claude-code-session-manager 0.79.0 → 0.80.0

package/src/main/lib/__tests__/schedulerBatchDepends.test.cjs

@@ -11,7 +11,7 @@
 
 // vitest globals (test) — same convention as the other .cjs tests.
 const assert = require('node:assert/strict');
-const { pickForProject, DEFAULT_PROJECT_CWD } = require('../schedulerBatch.cjs');
+const { pickForProject, findBlockingDep, DEFAULT_PROJECT_CWD, DEP_HISTORY_FAIL_OPEN } = require('../schedulerBatch.cjs');
 
 const CWD = DEFAULT_PROJECT_CWD;
 
@@ -74,14 +74,66 @@ test('still resolves an exact-slug dep (dep written WITH the NN- prefix)', () =>
   assert.deepEqual(batch.map((j) => j.slug), ['873-leftnav-two-face-framework']);
 });
 
-test('a dep with no row at all is treated as already done (archived/retired)', () => {
+// PRD 1122 — a dep slug with no live row is no longer auto-satisfied by
+// absence alone. It must show up in the caller's precomputed
+// history/archive Set (5th arg, built once per tick by
+// scheduler.cjs's computeDepHistorySatisfaction) or it HOLDS as
+// 'unresolved'. Observed live on starry-night-ships: a typo'd/format-
+// mismatched dep slug used to be silently indistinguishable from one
+// genuinely retired to history.
+test('a dep with no row IS treated as done when the caller supplies it as history/archive-satisfied', () => {
   const jobs = [
     job('874-nav-face-project-home', 'pending', { dependsOn: ['some-long-archived-prd'] }),
   ];
-  const { batch } = pick(jobs);
+  const { batch } = pickForProject(jobs, new Set(), 3, new Map(), new Set(['some-long-archived-prd']));
+  assert.deepEqual(batch.map((j) => j.slug), ['874-nav-face-project-home']);
+});
+
+test('a dep with no row and NOT in the history/archive set HOLDS as unresolved, with a named actionable reason', () => {
+  const jobs = [
+    job('874-nav-face-project-home', 'pending', { dependsOn: ['some-typo-d-prd'] }),
+  ];
+  const { batch, reason, holds } = pick(jobs);
+  assert.deepEqual(batch, []);
+  assert.match(reason, /depends-gate/);
+  assert.match(reason, /unresolvable dependencies/);
+  assert.match(reason, /874-nav-face-project-home <- some-typo-d-prd/);
+  assert.match(reason, /fix the dependsOn entry or archive the dependent/);
+  const hold = holds.find((h) => h.slug === '874-nav-face-project-home');
+  assert.equal(hold.depStatus, 'unresolved');
+});
+
+test('the double-prefixed-row regression: a row named 253-253-x referenced as bare x holds as unresolved', () => {
+  // bareSlug strips exactly ONE leading `NN-` run, so '253-253-x' bares to
+  // '253-x' — it does NOT bare-match dependsOn's 'x'. The double-prefixed row
+  // is therefore genuinely invisible to both exact and bare matching, the
+  // same as a typo — this is the exact 2026-09-06 starry-night-ships report.
+  const jobs = [
+    job('253-253-x', 'running'),
+    job('254-next', 'pending', { dependsOn: ['x'] }),
+  ];
+  const { batch, holds, reason } = pick(jobs);
+  assert.deepEqual(batch.map((j) => j.slug), []);
+  assert.match(reason, /unresolvable dependencies/);
+  const hold = holds.find((h) => h.slug === '254-next');
+  assert.equal(hold.dep, 'x');
+  assert.equal(hold.depStatus, 'unresolved');
+});
+
+test('DEP_HISTORY_FAIL_OPEN preserves the pre-1122 fail-open behaviour for a read failure', () => {
+  const jobs = [
+    job('874-nav-face-project-home', 'pending', { dependsOn: ['some-long-archived-prd'] }),
+  ];
+  const { batch } = pickForProject(jobs, new Set(), 3, new Map(), DEP_HISTORY_FAIL_OPEN);
   assert.deepEqual(batch.map((j) => j.slug), ['874-nav-face-project-home']);
 });
 
+test('findBlockingDep: bare-name resolution against satisfiedSlugs matches the live-row bare-name rule', () => {
+  const dependent = job('254-next', 'pending', { dependsOn: ['x'] });
+  assert.equal(findBlockingDep(dependent, [dependent], new Set(['253-x'])), undefined);
+  assert.equal(findBlockingDep(dependent, [dependent], new Set()), 'x');
+});
+
 test('a FAILED bare-named dep holds the dependent and reports an explicit reason', () => {
   const jobs = [
     job('873-leftnav-two-face-framework', 'failed'),
@@ -203,7 +255,7 @@ test('reports a per-job hold record naming the blocking dep and its status', ()
   const { batch, holds } = pick(jobs, new Set(), 5);
   assert.deepEqual(batch.map((j) => j.slug), ['985-foundation']);
   assert.deepEqual(holds, [
-    { slug: '986-dependent', dep: 'foundation', depStatus: 'pending' },
+    { slug: '986-dependent', dep: 'foundation', depStatus: 'pending', rootSlug: '985-foundation', rootStatus: 'pending' },
   ]);
 });
 
@@ -214,7 +266,7 @@ test('hold record carries a running dep status', () => {
   ];
   const { holds } = pick(jobs, new Set(['985-foundation']), 5);
   assert.deepEqual(holds, [
-    { slug: '986-dependent', dep: 'foundation', depStatus: 'running' },
+    { slug: '986-dependent', dep: 'foundation', depStatus: 'running', rootSlug: '985-foundation', rootStatus: 'running' },
   ]);
 });
 
@@ -227,7 +279,7 @@ test('hold record carries a failed dep status alongside the depends-gate reason'
   assert.deepEqual(batch, []);
   assert.match(reason, /depends-gate/);
   assert.deepEqual(holds, [
-    { slug: '986-dependent', dep: 'foundation', depStatus: 'failed' },
+    { slug: '986-dependent', dep: 'foundation', depStatus: 'failed', rootSlug: '985-foundation', rootStatus: 'failed' },
   ]);
 });
 
@@ -241,7 +293,7 @@ test('hold record carries a skipped dep status alongside the depends-gate reason
   assert.match(reason, /depends-gate/);
   assert.match(reason, /never-ran dependencies/);
   assert.deepEqual(holds, [
-    { slug: '986-dependent', dep: 'foundation', depStatus: 'skipped' },
+    { slug: '986-dependent', dep: 'foundation', depStatus: 'skipped', rootSlug: '985-foundation', rootStatus: 'skipped' },
   ]);
 });
 

package/src/main/lib/depSlugResolve.cjs

@@ -0,0 +1,72 @@
+'use strict';
+
+/**
+ * depSlugResolve.cjs — the single `dependsOn` slug-resolution rule (PRD 832),
+ * shared by schedulerBatch.cjs's findBlockingDep (run-time gating: does a
+ * queue row exist for this dep) and prdCreate.cjs's write-time validation
+ * (does a PRD exist for this dep at all). Both must agree on what a
+ * `dependsOn` entry resolves to, or a dep that validates at PRD-create time
+ * could still fail to block at run time (or vice versa) — so the matching
+ * rule lives here once, not copied into each caller.
+ *
+ * Resolution rule: exact slug match first; else bare-name match after
+ * stripping one leading `NN-` prefix — a human-authored `dependsOn:` can't
+ * know the `NN-` prefix the allocator will hand a sibling PRD.
+ */
+
+/** Strip one leading `NN-` prefix, if present. */
+function bareSlug(slug) {
+  return String(slug ?? '').replace(/^\d+-/, '');
+}
+
+/**
+ * Resolve `depSlug` against `candidateSlugs`: exact match wins outright;
+ * otherwise every candidate whose bare name matches. Returns a (possibly
+ * empty) array of matching candidate slugs.
+ */
+function resolveDepSlug(depSlug, candidateSlugs) {
+  if (candidateSlugs.includes(depSlug)) return [depSlug];
+  const bare = bareSlug(depSlug);
+  return candidateSlugs.filter((slug) => bareSlug(slug) === bare);
+}
+
+/**
+ * Levenshtein edit distance. O(n*m) in the two strings' lengths — fine here
+ * since it only ever runs over short slug strings (<= 60 chars, PRD_CREATE_SLUG_RE's
+ * cap) at PRD-create time, never in a hot/per-tick path.
+ */
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  const prevRow = new Array(n + 1);
+  const curRow = new Array(n + 1);
+  for (let j = 0; j <= n; j++) prevRow[j] = j;
+  for (let i = 1; i <= m; i++) {
+    curRow[0] = i;
+    for (let j = 1; j <= n; j++) {
+      curRow[j] = a[i - 1] === b[j - 1]
+        ? prevRow[j - 1]
+        : 1 + Math.min(prevRow[j - 1], prevRow[j], curRow[j - 1]);
+    }
+    for (let j = 0; j <= n; j++) prevRow[j] = curRow[j];
+  }
+  return prevRow[n];
+}
+
+/**
+ * Nearest existing slugs to `depSlug` by bare-name edit distance, closest
+ * first, capped at `limit` — used to build an actionable "did you mean"
+ * error when a dependsOn entry resolves to nothing.
+ */
+function findNearMatches(depSlug, candidateSlugs, limit = 3) {
+  const depBare = bareSlug(depSlug);
+  return candidateSlugs
+    .map((slug) => ({ slug, dist: levenshtein(depBare, bareSlug(slug)) }))
+    .sort((a, b) => a.dist - b.dist)
+    .slice(0, limit)
+    .map((entry) => entry.slug);
+}
+
+module.exports = { bareSlug, resolveDepSlug, findNearMatches };

package/src/main/lib/epicWorktreeMerge.cjs

@@ -37,9 +37,9 @@ const { validatePath } = require('../config.cjs');
  * real conflict — never throws (integrateEpicBranch/cleanupEpicWorktree
  * never do either).
  */
-async function mergeEpicToMainViaIpc(cwd, epicId, branch, dir) {
+async function mergeEpicToMainViaIpc(cwd, epicId, branch, dir, carriedPaths) {
   validatePath(cwd);
-  const outcome = await integrateEpicBranch({ cwd, branch, epicId });
+  const outcome = await integrateEpicBranch({ cwd, branch, epicId, carriedPaths });
   if (!outcome.ok) {
     console.log(`[epicWorktreeMerge] ${epicId}: needs manual resolution (${outcome.reason})`);
     return { ok: false, status: 'needs_merge_resolution', reason: outcome.reason };
@@ -56,7 +56,7 @@ function registerEpicWorktreeMergeHandlers() {
   const { schemas: s, validated: v } = require('../ipcSchemas.cjs');
   ipcMain.handle(
     'promptSessions:merge-to-main',
-    v(s.promptSessionsMergeToMain, ({ cwd, epicId, branch, dir }) => mergeEpicToMainViaIpc(cwd, epicId, branch, dir)),
+    v(s.promptSessionsMergeToMain, ({ cwd, epicId, branch, dir, carriedPaths }) => mergeEpicToMainViaIpc(cwd, epicId, branch, dir, carriedPaths)),
   );
 }
 

package/src/main/lib/epicWorktreeMint.cjs

@@ -30,10 +30,10 @@ const { validatePath } = require('../config.cjs');
 /**
  * createEpicWorktreeViaIpc(cwd, epicId) → Promise<EpicWorktree | null>
  *
- * Returns the `worktree` field shape (`{ dir, branch, baseCwd, status }`)
- * ready to persist onto the Epic record on success, or `null` on any
- * failure — createEpicWorktree/createWorktree never throw, so this never
- * does either.
+ * Returns the `worktree` field shape (`{ dir, branch, baseCwd, status,
+ * carriedPaths }`) ready to persist onto the Epic record on success, or
+ * `null` on any failure — createEpicWorktree/createWorktree never throw, so
+ * this never does either.
  */
 async function createEpicWorktreeViaIpc(cwd, epicId) {
   validatePath(cwd);
@@ -42,7 +42,19 @@ async function createEpicWorktreeViaIpc(cwd, epicId) {
     console.log(`[epicWorktreeMint] ${epicId}: not isolated (${result.reason})`);
     return null;
   }
-  return { dir: result.dir, branch: result.branch, baseCwd: result.baseCwd, status: 'active' };
+  // carriedPaths (base-tree WIP carried into this worktree — PRD 1094) MUST
+  // survive onto the persisted record: it's the only way integrateEpicBranch
+  // (via epicWorktreeMerge.cjs) can later apply the carried-wip-only skip
+  // instead of attempting a doomed merge against the base tree's still-dirty
+  // paths. Dropping it here silently (as this used to) meant that skip never
+  // fired for Epics, only for scheduler jobs.
+  return {
+    dir: result.dir,
+    branch: result.branch,
+    baseCwd: result.baseCwd,
+    status: 'active',
+    ...(Array.isArray(result.carriedPaths) && result.carriedPaths.length ? { carriedPaths: result.carriedPaths } : {}),
+  };
 }
 
 function registerEpicWorktreeMintHandlers() {

package/src/main/lib/fixPlanSlug.cjs

@@ -0,0 +1,62 @@
+/**
+ * fixPlanSlug.cjs — single source of truth for recognizing a scheduler-
+ * authored fix-plan PRD (PRD 1131).
+ *
+ * `isFixPlanSlug`'s `/^\d+-fix-/` name test used to be treated as sufficient
+ * evidence on its own. But any PRD an agent or human authors through
+ * `scheduler_create_prd` whose title happens to kebab-case into a
+ * `fix-`-leading slug silently inherited every fix-plan special case
+ * (depth-capped auto-investigation, `commitGuardVerdict`'s zero-edit
+ * exemption) it never asked for — PRD 1126
+ * (`126-fix-plan-death-reopens-parent`, `createdVia: scheduler-api`) was
+ * wrongly stamped `investigationDepth: 2` before it ever ran and had to be
+ * withdrawn and re-slugged.
+ *
+ * A genuine fix plan is authored directly by scheduler.cjs's
+ * `spawnInvestigation` — a raw `Write`, never through `scheduler_create_prd`
+ * (see `guard-prd-writes.cjs`'s exemption) — so it never carries a
+ * `createdVia` stamp. Its prompt template also stamps an explicit
+ * `isFixPlan: true` frontmatter key so classification has a positive
+ * signal to check, not just an absence.
+ *
+ * `classifyDiscoveredFixPlan` is the ONE place a freshly-parsed PRD file
+ * (which has real `createdVia`/`isFixPlan` frontmatter) is turned into a
+ * boolean fix-plan verdict — `reconcile()` calls it once per newly
+ * discovered PRD and persists the verdict onto the queue row's `isFixPlan`
+ * field, so every later consumer reads that stamp instead of re-deriving it
+ * from the name. `resolveIsFixPlan` is what those consumers call: an
+ * explicit `true`/`false` on the row wins; a row with the field entirely
+ * absent (any queue.json row persisted before this change shipped) falls
+ * back to the legacy slug-only heuristic so live history is never
+ * re-classified.
+ */
+'use strict';
+
+function isFixPlanSlug(slug) {
+  return /^\d+-fix-/.test(slug);
+}
+
+/**
+ * Classify a freshly-parsed PRD file (real `createdVia`/`isFixPlan`
+ * frontmatter available). `createdVia` is checked FIRST and always wins —
+ * proof the PRD was authored through the sanctioned scheduler_create_prd API
+ * (a lower-trust path than spawnInvestigation's own raw write) must never be
+ * overridable by an `isFixPlan: true` stamp in the same file, even though no
+ * current write path can produce both on one file (see prdCreate.cjs's
+ * slug-refusal + guard-prd-writes.cjs's write-guard). Structural belt, not
+ * just relying on those two other files staying in sync.
+ */
+function classifyDiscoveredFixPlan({ isFixPlan, createdVia } = {}, slug) {
+  if (createdVia) return false;
+  if (isFixPlan === true) return true;
+  return isFixPlanSlug(slug);
+}
+
+/** Classify a queue-row job, honoring an already-persisted `isFixPlan` stamp over the slug. */
+function resolveIsFixPlan(slug, isFixPlan) {
+  if (isFixPlan === true) return true;
+  if (isFixPlan === false) return false;
+  return isFixPlanSlug(slug);
+}
+
+module.exports = { isFixPlanSlug, classifyDiscoveredFixPlan, resolveIsFixPlan };

package/src/main/lib/gitWorktree.cjs

@@ -544,6 +544,69 @@ async function createWorktree({ kind, cwd, key }) {
   return { ok: true, dir, branch, baseCwd: cwd, carriedPaths };
 }
 
+/**
+ * True iff every path in `paths` has working-tree content in `cwd`
+ * byte-identical to its committed blob on `branch`. Used both by the
+ * carried-wip-only shortcut above and by integrateBranch's auto-resolve of a
+ * "would be overwritten by merge" refusal below — in both cases discarding a
+ * working-tree copy is only safe BECAUSE identity with the incoming commit is
+ * proven, never assumed. Fails toward false (not identical) on ANY read
+ * error — a `git show` failure or an unreadable working-tree file is never
+ * proof of identity.
+ */
+async function pathsIdenticalToBranch({ cwd, branch, paths }) {
+  if (!Array.isArray(paths) || !paths.length) return false;
+  for (const p of paths) {
+    try {
+      const branchContent = await execGit(['show', `${branch}:${p}`], { cwd, timeout: 10_000 });
+      const baseContent = await fsp.readFile(path.join(cwd, p), 'utf8');
+      if (branchContent !== baseContent) return false;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * Parses the path lists out of git's refusal to merge over dirty working-tree
+ * files. Git emits up to two distinct blocks — tracked paths under "local
+ * changes ... would be overwritten" (restorable via `git checkout --`, which
+ * needs an index entry) and untracked paths under "untracked working tree
+ * files ... would be overwritten" (no index entry, so `git checkout --`
+ * cannot touch them — they must be removed instead). Each block is a run of
+ * TAB-indented path lines terminated by the next non-indented line (a
+ * "Please ..." sentence or the next block's own header). Returns null when
+ * neither block is present — stderr from a genuine content conflict has no
+ * such block.
+ */
+function parseBlockingMergePaths(stderrText) {
+  if (!stderrText) return null;
+  const tracked = [];
+  const untracked = [];
+  let mode = null;
+  for (const rawLine of stderrText.split('\n')) {
+    if (/would be overwritten by merge:\s*$/.test(rawLine) && /local changes/.test(rawLine)) {
+      mode = 'tracked';
+      continue;
+    }
+    if (/would be overwritten by merge:\s*$/.test(rawLine) && /untracked working tree files/.test(rawLine)) {
+      mode = 'untracked';
+      continue;
+    }
+    if (mode) {
+      if (/^\t/.test(rawLine)) {
+        const p = rawLine.trim();
+        if (p) (mode === 'tracked' ? tracked : untracked).push(p);
+        continue;
+      }
+      mode = null;
+    }
+  }
+  if (!tracked.length && !untracked.length) return null;
+  return { tracked: Array.from(new Set(tracked)), untracked: Array.from(new Set(untracked)) };
+}
+
 /**
  * Integrate a branch back into `cwd`'s current HEAD — fast-forward when
  * possible, a real merge commit when the main tree advanced underneath (a
@@ -600,17 +663,7 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths }) {
         // committed exactly the carried WIP and nothing more. Any mismatch
         // (including a read failure — fail toward the safer default) falls
         // through to the normal merge attempt below instead of skipping.
-        let allIdentical = true;
-        for (const p of changed) {
-          try {
-            const branchContent = await execGit(['show', `${branch}:${p}`], { cwd, timeout: 10_000 });
-            const baseContent = await fsp.readFile(path.join(cwd, p), 'utf8');
-            if (branchContent !== baseContent) { allIdentical = false; break; }
-          } catch {
-            allIdentical = false;
-            break;
-          }
-        }
+        const allIdentical = await pathsIdenticalToBranch({ cwd, branch, paths: changed });
         if (allIdentical) {
           return { ok: true, integrated: false, reason: 'carried-wip-only' };
         }
@@ -637,9 +690,40 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths }) {
     await execGit(['merge', '--no-ff', '--no-edit', '-m', mergeMessage, branch], { cwd, timeout: 30_000 });
     return { ok: true, integrated: true, mergeCommit: true };
   } catch (e) {
+    const stderrText = (e && (e.stderrText || e.message)) || String(e);
+    // git refuses this class of merge before ever touching MERGE_HEAD, so
+    // there is nothing yet to abort here — only the retry below (if it also
+    // fails) can leave a half-applied merge behind.
+    const blocking = parseBlockingMergePaths(stderrText);
+    if (blocking) {
+      const allPaths = [...blocking.tracked, ...blocking.untracked];
+      const identical = await pathsIdenticalToBranch({ cwd, branch, paths: allPaths });
+      if (identical) {
+        try {
+          if (blocking.tracked.length) {
+            await execGit(['checkout', '--', ...blocking.tracked], { cwd, timeout: 30_000 });
+          }
+          for (const p of blocking.untracked) {
+            await fsp.rm(path.join(cwd, p), { force: true });
+          }
+          await execGit(['merge', '--no-ff', '--no-edit', '-m', mergeMessage, branch], { cwd, timeout: 30_000 });
+          return {
+            ok: true,
+            integrated: true,
+            mergeCommit: true,
+            autoResolved: 'identical_working_tree_duplicates',
+            resolvedPaths: allPaths,
+          };
+        } catch (retryErr) {
+          try { await execGit(['merge', '--abort'], { cwd, timeout: 10_000 }); } catch { /* nothing to abort */ }
+          const retryText = (retryErr && (retryErr.stderrText || retryErr.message)) || String(retryErr);
+          return { ok: false, reason: `merge failed (likely a real content conflict): ${retryText}` };
+        }
+      }
+    }
     // Abort a half-applied merge so `cwd` isn't left in a mid-merge state.
     try { await execGit(['merge', '--abort'], { cwd, timeout: 10_000 }); } catch { /* nothing to abort */ }
-    return { ok: false, reason: `merge failed (likely a real content conflict): ${(e && (e.stderrText || e.message)) || e}` };
+    return { ok: false, reason: `merge failed (likely a real content conflict): ${stderrText}` };
   }
 }
 
@@ -914,6 +998,7 @@ module.exports = {
   keyFromBranch,
   createWorktree,
   captureAndCarryBaseDiff,
+  pathsIdenticalToBranch,
   integrateBranch,
   cleanupWorktree,
   salvageWorktreeDiff,

package/src/main/lib/mcpToolCatalog.cjs

@@ -133,7 +133,10 @@ const MCP_TOOL_CATALOG = [
       + 'app\'s admin API. Refuses once a queue row exists for the slug and its status is anything but "pending" '
       + '(running/completed/failed/needs_review) — editing the spec under a live or already-finished executor is refused, '
       + 'not silently applied. Only recognized frontmatter keys (title, cwd, estimateMinutes, parallelGroup, '
-      + 'sourcePromptId, sourceTabId, tag) may be patched; unrecognized keys (e.g. dependsOn) round-trip unchanged.',
+      + 'sourcePromptId, sourceTabId, tag, dependsOn) may be patched; unrecognized keys round-trip unchanged. '
+      + 'Patching dependsOn to a non-empty array replaces it wholesale (validated against existing PRD slugs, '
+      + 'same resolver scheduler_create_prd uses); patching it to an explicit empty array CLEARS the dependency — '
+      + 'the safe way to fix a wrong dependsOn without archiving (which marks the PRD completed and wrongly frees its dependents).',
     whenToUse: 'Use to correct a PRD scope/estimate/tag before it starts running — e.g. before resetting a needs_review job whose spec needs to change.',
     whenNotToUse: 'Do not use once the job is running or terminal (completed/failed/needs_review) without first resetting it back to pending — the route refuses the edit.',
     exampleArgs: { slug: 'add-mcp-tool-catalog', frontmatter: { estimateMinutes: 45 } },

package/src/main/lib/prdCreate.cjs

@@ -28,6 +28,17 @@ const { appendAuditEvent } = require('./auditLog.cjs');
 const { resolveProjectContext } = require('./projectRootResolve.cjs');
 const { fixChainDepthOf, baseSlugOf } = require('./fixChainDepth.cjs');
 const { DEFAULT_PRD_AGENT_TYPE, assertAgentTypeWritable } = require('./prdAgentType.cjs');
+const { resolveDepSlug, findNearMatches } = require('./depSlugResolve.cjs');
+const { isFixPlanSlug } = require('./fixPlanSlug.cjs');
+
+// A caller-supplied slug that already starts with its own `NN-` (e.g.
+// "254-perf-x") used to silently become the double-prefixed row
+// "254-254-perf-x" once allocateParallelGroup() prepended the REAL
+// allocated NN — PRD_CREATE_SLUG_RE only enforces kebab-case shape, so it
+// never caught this. Refused outright rather than auto-stripped: silently
+// rewriting the caller's slug would hide the same mistake the old behavior
+// hid, just one layer further down.
+const SLUG_HAS_NN_PREFIX_RE = /^(\d+)-/;
 
 // Fix-chain depth cap (PRD 1113): a fix-of-a-fix (depth >= 2) is refused at
 // this shared write path rather than caught later — scheduler.cjs's
@@ -157,7 +168,7 @@ function resolveSourcePromptIdFromClaudeSession(cwd, claudeSessionId) {
  * the renderer-facing IPC handler (chat:create-prd, index.cjs) so the
  * validation/write logic lives in exactly one place (API-reuse standard).
  * `input` must already be schema-validated by the caller (schemas.schedulerCreatePrd).
- * `remote` is scheduler.cjs's remote object (allocateParallelGroup/readPrd/writePrd).
+ * `remote` is scheduler.cjs's remote object (allocateParallelGroup/readPrd/writePrd/listPrds).
  *
  * Returns `{ ok: true, nn, filename }` on success, or `{ ok: false, status, error }`
  * on failure — `status` is the HTTP status code the caller should map errors to
@@ -226,6 +237,18 @@ async function createPrd(input, remote) {
     if (fallback) input = { ...input, sourcePromptId: fallback };
   }
 
+  if (input.slug) {
+    const nnMatch = SLUG_HAS_NN_PREFIX_RE.exec(input.slug);
+    if (nnMatch) {
+      return {
+        ok: false,
+        status: 400,
+        error: `slug "${input.slug}" already starts with a numeric prefix "${nnMatch[1]}-" — the allocator ` +
+          `owns the NN- prefix, not the caller. Pass the bare name instead (e.g. "${input.slug.slice(nnMatch[0].length)}").`,
+      };
+    }
+  }
+
   const slug = input.slug || deriveSlugFromTitle(input.title);
   if (!slug || !PRD_CREATE_SLUG_RE.test(slug)) {
     return { ok: false, status: 400, error: 'could not derive a valid kebab-case slug from title; supply "slug" explicitly' };
@@ -243,10 +266,10 @@ async function createPrd(input, remote) {
   const filenameSlug = `${nn}-${slug}`;
 
   // Fix-chain depth guard (PRD 1113): refuse a fix-of-a-fix before it's ever
-  // written. depth 0/1 pass through unchanged (an ordinary PRD, or a first
-  // fix-plan, is never blocked); depth >= 2 means the base job has already
-  // failed to close via at least one prior fix attempt for reasons a repeat
-  // attempt won't resolve.
+  // written. depth >= 2 means the base job has already failed to close via
+  // at least one prior fix attempt for reasons a repeat attempt won't
+  // resolve — checked first so this distinct, human-escalation error still
+  // wins over the more general fix-plan-slug guard below for that shape.
   const chainDepth = fixChainDepthOf(filenameSlug);
   if (chainDepth > FIX_CHAIN_DEPTH_CAP) {
     const base = baseSlugOf(filenameSlug);
@@ -259,6 +282,29 @@ async function createPrd(input, remote) {
     };
   }
 
+  // Fix-plan-slug collision guard (PRD 1131): a caller-supplied or
+  // title-derived slug that happens to start with "fix-" collides with the
+  // scheduler's own NN-fix-... naming convention for fix plans it authors
+  // itself (spawnInvestigation) — and that shape carries real special-case
+  // semantics (depth-capped auto-investigation eligibility,
+  // commitGuardVerdict's zero-edit exemption) that a PRD authored through
+  // this API never asked for. Refused outright, not silently renamed, same
+  // fail-closed posture as the SLUG_HAS_NN_PREFIX_RE check above (PRD 1126:
+  // "126-fix-plan-death-reopens-parent" was wrongly stamped
+  // investigationDepth before it ever ran and had to be withdrawn). This
+  // subsumes the depth-1 case the chain-depth guard above deliberately let
+  // through (MAX_INVESTIGATION_DEPTH=1 means a first fix-plan is legitimate
+  // — but only when spawnInvestigation authors it, never through this API).
+  if (isFixPlanSlug(filenameSlug)) {
+    return {
+      ok: false,
+      status: 400,
+      error: `slug "${filenameSlug}" collides with the reserved NN-fix-... fix-plan naming convention ` +
+        '(reserved for PRDs the scheduler\'s own investigation loop authors itself). Reword the title/slug ' +
+        'so it does not start with "fix-" — e.g. "resolve-x" or "repair-x" instead of "fix-x".',
+    };
+  }
+
   // An explicit `parallelGroup` bypasses allocateParallelGroup()'s
   // collision-proof reservation, so re-check for an existing file at
   // this exact destination before writing — remote.writePrd itself has
@@ -284,6 +330,39 @@ async function createPrd(input, remote) {
     }
   }
 
+  // Write-time FK check for dependsOn (report on read / throw on write — see
+  // prdAgentType.cjs's header): every entry must resolve to a PRD that
+  // actually exists in this project, using the SAME resolution rule
+  // schedulerBatch.cjs's findBlockingDep applies at run time (exact slug,
+  // else bare-name after stripping one leading `NN-`) — a dep that
+  // validates here is guaranteed to be a dep findBlockingDep can actually
+  // see later. A listPrds() read failure is skipped-with-a-warning, never a
+  // write outage: an I/O hiccup on the read side must not block every PRD
+  // write in the project.
+  if (input.dependsOn && input.dependsOn.length) {
+    let listing;
+    try {
+      listing = await remote.listPrds({ cwd: input.cwd, limit: Number.MAX_SAFE_INTEGER });
+    } catch (e) {
+      console.warn(`[prdCreate] dependsOn validation skipped (listPrds failed): ${e?.message ?? e}`);
+      listing = null;
+    }
+    if (listing) {
+      const candidateSlugs = (listing.prds ?? []).map((p) => p.slug);
+      for (const dep of input.dependsOn) {
+        if (resolveDepSlug(dep, candidateSlugs).length > 0) continue;
+        const near = findNearMatches(dep, candidateSlugs);
+        const suggestion = near.length ? ` Closest existing slug(s): ${near.join(', ')}.` : '';
+        return {
+          ok: false,
+          status: 400,
+          error: `dependsOn entry "${dep}" does not resolve to any existing PRD in this project.${suggestion} ` +
+            'Pass the bare name (preferred) or the exact NN-prefixed slug of an existing PRD.',
+        };
+      }
+    }
+  }
+
   const body = buildPrdBody(input);
   const writeResult = await remote.writePrd(filenameSlug, body, input.cwd);
   if (!writeResult?.ok) {