claude-code-session-manager 0.78.0 → 0.80.0

package/src/main/scheduler.cjs

@@ -58,6 +58,8 @@ const launchFailure = require('./lib/launchFailure.cjs');
 const { appendError } = require('./lib/opsErrorLog.cjs');
 const { readTail } = require('./lib/fileTail.cjs');
 const { claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs } = require('./lib/reaperHelpers.cjs');
+const { detectRateLimitInLog } = require('./lib/rateLimitDetect.cjs');
+const { stripAppOwnedChurn } = require('./lib/jobDirtFilter.cjs');
 const { computeQueueHealth } = require('./lib/queueHealth.cjs');
 const { createLoadGate, topCpuConsumers } = require('./lib/loadGate.cjs');
 const { openLog, withChildAndLog } = require('./lib/childWithLog.cjs');
@@ -71,6 +73,7 @@ const { maybeEnqueueValidationPrompt } = require('./lib/epicValidationHook.cjs')
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
 const { verifyRun } = require('./runVerify.cjs');
 const { latestTerminalOutcomeForSlug, COMPLETED_EQUIVALENT_VERDICTS } = require('./lib/terminalRunOutcome.cjs');
+const { isFixPlanSlug, classifyDiscoveredFixPlan, resolveIsFixPlan } = require('./lib/fixPlanSlug.cjs');
 const { landedSinceRun } = require('./lib/landedSinceRun.cjs');
 const { declaredPathsForPrd } = require('./lib/prdDeclaredPaths.cjs');
 const logs = require('./logs.cjs');
@@ -97,7 +100,7 @@ const JOB_OVERRUN_FACTOR = process.env.SM_JOB_OVERRUN_FACTOR
 const JOB_OVERRUN_FLOOR_MS = process.env.SM_JOB_OVERRUN_FLOOR_MINUTES
   ? Number(process.env.SM_JOB_OVERRUN_FLOOR_MINUTES) * 60_000
   : JOB_OVERRUN_FLOOR_MS_DEFAULT;
-const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD } = require('./lib/schedulerBatch.cjs');
+const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD, DEP_HISTORY_FAIL_OPEN } = require('./lib/schedulerBatch.cjs');
 const { runDefinitionOfDoneOnDrain } = require('./lib/dodDrainHook.cjs');
 const { writeRcaReport, extractRcaBlock } = require('./lib/rcaReport.cjs');
 const queueHistory = require('./lib/queueHistory.cjs');
@@ -138,6 +141,7 @@ const jobWorktree = require('./lib/jobWorktree.cjs');
 const { reconcileEpicWorktreesOnBoot } = require('./lib/epicWorktreeBoot.cjs');
 const queueStore = require('./lib/queueStore.cjs');
 const { splitFrontmatter, parsePrdFile, serializePrdFile } = require('./lib/prdFrontmatter.cjs');
+const { resolveDepSlug, findNearMatches } = require('./lib/depSlugResolve.cjs');
 const { migratePrds, consolidateFlatPrds, legacyAdoptExistingPrds } = require('./lib/prdMigration.cjs');
 const { allProjectCwds } = require('../../scripts/lib/activeSessions.cjs');
 
@@ -1252,6 +1256,89 @@ function computeStallSummary(state) {
   return { stalled, total, running, pending, byProject };
 }
 
+/**
+ * computeBlockedChains(jobs) → [{ cwd, blockedBy, blocked }]
+ *
+ * Pure, no IO. The gap computeStallSummary above cannot see.
+ *
+ * `stalled` is defined as `running === 0 && pending === 0`, which encodes an
+ * assumption that a PENDING row is healthy in-progress work. It is not: a
+ * pending row whose `dependsOn` chain terminates in a TERMINAL non-completed
+ * status (`failed`/`skipped`) can never be dispatched by pickForProject, and
+ * never will be, but it still counts toward `pending` and so reads as a
+ * healthy queue to every monitor in the app.
+ *
+ * On 2026-09-05 starry-night-ships held 42 such rows behind one `failed`
+ * job for three hours. Machine-wide `stalled` was false (42 pending),
+ * per-project `stalled` was false (42 pending), the queue-health sweep
+ * doesn't count `failed` at all, and the supervisor only probes `running` —
+ * so nothing anywhere reported a problem while nothing could ever run.
+ *
+ * Reported per project as { blockedBy: [terminal slugs], blocked: count }.
+ * Transitive by construction: a row blocked by a row that is itself blocked
+ * resolves through the same walk.
+ */
+function computeBlockedChains(jobs) {
+  const rows = (Array.isArray(jobs) ? jobs : []).filter(Boolean);
+  const byCwd = new Map();
+  for (const j of rows) {
+    const key = j.cwd || '(unknown)';
+    if (!byCwd.has(key)) byCwd.set(key, []);
+    byCwd.get(key).push(j);
+  }
+
+  const out = [];
+  for (const [cwd, projectJobs] of byCwd) {
+    // Reuse the picker's OWN dep resolution so this can never disagree with
+    // what the scheduler will actually dispatch (bare-name fallback included).
+    const rowBySlug = new Map(projectJobs.map((j) => [j.slug, j]));
+    const rowsByBareSlug = new Map();
+    for (const j of projectJobs) {
+      const bare = String(j.slug ?? '').replace(/^\d+-/, '');
+      if (!rowsByBareSlug.has(bare)) rowsByBareSlug.set(bare, []);
+      rowsByBareSlug.get(bare).push(j);
+    }
+    const rowsForDep = (slug) => {
+      const exact = rowBySlug.get(slug);
+      if (exact) return [exact];
+      return rowsByBareSlug.get(String(slug ?? '').replace(/^\d+-/, '')) ?? [];
+    };
+
+    // Memoised walk: does this row's dep closure hit a terminally-stuck row?
+    const TERMINAL_STUCK = new Set(['failed', 'skipped']);
+    const verdicts = new Map(); // slug -> Set of terminal blocker slugs
+    const visiting = new Set();
+    const blockersFor = (job) => {
+      if (!job) return new Set();
+      if (verdicts.has(job.slug)) return verdicts.get(job.slug);
+      if (visiting.has(job.slug)) return new Set(); // dependsOn cycle — not our problem here
+      visiting.add(job.slug);
+      const found = new Set();
+      for (const depSlug of job.dependsOn ?? []) {
+        for (const dep of rowsForDep(depSlug)) {
+          if (TERMINAL_STUCK.has(dep.status)) found.add(dep.slug);
+          else if (dep.status !== 'completed') for (const b of blockersFor(dep)) found.add(b);
+        }
+      }
+      visiting.delete(job.slug);
+      verdicts.set(job.slug, found);
+      return found;
+    };
+
+    const blockedBy = new Set();
+    let blocked = 0;
+    for (const j of projectJobs) {
+      if (j.status !== 'pending') continue;
+      const bs = blockersFor(j);
+      if (bs.size === 0) continue;
+      blocked += 1;
+      for (const b of bs) blockedBy.add(b);
+    }
+    if (blocked > 0) out.push({ cwd, blockedBy: [...blockedBy].sort(), blocked });
+  }
+  return out;
+}
+
 /**
  * findStaleQuarantinedJobs(jobs, now, thresholdMs) → [{ slug, cwd, ageMs }]
  *
@@ -1987,11 +2074,24 @@ async function reconcile(state) {
       exitCode: null,
       error: null,
     };
-    // Newly-discovered fix-plan PRD: stamp its investigationDepth relative to
-    // the original job it heals, so selectAutoFixTargets/spawnInvestigation
-    // can bound the fix-of-a-fix recursion (see MAX_INVESTIGATION_DEPTH).
-    // Non-fix-plan jobs get no explicit field — they read as depth 1 via `?? 1`.
-    if (isFixPlanSlug(slug)) {
+    // Fix-plan classification (PRD 1131): a freshly-discovered PRD is a
+    // genuine scheduler-authored fix plan only when its OWN provenance says
+    // so — an explicit isFixPlan:true stamp (spawnInvestigation's prompt
+    // template) or the absence of any createdVia stamp at all (legacy
+    // fallback, matching the "no provenance = trust the name" rule the
+    // quarantine gate below already applies) — never merely because the
+    // slug looks like one. See lib/fixPlanSlug.cjs's header for why (PRD
+    // 1126: a scheduler_create_prd-authored PRD whose slug happened to start
+    // with "fix-" was wrongly stamped investigationDepth before it ever ran).
+    // Persisted onto the queue row so every later consumer
+    // (commitGuardVerdict, isFixPlanBeyondDepthCap, the fix-plan-completion
+    // checks) reads this stamp instead of re-deriving it from the name.
+    entry.isFixPlan = classifyDiscoveredFixPlan(p, slug);
+    // Stamp investigationDepth relative to the original job it heals, so
+    // selectAutoFixTargets/spawnInvestigation can bound the fix-of-a-fix
+    // recursion (see MAX_INVESTIGATION_DEPTH). Non-fix-plan jobs get no
+    // explicit field — they read as depth 1 via `?? 1`.
+    if (entry.isFixPlan) {
       const parent = healTargetForFix(slug, state.jobs);
       entry.investigationDepth = parent ? (parent.investigationDepth ?? 1) + 1 : 2;
     }
@@ -2003,8 +2103,9 @@ async function reconcile(state) {
     // guard-prd-writes.cjs PreToolUse hook should have denied. Fix-plan PRDs
     // are exempt: spawnInvestigation's own probe writes them directly by
     // design (a trusted, scheduler-spawned internal loop, not an
-    // agent/human authoring a PRD), matching the isFixPlanSlug convention
-    // used everywhere else this distinction matters.
+    // agent/human authoring a PRD) — entry.isFixPlan (just classified above)
+    // is the provenance-aware verdict for that exemption now, not a raw
+    // isFixPlanSlug name check.
     //
     // Quarantine is loud and reversible, never a silent skip (see the
     // 2026-08-01 23-PRD outage this file's header references for what a
@@ -2013,7 +2114,7 @@ async function reconcile(state) {
     // (schedule:adopt-prd) that stamps the file via the same update-prd API
     // route the MCP tool uses — reconcile()'s adopt path above promotes it
     // to 'pending' on the very next pass, within one tick of being stamped.
-    if (!p.createdVia && !isFixPlanSlug(slug)) {
+    if (!p.createdVia && !entry.isFixPlan) {
       entry.status = 'quarantined';
       // Stamped at creation (not via transitionJob, since this is a
       // brand-new row minted directly at 'quarantined' rather than
@@ -2119,6 +2220,9 @@ let firstFailureAt = null;
 let firstNon429FailureAt = null; // tracks only transient/config failures; 429s don't count toward network-pause threshold
 let lastFailureKind = null; // 'transient' | 'meter_rate_limited' | 'auth' | null
 let pauseClearedManuallyAt = null;
+// PRD 1119: consecutive-rapid-rate-limit hard-pause tracking, keyed per slug.
+// See isCooldownSuppressed/nextRapidRateLimitCount below for the pure rules.
+const consecutiveRapidRateLimitsBySlug = new Map();
 
 // ---------- timer ----------
 
@@ -2337,13 +2441,71 @@ async function rescheduleTimer() {
 
 // ---------- pause / resume ----------
 
-async function setPaused(reason, resumeAtIso) {
+const MANUAL_PAUSE_COOLDOWN_MS = 300_000;
+// PRD 1119: after this many consecutive rate-limited dispatches of the SAME
+// slug that EACH also finished in under RAPID_RATE_LIMIT_WINDOW_MS, the rate
+// limit is not a stale/flaky auto-detection any more — it's real and
+// persistent for this job. Engage a hard pause the manual-clear cooldown
+// cannot suppress at all. This exists because the freshness check alone
+// (isCooldownSuppressed) is not sufficient: if the computed resumeAt is
+// itself wrong or stale (e.g. a failed usage-API fetch), the resume timer
+// can keep re-clearing the pause every ~30s, and every SUBSEQUENT dispatch
+// is genuinely "fresh" (it started after that re-clear) — so freshness alone
+// would let the spin continue indefinitely within the same 5-minute cooldown
+// window. The rapid-repeat count is an independent circuit breaker of last
+// resort for exactly that case.
+const CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD = 3;
+const RAPID_RATE_LIMIT_WINDOW_MS = 30_000;
+
+/**
+ * Pure: should setPaused()'s manual-override cooldown suppress WRITING this
+ * pause? `force` (the rapid-repeat hard pause) always answers no — that path
+ * exists precisely to bypass the cooldown. Otherwise, suppress only while
+ * inside the cooldown window AND the triggering observation is stale, i.e.
+ * it was NOT produced by a run that started after the human's manual clear.
+ * A run that started after the clear is fresh evidence the human's fix (if
+ * any) did not hold, and must be allowed to re-engage the pause regardless
+ * of the cooldown — the cooldown's job is to ignore STALE auto-detections,
+ * never to ignore new evidence.
+ */
+function isCooldownSuppressed({ pauseClearedManuallyAt: clearedAt, now, observedAt, force }) {
+  if (force) return false;
+  if (!clearedAt) return false;
+  if (now - clearedAt >= MANUAL_PAUSE_COOLDOWN_MS) return false;
+  const isFresh = typeof observedAt === 'number' && observedAt > clearedAt;
+  return !isFresh;
+}
+
+/**
+ * Pure: the next consecutive-rapid-rate-limit count for a slug, given its
+ * previous count and this run's outcome. Increments only on a rate-limited
+ * run that ALSO ran under RAPID_RATE_LIMIT_WINDOW_MS (a genuine "dispatch,
+ * 429, die" cycle — not a job that ran for a while before hitting the
+ * limit). Resets to 0 on any non-rate-limited outcome. A rate-limited-but-
+ * slow run leaves the count unchanged: still a rate limit, just not the
+ * rapid-spin shape this cap exists to catch.
+ */
+function nextRapidRateLimitCount(prevCount, { rateLimited, durationMs }) {
+  if (!rateLimited) return 0;
+  if (durationMs < RAPID_RATE_LIMIT_WINDOW_MS) return (prevCount || 0) + 1;
+  return prevCount || 0;
+}
+
+async function setPaused(reason, resumeAtIso, opts = {}) {
+  const { observedAt = null, force = false } = opts;
   // Honor manual-override cooldown: if the user cleared a pause within the
-  // last 5 minutes, suppress auto-pause re-engagement on the same condition.
-  if (pauseClearedManuallyAt && Date.now() - pauseClearedManuallyAt < 300_000) {
+  // last 5 minutes, suppress auto-pause re-engagement UNLESS this pause is
+  // backed by a fresh observation (a run that started after the clear) or is
+  // forced (the rapid-repeat hard pause, which the cooldown cannot suppress).
+  if (isCooldownSuppressed({ pauseClearedManuallyAt, now: Date.now(), observedAt, force })) {
     console.log(`[scheduler] setPaused(${reason}) suppressed by manual override cooldown`);
     return;
   }
+  if (force) {
+    console.log(`[scheduler] setPaused(${reason}) forced past manual override cooldown — rapid-repeat rate-limit cap engaged`);
+  } else if (pauseClearedManuallyAt && Date.now() - pauseClearedManuallyAt < MANUAL_PAUSE_COOLDOWN_MS) {
+    console.log(`[scheduler] setPaused(${reason}) engaging despite manual override cooldown — triggering run started after the manual clear`);
+  }
 
   // For 'network' with no explicit resumeAt, auto-resume after 30 minutes.
   let effectiveResumeAt = resumeAtIso;
@@ -2438,6 +2600,17 @@ function resetJobFields(job, errorMsg, opts = {}) {
   delete job.verifierVerdict;
   delete job.uncommittedPaths;
   delete job.resumeRecoveryAttempted;
+  // Same one-attempt-per-episode category as resumeRecoveryAttempted above —
+  // a re-fired row must be able to earn a fresh mechanical-recovery attempt
+  // if it parks needs_review again (PRD 1130).
+  delete job.mechanicalRecoveryAttempted;
+  // Quarantine (PRD 1128) is scoped to THIS run's episode exactly like
+  // resumeRecoveryAttempted above — a re-fired row must be able to earn a
+  // fresh quarantine attempt if it parks needs_review again.
+  delete job.leftoverQuarantineAttempted;
+  delete job.quarantinedTo;
+  delete job.quarantinedCommit;
+  delete job.quarantinedPaths;
   // Same "this run's outcome, not durable across a reset" category as the
   // fields above — a stale 'archive' recoveryAction from a prior life of this
   // slug must never survive a reset and silently exclude a genuinely-new
@@ -2446,6 +2619,10 @@ function resetJobFields(job, errorMsg, opts = {}) {
   // can otherwise linger forever when RCA is disabled or errors).
   delete job.rcaFailureClass;
   delete job.rcaRecoveryAction;
+  // Same "this run's outcome, not durable across a reset" category — a
+  // human-driven reset must genuinely start the auto-fix budget over,
+  // including the one-time dead-fix-plan-child reopen (PRD 1129).
+  delete job.autoFixReopened;
   // Like exitCode: this run's outcome, not durable across a reset — a stale
   // leak badge from a prior attempt must not linger once the job re-fires.
   delete job.leakedDescendants;
@@ -2862,21 +3039,6 @@ async function notifyNeedsReview(job, report, {
   }
 }
 
-/** Scan the tail of a job's log for the canonical rate-limit signal. We look
- *  at the last 16 KB — final result event always lands at the end.
- *  Uses readTail() so no raw fd lifecycle is needed here. */
-function detectRateLimitInLog(logPath) {
-  try {
-    const text = readTail(logPath, 16384);
-    if (!text) return false;
-    return /"rateLimitType":"five_hour"/.test(text)
-      || /"api_error_status":429/.test(text)
-      || /You'?ve hit your limit/.test(text);
-  } catch {
-    return false;
-  }
-}
-
 /** Scan the tail of a job's log for a network-outage signal: the structured
  *  `terminal_reason":"api_error"` field alongside a network-class error
  *  string. This is NOT a real code defect — spawning an auto-fix
@@ -3172,6 +3334,302 @@ As the LAST LINE of your final result text, emit exactly one of:
 Print PASS only once the commit above has actually landed.`;
 }
 
+/**
+ * Mechanical recovery (PRD 1130). isFixPlanBeyondDepthCap (below) is the
+ * ONLY gate on re-investigating a fix-plan job at investigationDepth >= 2 —
+ * correct for open-ended "author another plan" recursion, but it also
+ * strands a depth-capped job whose failure was fully mechanical (no
+ * judgement required) with no other ladder rung, since resume-first recovery
+ * (selectResumeRecoveryTarget above) is hard-gated on verdict
+ * 'uncommitted_changes'. This rung is evaluated INDEPENDENTLY of
+ * isFixPlanBeyondDepthCap — depth never disqualifies it, because unlike
+ * auto-fix it authors no plan and spawns no model; it is pure git.
+ *
+ * The closed set of mechanically-resolvable verdicts starts at exactly
+ * 'worktree_integration_failed': PRD 1125 already taught integrateBranch to
+ * parse git's "would be overwritten by merge" stderr, verify the blocking
+ * paths are byte-identical to the branch, discard the proven duplicates, and
+ * retry the merge once. A job parked with this verdict has its `sm-job/
+ * <slug>` branch preserved (integrateJobBranch never deletes the branch on
+ * failure — see cleanupJobWorktree's `keepBranch: !integration.ok`), so a
+ * plain re-call of integrateBranch against that same branch inherits PRD
+ * 1125's auto-resolution for free — no re-implementation needed here.
+ *
+ * Bounded to exactly one attempt via job.mechanicalRecoveryAttempted,
+ * stamped in the SAME mutate as the outcome (performMechanicalRecovery,
+ * below) — never here — so this selector alone can be unit-tested exactly
+ * like selectResumeRecoveryTarget/selectLeftoverQuarantineTarget.
+ *
+ * Kill-switch: SM_MECHANICAL_RECOVERY_DISABLE=1 restores today's behaviour
+ * exactly (always returns null), mirroring SM_RESUME_RECOVERY_DISABLE.
+ */
+const MECHANICALLY_RESOLVABLE_VERDICTS = new Set(['worktree_integration_failed']);
+
+function selectMechanicalRecoveryTarget(job) {
+  if (process.env.SM_MECHANICAL_RECOVERY_DISABLE === '1') return null;
+  if (!job || job.status !== 'needs_review') return null;
+  if (!MECHANICALLY_RESOLVABLE_VERDICTS.has(job.verifierVerdict)) return null;
+  if (job.mechanicalRecoveryAttempted === true) return null;
+  const cwd = job.cwd || DEFAULT_PROJECT_CWD;
+  return { slug: job.slug, cwd, branch: jobWorktree.branchNameFor(job.slug), carriedPaths: job.carriedPaths || [] };
+}
+
+/**
+ * Perform an already-selected mechanical recovery (selectMechanicalRecoveryTarget
+ * above) — a direct re-attempt of integrateBranch against the job's preserved
+ * branch, never a fresh `claude -p` dispatch. On success the job transitions
+ * needs_review -> completed and its verifierVerdict is cleared; the branch,
+ * now merged, is deleted like any other successfully-integrated job branch.
+ * On failure (including a branch that no longer exists — already deleted or
+ * already merged) the job stays needs_review, mechanicalRecoveryAttempted is
+ * stamped, and the retry's own failure text is appended to `error`. Either
+ * way mechanicalRecoveryAttempted is stamped in this SAME mutate, so a crash
+ * between the git call returning and this mutate landing simply repeats an
+ * idempotent git operation on the next pass rather than leaving the job
+ * re-eligible forever.
+ */
+async function performMechanicalRecovery(job, target) {
+  const integration = await jobWorktree.integrateJobBranch({
+    cwd: target.cwd, branch: target.branch, slug: target.slug, carriedPaths: target.carriedPaths,
+  });
+  if (integration.ok) {
+    await jobWorktree.cleanupJobWorktree({ cwd: target.cwd, dir: undefined, branch: target.branch, keepBranch: false });
+  }
+  let becameCompleted = false;
+  await mutate((s) => {
+    const j = s.jobs.find((x) => x.slug === job.slug);
+    if (!j) return;
+    j.mechanicalRecoveryAttempted = true;
+    if (integration.ok) {
+      if (transitionJob(j, 'completed', {
+        reason: `mechanical recovery: ${target.branch} re-integrated successfully`,
+        source: 'scheduler:mechanicalRecovery',
+      })) {
+        delete j.verifierVerdict;
+        j.exitCode = 0;
+        j.error = null;
+        becameCompleted = true;
+      }
+    } else {
+      const pointer = `Mechanical recovery retry failed: ${integration.reason}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+    }
+  });
+  if (integration.ok) {
+    console.log(`[scheduler] mechanical-recovery: ${job.slug} → completed (branch ${target.branch} re-integrated)`);
+    if (becameCompleted) await archiveCompletedPrd(job.slug, job.cwd);
+  } else {
+    console.error(`[scheduler] mechanical-recovery: ${job.slug} → retry failed: ${integration.reason}`);
+  }
+}
+
+/**
+ * Leftover quarantine (PRD 1128). Resume-first recovery gets exactly one
+ * `--resume` attempt (selectResumeRecoveryTarget above); when that attempt
+ * ALSO parks needs_review with 'uncommitted_changes', the leftovers are
+ * about to sit dirty in the SHARED tree forever — git then refuses any later
+ * worktree merge for this cwd that would overwrite them, turning one parked
+ * job into a project-wide stall (216-jupiter-sand-kazekage, 2026-09-06).
+ * Pure/no I/O, mirroring selectResumeRecoveryTarget so the eligibility rule
+ * is unit-testable directly.
+ *
+ * Bounded to exactly one attempt via job.leftoverQuarantineAttempted, stamped
+ * synchronously by the caller in the SAME mutate as this decision (never
+ * here) — see spawnJob's finalize and reverifyNeedsReview's periodic pass.
+ *
+ * Kill-switch: SM_LEFTOVER_QUARANTINE_DISABLE=1 restores today's behaviour
+ * exactly (always returns null), mirroring SM_RESUME_RECOVERY_DISABLE.
+ */
+function selectLeftoverQuarantineTarget(job) {
+  if (process.env.SM_LEFTOVER_QUARANTINE_DISABLE === '1') return null;
+  if (!job || job.status !== 'needs_review') return null;
+  if (job.verifierVerdict !== 'uncommitted_changes') return null;
+  if (job.resumeRecoveryAttempted !== true) return null;
+  if (job.leftoverQuarantineAttempted === true) return null;
+  const uncommittedPaths = Array.isArray(job.uncommittedPaths)
+    ? job.uncommittedPaths.filter((p) => typeof p === 'string' && p.length > 0)
+    : [];
+  if (!uncommittedPaths.length) return null;
+  // The single most important constraint: never touch a path that was
+  // ALREADY dirty at this run's own dispatch time (preRunDirtyPaths) — that
+  // is foreign WIP (a human's or a sibling's), not this job's own leftover.
+  const preRunDirty = new Set(Array.isArray(job.preRunDirtyPaths) ? job.preRunDirtyPaths : []);
+  const paths = uncommittedPaths.filter((p) => !preRunDirty.has(p));
+  if (!paths.length) return null;
+  return { slug: job.slug, cwd: job.cwd, paths };
+}
+
+function execGitAt(cwd, args, { env, timeout = 20_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(
+      'git',
+      ['-C', cwd, ...args],
+      { timeout, windowsHide: true, encoding: 'utf8', env: env ? { ...process.env, ...env } : process.env },
+      (err, stdout, stderr) => {
+        if (err) {
+          err.stderrText = stderr;
+          reject(err);
+          return;
+        }
+        resolve(stdout || '');
+      },
+    );
+  });
+}
+
+async function pathExistsInTree(cwd, treeish, p) {
+  try {
+    await execGitAt(cwd, ['cat-file', '-e', `${treeish}:${p}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Commit exactly `paths` (must already be dirty on disk) onto a dedicated
+ * `sm-salvage/<slug>` ref, built from `headBefore` (or current HEAD when
+ * unavailable) via a THROWAWAY `GIT_INDEX_FILE` — never touches the live
+ * index, never moves the checked-out branch — then restores those paths to
+ * match that baseline commit's tree, so the shared working tree returns to
+ * its pre-run state. This is deliberately NOT `git stash` (the destructive-
+ * git guard blocks stash on a shared tree, and a stash nobody restores
+ * strands the work invisibly — see standards.md).
+ *
+ * Never throws: any git failure, or a non-git cwd, aborts the WHOLE attempt
+ * with the tree untouched (no partial restore) — restore only ever runs
+ * after the salvage ref/commit has safely landed, so a failure there leaves
+ * the data recoverable from the ref even though the tree stayed dirty.
+ * A path no longer dirty on disk (already committed, or reverted since) is
+ * skipped, never force-restored.
+ */
+async function quarantineLeftovers({ cwd, slug, paths, headBefore }) {
+  if (!cwd || !slug || !Array.isArray(paths) || paths.length === 0) {
+    return { ok: false, reason: 'no cwd/slug/paths given' };
+  }
+  let baseline = headBefore || null;
+  try {
+    if (!baseline) {
+      baseline = (await execGitAt(cwd, ['rev-parse', 'HEAD'])).trim();
+    }
+    if (!baseline) return { ok: false, reason: 'could not resolve a baseline commit (non-git cwd?)' };
+
+    const dirtyNowRaw = await execGitAt(cwd, ['status', '--porcelain', '--', ...paths]);
+    const dirtyNow = new Set(parsePorcelain(dirtyNowRaw));
+    const toQuarantine = paths.filter((p) => dirtyNow.has(p));
+    const skippedPaths = paths.filter((p) => !dirtyNow.has(p));
+    if (!toQuarantine.length) {
+      return { ok: true, ref: null, commit: null, quarantinedPaths: [], skippedPaths };
+    }
+
+    const tmpIndex = path.join(os.tmpdir(), `sm-salvage-index-${slug}-${process.pid}-${Date.now()}`);
+    const env = { GIT_INDEX_FILE: tmpIndex };
+    let treeSha;
+    let commitSha;
+    try {
+      await execGitAt(cwd, ['read-tree', baseline], { env });
+      for (const p of toQuarantine) {
+        if (fs.existsSync(path.join(cwd, p))) {
+          await execGitAt(cwd, ['add', '--', p], { env });
+        } else {
+          await execGitAt(cwd, ['rm', '--cached', '--ignore-unmatch', '--', p], { env });
+        }
+      }
+      treeSha = (await execGitAt(cwd, ['write-tree'], { env })).trim();
+      commitSha = (await execGitAt(cwd, ['commit-tree', treeSha, '-p', baseline, '-m', `salvage: leftover changes from ${slug}`], { env })).trim();
+    } catch (e) {
+      return { ok: false, reason: `git command failed while building the salvage commit: ${(e && (e.stderrText || e.message)) || e}` };
+    } finally {
+      await fsp.rm(tmpIndex, { force: true }).catch(() => {});
+    }
+
+    const ref = `sm-salvage/${slug}`;
+    try {
+      await execGitAt(cwd, ['update-ref', `refs/heads/${ref}`, commitSha]);
+    } catch (e) {
+      return { ok: false, reason: `git command failed updating ${ref}: ${(e && (e.stderrText || e.message)) || e}` };
+    }
+
+    // The salvage commit is safely landed at this point — a failure from here
+    // on is reported with the ref/commit still attached so nothing looks lost
+    // even if the tree itself couldn't be fully restored.
+    try {
+      const inBaseline = [];
+      const notInBaseline = [];
+      for (const p of toQuarantine) {
+        // eslint-disable-next-line no-await-in-loop
+        if (await pathExistsInTree(cwd, baseline, p)) inBaseline.push(p); else notInBaseline.push(p);
+      }
+      if (inBaseline.length) {
+        await execGitAt(cwd, ['checkout', baseline, '--', ...inBaseline]);
+      }
+      if (notInBaseline.length) {
+        await execGitAt(cwd, ['reset', '--', ...notInBaseline]).catch(() => {});
+        for (const p of notInBaseline) {
+          // eslint-disable-next-line no-await-in-loop
+          await fsp.rm(path.join(cwd, p), { force: true });
+        }
+      }
+    } catch (e) {
+      return {
+        ok: false,
+        ref,
+        commit: commitSha,
+        reason: `salvage commit landed at ${ref} (${commitSha}) but restoring the working tree failed: ${(e && (e.stderrText || e.message)) || e}`,
+      };
+    }
+
+    return { ok: true, ref, commit: commitSha, quarantinedPaths: toQuarantine, skippedPaths };
+  } catch (e) {
+    return { ok: false, reason: `git command failed: ${(e && (e.stderrText || e.message)) || e}` };
+  }
+}
+
+/**
+ * Perform an already-selected quarantine (job.leftoverQuarantineAttempted
+ * must already be true, stamped by the caller) and persist the outcome onto
+ * the job row: `quarantinedTo`/`quarantinedCommit`/`quarantinedPaths` on
+ * success, plus a one-line pointer appended to `error` naming the ref so a
+ * human can recover with a single named command
+ * (`git show sm-salvage/<slug>`). The belt-and-braces `salvagePatch` (when
+ * present) is referenced alongside it, never removed. On failure, only a
+ * diagnostic is appended — the job row's dirt-describing fields are left as
+ * they were, since the tree itself was left untouched (or, for a
+ * restore-only failure, the salvage ref is still named in the note).
+ *
+ * `headBefore`, when the caller has it fresh (spawnJob's own finalize still
+ * has the local `guardHeadBefore` in scope for the run that just parked —
+ * the same value is deleted off the job ROW earlier in that same finalize),
+ * is used as the salvage ref's baseline commit; otherwise (the periodic
+ * reverifyNeedsReview pass, re-discovering an already-parked row) this falls
+ * back to the current HEAD inside quarantineLeftovers itself.
+ */
+async function performLeftoverQuarantine(job, paths, headBefore = null) {
+  const result = await quarantineLeftovers({
+    cwd: job.cwd || DEFAULT_PROJECT_CWD,
+    slug: job.slug,
+    paths,
+    headBefore: headBefore || job.guardHeadBefore || null,
+  });
+  await mutate((s) => {
+    const j = s.jobs.find((x) => x.slug === job.slug);
+    if (!j) return;
+    if (result.ok && Array.isArray(result.quarantinedPaths) && result.quarantinedPaths.length) {
+      j.quarantinedTo = result.ref;
+      j.quarantinedCommit = result.commit;
+      j.quarantinedPaths = capDirtyPaths(result.quarantinedPaths);
+      const salvageNote = j.salvagePatch ? `; salvage patch also at ${j.salvagePatch}` : '';
+      const pointer = `Leftovers quarantined to ${result.ref} (commit ${result.commit}) — recover via \`git show ${result.ref}\`${salvageNote}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+      console.log(`[scheduler] ${job.slug}: quarantined ${result.quarantinedPaths.length} leftover path(s) to ${result.ref} (${result.commit})`);
+    } else if (!result.ok) {
+      const pointer = `Leftover quarantine failed: ${result.reason}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+      console.error(`[scheduler] ${job.slug}: leftover quarantine failed: ${result.reason}`);
+    }
+  });
+}
+
 /**
  * Pure argv builder for a `claude -p` child spawn, shared so the
  * resume-vs-fresh-session choice is made in exactly one place. `resume`
@@ -3197,10 +3655,17 @@ function buildClaudeSpawnArgs({ prompt, model, sessionId, resume, systemPrompt }
 
 // ---------- execution ----------
 
+// Allocates the runId/dir pair at dispatch time WITHOUT creating the
+// directory — a dispatch that aborts inside spawnJob before executeJob's
+// openLog() call (slot-acquire miss, worktree-cap deferral, launch-gate
+// block, ...) must leave no trace on disk. The directory is materialised
+// lazily, the first time something actually needs to write into it (see
+// openLog's mkdirSync in executeJob below). Because tickQueue hands ONE
+// shared batch dir to every spawnJob in the batch, several jobs may race to
+// create it — `recursive: true` makes that race safe.
 function pickRunDir() {
   const ts = new Date().toISOString().replace(/[:.]/g, '-');
   const dir = path.join(RUNS_DIR, ts);
-  fs.mkdirSync(dir, { recursive: true });
   return { runId: ts, dir };
 }
 
@@ -3228,6 +3693,12 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
   // fresh one via `--session-id` is the entire point of the recovery.
   const sessionId = resumeTarget ? resumeTarget.sessionId : randomUUID();
 
+  // Materialise the (possibly shared-batch) run dir lazily, right before the
+  // first write into it — see pickRunDir's comment for why this is deferred
+  // this far. recursive:true makes it safe if a sibling job in the same
+  // batch dir already created it.
+  fs.mkdirSync(runDir, { recursive: true });
+
   // Phase 1: open log fd so we can emit pre-spawn diagnostics (early-exit
   // error paths) before the child is created. withChildAndLog takes ownership
   // of fd/safeLog/closeFd from the point it is called.
@@ -3638,13 +4109,9 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
 // project (keyed by cwd) so jobs in different repos run concurrently up to
 // the cap; within one project, sequential-group semantics are preserved.
 
-/**
- * Recognize fix-plan slugs (NN-fix-...) so we don't recurse on a fix-plan that
- * itself failed. The pattern matches the slug we generate in spawnInvestigation.
- */
-function isFixPlanSlug(slug) {
-  return /^\d+-fix-/.test(slug);
-}
+// isFixPlanSlug/classifyDiscoveredFixPlan/resolveIsFixPlan now live in
+// lib/fixPlanSlug.cjs (PRD 1131) — see that module's header for why slug
+// shape alone is no longer sufficient to classify a fix plan.
 
 /**
  * The fix-plan slug spawnInvestigation authors for a given failed job —
@@ -3683,7 +4150,25 @@ function healTargetForFix(fixSlug, jobs) {
  * unit-tested (no spawn, no fs). Inputs are the already-resolved values that
  * spawnInvestigation computes.
  */
-function buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group }) {
+function buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group, deadChild = null }) {
+  const deadFixChildNote = deadChild ? `
+
+# This is a REOPENED investigation — your own prior fix plan died
+You already investigated this job once and produced a fix-plan PRD, \`${deadChild.slug}\`, which was
+supposed to heal it. That fix-plan job itself reached a terminal, non-completed status
+(\`${deadChild.status}\`) without ever fixing the original failure — so the parent job you are now
+investigating is stuck again with nothing left to retry it automatically. This is the ONE reopen
+this parent gets; do not cold-read the log and re-derive the plan that already failed.
+
+Dead fix-plan child's own outcome:
+- Slug: ${deadChild.slug}
+- Status: ${deadChild.status}
+- Verifier verdict: ${deadChild.verifierVerdict ?? '(none recorded)'}
+- Error: ${deadChild.error ?? '(none recorded)'}
+
+Read why THAT job died (its own run log, if any, under the runs directory) before writing a new
+fix-plan PRD, and make sure your new plan is genuinely different from — not a repeat of — whatever
+that dead child attempted.` : '';
   const abandonedBackgroundTaskNote = failedJob.verifierVerdict === 'abandoned_background_task' ? `
 
 # Known failure class: abandoned background task
@@ -3704,7 +4189,7 @@ The fix-plan PRD you write for this MUST instruct its executor to, in order:
 1. Check for a salvage patch (named \`<slug>.uncommitted.patch\` in the run directory${failedJob.salvagePatch ? `, e.g. \`${failedJob.salvagePatch}\`` : ''}) and, if found, apply it to the working tree BEFORE inspecting \`git status\`/\`git diff\` in ${cwd} for uncommitted changes matching the original PRD's acceptance criteria.
 2. If the work is present (via the applied patch or already in the tree) and satisfies the acceptance criteria, run the project's verify commands and COMMIT it — do not re-implement or re-plan the PRD from scratch.
 3. Only fall back to re-implementing whatever acceptance criteria are genuinely missing after applying any salvage patch, not the whole PRD.` : '';
-  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.${abandonedBackgroundTaskNote}
+  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.${deadFixChildNote}${abandonedBackgroundTaskNote}
 
 # Failed job
 - Slug: ${failedJob.slug}
@@ -3749,8 +4234,13 @@ ${logTail}
    cwd: ${cwd}
    parallelGroup: ${group}
    estimateMinutes: <your time estimate>
+   isFixPlan: true
    ---
    \`\`\`
+   \`isFixPlan: true\` is REQUIRED — it is the scheduler's provenance signal that this PRD is a
+   genuine auto-authored fix plan (not a human/agent PRD whose slug merely happens to start with
+   "fix-"); omitting it means this fix plan will not get its depth-cap/zero-edit-commit-guard
+   exemptions.
    \`cwd\` must be the git repo root where the fix will actually land. If the failed job's cwd is
    not that repo (e.g. a scratch dir like \`/tmp\`), set \`cwd:\` to the correct repo root instead —
    the scheduler's commit guard and post-run verifier read git state from this path, and a
@@ -3824,7 +4314,7 @@ function readRunOutcomeSidecars(runDir, slug) {
  */
 const INVESTIGATION_LAUNCH_KEY = 'investigation';
 
-async function spawnInvestigation(failedJob, runDir) {
+async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {}) {
   // The probe launches with the same CLI as the job it diagnoses. While
   // that CLI cannot launch at all (launch circuit breaker, issue #11 list
   // B1: probes e4f82da2/d374e6bf died on the same HTTP 400 as the runs
@@ -3853,7 +4343,14 @@ async function spawnInvestigation(failedJob, runDir) {
     console.log(`[scheduler] skip investigation: ${failedJob.slug} is resume-recovery eligible`);
     return { deferred: false };
   }
-  if (isFixPlanBeyondDepthCap(failedJob.slug, failedJob.investigationDepth)) {
+  // Mechanical recovery (PRD 1130): same first-refusal treatment — a job
+  // eligible for a pure-git retry must never also get a cold-read fix-plan
+  // PRD authored in the same pass.
+  if (selectMechanicalRecoveryTarget(failedJob)) {
+    console.log(`[scheduler] skip investigation: ${failedJob.slug} is mechanical-recovery eligible`);
+    return { deferred: false };
+  }
+  if (isFixPlanBeyondDepthCap(failedJob.slug, failedJob.investigationDepth, failedJob.isFixPlan)) {
     console.log(`[scheduler] skip investigation: ${failedJob.slug} is a fix plan at/beyond depth cap (depth=${failedJob.investigationDepth ?? 'none'})`);
     return { deferred: false };
   }
@@ -3910,7 +4407,13 @@ async function spawnInvestigation(failedJob, runDir) {
 
   const logTail = readTail(failedLogPath, 16 * 1024) || '(failed to read log)';
 
-  if (fs.existsSync(fixPath)) {
+  // A dead-fix-plan reopen (PRD 1129) targets the SAME fixPath its dead
+  // child was originally authored at, by construction (fixSlugFor is a pure
+  // function of the parent) — the file existing is not staleness here, it's
+  // the whole reason a reopen was offered. Skip the guard in that one case
+  // so the second investigation can overwrite the dead plan; every other
+  // caller keeps the original protection against clobbering a live sibling.
+  if (fs.existsSync(fixPath) && !deadChild) {
     console.log(`[scheduler] skip investigation: fix plan already exists at ${fixPath}`);
     releaseSlot();
     return { deferred: false };
@@ -3936,7 +4439,7 @@ async function spawnInvestigation(failedJob, runDir) {
     console.warn(`[scheduler] investigation cwd is not a git repo (${cwd}); falling back to ${DEFAULT_PROJECT_CWD}`);
     cwd = DEFAULT_PROJECT_CWD;
   }
-  const prompt = buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group });
+  const prompt = buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group, deadChild });
 
   // Phase 1: open log fd for pre-spawn diagnostics.
   const { fd, safeLog, closeFd } = openLog(investigationLogPath);
@@ -4065,6 +4568,22 @@ async function spawnInvestigation(failedJob, runDir) {
         mutate((s) => {
           const j = s.jobs.find((x) => x.slug === failedJob.slug);
           if (j) j.autoFixOutcome = 'plan';
+          // Dead-fix-plan reopen (PRD 1129): fixSlugFor is a pure function of
+          // the parent, so the freshly-authored plan landed at the SAME slug
+          // as the dead child — reconcile() sees an already-known slug and
+          // will never re-mint a pending row for it. Explicitly reset the
+          // dead child's own row here so the overwritten plan actually gets
+          // a chance to run, rather than sitting inert behind a permanently
+          // terminal queue row. force:true because 'skipped' (a valid dead
+          // status here) is otherwise reset-refused by design.
+          if (deadChild) {
+            const child = s.jobs.find((x) => x.slug === deadChild.slug);
+            if (child) {
+              resetJobFields(child, 'reset by dead-fix-plan reopen: parent investigation authored a new plan', {
+                force: true, source: 'spawnInvestigation:dead-fix-plan-reopen',
+              });
+            }
+          }
         }).catch(() => {});
       } else {
         console.log(`[scheduler] investigation finished WITHOUT producing fix plan (slug=${failedJob.slug}, code=${exitCode})`);
@@ -4147,6 +4666,58 @@ async function computeLaunchHolds(state, { now = Date.now(), claudeVersion } = {
   return held;
 }
 
+/**
+ * computeDepHistorySatisfaction(state) → Map<cwd, Set<string>|symbol>
+ *
+ * PRD 1122's once-per-tick dependsOn history/archive lookup: for every
+ * distinct project cwd with jobs this tick, builds the set of dep slugs that
+ * have no live queue row but are nonetheless known-satisfied — a completed
+ * record in that project's own `state/history.jsonl` shard
+ * (queueHistory.completedSlugsForCwd, scoped per-project so a same-named PRD
+ * in an unrelated project can never satisfy a dep here), or a `.md` file
+ * under any of that project's `prds-archived/` dirs (listArchivedPrdDirs —
+ * covers both the retired flat layout and every Epic's own sibling archive).
+ * findBlockingDep (schedulerBatch.cjs) treats a dep slug as blocking
+ * whenever it has no live row AND is absent from this set, so a typo or a
+ * double-prefixed slug (the exact 2026-09-06 starry-night-ships incident)
+ * HOLDS its dependent instead of silently dispatching it.
+ *
+ * Fails OPEN per project, never queue-wide: a history-shard or archive-scan
+ * read error for one cwd degrades that cwd's value to
+ * `DEP_HISTORY_FAIL_OPEN` (findBlockingDep then treats every rowless dep in
+ * that project as satisfied, exactly today's pre-1122 behaviour) with a
+ * logged warning — it never throws out of this function and never blocks
+ * every OTHER project's dispatch for one project's bad fs state.
+ *
+ * Computed ONCE here, before pickNextBatch runs, and threaded down as pure
+ * data (quietOpts.satisfiedSlugsByCwd) — schedulerBatch.cjs itself does no
+ * I/O, so this is the only fs read this gate costs per tick, not one per job
+ * per dep.
+ */
+async function computeDepHistorySatisfaction(state) {
+  const byCwd = new Map();
+  const cwds = new Set((state?.jobs || []).map((j) => j.cwd || DEFAULT_PROJECT_CWD));
+  for (const cwd of cwds) {
+    const satisfied = new Set();
+    try {
+      for (const slug of await queueHistory.completedSlugsForCwd(cwd)) satisfied.add(slug);
+      for (const dir of listArchivedPrdDirs(cwd)) {
+        let entries;
+        try { entries = await fsp.readdir(dir); } catch { continue; }
+        for (const name of entries) {
+          if (name.endsWith('.md')) satisfied.add(name.slice(0, -3));
+        }
+      }
+    } catch (e) {
+      console.warn(`[scheduler] depHistorySatisfaction: history/archive lookup failed for ${cwd} (${e?.message}) — falling back to fail-open dep resolution for this project this tick`);
+      byCwd.set(cwd, DEP_HISTORY_FAIL_OPEN);
+      continue;
+    }
+    byCwd.set(cwd, satisfied);
+  }
+  return byCwd;
+}
+
 /**
  * A run that never got a turn (res.launchFailure — see executeJob's onExit)
  * is routed here instead of the failed/investigation path (issue #11 lists
@@ -4317,6 +4888,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       console.log(`[scheduler] ${job.slug}: dispatching as launch probe for '${launchKey}'${launchEnv ? ` with mitigation ${JSON.stringify(launchEnv)}` : ''}`);
     }
 
+    // Captured here (not read back off `job`, a pre-dispatch snapshot that
+    // mutate()'s fresh-from-disk read never touches) so the rate-limited
+    // branch below has this run's OWN start time — the freshness check
+    // (isCooldownSuppressed) needs to know whether this specific dispatch
+    // started after the manual clear, not whatever startedAt this row
+    // carried from a prior run.
+    let dispatchStartedAtMs = null;
     await mutate((s) => {
       const idx = s.jobs.findIndex((x) => x.slug === job.slug);
       if (idx >= 0) {
@@ -4327,6 +4905,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
         delete s.jobs[idx].heldReason;
         s.jobs[idx].runId = runId;
         s.jobs[idx].startedAt = new Date().toISOString();
+        dispatchStartedAtMs = Date.parse(s.jobs[idx].startedAt);
         if (job.quietMachine === true) {
           s.jobs[idx].quietMachine = true;
           s.jobs[idx].quietLeaseDegraded = job.quietLeaseDegraded === true;
@@ -4434,6 +5013,11 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     let res;
     let worktreeLeftoverDirty = [];
     let worktreeIntegrationFailure = null;
+    // Set only when integrateJobBranch's stderr-parsing auto-resolve fired
+    // (PRD 1125) — surfaced on the job row so the Queue UI can say the merge
+    // self-healed rather than silently looking like an ordinary merge.
+    let mergeAutoResolved = null;
+    let mergeAutoResolvedPaths = null;
     // A job's uncommitted-work patch, whichever isolation mode produced it —
     // set by EITHER branch below, never both (worktree.ok picks exactly one
     // shape for the whole run). Named generically (not "worktree...") because
@@ -4481,6 +5065,11 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           console.error(`[scheduler] ${job.slug}: worktree branch integration FAILED (${integration.reason}) — branch ${worktree.branch} preserved in ${guardCwd} for manual recovery`);
         } else if (integration.integrated) {
           console.log(`[scheduler] ${job.slug}: worktree branch ${worktree.branch} integrated into ${guardCwd}${integration.mergeCommit ? ' (merge commit)' : ' (fast-forward)'}`);
+          if (integration.autoResolved) {
+            mergeAutoResolved = integration.autoResolved;
+            mergeAutoResolvedPaths = integration.resolvedPaths || [];
+            console.log(`[scheduler] ${job.slug}: merge auto-resolved (${integration.autoResolved}) — discarded ${mergeAutoResolvedPaths.length} identical working-tree duplicate(s): ${mergeAutoResolvedPaths.join(', ')}`);
+          }
         }
         await jobWorktree.cleanupJobWorktree({
           cwd: guardCwd,
@@ -4531,12 +5120,18 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     // (non-git cwd / git errored) — NEVER treated as "left nothing", exactly
     // like every other best-effort git-state check in this function.
     const afterGuardCwd = await uncommittedChanges(guardCwd);
+    // stripAppOwnedChurn: the app writes session-manager-operations/ (queue.json,
+    // history.jsonl, active-index.json, transcripts) DURING this job's own guard
+    // window, so those land in the delta and get blamed on the job. A job can
+    // never be responsible for them — see jobDirtFilter.cjs. Applied here, at
+    // the single place the delta is computed, so the commit guard, the
+    // transient-retry dirty check and leftoverPaths all agree.
     const newlyDirtyAll = afterGuardCwd === null
       ? null
-      : [...new Set([
+      : stripAppOwnedChurn([...new Set([
           ...afterGuardCwd.filter((p) => !new Set(guardBaseline || []).has(p)),
           ...worktreeLeftoverDirty,
-        ])];
+        ])]);
 
     if (res.launchFailure) {
       await handleLaunchFailure({ job, res, runId, runDir, launchKey, launchEnv, claudeVersion: claudeVersionNow });
@@ -4570,7 +5165,17 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
 
     if (res.rateLimited) {
       const resetIso = await refreshNextReset().catch(() => cachedNextReset);
-      await setPaused('rate_limit', resetIso);
+      const observedAt = dispatchStartedAtMs;
+      const prevCount = consecutiveRapidRateLimitsBySlug.get(job.slug) || 0;
+      const nextCount = nextRapidRateLimitCount(prevCount, { rateLimited: true, durationMs: res.durationMs });
+      consecutiveRapidRateLimitsBySlug.set(job.slug, nextCount);
+      const forceHardPause = nextCount >= CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD;
+      if (forceHardPause) {
+        console.log(`[scheduler] ${job.slug}: ${nextCount} consecutive rate-limited dispatches under ${RAPID_RATE_LIMIT_WINDOW_MS / 1000}s each — engaging hard pause`);
+      }
+      await setPaused('rate_limit', resetIso, { observedAt, force: forceHardPause });
+    } else {
+      consecutiveRapidRateLimitsBySlug.delete(job.slug);
     }
 
     // Stale queue entry: the PRD was archived (already shipped) or is gone
@@ -4700,7 +5305,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           ranInWorktree: worktree.ok,
           jobSelfCommitted,
           legitimateNoOp: guardIsLegitimateNoOp,
-          isFixPlanJob: isFixPlanSlug(job.slug),
+          isFixPlanJob: resolveIsFixPlan(job.slug, job.isFixPlan),
           verifyResult,
           salvagePatch,
         });
@@ -4777,9 +5382,14 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     let failedJobSnapshot = null;
     let needsInvestigationNow = false;
     let investigationJobSnapshot = null;
+    let investigationDeadChildSnapshot = null;
     let needsReviewRcaSnapshot = null;
     let resumeRecoveryJob = null;
     let resumeRecoveryTarget = null;
+    let quarantineJob = null;
+    let quarantinePaths = null;
+    let mechanicalRecoveryJob = null;
+    let mechanicalRecoveryTarget = null;
     let terminalNotifySnapshot = null;
     const newlyCompletedPrds = [];
     await mutate((s) => {
@@ -4874,6 +5484,17 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           } else {
             delete s.jobs[i2].uncommittedPaths;
           }
+          // Worktree merge self-healed (PRD 1125) — every blocking path was
+          // proven byte-identical to the branch, so the duplicate was
+          // discarded and the merge retried once, successfully. Surfaced so
+          // the Queue UI shows a self-heal instead of an ordinary merge.
+          if (mergeAutoResolved) {
+            s.jobs[i2].mergeAutoResolved = mergeAutoResolved;
+            s.jobs[i2].mergeAutoResolvedPaths = capDirtyPaths(mergeAutoResolvedPaths);
+          } else {
+            delete s.jobs[i2].mergeAutoResolved;
+            delete s.jobs[i2].mergeAutoResolvedPaths;
+          }
           // Non-blocking notes (e.g. a recovered missing-dependency probe, or a
           // pattern hit demoted because a materially-checkable verdict outranked
           // it) — surfaced even on completed jobs so the signal isn't lost.
@@ -4924,6 +5545,18 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             // takes the treatAsPending branch above and never reaches here).
             needsReviewRcaSnapshot = { ...s.jobs[i2] };
 
+            // Mechanical recovery (PRD 1130): evaluated FIRST, ahead of both
+            // resume-first recovery and auto-fix — a job parked with a
+            // mechanically-resolvable verdict (see
+            // selectMechanicalRecoveryTarget) needs no model, no plan, and no
+            // depth-cap check, so it must never fall through to either.
+            // Snapshot only (no I/O inside mutate()); the actual git retry
+            // happens outside mutate(), below.
+            const mTarget = selectMechanicalRecoveryTarget(s.jobs[i2]);
+            if (mTarget) {
+              mechanicalRecoveryJob = { ...s.jobs[i2] };
+              mechanicalRecoveryTarget = mTarget;
+            } else {
             // Resume-first recovery (PRD 1111): evaluated BEFORE the auto-fix
             // eligibility check below — a job whose verdict is
             // 'uncommitted_changes' with a live sessionId gets one bounded
@@ -4937,6 +5570,22 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               resumeRecoveryJob = { ...s.jobs[i2] };
               resumeRecoveryTarget = target;
             } else {
+            // Leftover quarantine (PRD 1128): resume recovery is spent
+            // (resumeRecoveryAttempted already true) and this run STILL parked
+            // needs_review with uncommitted_changes — the leftovers are about
+            // to sit dirty in the shared tree forever, poisoning every later
+            // worktree merge for this cwd. Stamp the one-attempt marker HERE,
+            // synchronously in the same mutate as this decision (mirrors
+            // resumeRecoveryAttempted's own stamp-before-acting rule above),
+            // so a concurrent reverifyNeedsReview pass can never double-fire
+            // this. The actual git work is async and runs outside mutate(),
+            // below (performLeftoverQuarantine).
+            const quarantineTarget = selectLeftoverQuarantineTarget(s.jobs[i2]);
+            if (quarantineTarget) {
+              s.jobs[i2].leftoverQuarantineAttempted = true;
+              quarantineJob = { ...s.jobs[i2] };
+              quarantinePaths = quarantineTarget.paths;
+            }
             // Same-tick auto-fix (feedback 2026-07-12): rather than waiting up to
             // 10 min for reverifyNeedsReview()'s periodic pass, check right here
             // whether this job qualifies for auto-fix (same eligibility rule
@@ -4951,8 +5600,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               isEligibleForImmediateAutoFix(s.jobs[i2], s.jobs, fixSlugExists)
             ) {
               const isRetryAttempt = s.jobs[i2].autoFixAttempted === true;
+              const isDeadFixPlanReopen = isFixPlanDead(s.jobs[i2], s.jobs);
+              if (isDeadFixPlanReopen) {
+                investigationDeadChildSnapshot = s.jobs.find((x) => x.slug === fixSlugFor(s.jobs[i2])) || null;
+              }
               s.jobs[i2].autoFixAttempted = true;
               if (!s.jobs[i2].runId) s.jobs[i2].runId = runId;
+              if (isDeadFixPlanReopen) s.jobs[i2].autoFixReopened = true;
               if (isRetryAttempt) {
                 s.jobs[i2].autoFixRetries = (s.jobs[i2].autoFixRetries ?? 0) + 1;
                 delete s.jobs[i2].autoFixOutcome;
@@ -4961,13 +5615,14 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               investigationJobSnapshot = { ...s.jobs[i2] };
             }
             }
+            }
           }
           // Auto-promote: when a fix-* PRD completes successfully, the original
           // failed PRD's work is logically done. Flip its status to 'completed'
           // so the cross-group failure gate in pickNextBatch releases. Without
           // this, the queue stalls indefinitely behind a stale failure even
           // though the auto-recovery did its job.
-          if (effectiveStatus === 'completed' && isFixPlanSlug(job.slug)) {
+          if (effectiveStatus === 'completed' && resolveIsFixPlan(job.slug, job.isFixPlan)) {
             const orig = healTargetForFix(job.slug, s.jobs);
             if (orig) {
               const priorStatus = orig.status;
@@ -5039,6 +5694,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
         });
     }
 
+    if (mechanicalRecoveryJob && mechanicalRecoveryTarget) {
+      console.log(`[scheduler] needs_review ${job.slug} → mechanical-recovery (re-integrating ${mechanicalRecoveryTarget.branch})`);
+      performMechanicalRecovery(mechanicalRecoveryJob, mechanicalRecoveryTarget).catch((e) => {
+        console.error('[scheduler] performMechanicalRecovery error', job.slug, e);
+      });
+    }
+
     if (resumeRecoveryJob && resumeRecoveryTarget) {
       console.log(`[scheduler] needs_review ${job.slug} → resume-recovery (session ${resumeRecoveryTarget.sessionId}, ${resumeRecoveryTarget.dirtyPaths.length} dirty path(s))`);
       spawnResumeRecovery(resumeRecoveryJob, resumeRecoveryTarget).catch((e) => {
@@ -5046,6 +5708,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       });
     }
 
+    if (quarantineJob && quarantinePaths) {
+      console.log(`[scheduler] needs_review ${job.slug} → quarantining ${quarantinePaths.length} leftover path(s) (resume recovery already spent)`);
+      performLeftoverQuarantine(quarantineJob, quarantinePaths, guardHeadBefore).catch((e) => {
+        console.error('[scheduler] performLeftoverQuarantine error', job.slug, e);
+      });
+    }
+
     if (actuallyFailed && failedJobSnapshot) {
       // Transient-failure detector. A 143/137 exit is ALWAYS a signal kill — the
       // agent never self-exits with those — so the only question is WHO killed it.
@@ -5118,7 +5787,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       }
     } else if (needsInvestigationNow && investigationJobSnapshot) {
       console.log(`[scheduler] needs_review ${job.slug} → immediate auto-fix investigation (not waiting for periodic reverify)`);
-      spawnInvestigation(investigationJobSnapshot, runDir).catch((e) => {
+      spawnInvestigation(investigationJobSnapshot, runDir, { deadChild: investigationDeadChildSnapshot }).catch((e) => {
         console.error('[scheduler] spawnInvestigation error', job.slug, e);
       });
     }
@@ -5188,11 +5857,13 @@ function tickQueue({ bypassLoadGate = false } = {}) {
     // ceilinged the queue at 3 while the pool the user configured said 5.
     const freeSlots = sessionSlots.available();
     const heldSlugs = await computeLaunchHolds(state);
+    const satisfiedSlugsByCwd = await computeDepHistorySatisfaction(state);
     const { batch, reason: holdReason, holds } = pickNextBatch(state.jobs, runningSet, freeSlots, {
       leaseHeld: quietMachineLease.isHeld(),
       machineInUse: sessionSlots.inUse(),
       now: Date.now(),
       heldSlugs,
+      satisfiedSlugsByCwd,
     });
     if (batch.length === 0 && freeSlots === 0) {
       const snap = sessionSlots.snapshot();
@@ -5366,6 +6037,109 @@ async function maybeLaunchWhenAvailable(state) {
   tickQueue().catch((e) => console.error('[scheduler] tickQueue error', e));
 }
 
+/** How long a queue may hold ready work with nothing running before the
+ *  starvation watchdog forces a tick. Deliberately longer than the poll
+ *  loop's own cadence + backoff, so this only ever fires when the normal
+ *  path has genuinely stopped driving the queue — it is a safety net, not a
+ *  second scheduler. */
+const QUEUE_STARVATION_MS = 10 * 60_000;
+
+/**
+ * classifyQueueStarvation({ jobs, paused, runningCount, lastRunAtMs, now, thresholdMs })
+ *   → null | { kind: 'starved' | 'blocked', pending, dispatchable, blockedChains, idleMs }
+ *
+ * Pure, no IO. Answers the one question the user's invariant reduces to:
+ * "there are PRDs in a queue — is anything actually going to run them?"
+ *
+ * Every stall this codebase has seen was a DIFFERENT cause with the SAME
+ * shape: ready rows, nothing running, nobody ticking. A rate-limited exit
+ * stamped terminal `failed` (2026-09-05, 42 rows); a spin loop past the
+ * manual-clear cooldown; a worktree merge-back that left the project on a
+ * job branch; a job parked `needs_review` with no fix plan; app churn
+ * counted as unfinished work. Guarding each cause individually will always
+ * lag the next one, so this guards the SHAPE instead.
+ *
+ * Two outcomes, deliberately distinguished — they need opposite responses:
+ *   'starved' — at least one pending row is dispatchable RIGHT NOW and
+ *               nothing is running. Whatever should have ticked, didn't.
+ *               Forcing a tick is safe and fixes it.
+ *   'blocked' — every pending row is behind a terminal/parked dependency.
+ *               A tick cannot help; this needs a human (or a heal pass) to
+ *               resolve the blocker, and must be reported as such rather
+ *               than silently re-ticking forever.
+ *
+ * Returns null when the queue is healthy (work running, nothing pending,
+ * paused on purpose, or simply not idle long enough yet).
+ */
+function classifyQueueStarvation({ jobs, paused, runningCount, lastRunAtMs, now, thresholdMs = QUEUE_STARVATION_MS } = {}) {
+  if (paused) return null;                      // paused is a DECISION, not a stall
+  if (runningCount > 0) return null;            // work is flowing
+  const rows = Array.isArray(jobs) ? jobs : [];
+  const pending = rows.filter((j) => j && j.status === 'pending');
+  if (pending.length === 0) return null;        // nothing to run — not a stall
+
+  const idleMs = Number.isFinite(lastRunAtMs) ? now - lastRunAtMs : Infinity;
+  if (idleMs < thresholdMs) return null;        // give the normal path its chance first
+
+  // Which pending rows could actually dispatch? Anything NOT named by a
+  // blocked chain. computeBlockedChains already walks dependsOn with the
+  // picker's own resolution, so the two can never disagree.
+  const blockedChains = computeBlockedChains(rows);
+  const blockedTotal = blockedChains.reduce((n, c) => n + c.blocked, 0);
+  const dispatchable = pending.length - blockedTotal;
+
+  return {
+    kind: dispatchable > 0 ? 'starved' : 'blocked',
+    pending: pending.length,
+    dispatchable,
+    blockedChains,
+    idleMs,
+  };
+}
+
+/**
+ * The watchdog half: acts on classifyQueueStarvation. Called from the
+ * heartbeat, which already runs on its own timer independent of the billing
+ * poll loop — so a wedged or never-succeeding poll (the /api/oauth/usage
+ * endpoint was itself 429ing all of 2026-09-05) can no longer leave a queue
+ * with ready work idle indefinitely.
+ */
+async function runQueueStarvationWatchdog(state, { now = Date.now(), thresholdMs = QUEUE_STARVATION_MS } = {}) {
+  const verdict = classifyQueueStarvation({
+    jobs: state?.jobs,
+    paused: state?.paused,
+    runningCount: runningSet.size,
+    lastRunAtMs: Date.parse(state?.lastRunAt ?? ''),
+    now,
+    thresholdMs,
+  });
+  if (!verdict) return null;
+
+  const mins = Math.round(verdict.idleMs / 60_000);
+  if (verdict.kind === 'blocked') {
+    console.warn(
+      `[scheduler] QUEUE BLOCKED: ${verdict.pending} pending job(s), 0 running, idle ${mins}m — every ready row is behind a `
+      + `terminal or parked dependency, so ticking cannot help. Blockers: `
+      + verdict.blockedChains.map((c) => `${c.cwd} [${c.blockedBy.join(', ')}]`).join(' · '),
+    );
+    appendAuditEvent('queue_blocked_stall', { pending: verdict.pending, idleMs: verdict.idleMs, chains: verdict.blockedChains });
+    return verdict;
+  }
+
+  console.warn(
+    `[scheduler] QUEUE STARVED: ${verdict.dispatchable} dispatchable job(s) of ${verdict.pending} pending, 0 running, `
+    + `idle ${mins}m (>= ${Math.round(thresholdMs / 60_000)}m) — forcing a tick`,
+  );
+  appendAuditEvent('queue_starvation_forced_tick', { pending: verdict.pending, dispatchable: verdict.dispatchable, idleMs: verdict.idleMs });
+  // A never-populated utilization reading is itself one of the ways the
+  // when-available path silently never fires (maybeLaunchWhenAvailable
+  // returns early on null). Treat unknown as safe here, exactly as the
+  // billing meter's own 429 fallback already does.
+  if (cachedUtilization === null || cachedUtilization === undefined) cachedUtilization = 0;
+  await tickQueue({ bypassLoadGate: false }).catch((e) => console.error('[scheduler] starvation tick error', e));
+  return verdict;
+}
+
 // ---------- dead-process reaper ----------
 
 // Queue-health sweep cadence: hangs off reapDeadRunningJobs's own cycle
@@ -5440,11 +6214,41 @@ async function reapDeadRunningJobs() {
 
     if (dead.length === 0) return;
 
+    // A rate-limited death is retryable, not terminal — mirror spawnJob's own
+    // live-process handling (PRD 1117) exactly: engage the SAME setPaused
+    // pause here too. Skipping this would reset the row to 'pending' but
+    // leave dispatch unpaused, so the next tick immediately re-fires it into
+    // the same still-active rate limit — the spin loop this PRD exists to
+    // stop. Done once, outside mutate(), before finalizing any row below.
+    if (dead.some((d) => d.outcome === 'rate_limited')) {
+      const resetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const triggering = dead.find((d) => d.outcome === 'rate_limited');
+      const triggeringRow = triggering ? state.jobs.find((x) => x.slug === triggering.slug) : null;
+      const observedAtMs = triggeringRow?.startedAt ? Date.parse(triggeringRow.startedAt) : null;
+      // Same rapid-repeat circuit breaker spawnJob's own res.rateLimited
+      // branch drives (see consecutiveRapidRateLimitsBySlug above) — a
+      // process that gets rate-limited and then dies without spawnJob's own
+      // branch ever running is reconciled HERE instead, and must feed the
+      // same counter or a stale/wrong resumeAt could keep re-clearing this
+      // path's "fresh" pause every reap cycle with no hard cap ever engaging.
+      const durationMs = Number.isFinite(observedAtMs) ? Date.now() - observedAtMs : Infinity;
+      const prevCount = consecutiveRapidRateLimitsBySlug.get(triggering.slug) || 0;
+      const nextCount = nextRapidRateLimitCount(prevCount, { rateLimited: true, durationMs });
+      consecutiveRapidRateLimitsBySlug.set(triggering.slug, nextCount);
+      const forceHardPause = nextCount >= CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD;
+      if (forceHardPause) {
+        console.log(`[scheduler] ${triggering.slug}: ${nextCount} consecutive rate-limited dispatches under ${RAPID_RATE_LIMIT_WINDOW_MS / 1000}s each (reaped) — engaging hard pause`);
+      }
+      await setPaused('rate_limit', resetIso, { observedAt: observedAtMs, force: forceHardPause });
+    }
+
     await mutate(async (s) => {
       for (const { slug, pid, outcome, gateOutcome, pidless, reason } of dead) {
         const idx = s.jobs.findIndex((x) => x.slug === slug);
         if (idx < 0 || s.jobs[idx].status !== 'running') continue; // race guard
+        const rateLimited = outcome === 'rate_limited';
         const success = outcome === 'success';
+        if (!rateLimited) consecutiveRapidRateLimitsBySlug.delete(slug);
 
         // Best-effort in-place leftover computation: a job whose owning
         // process vanished without spawnJob()'s own finally block ever
@@ -5479,13 +6283,23 @@ async function reapDeadRunningJobs() {
         const leftoverSuffix = deltaPaths && deltaPaths.length
           ? ` — left ${deltaPaths.length} files uncommitted`
           : '';
-        const transitionReason = (pidless ? reason : `reaped: process gone (outcome=${outcome})`) + leftoverSuffix;
-
-        transitionJob(s.jobs[idx], success ? 'completed' : 'failed', { reason: transitionReason, source: 'reapDeadRunningJobs' });
-        s.jobs[idx].exitCode = success ? 0 : (s.jobs[idx].exitCode ?? 1);
-        s.jobs[idx].finishedAt = new Date().toISOString();
-        s.jobs[idx].error = success ? null : `${transitionReason} (outcome=${outcome})`;
-        s.jobs[idx].gateOutcome = gateOutcome;
+        const transitionReason = rateLimited
+          ? `reaped: rate limit detected — reset to pending, not failed (outcome=${outcome})${leftoverSuffix}`
+          : (pidless ? reason : `reaped: process gone (outcome=${outcome})`) + leftoverSuffix;
+
+        if (rateLimited) {
+          // Retryable, never terminal (PRD 1117) — same resetJobFields path
+          // spawnJob's own rateLimited branch uses (see ~4797's
+          // treatAsPending), so the row comes back exactly like any other
+          // paused-for-rate-limit reset: fresh runId/startedAt/exitCode.
+          resetJobFields(s.jobs[idx], transitionReason, { source: 'reapDeadRunningJobs:rate-limit' });
+        } else {
+          transitionJob(s.jobs[idx], success ? 'completed' : 'failed', { reason: transitionReason, source: 'reapDeadRunningJobs' });
+          s.jobs[idx].exitCode = success ? 0 : (s.jobs[idx].exitCode ?? 1);
+          s.jobs[idx].finishedAt = new Date().toISOString();
+          s.jobs[idx].error = success ? null : `${transitionReason} (outcome=${outcome})`;
+          s.jobs[idx].gateOutcome = gateOutcome;
+        }
         delete s.jobs[idx].runtime;
         delete s.jobs[idx].guardBaseline;
         delete s.jobs[idx].guardHeadBefore;
@@ -5499,7 +6313,10 @@ async function reapDeadRunningJobs() {
         // with no exit event) wedges the lease held forever and stalls
         // dispatch for every project until the app restarts.
         if (s.jobs[idx].quietMachine === true) quietMachineLease.release(slug);
-        if (pidless) {
+        if (rateLimited) {
+          console.log(`[scheduler] reaped rate-limited job slug=${slug} — reset to pending, pause engaged`);
+          appendAuditEvent('job_reaped_rate_limited', { slug, cwd: s.jobs[idx].cwd ?? null });
+        } else if (pidless) {
           console.log(`[scheduler] reaped pidless zombie job slug=${slug} outcome=${outcome}`);
           appendAuditEvent('job_reaped_pidless', { slug, cwd: s.jobs[idx].cwd ?? null, outcome, graceMs: PIDLESS_SPAWN_GRACE_MS });
         } else {
@@ -5711,10 +6528,16 @@ const MAX_INVESTIGATION_DEPTH = 1;
  * no recorded investigationDepth (a job already in the queue before this
  * depth tracking shipped) is treated as excluded too, preserving the
  * pre-existing blanket-exclusion behavior for legacy jobs — no retroactive
- * migration. Non-fix-plan slugs are never capped here. Exported for tests.
+ * migration. Non-fix-plan jobs are never capped here.
+ *
+ * `isFixPlan` (PRD 1131) is the job's own persisted classification stamp
+ * (see lib/fixPlanSlug.cjs's resolveIsFixPlan) — an explicit true/false wins
+ * over the slug; only a row with the field entirely absent (persisted
+ * before this change shipped) falls back to the legacy slug-only heuristic.
+ * Exported for tests.
  */
-function isFixPlanBeyondDepthCap(slug, investigationDepth) {
-  if (!isFixPlanSlug(slug)) return false;
+function isFixPlanBeyondDepthCap(slug, investigationDepth, isFixPlan) {
+  if (!resolveIsFixPlan(slug, isFixPlan)) return false;
   if (investigationDepth == null) return true;
   return investigationDepth >= MAX_INVESTIGATION_DEPTH + 1;
 }
@@ -5767,12 +6590,18 @@ function isUnresolvableNeedsReview(job, { hasRunDir }) {
  * ('no-plan', 'error', and unstamped/undefined) — mirrors the retry
  * eligibility rule in selectAutoFixTargets so a job can never be retry-
  * eligible there and simultaneously un-annotatable here.
+ *
+ * A parent stamped `autoFixReopened: true` (its dead fix-plan child earned
+ * it exactly one further attempt — see isFixPlanDead) is a separate
+ * exhaustion path: it is spent as soon as that second investigation
+ * concludes with ANY outcome, including another 'plan' — a reopened parent
+ * never gets a third attempt, so unlike the fresh case a 'plan' outcome does
+ * not exempt it here.
  */
 function isExhaustedAutoFix(job) {
-  return !!job && job.status === 'needs_review'
-    && job.autoFixAttempted === true
-    && job.autoFixOutcome !== 'plan'
-    && (job.autoFixRetries ?? 0) >= 1;
+  if (!job || job.status !== 'needs_review' || job.autoFixAttempted !== true) return false;
+  if (job.autoFixReopened === true) return job.autoFixOutcome != null;
+  return job.autoFixOutcome !== 'plan' && (job.autoFixRetries ?? 0) >= 1;
 }
 
 /**
@@ -5788,6 +6617,31 @@ function isPlanUnqueued(job, queuedSlugs) {
   return !queuedSlugs.has(fixSlugFor(job));
 }
 
+// Terminal-and-not-completed statuses a fix-plan child can die in — see
+// isFixPlanDead.
+const DEAD_FIX_CHILD_STATUSES = new Set(['needs_review', 'failed', 'quarantined', 'skipped']);
+
+/**
+ * Pure predicate: a parent stuck at outcome 'plan' whose own fix-plan child
+ * (fixSlugFor(job)) has ITSELF died — reached a terminal non-completed
+ * status — with nothing left in the ladder that will ever revisit either
+ * row again (selectAutoFixTargets skips a 'plan' outcome outright, and
+ * isPlanUnqueued only fires when the child never reached the queue at all,
+ * which isn't true once a dead child row exists). `job.autoFixReopened`
+ * gates this to exactly once per parent — once stamped, this always returns
+ * false so the parent can never be reopened a second time. Exported for
+ * tests.
+ */
+function isFixPlanDead(job, jobsInProject) {
+  if (!job || job.status !== 'needs_review') return false;
+  if (job.autoFixOutcome !== 'plan') return false;
+  if (job.autoFixReopened === true) return false;
+  const fixSlug = fixSlugFor(job);
+  const child = (jobsInProject || []).find((j) => j.slug === fixSlug);
+  if (!child) return false;
+  return DEAD_FIX_CHILD_STATUSES.has(child.status);
+}
+
 /**
  * Pure predicate: is this job eligible for the boot re-verify self-heal? Only
  * needs_review jobs with a run log (own or backfilled via resolveRunId) AND a
@@ -5933,16 +6787,30 @@ function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRu
     // bounded `--resume` attempt must never also become a fix-plan target
     // in the same pass — see spawnInvestigation's own identical guard.
     if (selectResumeRecoveryTarget(job)) return false;
+    // Mechanical recovery (PRD 1130): a job eligible for a pure-git retry
+    // must never also become a fix-plan target — it needs no plan and no
+    // model. Defensive: today's single mechanically-resolvable verdict
+    // (worktree_integration_failed) is already excluded below via the depth
+    // cap, but this must hold even if that stops being true.
+    if (selectMechanicalRecoveryTarget(job)) return false;
     const runId = job.runId || resolveJobRunId(job);
     if (!runId) return false;
-    if (isFixPlanBeyondDepthCap(job.slug, job.investigationDepth)) return false;
+    if (isFixPlanBeyondDepthCap(job.slug, job.investigationDepth, job.isFixPlan)) return false;
+    // A dead fix-plan child (PRD 1129) earns its parent exactly one further
+    // attempt, bypassing the normal 'plan' exclusion and the fix-slug/queue
+    // membership checks below — those checks exist to stop a FRESH
+    // investigation from clobbering a live sibling, but here the sibling is
+    // dead and reusing its slug is the whole point of the reopen.
+    const dead = isFixPlanDead(job, jobs);
     if (job.autoFixAttempted) {
-      const retryEligible = job.autoFixOutcome === 'no-plan'
+      const retryEligible = dead
+        || job.autoFixOutcome === 'no-plan'
         || job.autoFixOutcome === 'error'
         || job.autoFixOutcome == null;
       if (!retryEligible) return false;
-      if ((job.autoFixRetries ?? 0) >= 1) return false;
+      if (!dead && (job.autoFixRetries ?? 0) >= 1) return false;
     }
+    if (dead) return true;
     const fixSlug = fixSlugFor(job);
     if (fixSlugExists(fixSlug)) return false;
     if (slugsInQueue.has(fixSlug)) return false;
@@ -6121,7 +6989,7 @@ async function reverifyNeedsReview() {
   const promotedPrds = [];
   await mutate((s) => {
     for (const job of s.jobs) {
-      if (job.status !== 'completed' || !isFixPlanSlug(job.slug)) continue;
+      if (job.status !== 'completed' || !resolveIsFixPlan(job.slug, job.isFixPlan)) continue;
       const orig = healTargetForFix(job.slug, s.jobs);
       if (!orig) continue;
       const priorStatus = orig.status;
@@ -6205,6 +7073,23 @@ async function reverifyNeedsReview() {
     ? await readQueue()
     : afterHealForAnnotate;
 
+  // Mechanical recovery (PRD 1130): evaluated first, ahead of both
+  // resume-first recovery and auto-fix below — catches a job whose
+  // mechanically-resolvable verdict this periodic pass finds still eligible
+  // (e.g. one already parked before this rung shipped, or one the same-tick
+  // check in spawnJob missed because the app restarted in between). Depth
+  // never disqualifies it, so it runs regardless of investigationDepth.
+  {
+    for (const job of queueForResumeAndAutofix.jobs) {
+      const target = selectMechanicalRecoveryTarget(job);
+      if (!target) continue;
+      console.log(`[scheduler] mechanical-recovery: needs_review ${job.slug} → re-integrating ${target.branch}`);
+      performMechanicalRecovery(job, target).catch((e) => {
+        console.error('[scheduler] performMechanicalRecovery error', job.slug, e);
+      });
+    }
+  }
+
   // Resume-first recovery (PRD 1111): before any fix-plan investigation is
   // authored below, offer the bounded one-attempt `--resume` dispatch to any
   // needs_review job this periodic pass finds still eligible — e.g. one the
@@ -6223,6 +7108,26 @@ async function reverifyNeedsReview() {
     }
   }
 
+  // Leftover quarantine (PRD 1128), periodic pass: catches a job parked
+  // needs_review with resume recovery already spent BEFORE this feature
+  // shipped, or one the same-tick check in spawnJob missed because the app
+  // restarted in between. Stamps the one-attempt marker in its own mutate
+  // BEFORE the async git work starts (same race-closing rule as the resume
+  // loop above and spawnJob's own dispatch stamp).
+  {
+    for (const job of queueForResumeAndAutofix.jobs) {
+      const quarantineTarget = selectLeftoverQuarantineTarget(job);
+      if (!quarantineTarget) continue;
+      console.log(`[scheduler] leftover-quarantine: needs_review ${job.slug} → quarantining ${quarantineTarget.paths.length} leftover path(s)`);
+      mutate((s) => {
+        const j = s.jobs.find((x) => x.slug === job.slug);
+        if (j) j.leftoverQuarantineAttempted = true;
+      }).then(() => performLeftoverQuarantine(job, quarantineTarget.paths)).catch((e) => {
+        console.error('[scheduler] performLeftoverQuarantine error', job.slug, e);
+      });
+    }
+  }
+
   // Auto-fix: spawn a fix-plan investigation for each job still in
   // needs_review after the heal pass (kill-switch: SM_AUTOFIX_DISABLE=1).
   // spawnInvestigation early-returns once investigationsInFlight reaches
@@ -6236,23 +7141,30 @@ async function reverifyNeedsReview() {
       const runId = job.runId || resolveRunId(job);
       const runDir = path.join(RUNS_DIR, runId);
       const isRetryAttempt = job.autoFixAttempted === true;
+      const isDeadFixPlanReopen = isFixPlanDead(job, queueForResumeAndAutofix.jobs);
+      const deadChild = isDeadFixPlanReopen
+        ? queueForResumeAndAutofix.jobs.find((j) => j.slug === fixSlugFor(job))
+        : null;
       // Persist the attempt BEFORE spawning — a crash mid-investigation still
       // counts it (mirrors orphanRetries). Safe even when the slot is busy: the
       // investigation is queued and drained as slots free, so it is genuinely
-      // attempted rather than silently dropped.
+      // attempted rather than silently dropped. autoFixReopened is stamped in
+      // this SAME mutate so a crash between selection and dispatch can never
+      // leave the parent re-eligible for a second reopen (PRD 1129).
       await mutate((s) => {
         const j = s.jobs.find((x) => x.slug === job.slug);
         if (j) {
           j.autoFixAttempted = true;
           if (!j.runId && runId) j.runId = runId;
+          if (isDeadFixPlanReopen) j.autoFixReopened = true;
           if (isRetryAttempt) {
             j.autoFixRetries = (j.autoFixRetries ?? 0) + 1;
             delete j.autoFixOutcome;
           }
         }
       });
-      console.log(`[scheduler] auto-fix: needs_review ${job.slug} → authoring fix-plan (${isRetryAttempt ? 'retry' : '1/1'})`);
-      spawnInvestigation(job, runDir).catch((e) => {
+      console.log(`[scheduler] auto-fix: needs_review ${job.slug} → authoring fix-plan (${isRetryAttempt ? 'retry' : '1/1'}${isDeadFixPlanReopen ? ', dead fix-plan child reopen' : ''})`);
+      spawnInvestigation(job, runDir, { deadChild }).catch((e) => {
         console.error('[scheduler] auto-fix spawnInvestigation error', job.slug, e);
       });
     }
@@ -6865,6 +7777,14 @@ async function init() {
   if (heartbeatInterval) clearInterval(heartbeatInterval);
   heartbeatInterval = setInterval(() => {
     const s = readQueueSync();
+    // NEVER-STOP INVARIANT: if a queue holds ready PRDs and nothing is
+    // running, something must drive it. This is the only driver that does
+    // not depend on the billing poll loop, a pause timer, or a completing
+    // job to schedule the next tick — every one of which has failed at
+    // least once. See classifyQueueStarvation.
+    if (!s.unreadable) {
+      runQueueStarvationWatchdog(s).catch((e) => console.error('[scheduler] starvation watchdog error', e));
+    }
     // Initialise from the real status union (scheduleJobSchema.cjs) rather
     // than a hand-maintained subset — the old `{ pending, running, completed,
     // failed }` literal silently minted a NEW key for any other value
@@ -7335,6 +8255,36 @@ const remote = {
       return { ok: false, error: `job status is "${job.status}" — only a not-yet-running PRD (status "pending"/"quarantined", or no queue row yet) may be edited` };
     }
 
+    // Write-time FK check for a patched dependsOn (PRD 1124), reusing the
+    // SAME resolution rule scheduler_create_prd's prdCreate.cjs applies (exact
+    // slug, else bare-name after stripping one leading `NN-`) so update and
+    // create can never disagree about what a dependsOn entry resolves to. An
+    // explicit empty array CLEARS the dependency and skips validation — there
+    // is nothing to resolve. A listPrds() read failure is skipped-with-a-
+    // warning, matching createPrd's tolerance for an I/O hiccup.
+    if (frontmatter && Array.isArray(frontmatter.dependsOn) && frontmatter.dependsOn.length) {
+      let listing;
+      try {
+        listing = await this.listPrds({ cwd, limit: Number.MAX_SAFE_INTEGER });
+      } catch (e) {
+        console.warn(`[scheduler] updatePrd: dependsOn validation skipped (listPrds failed): ${e?.message ?? e}`);
+        listing = null;
+      }
+      if (listing) {
+        const candidateSlugs = (listing.prds ?? []).map((p) => p.slug);
+        for (const dep of frontmatter.dependsOn) {
+          if (resolveDepSlug(dep, candidateSlugs).length > 0) continue;
+          const near = findNearMatches(dep, candidateSlugs);
+          const suggestion = near.length ? ` Closest existing slug(s): ${near.join(', ')}.` : '';
+          return {
+            ok: false,
+            error: `dependsOn entry "${dep}" does not resolve to any existing PRD in this project.${suggestion} ` +
+              'Pass the bare name (preferred) or the exact NN-prefixed slug of an existing PRD.',
+          };
+        }
+      }
+    }
+
     let dir = null;
     let filePath = null;
     if (cwd) {
@@ -7465,4 +8415,149 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
   });
 }
 
-module.exports = { findOverrunningJobs, JOB_OVERRUN_FACTOR, JOB_OVERRUN_FLOOR_MS, registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, healRefusalReason, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, IDLE_OUTPUT_KILL_MS, BASH_DEFAULT_TIMEOUT_MS, BASH_MAX_TIMEOUT_MS, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isFailedUnverifiedShaped, computeLooksDone, isPromotableOriginal, selectAutoFixTargets, applyRcaClassification, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, isExhaustedAutoFix, isPlanUnqueued, fixSlugFor, healTargetForFix, buildInvestigationPrompt, isGitRepoSync, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, leftoverFieldsFrom, applyLeftoverFields, LEFTOVER_PATHS_CAP, capDirtyPaths, buildForeignWipSection, PRE_RUN_DIRTY_PATHS_CAP, FOREIGN_WIP_DELIMITER, FOREIGN_WIP_END_DELIMITER, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, resolveVerifyPrdPath, resolveFixPlanPath, resolveNotifyPrd, runPrdMigration, consolidateAllFlatPrds, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult, spawnJob, listPrdsInternal, computeStallSummary, findStaleQuarantinedJobs, QUARANTINE_ESCALATE_MS, applyClearQueueVictims, PIDLESS_SPAWN_GRACE_MS, findStrandedInvestigations, INVESTIGATION_MAX_MS, stashList, parseStashLine, pathsChangedSince, restoreSpecificStash, evaluateSharedTreeGuard, checkSharedTreeGuard, uncommittedChanges, gitHead, selectResumeRecoveryTarget, buildResumeRecoveryPreamble, buildClaudeSpawnArgs, spawnResumeRecovery, spawnInvestigation, computeLaunchHolds, handleLaunchFailure, applyLaunchFailure };
+module.exports = {
+  classifyQueueStarvation,
+  runQueueStarvationWatchdog,
+  QUEUE_STARVATION_MS,
+  computeBlockedChains,
+  stripAppOwnedChurn,
+  findOverrunningJobs,
+  JOB_OVERRUN_FACTOR,
+  JOB_OVERRUN_FLOOR_MS,
+  registerScheduleHandlers,
+  attachWindow,
+  init,
+  ROOT,
+  PRDS_DIR,
+  healRefusalReason,
+  writeQueue,
+  reconcile,
+  reconcileSourcePromptId,
+  allocateParallelGroup,
+  selectHistoryJobs,
+  parsePorcelain,
+  FINISH_PROTOCOL,
+  IDLE_OUTPUT_KILL_MS,
+  BASH_DEFAULT_TIMEOUT_MS,
+  BASH_MAX_TIMEOUT_MS,
+  remote,
+  pickNextBatch,
+  pickForProject,
+  reapDeadRunningJobs,
+  pollRecoveryClearSource,
+  memoryLimitedBatchSize,
+  availableForJobs,
+  reverifyNeedsReview,
+  isRescanCandidate,
+  isFailedUnverifiedShaped,
+  computeLooksDone,
+  isPromotableOriginal,
+  selectAutoFixTargets,
+  applyRcaClassification,
+  isEligibleForImmediateAutoFix,
+  resolveRunId,
+  isUnresolvableNeedsReview,
+  isExhaustedAutoFix,
+  isPlanUnqueued,
+  isFixPlanDead,
+  fixSlugFor,
+  healTargetForFix,
+  buildInvestigationPrompt,
+  isGitRepoSync,
+  committedInWindow,
+  computeCommittedDuringRun,
+  classifySigtermWithCommit,
+  isFixPlanSlug,
+  classifyDiscoveredFixPlan,
+  resolveIsFixPlan,
+  isFixPlanBeyondDepthCap,
+  MAX_INVESTIGATION_DEPTH,
+  forceTickOutcome,
+  applyPauseCleared,
+  detectNetworkErrorInLog,
+  detectRateLimitInLog,
+  classifyFailureOutcome,
+  commitGuardVerdict,
+  leftoverFieldsFrom,
+  applyLeftoverFields,
+  LEFTOVER_PATHS_CAP,
+  capDirtyPaths,
+  buildForeignWipSection,
+  PRE_RUN_DIRTY_PATHS_CAP,
+  FOREIGN_WIP_DELIMITER,
+  FOREIGN_WIP_END_DELIMITER,
+  TRANSIENT_RETRY_CAP,
+  buildScheduleStatePayload,
+  partitionBootOrphans,
+  applyOrphanOutcome,
+  BOOT_ORPHAN_KILL_GRACE_MS,
+  registerAdminRoutes,
+  notifyOriginatingTab,
+  notifyNeedsReview,
+  isNotifiableTerminalStatus,
+  extractResultTextFromLog,
+  candidatePrdsDirs,
+  candidateArchivedPrdsDirs,
+  resolveArchivedPrdStatus,
+  prdDirForCwd,
+  prdPathForJob,
+  archivedPrdPathForJob,
+  archivedTwinExists,
+  findPrdDir,
+  resolveVerifyPrdPath,
+  resolveFixPlanPath,
+  resolveNotifyPrd,
+  runPrdMigration,
+  consolidateAllFlatPrds,
+  shouldSkipInvestigationForCleanRun,
+  archiveCompletedPrd,
+  retireCompletedSlugs,
+  SCHEDULER_BOOTED_AT,
+  SCHEDULER_CODE_SHA,
+  resetJobFields,
+  executeJob,
+  prdArchivedSkipResult,
+  spawnJob,
+  listPrdsInternal,
+  computeStallSummary,
+  findStaleQuarantinedJobs,
+  QUARANTINE_ESCALATE_MS,
+  applyClearQueueVictims,
+  PIDLESS_SPAWN_GRACE_MS,
+  findStrandedInvestigations,
+  INVESTIGATION_MAX_MS,
+  stashList,
+  parseStashLine,
+  pathsChangedSince,
+  restoreSpecificStash,
+  evaluateSharedTreeGuard,
+  checkSharedTreeGuard,
+  uncommittedChanges,
+  gitHead,
+  selectResumeRecoveryTarget,
+  buildResumeRecoveryPreamble,
+  buildClaudeSpawnArgs,
+  spawnResumeRecovery,
+  selectMechanicalRecoveryTarget,
+  performMechanicalRecovery,
+  MECHANICALLY_RESOLVABLE_VERDICTS,
+  selectLeftoverQuarantineTarget,
+  quarantineLeftovers,
+  performLeftoverQuarantine,
+  spawnInvestigation,
+  computeLaunchHolds,
+  computeDepHistorySatisfaction,
+  handleLaunchFailure,
+  applyLaunchFailure,
+  setPaused,
+  clearPause,
+  tickQueue,
+  runDueJobs,
+  isCooldownSuppressed,
+  nextRapidRateLimitCount,
+  CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD,
+  RAPID_RATE_LIMIT_WINDOW_MS,
+  MANUAL_PAUSE_COOLDOWN_MS,
+  RUNS_DIR,
+  pickRunDir,
+};