claude-code-session-manager 0.79.0 → 0.80.0

package/src/main/scheduler.cjs

@@ -73,6 +73,7 @@ const { maybeEnqueueValidationPrompt } = require('./lib/epicValidationHook.cjs')
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
 const { verifyRun } = require('./runVerify.cjs');
 const { latestTerminalOutcomeForSlug, COMPLETED_EQUIVALENT_VERDICTS } = require('./lib/terminalRunOutcome.cjs');
+const { isFixPlanSlug, classifyDiscoveredFixPlan, resolveIsFixPlan } = require('./lib/fixPlanSlug.cjs');
 const { landedSinceRun } = require('./lib/landedSinceRun.cjs');
 const { declaredPathsForPrd } = require('./lib/prdDeclaredPaths.cjs');
 const logs = require('./logs.cjs');
@@ -99,7 +100,7 @@ const JOB_OVERRUN_FACTOR = process.env.SM_JOB_OVERRUN_FACTOR
 const JOB_OVERRUN_FLOOR_MS = process.env.SM_JOB_OVERRUN_FLOOR_MINUTES
   ? Number(process.env.SM_JOB_OVERRUN_FLOOR_MINUTES) * 60_000
   : JOB_OVERRUN_FLOOR_MS_DEFAULT;
-const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD } = require('./lib/schedulerBatch.cjs');
+const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD, DEP_HISTORY_FAIL_OPEN } = require('./lib/schedulerBatch.cjs');
 const { runDefinitionOfDoneOnDrain } = require('./lib/dodDrainHook.cjs');
 const { writeRcaReport, extractRcaBlock } = require('./lib/rcaReport.cjs');
 const queueHistory = require('./lib/queueHistory.cjs');
@@ -140,6 +141,7 @@ const jobWorktree = require('./lib/jobWorktree.cjs');
 const { reconcileEpicWorktreesOnBoot } = require('./lib/epicWorktreeBoot.cjs');
 const queueStore = require('./lib/queueStore.cjs');
 const { splitFrontmatter, parsePrdFile, serializePrdFile } = require('./lib/prdFrontmatter.cjs');
+const { resolveDepSlug, findNearMatches } = require('./lib/depSlugResolve.cjs');
 const { migratePrds, consolidateFlatPrds, legacyAdoptExistingPrds } = require('./lib/prdMigration.cjs');
 const { allProjectCwds } = require('../../scripts/lib/activeSessions.cjs');
 
@@ -2072,11 +2074,24 @@ async function reconcile(state) {
       exitCode: null,
       error: null,
     };
-    // Newly-discovered fix-plan PRD: stamp its investigationDepth relative to
-    // the original job it heals, so selectAutoFixTargets/spawnInvestigation
-    // can bound the fix-of-a-fix recursion (see MAX_INVESTIGATION_DEPTH).
-    // Non-fix-plan jobs get no explicit field — they read as depth 1 via `?? 1`.
-    if (isFixPlanSlug(slug)) {
+    // Fix-plan classification (PRD 1131): a freshly-discovered PRD is a
+    // genuine scheduler-authored fix plan only when its OWN provenance says
+    // so — an explicit isFixPlan:true stamp (spawnInvestigation's prompt
+    // template) or the absence of any createdVia stamp at all (legacy
+    // fallback, matching the "no provenance = trust the name" rule the
+    // quarantine gate below already applies) — never merely because the
+    // slug looks like one. See lib/fixPlanSlug.cjs's header for why (PRD
+    // 1126: a scheduler_create_prd-authored PRD whose slug happened to start
+    // with "fix-" was wrongly stamped investigationDepth before it ever ran).
+    // Persisted onto the queue row so every later consumer
+    // (commitGuardVerdict, isFixPlanBeyondDepthCap, the fix-plan-completion
+    // checks) reads this stamp instead of re-deriving it from the name.
+    entry.isFixPlan = classifyDiscoveredFixPlan(p, slug);
+    // Stamp investigationDepth relative to the original job it heals, so
+    // selectAutoFixTargets/spawnInvestigation can bound the fix-of-a-fix
+    // recursion (see MAX_INVESTIGATION_DEPTH). Non-fix-plan jobs get no
+    // explicit field — they read as depth 1 via `?? 1`.
+    if (entry.isFixPlan) {
       const parent = healTargetForFix(slug, state.jobs);
       entry.investigationDepth = parent ? (parent.investigationDepth ?? 1) + 1 : 2;
     }
@@ -2088,8 +2103,9 @@ async function reconcile(state) {
     // guard-prd-writes.cjs PreToolUse hook should have denied. Fix-plan PRDs
     // are exempt: spawnInvestigation's own probe writes them directly by
     // design (a trusted, scheduler-spawned internal loop, not an
-    // agent/human authoring a PRD), matching the isFixPlanSlug convention
-    // used everywhere else this distinction matters.
+    // agent/human authoring a PRD) — entry.isFixPlan (just classified above)
+    // is the provenance-aware verdict for that exemption now, not a raw
+    // isFixPlanSlug name check.
     //
     // Quarantine is loud and reversible, never a silent skip (see the
     // 2026-08-01 23-PRD outage this file's header references for what a
@@ -2098,7 +2114,7 @@ async function reconcile(state) {
     // (schedule:adopt-prd) that stamps the file via the same update-prd API
     // route the MCP tool uses — reconcile()'s adopt path above promotes it
     // to 'pending' on the very next pass, within one tick of being stamped.
-    if (!p.createdVia && !isFixPlanSlug(slug)) {
+    if (!p.createdVia && !entry.isFixPlan) {
       entry.status = 'quarantined';
       // Stamped at creation (not via transitionJob, since this is a
       // brand-new row minted directly at 'quarantined' rather than
@@ -2584,6 +2600,17 @@ function resetJobFields(job, errorMsg, opts = {}) {
   delete job.verifierVerdict;
   delete job.uncommittedPaths;
   delete job.resumeRecoveryAttempted;
+  // Same one-attempt-per-episode category as resumeRecoveryAttempted above —
+  // a re-fired row must be able to earn a fresh mechanical-recovery attempt
+  // if it parks needs_review again (PRD 1130).
+  delete job.mechanicalRecoveryAttempted;
+  // Quarantine (PRD 1128) is scoped to THIS run's episode exactly like
+  // resumeRecoveryAttempted above — a re-fired row must be able to earn a
+  // fresh quarantine attempt if it parks needs_review again.
+  delete job.leftoverQuarantineAttempted;
+  delete job.quarantinedTo;
+  delete job.quarantinedCommit;
+  delete job.quarantinedPaths;
   // Same "this run's outcome, not durable across a reset" category as the
   // fields above — a stale 'archive' recoveryAction from a prior life of this
   // slug must never survive a reset and silently exclude a genuinely-new
@@ -2592,6 +2619,10 @@ function resetJobFields(job, errorMsg, opts = {}) {
   // can otherwise linger forever when RCA is disabled or errors).
   delete job.rcaFailureClass;
   delete job.rcaRecoveryAction;
+  // Same "this run's outcome, not durable across a reset" category — a
+  // human-driven reset must genuinely start the auto-fix budget over,
+  // including the one-time dead-fix-plan-child reopen (PRD 1129).
+  delete job.autoFixReopened;
   // Like exitCode: this run's outcome, not durable across a reset — a stale
   // leak badge from a prior attempt must not linger once the job re-fires.
   delete job.leakedDescendants;
@@ -3303,6 +3334,302 @@ As the LAST LINE of your final result text, emit exactly one of:
 Print PASS only once the commit above has actually landed.`;
 }
 
+/**
+ * Mechanical recovery (PRD 1130). isFixPlanBeyondDepthCap (below) is the
+ * ONLY gate on re-investigating a fix-plan job at investigationDepth >= 2 —
+ * correct for open-ended "author another plan" recursion, but it also
+ * strands a depth-capped job whose failure was fully mechanical (no
+ * judgement required) with no other ladder rung, since resume-first recovery
+ * (selectResumeRecoveryTarget above) is hard-gated on verdict
+ * 'uncommitted_changes'. This rung is evaluated INDEPENDENTLY of
+ * isFixPlanBeyondDepthCap — depth never disqualifies it, because unlike
+ * auto-fix it authors no plan and spawns no model; it is pure git.
+ *
+ * The closed set of mechanically-resolvable verdicts starts at exactly
+ * 'worktree_integration_failed': PRD 1125 already taught integrateBranch to
+ * parse git's "would be overwritten by merge" stderr, verify the blocking
+ * paths are byte-identical to the branch, discard the proven duplicates, and
+ * retry the merge once. A job parked with this verdict has its `sm-job/
+ * <slug>` branch preserved (integrateJobBranch never deletes the branch on
+ * failure — see cleanupJobWorktree's `keepBranch: !integration.ok`), so a
+ * plain re-call of integrateBranch against that same branch inherits PRD
+ * 1125's auto-resolution for free — no re-implementation needed here.
+ *
+ * Bounded to exactly one attempt via job.mechanicalRecoveryAttempted,
+ * stamped in the SAME mutate as the outcome (performMechanicalRecovery,
+ * below) — never here — so this selector alone can be unit-tested exactly
+ * like selectResumeRecoveryTarget/selectLeftoverQuarantineTarget.
+ *
+ * Kill-switch: SM_MECHANICAL_RECOVERY_DISABLE=1 restores today's behaviour
+ * exactly (always returns null), mirroring SM_RESUME_RECOVERY_DISABLE.
+ */
+const MECHANICALLY_RESOLVABLE_VERDICTS = new Set(['worktree_integration_failed']);
+
+function selectMechanicalRecoveryTarget(job) {
+  if (process.env.SM_MECHANICAL_RECOVERY_DISABLE === '1') return null;
+  if (!job || job.status !== 'needs_review') return null;
+  if (!MECHANICALLY_RESOLVABLE_VERDICTS.has(job.verifierVerdict)) return null;
+  if (job.mechanicalRecoveryAttempted === true) return null;
+  const cwd = job.cwd || DEFAULT_PROJECT_CWD;
+  return { slug: job.slug, cwd, branch: jobWorktree.branchNameFor(job.slug), carriedPaths: job.carriedPaths || [] };
+}
+
+/**
+ * Perform an already-selected mechanical recovery (selectMechanicalRecoveryTarget
+ * above) — a direct re-attempt of integrateBranch against the job's preserved
+ * branch, never a fresh `claude -p` dispatch. On success the job transitions
+ * needs_review -> completed and its verifierVerdict is cleared; the branch,
+ * now merged, is deleted like any other successfully-integrated job branch.
+ * On failure (including a branch that no longer exists — already deleted or
+ * already merged) the job stays needs_review, mechanicalRecoveryAttempted is
+ * stamped, and the retry's own failure text is appended to `error`. Either
+ * way mechanicalRecoveryAttempted is stamped in this SAME mutate, so a crash
+ * between the git call returning and this mutate landing simply repeats an
+ * idempotent git operation on the next pass rather than leaving the job
+ * re-eligible forever.
+ */
+async function performMechanicalRecovery(job, target) {
+  const integration = await jobWorktree.integrateJobBranch({
+    cwd: target.cwd, branch: target.branch, slug: target.slug, carriedPaths: target.carriedPaths,
+  });
+  if (integration.ok) {
+    await jobWorktree.cleanupJobWorktree({ cwd: target.cwd, dir: undefined, branch: target.branch, keepBranch: false });
+  }
+  let becameCompleted = false;
+  await mutate((s) => {
+    const j = s.jobs.find((x) => x.slug === job.slug);
+    if (!j) return;
+    j.mechanicalRecoveryAttempted = true;
+    if (integration.ok) {
+      if (transitionJob(j, 'completed', {
+        reason: `mechanical recovery: ${target.branch} re-integrated successfully`,
+        source: 'scheduler:mechanicalRecovery',
+      })) {
+        delete j.verifierVerdict;
+        j.exitCode = 0;
+        j.error = null;
+        becameCompleted = true;
+      }
+    } else {
+      const pointer = `Mechanical recovery retry failed: ${integration.reason}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+    }
+  });
+  if (integration.ok) {
+    console.log(`[scheduler] mechanical-recovery: ${job.slug} → completed (branch ${target.branch} re-integrated)`);
+    if (becameCompleted) await archiveCompletedPrd(job.slug, job.cwd);
+  } else {
+    console.error(`[scheduler] mechanical-recovery: ${job.slug} → retry failed: ${integration.reason}`);
+  }
+}
+
+/**
+ * Leftover quarantine (PRD 1128). Resume-first recovery gets exactly one
+ * `--resume` attempt (selectResumeRecoveryTarget above); when that attempt
+ * ALSO parks needs_review with 'uncommitted_changes', the leftovers are
+ * about to sit dirty in the SHARED tree forever — git then refuses any later
+ * worktree merge for this cwd that would overwrite them, turning one parked
+ * job into a project-wide stall (216-jupiter-sand-kazekage, 2026-09-06).
+ * Pure/no I/O, mirroring selectResumeRecoveryTarget so the eligibility rule
+ * is unit-testable directly.
+ *
+ * Bounded to exactly one attempt via job.leftoverQuarantineAttempted, stamped
+ * synchronously by the caller in the SAME mutate as this decision (never
+ * here) — see spawnJob's finalize and reverifyNeedsReview's periodic pass.
+ *
+ * Kill-switch: SM_LEFTOVER_QUARANTINE_DISABLE=1 restores today's behaviour
+ * exactly (always returns null), mirroring SM_RESUME_RECOVERY_DISABLE.
+ */
+function selectLeftoverQuarantineTarget(job) {
+  if (process.env.SM_LEFTOVER_QUARANTINE_DISABLE === '1') return null;
+  if (!job || job.status !== 'needs_review') return null;
+  if (job.verifierVerdict !== 'uncommitted_changes') return null;
+  if (job.resumeRecoveryAttempted !== true) return null;
+  if (job.leftoverQuarantineAttempted === true) return null;
+  const uncommittedPaths = Array.isArray(job.uncommittedPaths)
+    ? job.uncommittedPaths.filter((p) => typeof p === 'string' && p.length > 0)
+    : [];
+  if (!uncommittedPaths.length) return null;
+  // The single most important constraint: never touch a path that was
+  // ALREADY dirty at this run's own dispatch time (preRunDirtyPaths) — that
+  // is foreign WIP (a human's or a sibling's), not this job's own leftover.
+  const preRunDirty = new Set(Array.isArray(job.preRunDirtyPaths) ? job.preRunDirtyPaths : []);
+  const paths = uncommittedPaths.filter((p) => !preRunDirty.has(p));
+  if (!paths.length) return null;
+  return { slug: job.slug, cwd: job.cwd, paths };
+}
+
+function execGitAt(cwd, args, { env, timeout = 20_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(
+      'git',
+      ['-C', cwd, ...args],
+      { timeout, windowsHide: true, encoding: 'utf8', env: env ? { ...process.env, ...env } : process.env },
+      (err, stdout, stderr) => {
+        if (err) {
+          err.stderrText = stderr;
+          reject(err);
+          return;
+        }
+        resolve(stdout || '');
+      },
+    );
+  });
+}
+
+async function pathExistsInTree(cwd, treeish, p) {
+  try {
+    await execGitAt(cwd, ['cat-file', '-e', `${treeish}:${p}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Commit exactly `paths` (must already be dirty on disk) onto a dedicated
+ * `sm-salvage/<slug>` ref, built from `headBefore` (or current HEAD when
+ * unavailable) via a THROWAWAY `GIT_INDEX_FILE` — never touches the live
+ * index, never moves the checked-out branch — then restores those paths to
+ * match that baseline commit's tree, so the shared working tree returns to
+ * its pre-run state. This is deliberately NOT `git stash` (the destructive-
+ * git guard blocks stash on a shared tree, and a stash nobody restores
+ * strands the work invisibly — see standards.md).
+ *
+ * Never throws: any git failure, or a non-git cwd, aborts the WHOLE attempt
+ * with the tree untouched (no partial restore) — restore only ever runs
+ * after the salvage ref/commit has safely landed, so a failure there leaves
+ * the data recoverable from the ref even though the tree stayed dirty.
+ * A path no longer dirty on disk (already committed, or reverted since) is
+ * skipped, never force-restored.
+ */
+async function quarantineLeftovers({ cwd, slug, paths, headBefore }) {
+  if (!cwd || !slug || !Array.isArray(paths) || paths.length === 0) {
+    return { ok: false, reason: 'no cwd/slug/paths given' };
+  }
+  let baseline = headBefore || null;
+  try {
+    if (!baseline) {
+      baseline = (await execGitAt(cwd, ['rev-parse', 'HEAD'])).trim();
+    }
+    if (!baseline) return { ok: false, reason: 'could not resolve a baseline commit (non-git cwd?)' };
+
+    const dirtyNowRaw = await execGitAt(cwd, ['status', '--porcelain', '--', ...paths]);
+    const dirtyNow = new Set(parsePorcelain(dirtyNowRaw));
+    const toQuarantine = paths.filter((p) => dirtyNow.has(p));
+    const skippedPaths = paths.filter((p) => !dirtyNow.has(p));
+    if (!toQuarantine.length) {
+      return { ok: true, ref: null, commit: null, quarantinedPaths: [], skippedPaths };
+    }
+
+    const tmpIndex = path.join(os.tmpdir(), `sm-salvage-index-${slug}-${process.pid}-${Date.now()}`);
+    const env = { GIT_INDEX_FILE: tmpIndex };
+    let treeSha;
+    let commitSha;
+    try {
+      await execGitAt(cwd, ['read-tree', baseline], { env });
+      for (const p of toQuarantine) {
+        if (fs.existsSync(path.join(cwd, p))) {
+          await execGitAt(cwd, ['add', '--', p], { env });
+        } else {
+          await execGitAt(cwd, ['rm', '--cached', '--ignore-unmatch', '--', p], { env });
+        }
+      }
+      treeSha = (await execGitAt(cwd, ['write-tree'], { env })).trim();
+      commitSha = (await execGitAt(cwd, ['commit-tree', treeSha, '-p', baseline, '-m', `salvage: leftover changes from ${slug}`], { env })).trim();
+    } catch (e) {
+      return { ok: false, reason: `git command failed while building the salvage commit: ${(e && (e.stderrText || e.message)) || e}` };
+    } finally {
+      await fsp.rm(tmpIndex, { force: true }).catch(() => {});
+    }
+
+    const ref = `sm-salvage/${slug}`;
+    try {
+      await execGitAt(cwd, ['update-ref', `refs/heads/${ref}`, commitSha]);
+    } catch (e) {
+      return { ok: false, reason: `git command failed updating ${ref}: ${(e && (e.stderrText || e.message)) || e}` };
+    }
+
+    // The salvage commit is safely landed at this point — a failure from here
+    // on is reported with the ref/commit still attached so nothing looks lost
+    // even if the tree itself couldn't be fully restored.
+    try {
+      const inBaseline = [];
+      const notInBaseline = [];
+      for (const p of toQuarantine) {
+        // eslint-disable-next-line no-await-in-loop
+        if (await pathExistsInTree(cwd, baseline, p)) inBaseline.push(p); else notInBaseline.push(p);
+      }
+      if (inBaseline.length) {
+        await execGitAt(cwd, ['checkout', baseline, '--', ...inBaseline]);
+      }
+      if (notInBaseline.length) {
+        await execGitAt(cwd, ['reset', '--', ...notInBaseline]).catch(() => {});
+        for (const p of notInBaseline) {
+          // eslint-disable-next-line no-await-in-loop
+          await fsp.rm(path.join(cwd, p), { force: true });
+        }
+      }
+    } catch (e) {
+      return {
+        ok: false,
+        ref,
+        commit: commitSha,
+        reason: `salvage commit landed at ${ref} (${commitSha}) but restoring the working tree failed: ${(e && (e.stderrText || e.message)) || e}`,
+      };
+    }
+
+    return { ok: true, ref, commit: commitSha, quarantinedPaths: toQuarantine, skippedPaths };
+  } catch (e) {
+    return { ok: false, reason: `git command failed: ${(e && (e.stderrText || e.message)) || e}` };
+  }
+}
+
+/**
+ * Perform an already-selected quarantine (job.leftoverQuarantineAttempted
+ * must already be true, stamped by the caller) and persist the outcome onto
+ * the job row: `quarantinedTo`/`quarantinedCommit`/`quarantinedPaths` on
+ * success, plus a one-line pointer appended to `error` naming the ref so a
+ * human can recover with a single named command
+ * (`git show sm-salvage/<slug>`). The belt-and-braces `salvagePatch` (when
+ * present) is referenced alongside it, never removed. On failure, only a
+ * diagnostic is appended — the job row's dirt-describing fields are left as
+ * they were, since the tree itself was left untouched (or, for a
+ * restore-only failure, the salvage ref is still named in the note).
+ *
+ * `headBefore`, when the caller has it fresh (spawnJob's own finalize still
+ * has the local `guardHeadBefore` in scope for the run that just parked —
+ * the same value is deleted off the job ROW earlier in that same finalize),
+ * is used as the salvage ref's baseline commit; otherwise (the periodic
+ * reverifyNeedsReview pass, re-discovering an already-parked row) this falls
+ * back to the current HEAD inside quarantineLeftovers itself.
+ */
+async function performLeftoverQuarantine(job, paths, headBefore = null) {
+  const result = await quarantineLeftovers({
+    cwd: job.cwd || DEFAULT_PROJECT_CWD,
+    slug: job.slug,
+    paths,
+    headBefore: headBefore || job.guardHeadBefore || null,
+  });
+  await mutate((s) => {
+    const j = s.jobs.find((x) => x.slug === job.slug);
+    if (!j) return;
+    if (result.ok && Array.isArray(result.quarantinedPaths) && result.quarantinedPaths.length) {
+      j.quarantinedTo = result.ref;
+      j.quarantinedCommit = result.commit;
+      j.quarantinedPaths = capDirtyPaths(result.quarantinedPaths);
+      const salvageNote = j.salvagePatch ? `; salvage patch also at ${j.salvagePatch}` : '';
+      const pointer = `Leftovers quarantined to ${result.ref} (commit ${result.commit}) — recover via \`git show ${result.ref}\`${salvageNote}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+      console.log(`[scheduler] ${job.slug}: quarantined ${result.quarantinedPaths.length} leftover path(s) to ${result.ref} (${result.commit})`);
+    } else if (!result.ok) {
+      const pointer = `Leftover quarantine failed: ${result.reason}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+      console.error(`[scheduler] ${job.slug}: leftover quarantine failed: ${result.reason}`);
+    }
+  });
+}
+
 /**
  * Pure argv builder for a `claude -p` child spawn, shared so the
  * resume-vs-fresh-session choice is made in exactly one place. `resume`
@@ -3782,13 +4109,9 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
 // project (keyed by cwd) so jobs in different repos run concurrently up to
 // the cap; within one project, sequential-group semantics are preserved.
 
-/**
- * Recognize fix-plan slugs (NN-fix-...) so we don't recurse on a fix-plan that
- * itself failed. The pattern matches the slug we generate in spawnInvestigation.
- */
-function isFixPlanSlug(slug) {
-  return /^\d+-fix-/.test(slug);
-}
+// isFixPlanSlug/classifyDiscoveredFixPlan/resolveIsFixPlan now live in
+// lib/fixPlanSlug.cjs (PRD 1131) — see that module's header for why slug
+// shape alone is no longer sufficient to classify a fix plan.
 
 /**
  * The fix-plan slug spawnInvestigation authors for a given failed job —
@@ -3827,7 +4150,25 @@ function healTargetForFix(fixSlug, jobs) {
  * unit-tested (no spawn, no fs). Inputs are the already-resolved values that
  * spawnInvestigation computes.
  */
-function buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group }) {
+function buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group, deadChild = null }) {
+  const deadFixChildNote = deadChild ? `
+
+# This is a REOPENED investigation — your own prior fix plan died
+You already investigated this job once and produced a fix-plan PRD, \`${deadChild.slug}\`, which was
+supposed to heal it. That fix-plan job itself reached a terminal, non-completed status
+(\`${deadChild.status}\`) without ever fixing the original failure — so the parent job you are now
+investigating is stuck again with nothing left to retry it automatically. This is the ONE reopen
+this parent gets; do not cold-read the log and re-derive the plan that already failed.
+
+Dead fix-plan child's own outcome:
+- Slug: ${deadChild.slug}
+- Status: ${deadChild.status}
+- Verifier verdict: ${deadChild.verifierVerdict ?? '(none recorded)'}
+- Error: ${deadChild.error ?? '(none recorded)'}
+
+Read why THAT job died (its own run log, if any, under the runs directory) before writing a new
+fix-plan PRD, and make sure your new plan is genuinely different from — not a repeat of — whatever
+that dead child attempted.` : '';
   const abandonedBackgroundTaskNote = failedJob.verifierVerdict === 'abandoned_background_task' ? `
 
 # Known failure class: abandoned background task
@@ -3848,7 +4189,7 @@ The fix-plan PRD you write for this MUST instruct its executor to, in order:
 1. Check for a salvage patch (named \`<slug>.uncommitted.patch\` in the run directory${failedJob.salvagePatch ? `, e.g. \`${failedJob.salvagePatch}\`` : ''}) and, if found, apply it to the working tree BEFORE inspecting \`git status\`/\`git diff\` in ${cwd} for uncommitted changes matching the original PRD's acceptance criteria.
 2. If the work is present (via the applied patch or already in the tree) and satisfies the acceptance criteria, run the project's verify commands and COMMIT it — do not re-implement or re-plan the PRD from scratch.
 3. Only fall back to re-implementing whatever acceptance criteria are genuinely missing after applying any salvage patch, not the whole PRD.` : '';
-  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.${abandonedBackgroundTaskNote}
+  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.${deadFixChildNote}${abandonedBackgroundTaskNote}
 
 # Failed job
 - Slug: ${failedJob.slug}
@@ -3893,8 +4234,13 @@ ${logTail}
    cwd: ${cwd}
    parallelGroup: ${group}
    estimateMinutes: <your time estimate>
+   isFixPlan: true
    ---
    \`\`\`
+   \`isFixPlan: true\` is REQUIRED — it is the scheduler's provenance signal that this PRD is a
+   genuine auto-authored fix plan (not a human/agent PRD whose slug merely happens to start with
+   "fix-"); omitting it means this fix plan will not get its depth-cap/zero-edit-commit-guard
+   exemptions.
    \`cwd\` must be the git repo root where the fix will actually land. If the failed job's cwd is
    not that repo (e.g. a scratch dir like \`/tmp\`), set \`cwd:\` to the correct repo root instead —
    the scheduler's commit guard and post-run verifier read git state from this path, and a
@@ -3968,7 +4314,7 @@ function readRunOutcomeSidecars(runDir, slug) {
  */
 const INVESTIGATION_LAUNCH_KEY = 'investigation';
 
-async function spawnInvestigation(failedJob, runDir) {
+async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {}) {
   // The probe launches with the same CLI as the job it diagnoses. While
   // that CLI cannot launch at all (launch circuit breaker, issue #11 list
   // B1: probes e4f82da2/d374e6bf died on the same HTTP 400 as the runs
@@ -3997,7 +4343,14 @@ async function spawnInvestigation(failedJob, runDir) {
     console.log(`[scheduler] skip investigation: ${failedJob.slug} is resume-recovery eligible`);
     return { deferred: false };
   }
-  if (isFixPlanBeyondDepthCap(failedJob.slug, failedJob.investigationDepth)) {
+  // Mechanical recovery (PRD 1130): same first-refusal treatment — a job
+  // eligible for a pure-git retry must never also get a cold-read fix-plan
+  // PRD authored in the same pass.
+  if (selectMechanicalRecoveryTarget(failedJob)) {
+    console.log(`[scheduler] skip investigation: ${failedJob.slug} is mechanical-recovery eligible`);
+    return { deferred: false };
+  }
+  if (isFixPlanBeyondDepthCap(failedJob.slug, failedJob.investigationDepth, failedJob.isFixPlan)) {
     console.log(`[scheduler] skip investigation: ${failedJob.slug} is a fix plan at/beyond depth cap (depth=${failedJob.investigationDepth ?? 'none'})`);
     return { deferred: false };
   }
@@ -4054,7 +4407,13 @@ async function spawnInvestigation(failedJob, runDir) {
 
   const logTail = readTail(failedLogPath, 16 * 1024) || '(failed to read log)';
 
-  if (fs.existsSync(fixPath)) {
+  // A dead-fix-plan reopen (PRD 1129) targets the SAME fixPath its dead
+  // child was originally authored at, by construction (fixSlugFor is a pure
+  // function of the parent) — the file existing is not staleness here, it's
+  // the whole reason a reopen was offered. Skip the guard in that one case
+  // so the second investigation can overwrite the dead plan; every other
+  // caller keeps the original protection against clobbering a live sibling.
+  if (fs.existsSync(fixPath) && !deadChild) {
     console.log(`[scheduler] skip investigation: fix plan already exists at ${fixPath}`);
     releaseSlot();
     return { deferred: false };
@@ -4080,7 +4439,7 @@ async function spawnInvestigation(failedJob, runDir) {
     console.warn(`[scheduler] investigation cwd is not a git repo (${cwd}); falling back to ${DEFAULT_PROJECT_CWD}`);
     cwd = DEFAULT_PROJECT_CWD;
   }
-  const prompt = buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group });
+  const prompt = buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group, deadChild });
 
   // Phase 1: open log fd for pre-spawn diagnostics.
   const { fd, safeLog, closeFd } = openLog(investigationLogPath);
@@ -4209,6 +4568,22 @@ async function spawnInvestigation(failedJob, runDir) {
         mutate((s) => {
           const j = s.jobs.find((x) => x.slug === failedJob.slug);
           if (j) j.autoFixOutcome = 'plan';
+          // Dead-fix-plan reopen (PRD 1129): fixSlugFor is a pure function of
+          // the parent, so the freshly-authored plan landed at the SAME slug
+          // as the dead child — reconcile() sees an already-known slug and
+          // will never re-mint a pending row for it. Explicitly reset the
+          // dead child's own row here so the overwritten plan actually gets
+          // a chance to run, rather than sitting inert behind a permanently
+          // terminal queue row. force:true because 'skipped' (a valid dead
+          // status here) is otherwise reset-refused by design.
+          if (deadChild) {
+            const child = s.jobs.find((x) => x.slug === deadChild.slug);
+            if (child) {
+              resetJobFields(child, 'reset by dead-fix-plan reopen: parent investigation authored a new plan', {
+                force: true, source: 'spawnInvestigation:dead-fix-plan-reopen',
+              });
+            }
+          }
         }).catch(() => {});
       } else {
         console.log(`[scheduler] investigation finished WITHOUT producing fix plan (slug=${failedJob.slug}, code=${exitCode})`);
@@ -4291,6 +4666,58 @@ async function computeLaunchHolds(state, { now = Date.now(), claudeVersion } = {
   return held;
 }
 
+/**
+ * computeDepHistorySatisfaction(state) → Map<cwd, Set<string>|symbol>
+ *
+ * PRD 1122's once-per-tick dependsOn history/archive lookup: for every
+ * distinct project cwd with jobs this tick, builds the set of dep slugs that
+ * have no live queue row but are nonetheless known-satisfied — a completed
+ * record in that project's own `state/history.jsonl` shard
+ * (queueHistory.completedSlugsForCwd, scoped per-project so a same-named PRD
+ * in an unrelated project can never satisfy a dep here), or a `.md` file
+ * under any of that project's `prds-archived/` dirs (listArchivedPrdDirs —
+ * covers both the retired flat layout and every Epic's own sibling archive).
+ * findBlockingDep (schedulerBatch.cjs) treats a dep slug as blocking
+ * whenever it has no live row AND is absent from this set, so a typo or a
+ * double-prefixed slug (the exact 2026-09-06 starry-night-ships incident)
+ * HOLDS its dependent instead of silently dispatching it.
+ *
+ * Fails OPEN per project, never queue-wide: a history-shard or archive-scan
+ * read error for one cwd degrades that cwd's value to
+ * `DEP_HISTORY_FAIL_OPEN` (findBlockingDep then treats every rowless dep in
+ * that project as satisfied, exactly today's pre-1122 behaviour) with a
+ * logged warning — it never throws out of this function and never blocks
+ * every OTHER project's dispatch for one project's bad fs state.
+ *
+ * Computed ONCE here, before pickNextBatch runs, and threaded down as pure
+ * data (quietOpts.satisfiedSlugsByCwd) — schedulerBatch.cjs itself does no
+ * I/O, so this is the only fs read this gate costs per tick, not one per job
+ * per dep.
+ */
+async function computeDepHistorySatisfaction(state) {
+  const byCwd = new Map();
+  const cwds = new Set((state?.jobs || []).map((j) => j.cwd || DEFAULT_PROJECT_CWD));
+  for (const cwd of cwds) {
+    const satisfied = new Set();
+    try {
+      for (const slug of await queueHistory.completedSlugsForCwd(cwd)) satisfied.add(slug);
+      for (const dir of listArchivedPrdDirs(cwd)) {
+        let entries;
+        try { entries = await fsp.readdir(dir); } catch { continue; }
+        for (const name of entries) {
+          if (name.endsWith('.md')) satisfied.add(name.slice(0, -3));
+        }
+      }
+    } catch (e) {
+      console.warn(`[scheduler] depHistorySatisfaction: history/archive lookup failed for ${cwd} (${e?.message}) — falling back to fail-open dep resolution for this project this tick`);
+      byCwd.set(cwd, DEP_HISTORY_FAIL_OPEN);
+      continue;
+    }
+    byCwd.set(cwd, satisfied);
+  }
+  return byCwd;
+}
+
 /**
  * A run that never got a turn (res.launchFailure — see executeJob's onExit)
  * is routed here instead of the failed/investigation path (issue #11 lists
@@ -4586,6 +5013,11 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     let res;
     let worktreeLeftoverDirty = [];
     let worktreeIntegrationFailure = null;
+    // Set only when integrateJobBranch's stderr-parsing auto-resolve fired
+    // (PRD 1125) — surfaced on the job row so the Queue UI can say the merge
+    // self-healed rather than silently looking like an ordinary merge.
+    let mergeAutoResolved = null;
+    let mergeAutoResolvedPaths = null;
     // A job's uncommitted-work patch, whichever isolation mode produced it —
     // set by EITHER branch below, never both (worktree.ok picks exactly one
     // shape for the whole run). Named generically (not "worktree...") because
@@ -4633,6 +5065,11 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           console.error(`[scheduler] ${job.slug}: worktree branch integration FAILED (${integration.reason}) — branch ${worktree.branch} preserved in ${guardCwd} for manual recovery`);
         } else if (integration.integrated) {
           console.log(`[scheduler] ${job.slug}: worktree branch ${worktree.branch} integrated into ${guardCwd}${integration.mergeCommit ? ' (merge commit)' : ' (fast-forward)'}`);
+          if (integration.autoResolved) {
+            mergeAutoResolved = integration.autoResolved;
+            mergeAutoResolvedPaths = integration.resolvedPaths || [];
+            console.log(`[scheduler] ${job.slug}: merge auto-resolved (${integration.autoResolved}) — discarded ${mergeAutoResolvedPaths.length} identical working-tree duplicate(s): ${mergeAutoResolvedPaths.join(', ')}`);
+          }
         }
         await jobWorktree.cleanupJobWorktree({
           cwd: guardCwd,
@@ -4868,7 +5305,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           ranInWorktree: worktree.ok,
           jobSelfCommitted,
           legitimateNoOp: guardIsLegitimateNoOp,
-          isFixPlanJob: isFixPlanSlug(job.slug),
+          isFixPlanJob: resolveIsFixPlan(job.slug, job.isFixPlan),
           verifyResult,
           salvagePatch,
         });
@@ -4945,9 +5382,14 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     let failedJobSnapshot = null;
     let needsInvestigationNow = false;
     let investigationJobSnapshot = null;
+    let investigationDeadChildSnapshot = null;
     let needsReviewRcaSnapshot = null;
     let resumeRecoveryJob = null;
     let resumeRecoveryTarget = null;
+    let quarantineJob = null;
+    let quarantinePaths = null;
+    let mechanicalRecoveryJob = null;
+    let mechanicalRecoveryTarget = null;
     let terminalNotifySnapshot = null;
     const newlyCompletedPrds = [];
     await mutate((s) => {
@@ -5042,6 +5484,17 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           } else {
             delete s.jobs[i2].uncommittedPaths;
           }
+          // Worktree merge self-healed (PRD 1125) — every blocking path was
+          // proven byte-identical to the branch, so the duplicate was
+          // discarded and the merge retried once, successfully. Surfaced so
+          // the Queue UI shows a self-heal instead of an ordinary merge.
+          if (mergeAutoResolved) {
+            s.jobs[i2].mergeAutoResolved = mergeAutoResolved;
+            s.jobs[i2].mergeAutoResolvedPaths = capDirtyPaths(mergeAutoResolvedPaths);
+          } else {
+            delete s.jobs[i2].mergeAutoResolved;
+            delete s.jobs[i2].mergeAutoResolvedPaths;
+          }
           // Non-blocking notes (e.g. a recovered missing-dependency probe, or a
           // pattern hit demoted because a materially-checkable verdict outranked
           // it) — surfaced even on completed jobs so the signal isn't lost.
@@ -5092,6 +5545,18 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             // takes the treatAsPending branch above and never reaches here).
             needsReviewRcaSnapshot = { ...s.jobs[i2] };
 
+            // Mechanical recovery (PRD 1130): evaluated FIRST, ahead of both
+            // resume-first recovery and auto-fix — a job parked with a
+            // mechanically-resolvable verdict (see
+            // selectMechanicalRecoveryTarget) needs no model, no plan, and no
+            // depth-cap check, so it must never fall through to either.
+            // Snapshot only (no I/O inside mutate()); the actual git retry
+            // happens outside mutate(), below.
+            const mTarget = selectMechanicalRecoveryTarget(s.jobs[i2]);
+            if (mTarget) {
+              mechanicalRecoveryJob = { ...s.jobs[i2] };
+              mechanicalRecoveryTarget = mTarget;
+            } else {
             // Resume-first recovery (PRD 1111): evaluated BEFORE the auto-fix
             // eligibility check below — a job whose verdict is
             // 'uncommitted_changes' with a live sessionId gets one bounded
@@ -5105,6 +5570,22 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               resumeRecoveryJob = { ...s.jobs[i2] };
               resumeRecoveryTarget = target;
             } else {
+            // Leftover quarantine (PRD 1128): resume recovery is spent
+            // (resumeRecoveryAttempted already true) and this run STILL parked
+            // needs_review with uncommitted_changes — the leftovers are about
+            // to sit dirty in the shared tree forever, poisoning every later
+            // worktree merge for this cwd. Stamp the one-attempt marker HERE,
+            // synchronously in the same mutate as this decision (mirrors
+            // resumeRecoveryAttempted's own stamp-before-acting rule above),
+            // so a concurrent reverifyNeedsReview pass can never double-fire
+            // this. The actual git work is async and runs outside mutate(),
+            // below (performLeftoverQuarantine).
+            const quarantineTarget = selectLeftoverQuarantineTarget(s.jobs[i2]);
+            if (quarantineTarget) {
+              s.jobs[i2].leftoverQuarantineAttempted = true;
+              quarantineJob = { ...s.jobs[i2] };
+              quarantinePaths = quarantineTarget.paths;
+            }
             // Same-tick auto-fix (feedback 2026-07-12): rather than waiting up to
             // 10 min for reverifyNeedsReview()'s periodic pass, check right here
             // whether this job qualifies for auto-fix (same eligibility rule
@@ -5119,8 +5600,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               isEligibleForImmediateAutoFix(s.jobs[i2], s.jobs, fixSlugExists)
             ) {
               const isRetryAttempt = s.jobs[i2].autoFixAttempted === true;
+              const isDeadFixPlanReopen = isFixPlanDead(s.jobs[i2], s.jobs);
+              if (isDeadFixPlanReopen) {
+                investigationDeadChildSnapshot = s.jobs.find((x) => x.slug === fixSlugFor(s.jobs[i2])) || null;
+              }
               s.jobs[i2].autoFixAttempted = true;
               if (!s.jobs[i2].runId) s.jobs[i2].runId = runId;
+              if (isDeadFixPlanReopen) s.jobs[i2].autoFixReopened = true;
               if (isRetryAttempt) {
                 s.jobs[i2].autoFixRetries = (s.jobs[i2].autoFixRetries ?? 0) + 1;
                 delete s.jobs[i2].autoFixOutcome;
@@ -5129,13 +5615,14 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               investigationJobSnapshot = { ...s.jobs[i2] };
             }
             }
+            }
           }
           // Auto-promote: when a fix-* PRD completes successfully, the original
           // failed PRD's work is logically done. Flip its status to 'completed'
           // so the cross-group failure gate in pickNextBatch releases. Without
           // this, the queue stalls indefinitely behind a stale failure even
           // though the auto-recovery did its job.
-          if (effectiveStatus === 'completed' && isFixPlanSlug(job.slug)) {
+          if (effectiveStatus === 'completed' && resolveIsFixPlan(job.slug, job.isFixPlan)) {
             const orig = healTargetForFix(job.slug, s.jobs);
             if (orig) {
               const priorStatus = orig.status;
@@ -5207,6 +5694,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
         });
     }
 
+    if (mechanicalRecoveryJob && mechanicalRecoveryTarget) {
+      console.log(`[scheduler] needs_review ${job.slug} → mechanical-recovery (re-integrating ${mechanicalRecoveryTarget.branch})`);
+      performMechanicalRecovery(mechanicalRecoveryJob, mechanicalRecoveryTarget).catch((e) => {
+        console.error('[scheduler] performMechanicalRecovery error', job.slug, e);
+      });
+    }
+
     if (resumeRecoveryJob && resumeRecoveryTarget) {
       console.log(`[scheduler] needs_review ${job.slug} → resume-recovery (session ${resumeRecoveryTarget.sessionId}, ${resumeRecoveryTarget.dirtyPaths.length} dirty path(s))`);
       spawnResumeRecovery(resumeRecoveryJob, resumeRecoveryTarget).catch((e) => {
@@ -5214,6 +5708,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       });
     }
 
+    if (quarantineJob && quarantinePaths) {
+      console.log(`[scheduler] needs_review ${job.slug} → quarantining ${quarantinePaths.length} leftover path(s) (resume recovery already spent)`);
+      performLeftoverQuarantine(quarantineJob, quarantinePaths, guardHeadBefore).catch((e) => {
+        console.error('[scheduler] performLeftoverQuarantine error', job.slug, e);
+      });
+    }
+
     if (actuallyFailed && failedJobSnapshot) {
       // Transient-failure detector. A 143/137 exit is ALWAYS a signal kill — the
       // agent never self-exits with those — so the only question is WHO killed it.
@@ -5286,7 +5787,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       }
     } else if (needsInvestigationNow && investigationJobSnapshot) {
       console.log(`[scheduler] needs_review ${job.slug} → immediate auto-fix investigation (not waiting for periodic reverify)`);
-      spawnInvestigation(investigationJobSnapshot, runDir).catch((e) => {
+      spawnInvestigation(investigationJobSnapshot, runDir, { deadChild: investigationDeadChildSnapshot }).catch((e) => {
         console.error('[scheduler] spawnInvestigation error', job.slug, e);
       });
     }
@@ -5356,11 +5857,13 @@ function tickQueue({ bypassLoadGate = false } = {}) {
     // ceilinged the queue at 3 while the pool the user configured said 5.
     const freeSlots = sessionSlots.available();
     const heldSlugs = await computeLaunchHolds(state);
+    const satisfiedSlugsByCwd = await computeDepHistorySatisfaction(state);
     const { batch, reason: holdReason, holds } = pickNextBatch(state.jobs, runningSet, freeSlots, {
       leaseHeld: quietMachineLease.isHeld(),
       machineInUse: sessionSlots.inUse(),
       now: Date.now(),
       heldSlugs,
+      satisfiedSlugsByCwd,
     });
     if (batch.length === 0 && freeSlots === 0) {
       const snap = sessionSlots.snapshot();
@@ -6025,10 +6528,16 @@ const MAX_INVESTIGATION_DEPTH = 1;
  * no recorded investigationDepth (a job already in the queue before this
  * depth tracking shipped) is treated as excluded too, preserving the
  * pre-existing blanket-exclusion behavior for legacy jobs — no retroactive
- * migration. Non-fix-plan slugs are never capped here. Exported for tests.
+ * migration. Non-fix-plan jobs are never capped here.
+ *
+ * `isFixPlan` (PRD 1131) is the job's own persisted classification stamp
+ * (see lib/fixPlanSlug.cjs's resolveIsFixPlan) — an explicit true/false wins
+ * over the slug; only a row with the field entirely absent (persisted
+ * before this change shipped) falls back to the legacy slug-only heuristic.
+ * Exported for tests.
  */
-function isFixPlanBeyondDepthCap(slug, investigationDepth) {
-  if (!isFixPlanSlug(slug)) return false;
+function isFixPlanBeyondDepthCap(slug, investigationDepth, isFixPlan) {
+  if (!resolveIsFixPlan(slug, isFixPlan)) return false;
   if (investigationDepth == null) return true;
   return investigationDepth >= MAX_INVESTIGATION_DEPTH + 1;
 }
@@ -6081,12 +6590,18 @@ function isUnresolvableNeedsReview(job, { hasRunDir }) {
  * ('no-plan', 'error', and unstamped/undefined) — mirrors the retry
  * eligibility rule in selectAutoFixTargets so a job can never be retry-
  * eligible there and simultaneously un-annotatable here.
+ *
+ * A parent stamped `autoFixReopened: true` (its dead fix-plan child earned
+ * it exactly one further attempt — see isFixPlanDead) is a separate
+ * exhaustion path: it is spent as soon as that second investigation
+ * concludes with ANY outcome, including another 'plan' — a reopened parent
+ * never gets a third attempt, so unlike the fresh case a 'plan' outcome does
+ * not exempt it here.
  */
 function isExhaustedAutoFix(job) {
-  return !!job && job.status === 'needs_review'
-    && job.autoFixAttempted === true
-    && job.autoFixOutcome !== 'plan'
-    && (job.autoFixRetries ?? 0) >= 1;
+  if (!job || job.status !== 'needs_review' || job.autoFixAttempted !== true) return false;
+  if (job.autoFixReopened === true) return job.autoFixOutcome != null;
+  return job.autoFixOutcome !== 'plan' && (job.autoFixRetries ?? 0) >= 1;
 }
 
 /**
@@ -6102,6 +6617,31 @@ function isPlanUnqueued(job, queuedSlugs) {
   return !queuedSlugs.has(fixSlugFor(job));
 }
 
+// Terminal-and-not-completed statuses a fix-plan child can die in — see
+// isFixPlanDead.
+const DEAD_FIX_CHILD_STATUSES = new Set(['needs_review', 'failed', 'quarantined', 'skipped']);
+
+/**
+ * Pure predicate: a parent stuck at outcome 'plan' whose own fix-plan child
+ * (fixSlugFor(job)) has ITSELF died — reached a terminal non-completed
+ * status — with nothing left in the ladder that will ever revisit either
+ * row again (selectAutoFixTargets skips a 'plan' outcome outright, and
+ * isPlanUnqueued only fires when the child never reached the queue at all,
+ * which isn't true once a dead child row exists). `job.autoFixReopened`
+ * gates this to exactly once per parent — once stamped, this always returns
+ * false so the parent can never be reopened a second time. Exported for
+ * tests.
+ */
+function isFixPlanDead(job, jobsInProject) {
+  if (!job || job.status !== 'needs_review') return false;
+  if (job.autoFixOutcome !== 'plan') return false;
+  if (job.autoFixReopened === true) return false;
+  const fixSlug = fixSlugFor(job);
+  const child = (jobsInProject || []).find((j) => j.slug === fixSlug);
+  if (!child) return false;
+  return DEAD_FIX_CHILD_STATUSES.has(child.status);
+}
+
 /**
  * Pure predicate: is this job eligible for the boot re-verify self-heal? Only
  * needs_review jobs with a run log (own or backfilled via resolveRunId) AND a
@@ -6247,16 +6787,30 @@ function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRu
     // bounded `--resume` attempt must never also become a fix-plan target
     // in the same pass — see spawnInvestigation's own identical guard.
     if (selectResumeRecoveryTarget(job)) return false;
+    // Mechanical recovery (PRD 1130): a job eligible for a pure-git retry
+    // must never also become a fix-plan target — it needs no plan and no
+    // model. Defensive: today's single mechanically-resolvable verdict
+    // (worktree_integration_failed) is already excluded below via the depth
+    // cap, but this must hold even if that stops being true.
+    if (selectMechanicalRecoveryTarget(job)) return false;
     const runId = job.runId || resolveJobRunId(job);
     if (!runId) return false;
-    if (isFixPlanBeyondDepthCap(job.slug, job.investigationDepth)) return false;
+    if (isFixPlanBeyondDepthCap(job.slug, job.investigationDepth, job.isFixPlan)) return false;
+    // A dead fix-plan child (PRD 1129) earns its parent exactly one further
+    // attempt, bypassing the normal 'plan' exclusion and the fix-slug/queue
+    // membership checks below — those checks exist to stop a FRESH
+    // investigation from clobbering a live sibling, but here the sibling is
+    // dead and reusing its slug is the whole point of the reopen.
+    const dead = isFixPlanDead(job, jobs);
     if (job.autoFixAttempted) {
-      const retryEligible = job.autoFixOutcome === 'no-plan'
+      const retryEligible = dead
+        || job.autoFixOutcome === 'no-plan'
         || job.autoFixOutcome === 'error'
         || job.autoFixOutcome == null;
       if (!retryEligible) return false;
-      if ((job.autoFixRetries ?? 0) >= 1) return false;
+      if (!dead && (job.autoFixRetries ?? 0) >= 1) return false;
     }
+    if (dead) return true;
     const fixSlug = fixSlugFor(job);
     if (fixSlugExists(fixSlug)) return false;
     if (slugsInQueue.has(fixSlug)) return false;
@@ -6435,7 +6989,7 @@ async function reverifyNeedsReview() {
   const promotedPrds = [];
   await mutate((s) => {
     for (const job of s.jobs) {
-      if (job.status !== 'completed' || !isFixPlanSlug(job.slug)) continue;
+      if (job.status !== 'completed' || !resolveIsFixPlan(job.slug, job.isFixPlan)) continue;
       const orig = healTargetForFix(job.slug, s.jobs);
       if (!orig) continue;
       const priorStatus = orig.status;
@@ -6519,6 +7073,23 @@ async function reverifyNeedsReview() {
     ? await readQueue()
     : afterHealForAnnotate;
 
+  // Mechanical recovery (PRD 1130): evaluated first, ahead of both
+  // resume-first recovery and auto-fix below — catches a job whose
+  // mechanically-resolvable verdict this periodic pass finds still eligible
+  // (e.g. one already parked before this rung shipped, or one the same-tick
+  // check in spawnJob missed because the app restarted in between). Depth
+  // never disqualifies it, so it runs regardless of investigationDepth.
+  {
+    for (const job of queueForResumeAndAutofix.jobs) {
+      const target = selectMechanicalRecoveryTarget(job);
+      if (!target) continue;
+      console.log(`[scheduler] mechanical-recovery: needs_review ${job.slug} → re-integrating ${target.branch}`);
+      performMechanicalRecovery(job, target).catch((e) => {
+        console.error('[scheduler] performMechanicalRecovery error', job.slug, e);
+      });
+    }
+  }
+
   // Resume-first recovery (PRD 1111): before any fix-plan investigation is
   // authored below, offer the bounded one-attempt `--resume` dispatch to any
   // needs_review job this periodic pass finds still eligible — e.g. one the
@@ -6537,6 +7108,26 @@ async function reverifyNeedsReview() {
     }
   }
 
+  // Leftover quarantine (PRD 1128), periodic pass: catches a job parked
+  // needs_review with resume recovery already spent BEFORE this feature
+  // shipped, or one the same-tick check in spawnJob missed because the app
+  // restarted in between. Stamps the one-attempt marker in its own mutate
+  // BEFORE the async git work starts (same race-closing rule as the resume
+  // loop above and spawnJob's own dispatch stamp).
+  {
+    for (const job of queueForResumeAndAutofix.jobs) {
+      const quarantineTarget = selectLeftoverQuarantineTarget(job);
+      if (!quarantineTarget) continue;
+      console.log(`[scheduler] leftover-quarantine: needs_review ${job.slug} → quarantining ${quarantineTarget.paths.length} leftover path(s)`);
+      mutate((s) => {
+        const j = s.jobs.find((x) => x.slug === job.slug);
+        if (j) j.leftoverQuarantineAttempted = true;
+      }).then(() => performLeftoverQuarantine(job, quarantineTarget.paths)).catch((e) => {
+        console.error('[scheduler] performLeftoverQuarantine error', job.slug, e);
+      });
+    }
+  }
+
   // Auto-fix: spawn a fix-plan investigation for each job still in
   // needs_review after the heal pass (kill-switch: SM_AUTOFIX_DISABLE=1).
   // spawnInvestigation early-returns once investigationsInFlight reaches
@@ -6550,23 +7141,30 @@ async function reverifyNeedsReview() {
       const runId = job.runId || resolveRunId(job);
       const runDir = path.join(RUNS_DIR, runId);
       const isRetryAttempt = job.autoFixAttempted === true;
+      const isDeadFixPlanReopen = isFixPlanDead(job, queueForResumeAndAutofix.jobs);
+      const deadChild = isDeadFixPlanReopen
+        ? queueForResumeAndAutofix.jobs.find((j) => j.slug === fixSlugFor(job))
+        : null;
       // Persist the attempt BEFORE spawning — a crash mid-investigation still
       // counts it (mirrors orphanRetries). Safe even when the slot is busy: the
       // investigation is queued and drained as slots free, so it is genuinely
-      // attempted rather than silently dropped.
+      // attempted rather than silently dropped. autoFixReopened is stamped in
+      // this SAME mutate so a crash between selection and dispatch can never
+      // leave the parent re-eligible for a second reopen (PRD 1129).
       await mutate((s) => {
         const j = s.jobs.find((x) => x.slug === job.slug);
         if (j) {
           j.autoFixAttempted = true;
           if (!j.runId && runId) j.runId = runId;
+          if (isDeadFixPlanReopen) j.autoFixReopened = true;
           if (isRetryAttempt) {
             j.autoFixRetries = (j.autoFixRetries ?? 0) + 1;
             delete j.autoFixOutcome;
           }
         }
       });
-      console.log(`[scheduler] auto-fix: needs_review ${job.slug} → authoring fix-plan (${isRetryAttempt ? 'retry' : '1/1'})`);
-      spawnInvestigation(job, runDir).catch((e) => {
+      console.log(`[scheduler] auto-fix: needs_review ${job.slug} → authoring fix-plan (${isRetryAttempt ? 'retry' : '1/1'}${isDeadFixPlanReopen ? ', dead fix-plan child reopen' : ''})`);
+      spawnInvestigation(job, runDir, { deadChild }).catch((e) => {
         console.error('[scheduler] auto-fix spawnInvestigation error', job.slug, e);
       });
     }
@@ -7657,6 +8255,36 @@ const remote = {
       return { ok: false, error: `job status is "${job.status}" — only a not-yet-running PRD (status "pending"/"quarantined", or no queue row yet) may be edited` };
     }
 
+    // Write-time FK check for a patched dependsOn (PRD 1124), reusing the
+    // SAME resolution rule scheduler_create_prd's prdCreate.cjs applies (exact
+    // slug, else bare-name after stripping one leading `NN-`) so update and
+    // create can never disagree about what a dependsOn entry resolves to. An
+    // explicit empty array CLEARS the dependency and skips validation — there
+    // is nothing to resolve. A listPrds() read failure is skipped-with-a-
+    // warning, matching createPrd's tolerance for an I/O hiccup.
+    if (frontmatter && Array.isArray(frontmatter.dependsOn) && frontmatter.dependsOn.length) {
+      let listing;
+      try {
+        listing = await this.listPrds({ cwd, limit: Number.MAX_SAFE_INTEGER });
+      } catch (e) {
+        console.warn(`[scheduler] updatePrd: dependsOn validation skipped (listPrds failed): ${e?.message ?? e}`);
+        listing = null;
+      }
+      if (listing) {
+        const candidateSlugs = (listing.prds ?? []).map((p) => p.slug);
+        for (const dep of frontmatter.dependsOn) {
+          if (resolveDepSlug(dep, candidateSlugs).length > 0) continue;
+          const near = findNearMatches(dep, candidateSlugs);
+          const suggestion = near.length ? ` Closest existing slug(s): ${near.join(', ')}.` : '';
+          return {
+            ok: false,
+            error: `dependsOn entry "${dep}" does not resolve to any existing PRD in this project.${suggestion} ` +
+              'Pass the bare name (preferred) or the exact NN-prefixed slug of an existing PRD.',
+          };
+        }
+      }
+    }
+
     let dir = null;
     let filePath = null;
     if (cwd) {
@@ -7787,4 +8415,149 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
   });
 }
 
-module.exports = { classifyQueueStarvation, runQueueStarvationWatchdog, QUEUE_STARVATION_MS, computeBlockedChains, stripAppOwnedChurn, findOverrunningJobs, JOB_OVERRUN_FACTOR, JOB_OVERRUN_FLOOR_MS, registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, healRefusalReason, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, IDLE_OUTPUT_KILL_MS, BASH_DEFAULT_TIMEOUT_MS, BASH_MAX_TIMEOUT_MS, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isFailedUnverifiedShaped, computeLooksDone, isPromotableOriginal, selectAutoFixTargets, applyRcaClassification, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, isExhaustedAutoFix, isPlanUnqueued, fixSlugFor, healTargetForFix, buildInvestigationPrompt, isGitRepoSync, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, leftoverFieldsFrom, applyLeftoverFields, LEFTOVER_PATHS_CAP, capDirtyPaths, buildForeignWipSection, PRE_RUN_DIRTY_PATHS_CAP, FOREIGN_WIP_DELIMITER, FOREIGN_WIP_END_DELIMITER, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, resolveVerifyPrdPath, resolveFixPlanPath, resolveNotifyPrd, runPrdMigration, consolidateAllFlatPrds, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult, spawnJob, listPrdsInternal, computeStallSummary, findStaleQuarantinedJobs, QUARANTINE_ESCALATE_MS, applyClearQueueVictims, PIDLESS_SPAWN_GRACE_MS, findStrandedInvestigations, INVESTIGATION_MAX_MS, stashList, parseStashLine, pathsChangedSince, restoreSpecificStash, evaluateSharedTreeGuard, checkSharedTreeGuard, uncommittedChanges, gitHead, selectResumeRecoveryTarget, buildResumeRecoveryPreamble, buildClaudeSpawnArgs, spawnResumeRecovery, spawnInvestigation, computeLaunchHolds, handleLaunchFailure, applyLaunchFailure, setPaused, clearPause, tickQueue, runDueJobs, isCooldownSuppressed, nextRapidRateLimitCount, CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD, RAPID_RATE_LIMIT_WINDOW_MS, MANUAL_PAUSE_COOLDOWN_MS, RUNS_DIR, pickRunDir };
+module.exports = {
+  classifyQueueStarvation,
+  runQueueStarvationWatchdog,
+  QUEUE_STARVATION_MS,
+  computeBlockedChains,
+  stripAppOwnedChurn,
+  findOverrunningJobs,
+  JOB_OVERRUN_FACTOR,
+  JOB_OVERRUN_FLOOR_MS,
+  registerScheduleHandlers,
+  attachWindow,
+  init,
+  ROOT,
+  PRDS_DIR,
+  healRefusalReason,
+  writeQueue,
+  reconcile,
+  reconcileSourcePromptId,
+  allocateParallelGroup,
+  selectHistoryJobs,
+  parsePorcelain,
+  FINISH_PROTOCOL,
+  IDLE_OUTPUT_KILL_MS,
+  BASH_DEFAULT_TIMEOUT_MS,
+  BASH_MAX_TIMEOUT_MS,
+  remote,
+  pickNextBatch,
+  pickForProject,
+  reapDeadRunningJobs,
+  pollRecoveryClearSource,
+  memoryLimitedBatchSize,
+  availableForJobs,
+  reverifyNeedsReview,
+  isRescanCandidate,
+  isFailedUnverifiedShaped,
+  computeLooksDone,
+  isPromotableOriginal,
+  selectAutoFixTargets,
+  applyRcaClassification,
+  isEligibleForImmediateAutoFix,
+  resolveRunId,
+  isUnresolvableNeedsReview,
+  isExhaustedAutoFix,
+  isPlanUnqueued,
+  isFixPlanDead,
+  fixSlugFor,
+  healTargetForFix,
+  buildInvestigationPrompt,
+  isGitRepoSync,
+  committedInWindow,
+  computeCommittedDuringRun,
+  classifySigtermWithCommit,
+  isFixPlanSlug,
+  classifyDiscoveredFixPlan,
+  resolveIsFixPlan,
+  isFixPlanBeyondDepthCap,
+  MAX_INVESTIGATION_DEPTH,
+  forceTickOutcome,
+  applyPauseCleared,
+  detectNetworkErrorInLog,
+  detectRateLimitInLog,
+  classifyFailureOutcome,
+  commitGuardVerdict,
+  leftoverFieldsFrom,
+  applyLeftoverFields,
+  LEFTOVER_PATHS_CAP,
+  capDirtyPaths,
+  buildForeignWipSection,
+  PRE_RUN_DIRTY_PATHS_CAP,
+  FOREIGN_WIP_DELIMITER,
+  FOREIGN_WIP_END_DELIMITER,
+  TRANSIENT_RETRY_CAP,
+  buildScheduleStatePayload,
+  partitionBootOrphans,
+  applyOrphanOutcome,
+  BOOT_ORPHAN_KILL_GRACE_MS,
+  registerAdminRoutes,
+  notifyOriginatingTab,
+  notifyNeedsReview,
+  isNotifiableTerminalStatus,
+  extractResultTextFromLog,
+  candidatePrdsDirs,
+  candidateArchivedPrdsDirs,
+  resolveArchivedPrdStatus,
+  prdDirForCwd,
+  prdPathForJob,
+  archivedPrdPathForJob,
+  archivedTwinExists,
+  findPrdDir,
+  resolveVerifyPrdPath,
+  resolveFixPlanPath,
+  resolveNotifyPrd,
+  runPrdMigration,
+  consolidateAllFlatPrds,
+  shouldSkipInvestigationForCleanRun,
+  archiveCompletedPrd,
+  retireCompletedSlugs,
+  SCHEDULER_BOOTED_AT,
+  SCHEDULER_CODE_SHA,
+  resetJobFields,
+  executeJob,
+  prdArchivedSkipResult,
+  spawnJob,
+  listPrdsInternal,
+  computeStallSummary,
+  findStaleQuarantinedJobs,
+  QUARANTINE_ESCALATE_MS,
+  applyClearQueueVictims,
+  PIDLESS_SPAWN_GRACE_MS,
+  findStrandedInvestigations,
+  INVESTIGATION_MAX_MS,
+  stashList,
+  parseStashLine,
+  pathsChangedSince,
+  restoreSpecificStash,
+  evaluateSharedTreeGuard,
+  checkSharedTreeGuard,
+  uncommittedChanges,
+  gitHead,
+  selectResumeRecoveryTarget,
+  buildResumeRecoveryPreamble,
+  buildClaudeSpawnArgs,
+  spawnResumeRecovery,
+  selectMechanicalRecoveryTarget,
+  performMechanicalRecovery,
+  MECHANICALLY_RESOLVABLE_VERDICTS,
+  selectLeftoverQuarantineTarget,
+  quarantineLeftovers,
+  performLeftoverQuarantine,
+  spawnInvestigation,
+  computeLaunchHolds,
+  computeDepHistorySatisfaction,
+  handleLaunchFailure,
+  applyLaunchFailure,
+  setPaused,
+  clearPause,
+  tickQueue,
+  runDueJobs,
+  isCooldownSuppressed,
+  nextRapidRateLimitCount,
+  CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD,
+  RAPID_RATE_LIMIT_WINDOW_MS,
+  MANUAL_PAUSE_COOLDOWN_MS,
+  RUNS_DIR,
+  pickRunDir,
+};