit(['merge', '--abort'], { cwd, timeout: 10_000 }); } catch { /* nothing to abort */ }
+          const retryText = (retryErr && (retryErr.stderrText || retryErr.message)) || String(retryErr);
+          return { ok: false, reason: `merge failed (likely a real content conflict): ${retryText}` };
+        }
+      }
+    }
     // Abort a half-applied merge so `cwd` isn't left in a mid-merge state.
     try { await execGit(['merge', '--abort'], { cwd, timeout: 10_000 }); } catch { /* nothing to abort */ }
-    return { ok: false, reason: `merge failed (likely a real content conflict): ${(e && (e.stderrText || e.message)) || e}` };
+    return { ok: false, reason: `merge failed (likely a real content conflict): ${stderrText}` };
   }
 }
 
@@ -914,6 +998,7 @@ module.exports = {
   keyFromBranch,
   createWorktree,
   captureAndCarryBaseDiff,
+  pathsIdenticalToBranch,
   integrateBranch,
   cleanupWorktree,
   salvageWorktreeDiff,

package/src/main/lib/jobDirtFilter.cjs

@@ -0,0 +1,54 @@
+'use strict';
+
+/**
+ * jobDirtFilter.cjs — strip paths a scheduled job can NEVER be responsible
+ * for out of its post-run dirty delta.
+ *
+ * The commit guard parks a job on `needs_review` ("finish protocol
+ * incomplete: N uncommitted file(s)") whenever its run leaves tracked files
+ * dirty. That is the right rule for source files. It is wrong for
+ * `session-manager-operations/`: the SINGLE-WRITER LAW (lib/opsOwnership.cjs)
+ * says the app itself owns every namespace under that root — `scheduler`
+ * writes queue.json/history.jsonl on every dispatch and every finalize,
+ * `prompt-sessions` writes active-index.json and transcripts continuously.
+ * Those writes land DURING the job's own run, inside its own guard window,
+ * and get attributed to the job.
+ *
+ * Result before this filter: a job that did everything right and committed
+ * cleanly still parked, because the scheduler's own bookkeeping was dirty
+ * underneath it. Observed 2026-09-05 on social-signals-trader PRDs 4055 and
+ * 4056 (leftover lists led with active-index.json / queue.json /
+ * history.jsonl / .max-allocated-group) and on starry-night-ships PRD 206.
+ * Each parked row then blocked every job that dependsOn it, which is how a
+ * queue with 40 ready PRDs stops dead.
+ *
+ * Deliberately narrow: ONLY the app-owned operations root. A job that dirties
+ * real source and walks away is still a genuine finish-protocol violation and
+ * must still park.
+ */
+
+/** The one app-owned root. Matches at any depth, and only as a path segment. */
+const OPS_ROOT_SEGMENT = 'session-manager-operations';
+
+/** True when `p` lives under an app-owned operations root. Pure. */
+function isAppOwnedChurn(p) {
+  if (typeof p !== 'string' || p === '') return false;
+  // Normalise Windows-style separators defensively; git porcelain emits '/'.
+  const parts = p.replace(/\\/g, '/').split('/');
+  return parts.includes(OPS_ROOT_SEGMENT);
+}
+
+/**
+ * Remove app-owned churn from a dirty-path list.
+ *
+ * Preserves the caller's null contract: `null` means "git status itself was
+ * unavailable", which is NOT the same fact as "the job left nothing", and
+ * every caller already branches on it.
+ */
+function stripAppOwnedChurn(paths) {
+  if (paths === null || paths === undefined) return paths;
+  if (!Array.isArray(paths)) return paths;
+  return paths.filter((p) => !isAppOwnedChurn(p));
+}
+
+module.exports = { stripAppOwnedChurn, isAppOwnedChurn, OPS_ROOT_SEGMENT };

package/src/main/lib/mcpToolCatalog.cjs

@@ -133,7 +133,10 @@ const MCP_TOOL_CATALOG = [
       + 'app\'s admin API. Refuses once a queue row exists for the slug and its status is anything but "pending" '
       + '(running/completed/failed/needs_review) — editing the spec under a live or already-finished executor is refused, '
       + 'not silently applied. Only recognized frontmatter keys (title, cwd, estimateMinutes, parallelGroup, '
-      + 'sourcePromptId, sourceTabId, tag) may be patched; unrecognized keys (e.g. dependsOn) round-trip unchanged.',
+      + 'sourcePromptId, sourceTabId, tag, dependsOn) may be patched; unrecognized keys round-trip unchanged. '
+      + 'Patching dependsOn to a non-empty array replaces it wholesale (validated against existing PRD slugs, '
+      + 'same resolver scheduler_create_prd uses); patching it to an explicit empty array CLEARS the dependency — '
+      + 'the safe way to fix a wrong dependsOn without archiving (which marks the PRD completed and wrongly frees its dependents).',
     whenToUse: 'Use to correct a PRD scope/estimate/tag before it starts running — e.g. before resetting a needs_review job whose spec needs to change.',
     whenNotToUse: 'Do not use once the job is running or terminal (completed/failed/needs_review) without first resetting it back to pending — the route refuses the edit.',
     exampleArgs: { slug: 'add-mcp-tool-catalog', frontmatter: { estimateMinutes: 45 } },