claude-code-session-manager 0.79.0 → 0.81.0

package/src/main/scheduler.cjs

@@ -57,9 +57,14 @@ const { resolveClaudeBin, probeClaudeVersion } = require('./lib/claudeBin.cjs');
 const launchFailure = require('./lib/launchFailure.cjs');
 const { appendError } = require('./lib/opsErrorLog.cjs');
 const { readTail } = require('./lib/fileTail.cjs');
-const { claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs } = require('./lib/reaperHelpers.cjs');
+const {
+  claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs,
+  findLiveProcessForJob, logHasOutput, resolvePidlessGateOutcome, resolveCommitGuardOutcome,
+} = require('./lib/reaperHelpers.cjs');
+const { sweepStrandedJobBranches } = require('./lib/branchSweep.cjs');
 const { detectRateLimitInLog } = require('./lib/rateLimitDetect.cjs');
 const { stripAppOwnedChurn } = require('./lib/jobDirtFilter.cjs');
+const { resolveBindingRateLimitReset } = require('./lib/rateLimitWindow.cjs');
 const { computeQueueHealth } = require('./lib/queueHealth.cjs');
 const { createLoadGate, topCpuConsumers } = require('./lib/loadGate.cjs');
 const { openLog, withChildAndLog } = require('./lib/childWithLog.cjs');
@@ -71,9 +76,10 @@ const { enqueueExternalPrompt } = require('./chatRunner.cjs');
 const { appendResponseEventIfKnown } = require('./promptSessionEvents.cjs');
 const { maybeEnqueueValidationPrompt } = require('./lib/epicValidationHook.cjs');
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
-const { verifyRun } = require('./runVerify.cjs');
+const { verifyRun, parseLog, scanSentinel, scanForeignWipPathsClaim } = require('./runVerify.cjs');
 const { latestTerminalOutcomeForSlug, COMPLETED_EQUIVALENT_VERDICTS } = require('./lib/terminalRunOutcome.cjs');
-const { landedSinceRun } = require('./lib/landedSinceRun.cjs');
+const { isFixPlanSlug, classifyDiscoveredFixPlan, resolveIsFixPlan } = require('./lib/fixPlanSlug.cjs');
+const { landedSinceRun, landedOnMainSince } = require('./lib/landedSinceRun.cjs');
 const { declaredPathsForPrd } = require('./lib/prdDeclaredPaths.cjs');
 const logs = require('./logs.cjs');
 const { schemas, validated, SCHEDULE_SLUG_RE } = require('./ipcSchemas.cjs');
@@ -99,7 +105,7 @@ const JOB_OVERRUN_FACTOR = process.env.SM_JOB_OVERRUN_FACTOR
 const JOB_OVERRUN_FLOOR_MS = process.env.SM_JOB_OVERRUN_FLOOR_MINUTES
   ? Number(process.env.SM_JOB_OVERRUN_FLOOR_MINUTES) * 60_000
   : JOB_OVERRUN_FLOOR_MS_DEFAULT;
-const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD } = require('./lib/schedulerBatch.cjs');
+const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD, DEP_HISTORY_FAIL_OPEN } = require('./lib/schedulerBatch.cjs');
 const { runDefinitionOfDoneOnDrain } = require('./lib/dodDrainHook.cjs');
 const { writeRcaReport, extractRcaBlock } = require('./lib/rcaReport.cjs');
 const queueHistory = require('./lib/queueHistory.cjs');
@@ -140,6 +146,7 @@ const jobWorktree = require('./lib/jobWorktree.cjs');
 const { reconcileEpicWorktreesOnBoot } = require('./lib/epicWorktreeBoot.cjs');
 const queueStore = require('./lib/queueStore.cjs');
 const { splitFrontmatter, parsePrdFile, serializePrdFile } = require('./lib/prdFrontmatter.cjs');
+const { resolveDepSlug, findNearMatches } = require('./lib/depSlugResolve.cjs');
 const { migratePrds, consolidateFlatPrds, legacyAdoptExistingPrds } = require('./lib/prdMigration.cjs');
 const { allProjectCwds } = require('../../scripts/lib/activeSessions.cjs');
 
@@ -266,9 +273,10 @@ deferring it.
    Your own work must still never be left uncommitted — this only changes
    which paths get staged, never whether you commit.
 5. VERDICT SENTINEL — as the LAST LINE of your final result text, emit exactly
-   one of these two lines (no trailing text after it):
+   one of these lines (no trailing text after it):
      SCHEDULER_VERDICT: PASS
      SCHEDULER_VERDICT: FAIL <one-line reason>
+     SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP
    Print PASS only when the AC gate is green AND the commit from step 4 landed.
    Print FAIL (and exit 1) if the AC gate was red or the commit could not land.
    NEVER print PASS on a red AC gate — a lying PASS turns the verifier from a
@@ -276,6 +284,22 @@ deferring it.
    landed commit lets the verifier override incidental transcript noise (grep
    results containing "Error", a TDD red-test run early in the session, debug
    Tracebacks) so those do not false-trip a needs_review downgrade.
+   Print BLOCKED_BY_FOREIGN_WIP (and exit 1) ONLY when your own AC gate failed
+   because it ran against a SIBLING job's in-flight, uncommitted file — never
+   because of your own regression — AND every failing path is one this prompt
+   already disclosed to you as foreign (see the "FOREIGN WORKING-TREE STATE"
+   section above, if present). It MUST be accompanied by a second line naming
+   every such path:
+     FOREIGN_WIP_PATHS: <path1>, <path2>, ...
+   The scheduler independently validates every listed path against the exact
+   foreign-WIP manifest it disclosed to you. Only list a path that (a) this
+   prompt already told you is foreign WIP, not yours, AND (b) is why your own
+   AC gate failed — never a path you own, and never a path that failed for
+   some other reason of your own making. Any listed path NOT in that manifest
+   downgrades this whole verdict back to FAIL, with your claim rejected. This
+   is not an escape hatch for your own broken code: claiming it for a
+   regression you introduced, or for a path you never received as foreign
+   WIP, is a lying verdict exactly like a false PASS.
 
 A job that exits with uncommitted changes is treated as INCOMPLETE and flagged
 for review. Do NOT add work beyond the acceptance criteria — this protocol is the
@@ -569,6 +593,52 @@ async function computeCommittedDuringRun(cwd, headBefore, headAfter, startedAt,
   return module.exports.committedInWindow(cwd, startedAt, untilIso);
 }
 
+/**
+ * Read-only check: is a job's `sm-job/<slug>` worktree branch already fully
+ * integrated into `cwd`'s current HEAD — i.e. every commit on the branch is
+ * an ancestor of (or equal to) HEAD? Mirrors gitWorktree.cjs's own
+ * integrateBranch() no-op detection (`mergeBase === branchHead`) exactly, but
+ * deliberately never calls integrateBranch itself: this is used by
+ * reapDeadRunningJobs to PROVE a dead job's work already landed, never to
+ * perform the landing — attempting a real merge from an audit check is a
+ * mutating action with its own conflict/timing risk, and "land the still-
+ * stranded branch" is explicitly a separate, later decision (mechanical
+ * recovery, or a human), not something a reap pass should do on its own
+ * initiative. See reapDeadRunningJobs's own header comment for why the
+ * conservative failure direction here is needs_review, never a silent merge.
+ *
+ * Returns:
+ *  - true  — branch exists and is fully contained in HEAD (already
+ *    integrated by a prior pass, or a genuine no-op branch that never
+ *    diverged from its base — both cases legitimately "landed").
+ *  - false — branch exists and still holds commits not in HEAD (a real
+ *    stranded deliverable, e.g. the PRD 1118 shape).
+ *  - null  — branch does not exist at all (never a worktree run — an
+ *    in-place run, or SM_JOB_WORKTREE_DISABLE), or the git calls errored.
+ * Never throws.
+ */
+function isBranchAlreadyIntegrated(cwd, branch) {
+  return new Promise((resolve) => {
+    if (!cwd || !branch) { resolve(null); return; }
+    execFile(
+      'git', ['-C', cwd, 'rev-parse', '--verify', branch],
+      { timeout: 10_000, windowsHide: true },
+      (err, branchHeadOut) => {
+        if (err) { resolve(null); return; } // branch doesn't exist — not a worktree run
+        const branchHead = String(branchHeadOut || '').trim();
+        execFile(
+          'git', ['-C', cwd, 'merge-base', 'HEAD', branch],
+          { timeout: 10_000, windowsHide: true },
+          (mbErr, mbOut) => {
+            const mergeBase = mbErr ? '' : String(mbOut || '').trim();
+            resolve(mergeBase !== '' && mergeBase === branchHead);
+          },
+        );
+      },
+    );
+  });
+}
+
 /**
  * Override for a SIGTERM'd (143) run when a commit landed in its window.
  * Exit 143 alone doesn't prove the deliverable is missing — the 776/779
@@ -590,6 +660,74 @@ function classifySigtermWithCommit(exitCode, commitFoundInWindow) {
   };
 }
 
+/**
+ * Pure decision for spawnJob's finalize mutate (2026-09-06 incident): given
+ * the row this run is trying to finalize (or its absence) and this run's own
+ * identity, decide whether the finalize must be DROPPED instead of applied.
+ * Never mutates anything itself — callers apply `stampLandedCommit` and emit
+ * the audit event/log line.
+ *
+ *  - row missing entirely (i2 === -1 upstream): always drop, nothing to
+ *    stamp — there is no row left to carry the fact.
+ *  - row present but not 'running': drop the STATUS change (a cancelled row,
+ *    PRD 1024, must never be re-legalized to completed/needs_review by a
+ *    stale exit handler) but still let a genuinely-landed commit be stamped
+ *    as a fact — never a transition — when this run owns the row's current
+ *    runId, or the row doesn't already carry a newer one of its own.
+ *  - row present and 'running': not a drop; caller proceeds to finalize.
+ */
+function evaluateFinalizeDrop({ rowExists, rowStatus, rowRunId, rowLandedCommit, runId, landedCommit }) {
+  if (!rowExists) {
+    return { drop: true, reason: 'row-missing', stampLandedCommit: null };
+  }
+  if (rowStatus !== 'running') {
+    const stampLandedCommit = landedCommit && (rowRunId === runId || !rowLandedCommit) ? landedCommit : null;
+    return { drop: true, reason: 'row-not-running', stampLandedCommit };
+  }
+  return { drop: false, reason: null, stampLandedCommit: null };
+}
+
+/**
+ * Pure decision for spawnJob's dispatch mutate: given a PENDING row about to
+ * be dispatched and the newest terminalRunOutcome sidecar result for its
+ * slug, decide whether this dispatch should be SKIPPED because a prior run
+ * already completed this exact slug — the gap left by reconcile()'s own
+ * anti-resurrection guard, which only ever sees a slug BEFORE it first lands
+ * in s.jobs (2026-09-06 incident: an existing pending row was re-dispatched
+ * three times against already-shipped work).
+ *
+ * Compares the sidecar's finishedAt against THIS row's own last pending
+ * transition (or queuedAt, when the row has never been reset) rather than
+ * merely "a completed sidecar exists somewhere" — so a deliberate human
+ * re-queue of the same slug in a LATER episode (whose queuedAt/pending
+ * transition postdates the earlier completion) still runs.
+ */
+function evaluateDispatchSidecarReconcile({ rowStatus, rowRunId, statusHistory, queuedAt, outcome }) {
+  if (rowStatus !== 'pending') return { skip: false };
+  if (!outcome || outcome.status !== 'completed') return { skip: false };
+  if (outcome.runId === rowRunId) return { skip: false };
+  const lastPendingEntry = Array.isArray(statusHistory)
+    ? [...statusHistory].reverse().find((h) => h.to === 'pending')
+    : null;
+  const lastPendingAt = lastPendingEntry?.at ?? queuedAt ?? null;
+  if (lastPendingAt && (!outcome.finishedAt || outcome.finishedAt < lastPendingAt)) {
+    return { skip: false };
+  }
+  return { skip: true, runId: outcome.runId, finishedAt: outcome.finishedAt };
+}
+
+/**
+ * Pure detector for mutate()'s write-path regression check: transitionJob
+ * only ever APPENDS to statusHistory (capped at STATUS_HISTORY_CAP, never
+ * shrunk below it once reached) — so a running->pending change whose
+ * statusHistory got SHORTER is not a real transition, it's evidence this
+ * row's prior state was lost (e.g. a finalize mutate working off a stale
+ * in-memory snapshot).
+ */
+function isQueueRowRegression({ statusBefore, statusAfter, historyLenBefore, historyLenAfter }) {
+  return statusBefore === 'running' && statusAfter === 'pending' && historyLenAfter < historyLenBefore;
+}
+
 const ROOT = path.join(os.homedir(), '.claude', 'session-manager', 'scheduled-plans');
 const PRDS_DIR = path.join(ROOT, 'prds');
 const RUNS_DIR = path.join(ROOT, 'runs');
@@ -1563,7 +1701,42 @@ function mutate(fn) {
     if (state.unreadable) {
       throw new Error(`queue mutation skipped: queue.json unreadable (${state.unreadable})`);
     }
+    const beforeBySlug = new Map(
+      (state.jobs || []).map((j) => [
+        j.slug,
+        { status: j.status, historyLen: Array.isArray(j.statusHistory) ? j.statusHistory.length : 0 },
+      ]),
+    );
     const ret = await fn(state);
+    // Detection-only regression check: transitionJob only ever APPENDS to
+    // statusHistory (capped at STATUS_HISTORY_CAP, never shrunk below it) —
+    // so a running->pending change whose statusHistory got SHORTER is not a
+    // real transition, it's evidence this row's prior state was lost (e.g. a
+    // finalize mutate working off a stale in-memory snapshot). Never
+    // repaired here — mutate()'s job is to persist, not reconcile.
+    for (const j of state.jobs || []) {
+      const prior = beforeBySlug.get(j.slug);
+      if (!prior) continue;
+      const afterLen = Array.isArray(j.statusHistory) ? j.statusHistory.length : 0;
+      if (isQueueRowRegression({
+        statusBefore: prior.status,
+        statusAfter: j.status,
+        historyLenBefore: prior.historyLen,
+        historyLenAfter: afterLen,
+      })) {
+        console.error(
+          `[scheduler] queue row regressed: slug=${j.slug} running->pending with `
+          + `statusHistory ${prior.historyLen} -> ${afterLen}`,
+        );
+        appendAuditEvent('queue_row_regressed', {
+          slug: j.slug,
+          from: 'running',
+          to: 'pending',
+          historyBefore: prior.historyLen,
+          historyAfter: afterLen,
+        });
+      }
+    }
     await writeQueue(state);
     return ret;
   });
@@ -2072,11 +2245,24 @@ async function reconcile(state) {
       exitCode: null,
       error: null,
     };
-    // Newly-discovered fix-plan PRD: stamp its investigationDepth relative to
-    // the original job it heals, so selectAutoFixTargets/spawnInvestigation
-    // can bound the fix-of-a-fix recursion (see MAX_INVESTIGATION_DEPTH).
-    // Non-fix-plan jobs get no explicit field — they read as depth 1 via `?? 1`.
-    if (isFixPlanSlug(slug)) {
+    // Fix-plan classification (PRD 1131): a freshly-discovered PRD is a
+    // genuine scheduler-authored fix plan only when its OWN provenance says
+    // so — an explicit isFixPlan:true stamp (spawnInvestigation's prompt
+    // template) or the absence of any createdVia stamp at all (legacy
+    // fallback, matching the "no provenance = trust the name" rule the
+    // quarantine gate below already applies) — never merely because the
+    // slug looks like one. See lib/fixPlanSlug.cjs's header for why (PRD
+    // 1126: a scheduler_create_prd-authored PRD whose slug happened to start
+    // with "fix-" was wrongly stamped investigationDepth before it ever ran).
+    // Persisted onto the queue row so every later consumer
+    // (commitGuardVerdict, isFixPlanBeyondDepthCap, the fix-plan-completion
+    // checks) reads this stamp instead of re-deriving it from the name.
+    entry.isFixPlan = classifyDiscoveredFixPlan(p, slug);
+    // Stamp investigationDepth relative to the original job it heals, so
+    // selectAutoFixTargets/spawnInvestigation can bound the fix-of-a-fix
+    // recursion (see MAX_INVESTIGATION_DEPTH). Non-fix-plan jobs get no
+    // explicit field — they read as depth 1 via `?? 1`.
+    if (entry.isFixPlan) {
       const parent = healTargetForFix(slug, state.jobs);
       entry.investigationDepth = parent ? (parent.investigationDepth ?? 1) + 1 : 2;
     }
@@ -2088,8 +2274,9 @@ async function reconcile(state) {
     // guard-prd-writes.cjs PreToolUse hook should have denied. Fix-plan PRDs
     // are exempt: spawnInvestigation's own probe writes them directly by
     // design (a trusted, scheduler-spawned internal loop, not an
-    // agent/human authoring a PRD), matching the isFixPlanSlug convention
-    // used everywhere else this distinction matters.
+    // agent/human authoring a PRD) — entry.isFixPlan (just classified above)
+    // is the provenance-aware verdict for that exemption now, not a raw
+    // isFixPlanSlug name check.
     //
     // Quarantine is loud and reversible, never a silent skip (see the
     // 2026-08-01 23-PRD outage this file's header references for what a
@@ -2098,7 +2285,7 @@ async function reconcile(state) {
     // (schedule:adopt-prd) that stamps the file via the same update-prd API
     // route the MCP tool uses — reconcile()'s adopt path above promotes it
     // to 'pending' on the very next pass, within one tick of being stamped.
-    if (!p.createdVia && !isFixPlanSlug(slug)) {
+    if (!p.createdVia && !entry.isFixPlan) {
       entry.status = 'quarantined';
       // Stamped at creation (not via transitionJob, since this is a
       // brand-new row minted directly at 'quarantined' rather than
@@ -2150,6 +2337,12 @@ async function reconcile(state) {
     state.jobs = sorted;
   }
 
+  // Auto-requeue any job parked 'skipped' over a validated BLOCKED_BY_FOREIGN_WIP
+  // verdict once the paths that blocked it are no longer dirty in its own cwd —
+  // the only place this check runs, so a sibling landing its commit resumes the
+  // blocked job with no human action, on the very next reconcile() pass.
+  await requeueForeignWipBlockedJobs(state.jobs);
+
   // Auto-archive completed PRDs' .md files out of the live prds/ dir. Runs
   // AFTER the history append above (which is awaited) so a job's queue row
   // is always durably in history.jsonl before its file can be moved — a
@@ -2192,6 +2385,20 @@ function getNextResetCached() {
   return cachedNextReset;
 }
 
+/**
+ * Pure: picks the reset to pause against for a rate-limited run (PRD 1118).
+ * Prefers the BINDING window read off the run's own log — refreshNextReset()
+ * only ever reports five_hour, which is the wrong clock when a
+ * seven_day/seven_day_overage_included window is what actually 429'd
+ * (five_hour can read 0% utilization at the very same moment). Falls back
+ * to the billing-endpoint-derived reset only when the log yields nothing.
+ */
+function resolveRateLimitPauseReset(logPath, billingResetIso) {
+  const logReset = resolveBindingRateLimitReset(logPath);
+  if (logReset != null) return new Date(logReset * 1000).toISOString();
+  return billingResetIso ?? null;
+}
+
 // ---------- health / poll state ----------
 
 let bootedAt = Date.now();
@@ -2475,6 +2682,33 @@ function nextRapidRateLimitCount(prevCount, { rateLimited, durationMs }) {
   return prevCount || 0;
 }
 
+/**
+ * Pure: decides the resumeAt actually armed for a pause. 'network' and
+ * 'rate_limit' (PRD 1118) both get a bounded 30-minute fallback when no
+ * explicit resumeAt is supplied — the live rate_limit failure mode is the
+ * billing usage endpoint itself 429ing while the log yields no binding
+ * window either, which used to leave an indefinite pause with no resume
+ * timer at all (a queue that never comes back on its own).
+ */
+function computeEffectiveResumeAt(reason, resumeAtIso, nowMs = Date.now()) {
+  if (resumeAtIso) return resumeAtIso;
+  if (reason === 'network' || reason === 'rate_limit') {
+    return new Date(nowMs + 30 * 60_000).toISOString();
+  }
+  return null;
+}
+
+/**
+ * Pure: the setTimeout delay for a resume timer, plus whether it overflows
+ * setTimeout's signed-32-bit max (~24.8 days) and must not be armed.
+ * Resume fires 30s after the reset to give the auth/billing endpoint time
+ * to flip.
+ */
+function computeResumeDelay(effectiveResumeAtIso, nowMs = Date.now()) {
+  const delayMs = Math.max(30_000, new Date(effectiveResumeAtIso).getTime() - nowMs + 30_000);
+  return { delayMs, tooFar: delayMs > 0x7fffffff };
+}
+
 async function setPaused(reason, resumeAtIso, opts = {}) {
   const { observedAt = null, force = false } = opts;
   // Honor manual-override cooldown: if the user cleared a pause within the
@@ -2491,11 +2725,7 @@ async function setPaused(reason, resumeAtIso, opts = {}) {
     console.log(`[scheduler] setPaused(${reason}) engaging despite manual override cooldown — triggering run started after the manual clear`);
   }
 
-  // For 'network' with no explicit resumeAt, auto-resume after 30 minutes.
-  let effectiveResumeAt = resumeAtIso;
-  if (reason === 'network' && !resumeAtIso) {
-    effectiveResumeAt = new Date(Date.now() + 30 * 60_000).toISOString();
-  }
+  const effectiveResumeAt = computeEffectiveResumeAt(reason, resumeAtIso);
 
   await mutate((s) => {
     if (s.paused && s.paused.reason === reason) {
@@ -2509,9 +2739,8 @@ async function setPaused(reason, resumeAtIso, opts = {}) {
   if (resumeTimer) { clearTimeout(resumeTimer); resumeTimer = null; }
   if (!effectiveResumeAt) return;
 
-  // Resume 30s after the reset to give the auth/billing endpoint time to flip.
-  const delay = Math.max(30_000, new Date(effectiveResumeAt).getTime() - Date.now() + 30_000);
-  if (delay > 0x7fffffff) {
+  const { delayMs: delay, tooFar } = computeResumeDelay(effectiveResumeAt);
+  if (tooFar) {
     console.warn(`[scheduler] paused (${reason}); resumeAt too far for setTimeout (${delay}ms)`);
     return;
   }
@@ -2584,6 +2813,17 @@ function resetJobFields(job, errorMsg, opts = {}) {
   delete job.verifierVerdict;
   delete job.uncommittedPaths;
   delete job.resumeRecoveryAttempted;
+  // Same one-attempt-per-episode category as resumeRecoveryAttempted above —
+  // a re-fired row must be able to earn a fresh mechanical-recovery attempt
+  // if it parks needs_review again (PRD 1130).
+  delete job.mechanicalRecoveryAttempted;
+  // Quarantine (PRD 1128) is scoped to THIS run's episode exactly like
+  // resumeRecoveryAttempted above — a re-fired row must be able to earn a
+  // fresh quarantine attempt if it parks needs_review again.
+  delete job.leftoverQuarantineAttempted;
+  delete job.quarantinedTo;
+  delete job.quarantinedCommit;
+  delete job.quarantinedPaths;
   // Same "this run's outcome, not durable across a reset" category as the
   // fields above — a stale 'archive' recoveryAction from a prior life of this
   // slug must never survive a reset and silently exclude a genuinely-new
@@ -2592,6 +2832,10 @@ function resetJobFields(job, errorMsg, opts = {}) {
   // can otherwise linger forever when RCA is disabled or errors).
   delete job.rcaFailureClass;
   delete job.rcaRecoveryAction;
+  // Same "this run's outcome, not durable across a reset" category — a
+  // human-driven reset must genuinely start the auto-fix budget over,
+  // including the one-time dead-fix-plan-child reopen (PRD 1129).
+  delete job.autoFixReopened;
   // Like exitCode: this run's outcome, not durable across a reset — a stale
   // leak badge from a prior attempt must not linger once the job re-fires.
   delete job.leakedDescendants;
@@ -2605,6 +2849,13 @@ function resetJobFields(job, errorMsg, opts = {}) {
   delete job.leftoverCount;
   delete job.leftoverPathsTruncated;
   delete job.preRunDirtyPaths;
+  // A manual/force reset (e.g. a human clearing a 3-strikes needs_review
+  // park) must not leave the row permanently excluded from the auto-fix
+  // chain (selectAutoFixTargets checks job.blockedByForeignWip) — this run's
+  // BLOCKED_BY_FOREIGN_WIP history is done, the human is taking over.
+  delete job.blockedByForeignWip;
+  delete job.foreignWipBlockedPaths;
+  delete job.foreignWipBlockCount;
   // Deliberately NOT deleting job.landedCommit: it must outlive a reset so a
   // re-fired run of this same slug can pass it to verifyRun as
   // priorLandedCommit (pass_no_commit_prior_run_verified exemption).
@@ -3071,6 +3322,44 @@ function classifyFailureOutcome({ exitCode, networkError, durationMs, transientR
   return { action: 'retry', transientKind, retries };
 }
 
+/**
+ * Evidence gathering for the commit-guard's already-satisfied-on-main
+ * exemption (PRD 1136): does a commit reachable from `main`, landed AFTER
+ * this job's `queuedAt`, touch a path this PRD itself declares? Scoped to
+ * the PRD's own declared paths via declaredPathsForPrd — the same
+ * path-extraction computeLooksDone already uses — so an unrelated commit
+ * elsewhere in the repo is never credited to this job. Returns `[]` (never
+ * fabricates evidence) when the PRD names no paths or has no `queuedAt`.
+ *
+ * Requires EVERY declared path to have landed, not just one — declaredPathsForPrd's
+ * regex matches any backtick-quoted path in the PRD's Implementation notes or
+ * Acceptance criteria, including a path cited only as context (e.g.
+ * `` `src/main/scheduler.cjs:1234` `` pointing at a call site, not a file this
+ * PRD's own work touches). Unlike computeLooksDone's identical path-overlap
+ * heuristic — which only ever annotates a still-needs_review row for a human
+ * to confirm — this check drives an UNATTENDED transition straight to
+ * 'completed', so a single incidental hot-file citation must never be
+ * sufficient evidence on its own (code-review finding, 2026-09-07: a PRD
+ * that cites both its real target file and one hot file purely as context
+ * would auto-complete off any unrelated commit touching that hot file).
+ * Requiring full coverage of the declared-path set trades recall for safety
+ * exactly as this PRD's own constraint demands — a PRD that fails this
+ * stricter check still falls back to the existing needs_review park, never
+ * a false 'completed'.
+ *
+ * @returns {Promise<string[]>} full commit SHAs reachable from main, newest first
+ */
+async function findSatisfyingCommitOnMain(job) {
+  if (!job?.queuedAt) return [];
+  const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
+  const paths = declaredPathsForPrd(prdPath);
+  if (!paths.length) return [];
+  await fetchAllRefs(job.cwd);
+  const perPathCommits = await Promise.all(paths.map((p) => landedOnMainSince(job.cwd, job.queuedAt, [p])));
+  if (perPathCommits.some((commits) => commits.length === 0)) return [];
+  return landedOnMainSince(job.cwd, job.queuedAt, paths);
+}
+
 /**
  * Commit-guard verdict decision. Pure/no I/O so the false-positive defenses
  * can be unit-tested directly rather than only through a live spawnJob run.
@@ -3241,6 +3530,73 @@ function buildForeignWipSection({ preRunDirtyPaths, carriedPaths } = {}) {
   return '';
 }
 
+// A job whose validated BLOCKED_BY_FOREIGN_WIP claim keeps recurring against
+// the same sibling WIP is not making progress by re-firing forever — cap the
+// auto-requeue cycle and hand it to a human instead, naming the paths that
+// never went clean. Matches TRANSIENT_RETRY_CAP's "bounded self-heal, then
+// escalate" shape.
+const FOREIGN_WIP_BLOCK_STREAK_LIMIT = 3;
+
+/**
+ * Pure: validate an executor's BLOCKED_BY_FOREIGN_WIP claim against the exact
+ * foreign-WIP manifest THIS job was disclosed at dispatch time
+ * (preRunDirtyPaths / carriedPaths — PRD 1105). Every claimed path must be a
+ * member of that manifest; a path the job was never told was foreign cannot
+ * be laundered into a block, whether that's a genuine regression the
+ * executor is trying to dodge or an honest mistake. `job` is any object
+ * carrying those two array fields (the live queue row at finalize time).
+ *
+ * Returns `ok: false` for an empty claim too — a BLOCKED_BY_FOREIGN_WIP
+ * verdict with no FOREIGN_WIP_PATHS evidence at all is exactly as
+ * unsubstantiated as one naming an unlisted path.
+ */
+function validateForeignWipBlockClaim(claimedPaths, job) {
+  const manifest = new Set([
+    ...(Array.isArray(job?.preRunDirtyPaths) ? job.preRunDirtyPaths : []),
+    ...(Array.isArray(job?.carriedPaths) ? job.carriedPaths : []),
+  ]);
+  const claimed = Array.isArray(claimedPaths) ? claimedPaths.filter(Boolean) : [];
+  const validPaths = claimed.filter((p) => manifest.has(p));
+  const invalidPaths = claimed.filter((p) => !manifest.has(p));
+  return { ok: claimed.length > 0 && invalidPaths.length === 0, validPaths, invalidPaths };
+}
+
+/**
+ * Auto-requeue jobs parked 'skipped' with a validated BLOCKED_BY_FOREIGN_WIP
+ * verdict once none of the paths that blocked them are still dirty in their
+ * own `cwd` — so a sibling job landing its commit (or a human resolving their
+ * own WIP) resumes the blocked job with no human action needed, on the very
+ * next reconcile() pass. `getDirtyPaths` is injectable (defaults to the real
+ * `uncommittedChanges` git-status wrapper) so this is unit-testable without a
+ * real git repo. Mutates eligible jobs in place via transitionJob; returns
+ * nothing.
+ */
+async function requeueForeignWipBlockedJobs(jobs, { getDirtyPaths = uncommittedChanges } = {}) {
+  const candidates = (Array.isArray(jobs) ? jobs : []).filter(
+    (j) => j && j.status === 'skipped' && j.blockedByForeignWip === true,
+  );
+  for (const job of candidates) {
+    const blockedPaths = Array.isArray(job.foreignWipBlockedPaths) ? job.foreignWipBlockedPaths : [];
+    if (!blockedPaths.length) continue;
+    const dirty = await getDirtyPaths(job.cwd);
+    if (dirty === null) continue; // non-git cwd or git error — best-effort, leave parked
+    const dirtySet = new Set(dirty);
+    const stillDirty = blockedPaths.filter((p) => dirtySet.has(p));
+    if (stillDirty.length === 0) {
+      // resetJobFields (not a bare transitionJob) so the row re-enters
+      // 'pending' with none of the blocked run's stale exitCode/error/
+      // verifierVerdict/finishedAt/leftoverPaths left on it for a viewer to
+      // misread against the new 'pending' status — same reasoning as every
+      // other terminal->pending path in this file. force:true is required
+      // here: resetJobFields refuses skipped->pending without it.
+      resetJobFields(job, `foreign WIP cleared (was blocked on: ${blockedPaths.join(', ')}) — auto-requeued`, {
+        source: 'reconcile-foreign-wip-clear',
+        force: true,
+      });
+    }
+  }
+}
+
 /**
  * Resume-first recovery (PRD 1111). A job parked in needs_review with verdict
  * 'uncommitted_changes' has a live claude session (job.sessionId, minted by
@@ -3303,6 +3659,302 @@ As the LAST LINE of your final result text, emit exactly one of:
 Print PASS only once the commit above has actually landed.`;
 }
 
+/**
+ * Mechanical recovery (PRD 1130). isFixPlanBeyondDepthCap (below) is the
+ * ONLY gate on re-investigating a fix-plan job at investigationDepth >= 2 —
+ * correct for open-ended "author another plan" recursion, but it also
+ * strands a depth-capped job whose failure was fully mechanical (no
+ * judgement required) with no other ladder rung, since resume-first recovery
+ * (selectResumeRecoveryTarget above) is hard-gated on verdict
+ * 'uncommitted_changes'. This rung is evaluated INDEPENDENTLY of
+ * isFixPlanBeyondDepthCap — depth never disqualifies it, because unlike
+ * auto-fix it authors no plan and spawns no model; it is pure git.
+ *
+ * The closed set of mechanically-resolvable verdicts starts at exactly
+ * 'worktree_integration_failed': PRD 1125 already taught integrateBranch to
+ * parse git's "would be overwritten by merge" stderr, verify the blocking
+ * paths are byte-identical to the branch, discard the proven duplicates, and
+ * retry the merge once. A job parked with this verdict has its `sm-job/
+ * <slug>` branch preserved (integrateJobBranch never deletes the branch on
+ * failure — see cleanupJobWorktree's `keepBranch: !integration.ok`), so a
+ * plain re-call of integrateBranch against that same branch inherits PRD
+ * 1125's auto-resolution for free — no re-implementation needed here.
+ *
+ * Bounded to exactly one attempt via job.mechanicalRecoveryAttempted,
+ * stamped in the SAME mutate as the outcome (performMechanicalRecovery,
+ * below) — never here — so this selector alone can be unit-tested exactly
+ * like selectResumeRecoveryTarget/selectLeftoverQuarantineTarget.
+ *
+ * Kill-switch: SM_MECHANICAL_RECOVERY_DISABLE=1 restores today's behaviour
+ * exactly (always returns null), mirroring SM_RESUME_RECOVERY_DISABLE.
+ */
+const MECHANICALLY_RESOLVABLE_VERDICTS = new Set(['worktree_integration_failed']);
+
+function selectMechanicalRecoveryTarget(job) {
+  if (process.env.SM_MECHANICAL_RECOVERY_DISABLE === '1') return null;
+  if (!job || job.status !== 'needs_review') return null;
+  if (!MECHANICALLY_RESOLVABLE_VERDICTS.has(job.verifierVerdict)) return null;
+  if (job.mechanicalRecoveryAttempted === true) return null;
+  const cwd = job.cwd || DEFAULT_PROJECT_CWD;
+  return { slug: job.slug, cwd, branch: jobWorktree.branchNameFor(job.slug), carriedPaths: job.carriedPaths || [] };
+}
+
+/**
+ * Perform an already-selected mechanical recovery (selectMechanicalRecoveryTarget
+ * above) — a direct re-attempt of integrateBranch against the job's preserved
+ * branch, never a fresh `claude -p` dispatch. On success the job transitions
+ * needs_review -> completed and its verifierVerdict is cleared; the branch,
+ * now merged, is deleted like any other successfully-integrated job branch.
+ * On failure (including a branch that no longer exists — already deleted or
+ * already merged) the job stays needs_review, mechanicalRecoveryAttempted is
+ * stamped, and the retry's own failure text is appended to `error`. Either
+ * way mechanicalRecoveryAttempted is stamped in this SAME mutate, so a crash
+ * between the git call returning and this mutate landing simply repeats an
+ * idempotent git operation on the next pass rather than leaving the job
+ * re-eligible forever.
+ */
+async function performMechanicalRecovery(job, target) {
+  const integration = await jobWorktree.integrateJobBranch({
+    cwd: target.cwd, branch: target.branch, slug: target.slug, carriedPaths: target.carriedPaths,
+  });
+  if (integration.ok) {
+    await jobWorktree.cleanupJobWorktree({ cwd: target.cwd, dir: undefined, branch: target.branch, keepBranch: false });
+  }
+  let becameCompleted = false;
+  await mutate((s) => {
+    const j = s.jobs.find((x) => x.slug === job.slug);
+    if (!j) return;
+    j.mechanicalRecoveryAttempted = true;
+    if (integration.ok) {
+      if (transitionJob(j, 'completed', {
+        reason: `mechanical recovery: ${target.branch} re-integrated successfully`,
+        source: 'scheduler:mechanicalRecovery',
+      })) {
+        delete j.verifierVerdict;
+        j.exitCode = 0;
+        j.error = null;
+        becameCompleted = true;
+      }
+    } else {
+      const pointer = `Mechanical recovery retry failed: ${integration.reason}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+    }
+  });
+  if (integration.ok) {
+    console.log(`[scheduler] mechanical-recovery: ${job.slug} → completed (branch ${target.branch} re-integrated)`);
+    if (becameCompleted) await archiveCompletedPrd(job.slug, job.cwd);
+  } else {
+    console.error(`[scheduler] mechanical-recovery: ${job.slug} → retry failed: ${integration.reason}`);
+  }
+}
+
+/**
+ * Leftover quarantine (PRD 1128). Resume-first recovery gets exactly one
+ * `--resume` attempt (selectResumeRecoveryTarget above); when that attempt
+ * ALSO parks needs_review with 'uncommitted_changes', the leftovers are
+ * about to sit dirty in the SHARED tree forever — git then refuses any later
+ * worktree merge for this cwd that would overwrite them, turning one parked
+ * job into a project-wide stall (216-jupiter-sand-kazekage, 2026-09-06).
+ * Pure/no I/O, mirroring selectResumeRecoveryTarget so the eligibility rule
+ * is unit-testable directly.
+ *
+ * Bounded to exactly one attempt via job.leftoverQuarantineAttempted, stamped
+ * synchronously by the caller in the SAME mutate as this decision (never
+ * here) — see spawnJob's finalize and reverifyNeedsReview's periodic pass.
+ *
+ * Kill-switch: SM_LEFTOVER_QUARANTINE_DISABLE=1 restores today's behaviour
+ * exactly (always returns null), mirroring SM_RESUME_RECOVERY_DISABLE.
+ */
+function selectLeftoverQuarantineTarget(job) {
+  if (process.env.SM_LEFTOVER_QUARANTINE_DISABLE === '1') return null;
+  if (!job || job.status !== 'needs_review') return null;
+  if (job.verifierVerdict !== 'uncommitted_changes') return null;
+  if (job.resumeRecoveryAttempted !== true) return null;
+  if (job.leftoverQuarantineAttempted === true) return null;
+  const uncommittedPaths = Array.isArray(job.uncommittedPaths)
+    ? job.uncommittedPaths.filter((p) => typeof p === 'string' && p.length > 0)
+    : [];
+  if (!uncommittedPaths.length) return null;
+  // The single most important constraint: never touch a path that was
+  // ALREADY dirty at this run's own dispatch time (preRunDirtyPaths) — that
+  // is foreign WIP (a human's or a sibling's), not this job's own leftover.
+  const preRunDirty = new Set(Array.isArray(job.preRunDirtyPaths) ? job.preRunDirtyPaths : []);
+  const paths = uncommittedPaths.filter((p) => !preRunDirty.has(p));
+  if (!paths.length) return null;
+  return { slug: job.slug, cwd: job.cwd, paths };
+}
+
+function execGitAt(cwd, args, { env, timeout = 20_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(
+      'git',
+      ['-C', cwd, ...args],
+      { timeout, windowsHide: true, encoding: 'utf8', env: env ? { ...process.env, ...env } : process.env },
+      (err, stdout, stderr) => {
+        if (err) {
+          err.stderrText = stderr;
+          reject(err);
+          return;
+        }
+        resolve(stdout || '');
+      },
+    );
+  });
+}
+
+async function pathExistsInTree(cwd, treeish, p) {
+  try {
+    await execGitAt(cwd, ['cat-file', '-e', `${treeish}:${p}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Commit exactly `paths` (must already be dirty on disk) onto a dedicated
+ * `sm-salvage/<slug>` ref, built from `headBefore` (or current HEAD when
+ * unavailable) via a THROWAWAY `GIT_INDEX_FILE` — never touches the live
+ * index, never moves the checked-out branch — then restores those paths to
+ * match that baseline commit's tree, so the shared working tree returns to
+ * its pre-run state. This is deliberately NOT `git stash` (the destructive-
+ * git guard blocks stash on a shared tree, and a stash nobody restores
+ * strands the work invisibly — see standards.md).
+ *
+ * Never throws: any git failure, or a non-git cwd, aborts the WHOLE attempt
+ * with the tree untouched (no partial restore) — restore only ever runs
+ * after the salvage ref/commit has safely landed, so a failure there leaves
+ * the data recoverable from the ref even though the tree stayed dirty.
+ * A path no longer dirty on disk (already committed, or reverted since) is
+ * skipped, never force-restored.
+ */
+async function quarantineLeftovers({ cwd, slug, paths, headBefore }) {
+  if (!cwd || !slug || !Array.isArray(paths) || paths.length === 0) {
+    return { ok: false, reason: 'no cwd/slug/paths given' };
+  }
+  let baseline = headBefore || null;
+  try {
+    if (!baseline) {
+      baseline = (await execGitAt(cwd, ['rev-parse', 'HEAD'])).trim();
+    }
+    if (!baseline) return { ok: false, reason: 'could not resolve a baseline commit (non-git cwd?)' };
+
+    const dirtyNowRaw = await execGitAt(cwd, ['status', '--porcelain', '--', ...paths]);
+    const dirtyNow = new Set(parsePorcelain(dirtyNowRaw));
+    const toQuarantine = paths.filter((p) => dirtyNow.has(p));
+    const skippedPaths = paths.filter((p) => !dirtyNow.has(p));
+    if (!toQuarantine.length) {
+      return { ok: true, ref: null, commit: null, quarantinedPaths: [], skippedPaths };
+    }
+
+    const tmpIndex = path.join(os.tmpdir(), `sm-salvage-index-${slug}-${process.pid}-${Date.now()}`);
+    const env = { GIT_INDEX_FILE: tmpIndex };
+    let treeSha;
+    let commitSha;
+    try {
+      await execGitAt(cwd, ['read-tree', baseline], { env });
+      for (const p of toQuarantine) {
+        if (fs.existsSync(path.join(cwd, p))) {
+          await execGitAt(cwd, ['add', '--', p], { env });
+        } else {
+          await execGitAt(cwd, ['rm', '--cached', '--ignore-unmatch', '--', p], { env });
+        }
+      }
+      treeSha = (await execGitAt(cwd, ['write-tree'], { env })).trim();
+      commitSha = (await execGitAt(cwd, ['commit-tree', treeSha, '-p', baseline, '-m', `salvage: leftover changes from ${slug}`], { env })).trim();
+    } catch (e) {
+      return { ok: false, reason: `git command failed while building the salvage commit: ${(e && (e.stderrText || e.message)) || e}` };
+    } finally {
+      await fsp.rm(tmpIndex, { force: true }).catch(() => {});
+    }
+
+    const ref = `sm-salvage/${slug}`;
+    try {
+      await execGitAt(cwd, ['update-ref', `refs/heads/${ref}`, commitSha]);
+    } catch (e) {
+      return { ok: false, reason: `git command failed updating ${ref}: ${(e && (e.stderrText || e.message)) || e}` };
+    }
+
+    // The salvage commit is safely landed at this point — a failure from here
+    // on is reported with the ref/commit still attached so nothing looks lost
+    // even if the tree itself couldn't be fully restored.
+    try {
+      const inBaseline = [];
+      const notInBaseline = [];
+      for (const p of toQuarantine) {
+        // eslint-disable-next-line no-await-in-loop
+        if (await pathExistsInTree(cwd, baseline, p)) inBaseline.push(p); else notInBaseline.push(p);
+      }
+      if (inBaseline.length) {
+        await execGitAt(cwd, ['checkout', baseline, '--', ...inBaseline]);
+      }
+      if (notInBaseline.length) {
+        await execGitAt(cwd, ['reset', '--', ...notInBaseline]).catch(() => {});
+        for (const p of notInBaseline) {
+          // eslint-disable-next-line no-await-in-loop
+          await fsp.rm(path.join(cwd, p), { force: true });
+        }
+      }
+    } catch (e) {
+      return {
+        ok: false,
+        ref,
+        commit: commitSha,
+        reason: `salvage commit landed at ${ref} (${commitSha}) but restoring the working tree failed: ${(e && (e.stderrText || e.message)) || e}`,
+      };
+    }
+
+    return { ok: true, ref, commit: commitSha, quarantinedPaths: toQuarantine, skippedPaths };
+  } catch (e) {
+    return { ok: false, reason: `git command failed: ${(e && (e.stderrText || e.message)) || e}` };
+  }
+}
+
+/**
+ * Perform an already-selected quarantine (job.leftoverQuarantineAttempted
+ * must already be true, stamped by the caller) and persist the outcome onto
+ * the job row: `quarantinedTo`/`quarantinedCommit`/`quarantinedPaths` on
+ * success, plus a one-line pointer appended to `error` naming the ref so a
+ * human can recover with a single named command
+ * (`git show sm-salvage/<slug>`). The belt-and-braces `salvagePatch` (when
+ * present) is referenced alongside it, never removed. On failure, only a
+ * diagnostic is appended — the job row's dirt-describing fields are left as
+ * they were, since the tree itself was left untouched (or, for a
+ * restore-only failure, the salvage ref is still named in the note).
+ *
+ * `headBefore`, when the caller has it fresh (spawnJob's own finalize still
+ * has the local `guardHeadBefore` in scope for the run that just parked —
+ * the same value is deleted off the job ROW earlier in that same finalize),
+ * is used as the salvage ref's baseline commit; otherwise (the periodic
+ * reverifyNeedsReview pass, re-discovering an already-parked row) this falls
+ * back to the current HEAD inside quarantineLeftovers itself.
+ */
+async function performLeftoverQuarantine(job, paths, headBefore = null) {
+  const result = await quarantineLeftovers({
+    cwd: job.cwd || DEFAULT_PROJECT_CWD,
+    slug: job.slug,
+    paths,
+    headBefore: headBefore || job.guardHeadBefore || null,
+  });
+  await mutate((s) => {
+    const j = s.jobs.find((x) => x.slug === job.slug);
+    if (!j) return;
+    if (result.ok && Array.isArray(result.quarantinedPaths) && result.quarantinedPaths.length) {
+      j.quarantinedTo = result.ref;
+      j.quarantinedCommit = result.commit;
+      j.quarantinedPaths = capDirtyPaths(result.quarantinedPaths);
+      const salvageNote = j.salvagePatch ? `; salvage patch also at ${j.salvagePatch}` : '';
+      const pointer = `Leftovers quarantined to ${result.ref} (commit ${result.commit}) — recover via \`git show ${result.ref}\`${salvageNote}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+      console.log(`[scheduler] ${job.slug}: quarantined ${result.quarantinedPaths.length} leftover path(s) to ${result.ref} (${result.commit})`);
+    } else if (!result.ok) {
+      const pointer = `Leftover quarantine failed: ${result.reason}`;
+      j.error = j.error ? `${j.error}\n${pointer}` : pointer;
+      console.error(`[scheduler] ${job.slug}: leftover quarantine failed: ${result.reason}`);
+    }
+  });
+}
+
 /**
  * Pure argv builder for a `claude -p` child spawn, shared so the
  * resume-vs-fresh-session choice is made in exactly one place. `resume`
@@ -3782,13 +4434,9 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
 // project (keyed by cwd) so jobs in different repos run concurrently up to
 // the cap; within one project, sequential-group semantics are preserved.
 
-/**
- * Recognize fix-plan slugs (NN-fix-...) so we don't recurse on a fix-plan that
- * itself failed. The pattern matches the slug we generate in spawnInvestigation.
- */
-function isFixPlanSlug(slug) {
-  return /^\d+-fix-/.test(slug);
-}
+// isFixPlanSlug/classifyDiscoveredFixPlan/resolveIsFixPlan now live in
+// lib/fixPlanSlug.cjs (PRD 1131) — see that module's header for why slug
+// shape alone is no longer sufficient to classify a fix plan.
 
 /**
  * The fix-plan slug spawnInvestigation authors for a given failed job —
@@ -3827,7 +4475,25 @@ function healTargetForFix(fixSlug, jobs) {
  * unit-tested (no spawn, no fs). Inputs are the already-resolved values that
  * spawnInvestigation computes.
  */
-function buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group }) {
+function buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group, deadChild = null }) {
+  const deadFixChildNote = deadChild ? `
+
+# This is a REOPENED investigation — your own prior fix plan died
+You already investigated this job once and produced a fix-plan PRD, \`${deadChild.slug}\`, which was
+supposed to heal it. That fix-plan job itself reached a terminal, non-completed status
+(\`${deadChild.status}\`) without ever fixing the original failure — so the parent job you are now
+investigating is stuck again with nothing left to retry it automatically. This is the ONE reopen
+this parent gets; do not cold-read the log and re-derive the plan that already failed.
+
+Dead fix-plan child's own outcome:
+- Slug: ${deadChild.slug}
+- Status: ${deadChild.status}
+- Verifier verdict: ${deadChild.verifierVerdict ?? '(none recorded)'}
+- Error: ${deadChild.error ?? '(none recorded)'}
+
+Read why THAT job died (its own run log, if any, under the runs directory) before writing a new
+fix-plan PRD, and make sure your new plan is genuinely different from — not a repeat of — whatever
+that dead child attempted.` : '';
   const abandonedBackgroundTaskNote = failedJob.verifierVerdict === 'abandoned_background_task' ? `
 
 # Known failure class: abandoned background task
@@ -3848,7 +4514,7 @@ The fix-plan PRD you write for this MUST instruct its executor to, in order:
 1. Check for a salvage patch (named \`<slug>.uncommitted.patch\` in the run directory${failedJob.salvagePatch ? `, e.g. \`${failedJob.salvagePatch}\`` : ''}) and, if found, apply it to the working tree BEFORE inspecting \`git status\`/\`git diff\` in ${cwd} for uncommitted changes matching the original PRD's acceptance criteria.
 2. If the work is present (via the applied patch or already in the tree) and satisfies the acceptance criteria, run the project's verify commands and COMMIT it — do not re-implement or re-plan the PRD from scratch.
 3. Only fall back to re-implementing whatever acceptance criteria are genuinely missing after applying any salvage patch, not the whole PRD.` : '';
-  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.${abandonedBackgroundTaskNote}
+  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.${deadFixChildNote}${abandonedBackgroundTaskNote}
 
 # Failed job
 - Slug: ${failedJob.slug}
@@ -3893,8 +4559,13 @@ ${logTail}
    cwd: ${cwd}
    parallelGroup: ${group}
    estimateMinutes: <your time estimate>
+   isFixPlan: true
    ---
    \`\`\`
+   \`isFixPlan: true\` is REQUIRED — it is the scheduler's provenance signal that this PRD is a
+   genuine auto-authored fix plan (not a human/agent PRD whose slug merely happens to start with
+   "fix-"); omitting it means this fix plan will not get its depth-cap/zero-edit-commit-guard
+   exemptions.
    \`cwd\` must be the git repo root where the fix will actually land. If the failed job's cwd is
    not that repo (e.g. a scratch dir like \`/tmp\`), set \`cwd:\` to the correct repo root instead —
    the scheduler's commit guard and post-run verifier read git state from this path, and a
@@ -3951,6 +4622,11 @@ function readRunOutcomeSidecars(runDir, slug) {
   return {
     meta: readJson(path.join(runDir, `${slug}.meta.json`)),
     verdicts: readJson(path.join(runDir, `${slug}.verdicts.json`)),
+    // outcome.json (launchFailure.writeOutcomeSidecar) is the one sidecar
+    // that carries landedCommit — reused by the dispatch-time sidecar-
+    // reconcile guard and the pre-dispatch landedCommit backfill below,
+    // rather than growing a second reader for the same directory.
+    outcome: readJson(path.join(runDir, `${slug}.outcome.json`)),
   };
 }
 
@@ -3968,7 +4644,7 @@ function readRunOutcomeSidecars(runDir, slug) {
  */
 const INVESTIGATION_LAUNCH_KEY = 'investigation';
 
-async function spawnInvestigation(failedJob, runDir) {
+async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {}) {
   // The probe launches with the same CLI as the job it diagnoses. While
   // that CLI cannot launch at all (launch circuit breaker, issue #11 list
   // B1: probes e4f82da2/d374e6bf died on the same HTTP 400 as the runs
@@ -3997,7 +4673,14 @@ async function spawnInvestigation(failedJob, runDir) {
     console.log(`[scheduler] skip investigation: ${failedJob.slug} is resume-recovery eligible`);
     return { deferred: false };
   }
-  if (isFixPlanBeyondDepthCap(failedJob.slug, failedJob.investigationDepth)) {
+  // Mechanical recovery (PRD 1130): same first-refusal treatment — a job
+  // eligible for a pure-git retry must never also get a cold-read fix-plan
+  // PRD authored in the same pass.
+  if (selectMechanicalRecoveryTarget(failedJob)) {
+    console.log(`[scheduler] skip investigation: ${failedJob.slug} is mechanical-recovery eligible`);
+    return { deferred: false };
+  }
+  if (isFixPlanBeyondDepthCap(failedJob.slug, failedJob.investigationDepth, failedJob.isFixPlan)) {
     console.log(`[scheduler] skip investigation: ${failedJob.slug} is a fix plan at/beyond depth cap (depth=${failedJob.investigationDepth ?? 'none'})`);
     return { deferred: false };
   }
@@ -4054,7 +4737,13 @@ async function spawnInvestigation(failedJob, runDir) {
 
   const logTail = readTail(failedLogPath, 16 * 1024) || '(failed to read log)';
 
-  if (fs.existsSync(fixPath)) {
+  // A dead-fix-plan reopen (PRD 1129) targets the SAME fixPath its dead
+  // child was originally authored at, by construction (fixSlugFor is a pure
+  // function of the parent) — the file existing is not staleness here, it's
+  // the whole reason a reopen was offered. Skip the guard in that one case
+  // so the second investigation can overwrite the dead plan; every other
+  // caller keeps the original protection against clobbering a live sibling.
+  if (fs.existsSync(fixPath) && !deadChild) {
     console.log(`[scheduler] skip investigation: fix plan already exists at ${fixPath}`);
     releaseSlot();
     return { deferred: false };
@@ -4080,7 +4769,7 @@ async function spawnInvestigation(failedJob, runDir) {
     console.warn(`[scheduler] investigation cwd is not a git repo (${cwd}); falling back to ${DEFAULT_PROJECT_CWD}`);
     cwd = DEFAULT_PROJECT_CWD;
   }
-  const prompt = buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group });
+  const prompt = buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group, deadChild });
 
   // Phase 1: open log fd for pre-spawn diagnostics.
   const { fd, safeLog, closeFd } = openLog(investigationLogPath);
@@ -4209,6 +4898,22 @@ async function spawnInvestigation(failedJob, runDir) {
         mutate((s) => {
           const j = s.jobs.find((x) => x.slug === failedJob.slug);
           if (j) j.autoFixOutcome = 'plan';
+          // Dead-fix-plan reopen (PRD 1129): fixSlugFor is a pure function of
+          // the parent, so the freshly-authored plan landed at the SAME slug
+          // as the dead child — reconcile() sees an already-known slug and
+          // will never re-mint a pending row for it. Explicitly reset the
+          // dead child's own row here so the overwritten plan actually gets
+          // a chance to run, rather than sitting inert behind a permanently
+          // terminal queue row. force:true because 'skipped' (a valid dead
+          // status here) is otherwise reset-refused by design.
+          if (deadChild) {
+            const child = s.jobs.find((x) => x.slug === deadChild.slug);
+            if (child) {
+              resetJobFields(child, 'reset by dead-fix-plan reopen: parent investigation authored a new plan', {
+                force: true, source: 'spawnInvestigation:dead-fix-plan-reopen',
+              });
+            }
+          }
         }).catch(() => {});
       } else {
         console.log(`[scheduler] investigation finished WITHOUT producing fix plan (slug=${failedJob.slug}, code=${exitCode})`);
@@ -4291,6 +4996,58 @@ async function computeLaunchHolds(state, { now = Date.now(), claudeVersion } = {
   return held;
 }
 
+/**
+ * computeDepHistorySatisfaction(state) → Map<cwd, Set<string>|symbol>
+ *
+ * PRD 1122's once-per-tick dependsOn history/archive lookup: for every
+ * distinct project cwd with jobs this tick, builds the set of dep slugs that
+ * have no live queue row but are nonetheless known-satisfied — a completed
+ * record in that project's own `state/history.jsonl` shard
+ * (queueHistory.completedSlugsForCwd, scoped per-project so a same-named PRD
+ * in an unrelated project can never satisfy a dep here), or a `.md` file
+ * under any of that project's `prds-archived/` dirs (listArchivedPrdDirs —
+ * covers both the retired flat layout and every Epic's own sibling archive).
+ * findBlockingDep (schedulerBatch.cjs) treats a dep slug as blocking
+ * whenever it has no live row AND is absent from this set, so a typo or a
+ * double-prefixed slug (the exact 2026-09-06 starry-night-ships incident)
+ * HOLDS its dependent instead of silently dispatching it.
+ *
+ * Fails OPEN per project, never queue-wide: a history-shard or archive-scan
+ * read error for one cwd degrades that cwd's value to
+ * `DEP_HISTORY_FAIL_OPEN` (findBlockingDep then treats every rowless dep in
+ * that project as satisfied, exactly today's pre-1122 behaviour) with a
+ * logged warning — it never throws out of this function and never blocks
+ * every OTHER project's dispatch for one project's bad fs state.
+ *
+ * Computed ONCE here, before pickNextBatch runs, and threaded down as pure
+ * data (quietOpts.satisfiedSlugsByCwd) — schedulerBatch.cjs itself does no
+ * I/O, so this is the only fs read this gate costs per tick, not one per job
+ * per dep.
+ */
+async function computeDepHistorySatisfaction(state) {
+  const byCwd = new Map();
+  const cwds = new Set((state?.jobs || []).map((j) => j.cwd || DEFAULT_PROJECT_CWD));
+  for (const cwd of cwds) {
+    const satisfied = new Set();
+    try {
+      for (const slug of await queueHistory.completedSlugsForCwd(cwd)) satisfied.add(slug);
+      for (const dir of listArchivedPrdDirs(cwd)) {
+        let entries;
+        try { entries = await fsp.readdir(dir); } catch { continue; }
+        for (const name of entries) {
+          if (name.endsWith('.md')) satisfied.add(name.slice(0, -3));
+        }
+      }
+    } catch (e) {
+      console.warn(`[scheduler] depHistorySatisfaction: history/archive lookup failed for ${cwd} (${e?.message}) — falling back to fail-open dep resolution for this project this tick`);
+      byCwd.set(cwd, DEP_HISTORY_FAIL_OPEN);
+      continue;
+    }
+    byCwd.set(cwd, satisfied);
+  }
+  return byCwd;
+}
+
 /**
  * A run that never got a turn (res.launchFailure — see executeJob's onExit)
  * is routed here instead of the failed/investigation path (issue #11 lists
@@ -4468,9 +5225,64 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     // started after the manual clear, not whatever startedAt this row
     // carried from a prior run.
     let dispatchStartedAtMs = null;
+    let dispatchSkippedAlreadyCompleted = false;
     await mutate((s) => {
       const idx = s.jobs.findIndex((x) => x.slug === job.slug);
       if (idx >= 0) {
+        // Anti-resurrection guard for an EXISTING pending row (the gap left
+        // by reconcile()'s own guard, which only ever sees a slug BEFORE it
+        // first lands in s.jobs — 2026-09-06 incident: a finalize dropped
+        // silently three times over left this same slug 'pending' and the
+        // dispatcher re-fired it three more times against work that had
+        // already shipped). Skipped for a resume-recovery dispatch (that
+        // targets a specific prior session on purpose) and for anything not
+        // currently 'pending' (e.g. a needs_review->running recovery row).
+        if (!resumeTarget && s.jobs[idx].status === 'pending') {
+          const outcome = latestTerminalOutcomeForSlug(job.slug, { runsDir: RUNS_DIR });
+          const reconcileDecision = evaluateDispatchSidecarReconcile({
+            rowStatus: s.jobs[idx].status,
+            rowRunId: s.jobs[idx].runId ?? null,
+            statusHistory: s.jobs[idx].statusHistory,
+            queuedAt: s.jobs[idx].queuedAt ?? null,
+            outcome,
+          });
+          if (reconcileDecision.skip) {
+            const sidecar = readRunOutcomeSidecars(path.join(RUNS_DIR, reconcileDecision.runId), job.slug);
+            transitionJob(s.jobs[idx], 'completed', {
+              reason: `prior run ${reconcileDecision.runId} already completed this slug (sidecar-reconciled)`,
+              source: 'spawnJob:dispatch-sidecar-reconcile',
+            });
+            s.jobs[idx].runId = reconcileDecision.runId;
+            s.jobs[idx].finishedAt = reconcileDecision.finishedAt;
+            s.jobs[idx].exitCode = 0;
+            if (sidecar.outcome?.landedCommit) {
+              s.jobs[idx].landedCommit = sidecar.outcome.landedCommit;
+            }
+            appendAuditEvent('job_dispatch_skipped_already_completed', {
+              slug: job.slug,
+              priorRunId: reconcileDecision.runId,
+              cwd: job.cwd || defaultCwd,
+            });
+            console.warn(
+              `[scheduler] ${job.slug}: dispatch skipped — prior run ${reconcileDecision.runId} already `
+              + 'completed this slug (sidecar-reconciled)',
+            );
+            dispatchSkippedAlreadyCompleted = true;
+            return;
+          }
+          // Belt-and-braces (PRD fix-plan step 3): a row about to dispatch
+          // with no landedCommit of its own, whose newest sidecar for this
+          // slug DOES record one, gets it backfilled before spawn so
+          // verifyRun receives a real priorLandedCommit and the
+          // pass_no_commit_prior_run_verified exemption can fire on this
+          // run if it turns out to be another no-op re-verification.
+          if (!s.jobs[idx].landedCommit && outcome?.runId) {
+            const sidecar = readRunOutcomeSidecars(path.join(RUNS_DIR, outcome.runId), job.slug);
+            if (sidecar.outcome?.landedCommit) {
+              s.jobs[idx].landedCommit = sidecar.outcome.landedCommit;
+            }
+          }
+        }
         transitionJob(s.jobs[idx], 'running', {
           reason: resumeTarget ? 'dispatched for resume-recovery' : 'dispatched for execution',
           source: 'spawnJob:dispatch',
@@ -4494,6 +5306,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       }
     });
     await broadcast({ flush: true });
+    if (dispatchSkippedAlreadyCompleted) return;
 
     // Commit-guard baseline: snapshot the working tree BEFORE the run so the
     // post-run check flags only paths THIS job left dirty, not pre-existing WIP.
@@ -4586,6 +5399,11 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     let res;
     let worktreeLeftoverDirty = [];
     let worktreeIntegrationFailure = null;
+    // Set only when integrateJobBranch's stderr-parsing auto-resolve fired
+    // (PRD 1125) — surfaced on the job row so the Queue UI can say the merge
+    // self-healed rather than silently looking like an ordinary merge.
+    let mergeAutoResolved = null;
+    let mergeAutoResolvedPaths = null;
     // A job's uncommitted-work patch, whichever isolation mode produced it —
     // set by EITHER branch below, never both (worktree.ok picks exactly one
     // shape for the whole run). Named generically (not "worktree...") because
@@ -4633,6 +5451,11 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           console.error(`[scheduler] ${job.slug}: worktree branch integration FAILED (${integration.reason}) — branch ${worktree.branch} preserved in ${guardCwd} for manual recovery`);
         } else if (integration.integrated) {
           console.log(`[scheduler] ${job.slug}: worktree branch ${worktree.branch} integrated into ${guardCwd}${integration.mergeCommit ? ' (merge commit)' : ' (fast-forward)'}`);
+          if (integration.autoResolved) {
+            mergeAutoResolved = integration.autoResolved;
+            mergeAutoResolvedPaths = integration.resolvedPaths || [];
+            console.log(`[scheduler] ${job.slug}: merge auto-resolved (${integration.autoResolved}) — discarded ${mergeAutoResolvedPaths.length} identical working-tree duplicate(s): ${mergeAutoResolvedPaths.join(', ')}`);
+          }
         }
         await jobWorktree.cleanupJobWorktree({
           cwd: guardCwd,
@@ -4727,7 +5550,9 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     }
 
     if (res.rateLimited) {
-      const resetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const logPath = path.join(runDir, `${job.slug}.log`);
+      const billingResetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const resetIso = resolveRateLimitPauseReset(logPath, billingResetIso);
       const observedAt = dispatchStartedAtMs;
       const prevCount = consecutiveRapidRateLimitsBySlug.get(job.slug) || 0;
       const nextCount = nextRapidRateLimitCount(prevCount, { rateLimited: true, durationMs: res.durationMs });
@@ -4868,14 +5693,27 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           ranInWorktree: worktree.ok,
           jobSelfCommitted,
           legitimateNoOp: guardIsLegitimateNoOp,
-          isFixPlanJob: isFixPlanSlug(job.slug),
+          isFixPlanJob: resolveIsFixPlan(job.slug, job.isFixPlan),
           verifyResult,
           salvagePatch,
         });
         if (guardVerdict) {
-          verifyResult = guardVerdict;
-          const what = newlyDirty.length > 0 ? `left ${newlyDirty.length} files uncommitted` : 'made no commit on an already-clean tree';
-          console.log(`[scheduler] commit-guard: ${job.slug} ${what} → needs_review`);
+          // Already-satisfied-on-main exemption (PRD 1136): resolveCommitGuardOutcome
+          // only ever touches the clean-tree/no-commit shape ('silent_no_op') —
+          // a job that left dirty files behind is a genuine finish-protocol
+          // violation regardless of what already landed on main, so it is
+          // never routed through this check (see that function's own doc).
+          const satisfyingCommits = guardVerdict.verdict === 'silent_no_op'
+            ? await findSatisfyingCommitOnMain(job)
+            : [];
+          const finalVerdict = resolveCommitGuardOutcome(guardVerdict, satisfyingCommits);
+          verifyResult = finalVerdict;
+          if (finalVerdict.verdict === 'already_satisfied_on_main') {
+            console.log(`[scheduler] already-satisfied-on-main: ${job.slug} → completed (${finalVerdict.satisfyingSha})`);
+          } else {
+            const what = newlyDirty.length > 0 ? `left ${newlyDirty.length} files uncommitted` : 'made no commit on an already-clean tree';
+            console.log(`[scheduler] commit-guard: ${job.slug} ${what} → needs_review`);
+          }
         }
       }
     }
@@ -4941,13 +5779,37 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       );
     }
 
+    // BLOCKED_BY_FOREIGN_WIP claim scan: the executor exits non-zero for this
+    // outcome (same as FAIL — see FINISH_PROTOCOL), so it is never seen by the
+    // exit=0-only verifyRun call above; scanned here, against THIS run's own
+    // log, before the generic non-zero-exit -> 'failed' classification below.
+    // Read outside mutate() (I/O); actual manifest validation happens inside
+    // mutate(), against the LIVE row's preRunDirtyPaths/carriedPaths, so a
+    // stale local `job` snapshot can never be the source of truth for it.
+    let foreignWipClaimedPaths = null;
+    if (res.exitCode !== 0 && !res.rateLimited) {
+      try {
+        const { resultEvent, events } = parseLog(path.join(runDir, `${job.slug}.log`));
+        if (scanSentinel(resultEvent, events) === 'blocked_by_foreign_wip') {
+          foreignWipClaimedPaths = scanForeignWipPathsClaim(resultEvent, events);
+        }
+      } catch (e) {
+        console.warn(`[scheduler] ${job.slug}: foreign-WIP verdict scan failed, falling through to ordinary failed classification`, e?.message);
+      }
+    }
+
     let actuallyFailed = false;
     let failedJobSnapshot = null;
     let needsInvestigationNow = false;
     let investigationJobSnapshot = null;
+    let investigationDeadChildSnapshot = null;
     let needsReviewRcaSnapshot = null;
     let resumeRecoveryJob = null;
     let resumeRecoveryTarget = null;
+    let quarantineJob = null;
+    let quarantinePaths = null;
+    let mechanicalRecoveryJob = null;
+    let mechanicalRecoveryTarget = null;
     let terminalNotifySnapshot = null;
     const newlyCompletedPrds = [];
     await mutate((s) => {
@@ -4960,7 +5822,44 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       // scheduleJobTransitions.cjs's LEGAL_TRANSITIONS) and silently
       // undo the cancellation. Skip — the row already reflects its real
       // terminal state.
-      if (i2 >= 0 && s.jobs[i2].status !== 'running') return;
+      const finalizeDrop = evaluateFinalizeDrop({
+        rowExists: i2 >= 0,
+        rowStatus: i2 >= 0 ? s.jobs[i2].status : null,
+        rowRunId: i2 >= 0 ? (s.jobs[i2].runId ?? null) : null,
+        rowLandedCommit: i2 >= 0 ? (s.jobs[i2].landedCommit ?? null) : null,
+        runId,
+        landedCommit: jobLandedCommitThisRun ?? null,
+      });
+      if (finalizeDrop.drop) {
+        // Never silent (2026-09-06 incident: a bare early-return here dropped
+        // three legitimate no-op verifications of an already-shipped PRD with
+        // no trace at all, leaving the row stuck 'pending' so the dispatcher
+        // re-fired it three more times). 'row-not-running' covers a job
+        // already moved off 'running' by someone else (namely
+        // remote.cancelJob, PRD 1024) — re-finalizing anyway could
+        // re-legalize the row via a legal failed->completed/needs_review edge
+        // and silently undo the cancellation, so the STATUS change is still
+        // skipped; only a genuinely-landed commit is stamped as a fact.
+        const logFn = finalizeDrop.reason === 'row-missing' ? console.error : console.warn;
+        logFn(
+          `[scheduler] finalize dropped: slug=${job.slug} runId=${runId} reason=${finalizeDrop.reason} `
+          + `actualStatus=${i2 >= 0 ? s.jobs[i2].status : '(row-missing)'} `
+          + `rowRunId=${i2 >= 0 ? (s.jobs[i2].runId ?? '(none)') : '(none)'}`,
+        );
+        appendAuditEvent('job_finalize_dropped', {
+          slug: job.slug,
+          runId,
+          reason: finalizeDrop.reason,
+          actualStatus: i2 >= 0 ? s.jobs[i2].status : null,
+          rowRunId: i2 >= 0 ? (s.jobs[i2].runId ?? null) : null,
+          landedCommit: jobLandedCommitThisRun ?? null,
+          exitCode: res.exitCode,
+        });
+        if (finalizeDrop.stampLandedCommit) {
+          s.jobs[i2].landedCommit = finalizeDrop.stampLandedCommit;
+        }
+        return;
+      }
       if (i2 >= 0) {
         const treatAsPending = res.rateLimited || (s.paused && s.paused.reason === 'rate_limit');
         if (treatAsPending) {
@@ -4972,14 +5871,66 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           const sigtermOverride = res.exitCode !== 0
             ? classifySigtermWithCommit(res.exitCode, sigtermCommitFound)
             : null;
+          // Validated against the LIVE row's own foreign-WIP manifest — never
+          // the stale outer `job` snapshot — so an unlisted path cannot
+          // launder a real regression into a block (PRD: give the executor a
+          // first-class verdict for "the gate failed on a sibling's in-flight
+          // file", but VALIDATE the claim rather than trust it).
+          const foreignWipValidation = (!sigtermOverride && foreignWipClaimedPaths !== null)
+            ? validateForeignWipBlockClaim(foreignWipClaimedPaths, s.jobs[i2])
+            : null;
+          // Consecutive-block streak: cleared by default on every outcome and
+          // only re-established below inside the validated-block branch —
+          // so a completed run, an ordinary failure, or any other outcome
+          // between two blocks always resets "in a row" back to zero.
+          const priorForeignWipBlockCount = s.jobs[i2].foreignWipBlockCount ?? 0;
+          delete s.jobs[i2].foreignWipBlockCount;
           if (sigtermOverride) {
             effectiveStatus = sigtermOverride.status;
             sigtermOverrideReason = sigtermOverride.reason;
+          } else if (foreignWipValidation && foreignWipValidation.ok) {
+            const blockCount = priorForeignWipBlockCount + 1;
+            s.jobs[i2].foreignWipBlockCount = blockCount;
+            s.jobs[i2].blockedByForeignWip = true;
+            s.jobs[i2].foreignWipBlockedPaths = foreignWipValidation.validPaths;
+            if (blockCount >= FOREIGN_WIP_BLOCK_STREAK_LIMIT) {
+              // Blocked FOREIGN_WIP_BLOCK_STREAK_LIMIT times in a row on the
+              // same tree: auto-requeuing again would spin forever against
+              // paths that never go clean. Park for a human instead — never
+              // routed through the auto-fix chain (selectAutoFixTargets
+              // excludes any job.blockedByForeignWip row), since there is no
+              // fix-plan to author against another job's WIP.
+              effectiveStatus = 'needs_review';
+              s.jobs[i2].verifierVerdict = 'blocked_by_foreign_wip_streak';
+              sigtermOverrideReason = `blocked by foreign WIP ${blockCount} times in a row on persistently-dirty path(s): ${foreignWipValidation.validPaths.join(', ')} — auto-requeue exhausted, parked for human review`;
+            } else {
+              // Terminal-but-retryable, same shape as the existing 'skipped'
+              // status (never counts as failed, never enters the auto-fix
+              // chain, reconcile()'s requeueForeignWipBlockedJobs promotes it
+              // straight back to 'pending' once these exact paths go clean).
+              effectiveStatus = 'skipped';
+              sigtermOverrideReason = `blocked by foreign WIP (attempt ${blockCount}/${FOREIGN_WIP_BLOCK_STREAK_LIMIT}): ${foreignWipValidation.validPaths.join(', ')} — will auto-requeue once these path(s) are no longer dirty`;
+            }
+          } else if (foreignWipValidation && !foreignWipValidation.ok) {
+            // Claimed BLOCKED_BY_FOREIGN_WIP but named a path outside this
+            // job's own disclosed manifest (or named none at all) — downgrade
+            // to an ordinary failure and log the offending paths loudly so the
+            // rejection is never silent.
+            console.warn(`[scheduler] ${job.slug}: SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP downgraded to FAIL — claimed path(s) not in this job's foreign-WIP manifest: ${foreignWipValidation.invalidPaths.join(', ') || '(no FOREIGN_WIP_PATHS line)'}`);
+            effectiveStatus = 'failed';
+            sigtermOverrideReason = `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP rejected — unlisted path(s) not in the disclosed foreign-WIP manifest: ${foreignWipValidation.invalidPaths.join(', ') || '(no FOREIGN_WIP_PATHS line)'}`;
           } else if (res.exitCode !== 0) {
             effectiveStatus = 'failed';
           } else if (
             !verifyResult
             || COMPLETED_EQUIVALENT_VERDICTS.has(verifyResult.verdict)
+            // Already-satisfied-on-main (PRD 1136): a second, independently-
+            // evidenced route to 'completed' alongside COMPLETED_EQUIVALENT_
+            // VERDICTS above — kept as its own explicit check rather than
+            // folded into that shared Set so it can never leak into
+            // reverifyNeedsReview's or runVerify.cjs's unrelated healing
+            // decisions, which consult that Set for a different purpose.
+            || verifyResult.verdict === 'already_satisfied_on_main'
           ) {
             effectiveStatus = 'completed';
           } else if (verifyResult.downgradeTo === 'pending') {
@@ -4991,7 +5942,14 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             effectiveStatus = 'needs_review';
           }
 
-          transitionJob(s.jobs[i2], effectiveStatus, { reason: sigtermOverrideReason ?? `run finished with exit ${res.exitCode}`, source: 'spawnJob:finalize' });
+          // already_satisfied_on_main names the satisfying sha in its own
+          // reason — surface that on the completed row's statusHistory
+          // instead of the generic "run finished with exit 0" every other
+          // completed run gets.
+          const finalizeReason = (effectiveStatus === 'completed' && verifyResult?.verdict === 'already_satisfied_on_main')
+            ? verifyResult.reason
+            : (sigtermOverrideReason ?? `run finished with exit ${res.exitCode}`);
+          transitionJob(s.jobs[i2], effectiveStatus, { reason: finalizeReason, source: 'spawnJob:finalize' });
           s.jobs[i2].finishedAt = new Date().toISOString();
           s.jobs[i2].exitCode = res.exitCode;
           s.jobs[i2].leakedDescendants = res.leakedDescendants ?? [];
@@ -5000,7 +5958,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           } else {
             delete s.jobs[i2].salvagePatch;
           }
-          s.jobs[i2].error = effectiveStatus === 'needs_review'
+          s.jobs[i2].error = (effectiveStatus === 'needs_review' || s.jobs[i2].blockedByForeignWip === true)
             ? (verifyResult?.reason ?? sigtermOverrideReason ?? null)
             // A failed job (non-zero exit) never consults verifyResult above,
             // but a worktree integration failure is still worth surfacing on
@@ -5017,9 +5975,12 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             s.jobs[i2].landedCommit = jobLandedCommitThisRun;
           }
           // Persist the verifier's verdict string so the renderer can show it.
+          // 'blocked_by_foreign_wip_streak' is set above from the sigterm/
+          // exit-code path, never from verifyResult (which stays null on a
+          // non-zero exit) — never clobber it here.
           if (verifyResult?.verdict && verifyResult.verdict !== 'clean') {
             s.jobs[i2].verifierVerdict = verifyResult.verdict;
-          } else {
+          } else if (s.jobs[i2].verifierVerdict !== 'blocked_by_foreign_wip_streak') {
             delete s.jobs[i2].verifierVerdict;
           }
           // Closed-set outcome taxonomy (issue #11 list A2) so a queue row
@@ -5042,6 +6003,17 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           } else {
             delete s.jobs[i2].uncommittedPaths;
           }
+          // Worktree merge self-healed (PRD 1125) — every blocking path was
+          // proven byte-identical to the branch, so the duplicate was
+          // discarded and the merge retried once, successfully. Surfaced so
+          // the Queue UI shows a self-heal instead of an ordinary merge.
+          if (mergeAutoResolved) {
+            s.jobs[i2].mergeAutoResolved = mergeAutoResolved;
+            s.jobs[i2].mergeAutoResolvedPaths = capDirtyPaths(mergeAutoResolvedPaths);
+          } else {
+            delete s.jobs[i2].mergeAutoResolved;
+            delete s.jobs[i2].mergeAutoResolvedPaths;
+          }
           // Non-blocking notes (e.g. a recovered missing-dependency probe, or a
           // pattern hit demoted because a materially-checkable verdict outranked
           // it) — surfaced even on completed jobs so the signal isn't lost.
@@ -5092,6 +6064,18 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             // takes the treatAsPending branch above and never reaches here).
             needsReviewRcaSnapshot = { ...s.jobs[i2] };
 
+            // Mechanical recovery (PRD 1130): evaluated FIRST, ahead of both
+            // resume-first recovery and auto-fix — a job parked with a
+            // mechanically-resolvable verdict (see
+            // selectMechanicalRecoveryTarget) needs no model, no plan, and no
+            // depth-cap check, so it must never fall through to either.
+            // Snapshot only (no I/O inside mutate()); the actual git retry
+            // happens outside mutate(), below.
+            const mTarget = selectMechanicalRecoveryTarget(s.jobs[i2]);
+            if (mTarget) {
+              mechanicalRecoveryJob = { ...s.jobs[i2] };
+              mechanicalRecoveryTarget = mTarget;
+            } else {
             // Resume-first recovery (PRD 1111): evaluated BEFORE the auto-fix
             // eligibility check below — a job whose verdict is
             // 'uncommitted_changes' with a live sessionId gets one bounded
@@ -5105,6 +6089,22 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               resumeRecoveryJob = { ...s.jobs[i2] };
               resumeRecoveryTarget = target;
             } else {
+            // Leftover quarantine (PRD 1128): resume recovery is spent
+            // (resumeRecoveryAttempted already true) and this run STILL parked
+            // needs_review with uncommitted_changes — the leftovers are about
+            // to sit dirty in the shared tree forever, poisoning every later
+            // worktree merge for this cwd. Stamp the one-attempt marker HERE,
+            // synchronously in the same mutate as this decision (mirrors
+            // resumeRecoveryAttempted's own stamp-before-acting rule above),
+            // so a concurrent reverifyNeedsReview pass can never double-fire
+            // this. The actual git work is async and runs outside mutate(),
+            // below (performLeftoverQuarantine).
+            const quarantineTarget = selectLeftoverQuarantineTarget(s.jobs[i2]);
+            if (quarantineTarget) {
+              s.jobs[i2].leftoverQuarantineAttempted = true;
+              quarantineJob = { ...s.jobs[i2] };
+              quarantinePaths = quarantineTarget.paths;
+            }
             // Same-tick auto-fix (feedback 2026-07-12): rather than waiting up to
             // 10 min for reverifyNeedsReview()'s periodic pass, check right here
             // whether this job qualifies for auto-fix (same eligibility rule
@@ -5119,8 +6119,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               isEligibleForImmediateAutoFix(s.jobs[i2], s.jobs, fixSlugExists)
             ) {
               const isRetryAttempt = s.jobs[i2].autoFixAttempted === true;
+              const isDeadFixPlanReopen = isFixPlanDead(s.jobs[i2], s.jobs);
+              if (isDeadFixPlanReopen) {
+                investigationDeadChildSnapshot = s.jobs.find((x) => x.slug === fixSlugFor(s.jobs[i2])) || null;
+              }
               s.jobs[i2].autoFixAttempted = true;
               if (!s.jobs[i2].runId) s.jobs[i2].runId = runId;
+              if (isDeadFixPlanReopen) s.jobs[i2].autoFixReopened = true;
               if (isRetryAttempt) {
                 s.jobs[i2].autoFixRetries = (s.jobs[i2].autoFixRetries ?? 0) + 1;
                 delete s.jobs[i2].autoFixOutcome;
@@ -5129,13 +6134,14 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
               investigationJobSnapshot = { ...s.jobs[i2] };
             }
             }
+            }
           }
           // Auto-promote: when a fix-* PRD completes successfully, the original
           // failed PRD's work is logically done. Flip its status to 'completed'
           // so the cross-group failure gate in pickNextBatch releases. Without
           // this, the queue stalls indefinitely behind a stale failure even
           // though the auto-recovery did its job.
-          if (effectiveStatus === 'completed' && isFixPlanSlug(job.slug)) {
+          if (effectiveStatus === 'completed' && resolveIsFixPlan(job.slug, job.isFixPlan)) {
             const orig = healTargetForFix(job.slug, s.jobs);
             if (orig) {
               const priorStatus = orig.status;
@@ -5207,6 +6213,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
         });
     }
 
+    if (mechanicalRecoveryJob && mechanicalRecoveryTarget) {
+      console.log(`[scheduler] needs_review ${job.slug} → mechanical-recovery (re-integrating ${mechanicalRecoveryTarget.branch})`);
+      performMechanicalRecovery(mechanicalRecoveryJob, mechanicalRecoveryTarget).catch((e) => {
+        console.error('[scheduler] performMechanicalRecovery error', job.slug, e);
+      });
+    }
+
     if (resumeRecoveryJob && resumeRecoveryTarget) {
       console.log(`[scheduler] needs_review ${job.slug} → resume-recovery (session ${resumeRecoveryTarget.sessionId}, ${resumeRecoveryTarget.dirtyPaths.length} dirty path(s))`);
       spawnResumeRecovery(resumeRecoveryJob, resumeRecoveryTarget).catch((e) => {
@@ -5214,6 +6227,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       });
     }
 
+    if (quarantineJob && quarantinePaths) {
+      console.log(`[scheduler] needs_review ${job.slug} → quarantining ${quarantinePaths.length} leftover path(s) (resume recovery already spent)`);
+      performLeftoverQuarantine(quarantineJob, quarantinePaths, guardHeadBefore).catch((e) => {
+        console.error('[scheduler] performLeftoverQuarantine error', job.slug, e);
+      });
+    }
+
     if (actuallyFailed && failedJobSnapshot) {
       // Transient-failure detector. A 143/137 exit is ALWAYS a signal kill — the
       // agent never self-exits with those — so the only question is WHO killed it.
@@ -5286,7 +6306,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       }
     } else if (needsInvestigationNow && investigationJobSnapshot) {
       console.log(`[scheduler] needs_review ${job.slug} → immediate auto-fix investigation (not waiting for periodic reverify)`);
-      spawnInvestigation(investigationJobSnapshot, runDir).catch((e) => {
+      spawnInvestigation(investigationJobSnapshot, runDir, { deadChild: investigationDeadChildSnapshot }).catch((e) => {
         console.error('[scheduler] spawnInvestigation error', job.slug, e);
       });
     }
@@ -5356,11 +6376,13 @@ function tickQueue({ bypassLoadGate = false } = {}) {
     // ceilinged the queue at 3 while the pool the user configured said 5.
     const freeSlots = sessionSlots.available();
     const heldSlugs = await computeLaunchHolds(state);
+    const satisfiedSlugsByCwd = await computeDepHistorySatisfaction(state);
     const { batch, reason: holdReason, holds } = pickNextBatch(state.jobs, runningSet, freeSlots, {
       leaseHeld: quietMachineLease.isHeld(),
       machineInUse: sessionSlots.inUse(),
       now: Date.now(),
       heldSlugs,
+      satisfiedSlugsByCwd,
     });
     if (batch.length === 0 && freeSlots === 0) {
       const snap = sessionSlots.snapshot();
@@ -5663,6 +6685,55 @@ function runQueueHealthSweep(jobs) {
   }
 }
 
+// Cross-cycle "already attempted" memory for the branch sweep (PRD 1135) —
+// in-memory only, keyed `"<cwd>::<branch>"`. Resets on restart, same as
+// consecutiveRapidRateLimitsBySlug above; the goal is "don't retry a
+// permanently-conflicting branch every cycle forever" while the process
+// stays up, not durability across a restart.
+const branchSweepAttempted = new Set();
+
+/**
+ * Recover any `sm-job/*` branch left stranded (unmerged, owning row terminal
+ * or gone) across every known project — the other half of PRD 1135's
+ * invariant alongside the reaper's liveness check above: that check stops
+ * NEW stranding, this sweep recovers anything stranded before it (or by a
+ * crash the liveness check can't cover). Read-only reporting plus AT MOST one
+ * bounded integrateBranch attempt per branch per process lifetime (see
+ * branchSweepAttempted) — never forces anything, never deletes a branch.
+ * Hangs off the same cadence as runQueueHealthSweep. Never throws.
+ */
+async function runBranchSweep(jobs) {
+  if (process.env.SM_BRANCH_SWEEP_DISABLE === '1') return;
+  try {
+    for (const cwd of allProjectCwds()) {
+      let sweep;
+      try {
+        sweep = await sweepStrandedJobBranches({ cwd, jobs, attemptedBranches: branchSweepAttempted });
+      } catch (e) {
+        console.warn(`[scheduler] branch sweep error for ${cwd}`, e?.message);
+        continue;
+      }
+      for (const r of sweep.results) {
+        if (r.action === 'integrated') {
+          console.log(`[scheduler] branch-sweep: merged stranded branch ${r.branch} into ${cwd} HEAD`);
+          appendAuditEvent('branch_sweep_integrated', { cwd, branch: r.branch, slug: r.slug });
+        } else if (r.action === 'conflict') {
+          console.warn(`[scheduler] branch-sweep: ${r.branch} could not be integrated: ${r.integration?.reason}`);
+          appendAuditEvent('branch_sweep_conflict', { cwd, branch: r.branch, slug: r.slug, reason: r.integration?.reason });
+          if (r.slug) {
+            await mutate((s) => {
+              const j = s.jobs.find((x) => x.slug === r.slug);
+              if (j) j.strandedBranch = r.branch;
+            });
+          }
+        }
+      }
+    }
+  } catch (e) {
+    console.warn('[scheduler] branch sweep error', e?.message);
+  }
+}
+
 /**
  * Scan running jobs, identify those whose claude process is provably dead OR
  * whose spawn never got far enough to record a runtime.pid in the first
@@ -5680,14 +6751,35 @@ async function reapDeadRunningJobs() {
     // status:"running" with no slug left in runningSet to trigger reconciliation.
     // queue.json is the source of truth for which jobs are actually running.
     const state = await readQueue();
-    const { reapable, warnings } = selectReapableJobs(state.jobs, Date.now(), {
+    const { reapable, warnings, recovered } = selectReapableJobs(state.jobs, Date.now(), {
       pidAlive: claudePidAlive,
       grace: PIDLESS_SPAWN_GRACE_MS,
+      findLiveProcess: (j) => findLiveProcessForJob(j, {
+        worktreeDir: jobWorktree.worktreeDirFor(j.cwd || state.config?.defaultCwd || DEFAULT_PROJECT_CWD, j.slug),
+      }),
     });
     for (const w of warnings) {
       console.warn(`[scheduler] reapDeadRunningJobs: ${w.reason} slug=${w.slug} — leaving row alone`);
     }
 
+    // A pidless row whose process was proven alive by the /proc liveness
+    // scan must never be terminalized (2026-09-06 incident — see
+    // findLiveProcessForJob's header). Re-stamp the recovered pid so future
+    // cycles see it as an ordinary live-pid row, and stop here for it.
+    if (recovered.length) {
+      await mutate(async (s) => {
+        for (const r of recovered) {
+          const idx = s.jobs.findIndex((x) => x.slug === r.slug);
+          if (idx < 0 || s.jobs[idx].status !== 'running') continue;
+          s.jobs[idx].runtime = { ...(s.jobs[idx].runtime || {}), pid: r.pid };
+        }
+      });
+      for (const r of recovered) {
+        console.log(`[scheduler] reapDeadRunningJobs: pid=${r.pid} recovered by /proc liveness scan for slug=${r.slug} — row stays running`);
+        appendAuditEvent('job_pid_recovered_by_liveness_scan', { slug: r.slug, pid: r.pid });
+      }
+    }
+
     const dead = [];
     for (const { slug, pid, pidless, reason } of reapable) {
       const j = state.jobs.find((x) => x.slug === slug);
@@ -5698,15 +6790,18 @@ async function reapDeadRunningJobs() {
       // 'no_result' → non-success below → filed as failed, never completed.
       const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
       // A pidless reap means the spawn never got far enough to record a
-      // pid — the gate could not possibly have run, regardless of what
-      // classifyRunOutcome makes of an absent/empty log.
-      const gateOutcome = pidless ? 'never_ran' : mapOutcomeToGateOutcome(outcome);
-      dead.push({ slug, pid, outcome, gateOutcome, pidless, reason });
+      // pid — the gate could not possibly have run. But `never_ran` is only
+      // a true claim when the run dir produced no log output at all; a log
+      // with real content proves the job DID run (see
+      // resolvePidlessGateOutcome's header).
+      const gateOutcome = pidless ? resolvePidlessGateOutcome(outcome, logHasOutput(logPath)) : mapOutcomeToGateOutcome(outcome);
+      dead.push({ slug, pid, outcome, gateOutcome, pidless, reason, logPath });
     }
 
     queueHealthSweepCycle += 1;
     if (queueHealthSweepCycle % QUEUE_HEALTH_SWEEP_EVERY_N_CYCLES === 0) {
       runQueueHealthSweep(state.jobs);
+      await runBranchSweep(state.jobs);
     }
 
     if (dead.length === 0) return;
@@ -5718,8 +6813,9 @@ async function reapDeadRunningJobs() {
     // the same still-active rate limit — the spin loop this PRD exists to
     // stop. Done once, outside mutate(), before finalizing any row below.
     if (dead.some((d) => d.outcome === 'rate_limited')) {
-      const resetIso = await refreshNextReset().catch(() => cachedNextReset);
       const triggering = dead.find((d) => d.outcome === 'rate_limited');
+      const billingResetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const resetIso = resolveRateLimitPauseReset(triggering.logPath, billingResetIso);
       const triggeringRow = triggering ? state.jobs.find((x) => x.slug === triggering.slug) : null;
       const observedAtMs = triggeringRow?.startedAt ? Date.parse(triggeringRow.startedAt) : null;
       // Same rapid-repeat circuit breaker spawnJob's own res.rateLimited
@@ -5739,6 +6835,64 @@ async function reapDeadRunningJobs() {
       await setPaused('rate_limit', resetIso, { observedAt: observedAtMs, force: forceHardPause });
     }
 
+    // Prove integration BEFORE entering mutate() (PRD 1133): the check below
+    // shells out to git — including a full `git fetch --all --prune` (up to
+    // 20s) via computeCommittedDuringRun's committedInWindow, plus up to two
+    // 2s retry sleeps when nothing landed — for every dead job that needs the
+    // in-place fallback. mutate() serializes through ONE global mutateTail
+    // promise chain shared by every project's dispatch/admin/cancel mutation,
+    // same reason the rate-limit handling above already runs outside it — so
+    // doing this git work inside the mutate() callback would stall the whole
+    // scheduler's queue writes for the sum of these calls across every dead
+    // job in the batch (e.g. an app-restart reap that dead-letters several
+    // running jobs at once).
+    const integrationResults = new Map();
+    for (const d of dead) {
+      if (d.outcome !== 'success') continue;
+      const row = state.jobs.find((x) => x.slug === d.slug);
+      if (!row) continue;
+      const rowCwd = row.cwd || state.config?.defaultCwd || DEFAULT_PROJECT_CWD;
+      if (!isGitRepoSync(rowCwd)) continue;
+      const branch = jobWorktree.branchNameFor(d.slug);
+      const integrated = await isBranchAlreadyIntegrated(rowCwd, branch);
+      const headNow = await gitHead(rowCwd);
+      const guardHeadBeforeVal = row.guardHeadBefore || null;
+      let landedCommit = null;
+      let notLandedInfo = null;
+      let effectiveSuccess = true;
+      if (integrated === null) {
+        // No sm-job/<slug> branch — an in-place run (or worktree isolation
+        // disabled). Prove landing via the exact same HEAD-advance evidence
+        // the live commit-guard already uses — reused, not re-derived.
+        const committed = await computeCommittedDuringRun(
+          rowCwd, guardHeadBeforeVal, headNow, row.startedAt, new Date().toISOString(),
+        );
+        if (committed) {
+          if (guardHeadBeforeVal && headNow && headNow !== guardHeadBeforeVal) landedCommit = headNow;
+        } else {
+          effectiveSuccess = false;
+          notLandedInfo = {
+            verdict: 'reaped_without_integration',
+            reason: 'no commit landed during the run window — HEAD never advanced',
+          };
+        }
+      } else if (integrated === true) {
+        if (guardHeadBeforeVal && headNow && headNow !== guardHeadBeforeVal) landedCommit = headNow;
+      } else {
+        // Branch exists and still holds commits never merged into rowCwd's
+        // HEAD — the exact PRD 1118 shape. Never merge it here (see
+        // isBranchAlreadyIntegrated's header comment); park for review
+        // instead, naming the branch so the work is easy to find and land by
+        // hand or via mechanical recovery.
+        effectiveSuccess = false;
+        notLandedInfo = {
+          verdict: 'reaped_without_integration',
+          reason: `worktree branch ${branch} still holds unintegrated work — never merged into ${rowCwd}`,
+        };
+      }
+      integrationResults.set(d.slug, { effectiveSuccess, landedCommit, notLandedInfo });
+    }
+
     await mutate(async (s) => {
       for (const { slug, pid, outcome, gateOutcome, pidless, reason } of dead) {
         const idx = s.jobs.findIndex((x) => x.slug === slug);
@@ -5777,12 +6931,38 @@ async function reapDeadRunningJobs() {
             console.error(`[scheduler] reapDeadRunningJobs: in-place salvage failed for ${slug}`, e);
           }
         }
+        // Prove integration before this reap is allowed to say 'completed'
+        // (PRD 1133): a reaped job's owning process vanished before
+        // spawnJob's own post-run integration/commit-guard ever ran, so
+        // 'outcome=success' alone (a clean result event in the log) is not
+        // proof anything actually landed — the two live incidents this PRD
+        // exists for (1118, starry-night-ships 224) both had exactly that
+        // shape. Only evaluated for a genuinely successful, non-rate-limited
+        // outcome; a non-git cwd (isGitRepoSync false) skips this entirely,
+        // preserving today's behaviour exactly. The actual git work already
+        // ran ABOVE, before this mutate() call, into integrationResults — see
+        // that block's own header comment for why it must not run in here.
+        let effectiveSuccess = success;
+        let landedCommit = null;
+        let notLandedInfo = null;
+        if (success && !rateLimited) {
+          const ir = integrationResults.get(slug);
+          if (ir) {
+            effectiveSuccess = ir.effectiveSuccess;
+            landedCommit = ir.landedCommit;
+            notLandedInfo = ir.notLandedInfo;
+          }
+        }
+
         const leftoverSuffix = deltaPaths && deltaPaths.length
           ? ` — left ${deltaPaths.length} files uncommitted`
           : '';
+        const baseReason = notLandedInfo
+          ? `reaped: ${notLandedInfo.reason}`
+          : (pidless ? reason : `reaped: process gone (outcome=${outcome})`);
         const transitionReason = rateLimited
           ? `reaped: rate limit detected — reset to pending, not failed (outcome=${outcome})${leftoverSuffix}`
-          : (pidless ? reason : `reaped: process gone (outcome=${outcome})`) + leftoverSuffix;
+          : baseReason + leftoverSuffix;
 
         if (rateLimited) {
           // Retryable, never terminal (PRD 1117) — same resetJobFields path
@@ -5791,11 +6971,18 @@ async function reapDeadRunningJobs() {
           // paused-for-rate-limit reset: fresh runId/startedAt/exitCode.
           resetJobFields(s.jobs[idx], transitionReason, { source: 'reapDeadRunningJobs:rate-limit' });
         } else {
-          transitionJob(s.jobs[idx], success ? 'completed' : 'failed', { reason: transitionReason, source: 'reapDeadRunningJobs' });
-          s.jobs[idx].exitCode = success ? 0 : (s.jobs[idx].exitCode ?? 1);
+          const targetStatus = effectiveSuccess ? 'completed' : (notLandedInfo ? 'needs_review' : 'failed');
+          transitionJob(s.jobs[idx], targetStatus, { reason: transitionReason, source: 'reapDeadRunningJobs' });
+          s.jobs[idx].exitCode = effectiveSuccess ? 0 : (s.jobs[idx].exitCode ?? 1);
           s.jobs[idx].finishedAt = new Date().toISOString();
-          s.jobs[idx].error = success ? null : `${transitionReason} (outcome=${outcome})`;
+          s.jobs[idx].error = effectiveSuccess ? null : `${transitionReason} (outcome=${outcome})`;
           s.jobs[idx].gateOutcome = gateOutcome;
+          if (notLandedInfo) {
+            s.jobs[idx].verifierVerdict = notLandedInfo.verdict;
+          } else {
+            delete s.jobs[idx].verifierVerdict;
+          }
+          if (landedCommit) s.jobs[idx].landedCommit = landedCommit;
         }
         delete s.jobs[idx].runtime;
         delete s.jobs[idx].guardBaseline;
@@ -6025,10 +7212,16 @@ const MAX_INVESTIGATION_DEPTH = 1;
  * no recorded investigationDepth (a job already in the queue before this
  * depth tracking shipped) is treated as excluded too, preserving the
  * pre-existing blanket-exclusion behavior for legacy jobs — no retroactive
- * migration. Non-fix-plan slugs are never capped here. Exported for tests.
+ * migration. Non-fix-plan jobs are never capped here.
+ *
+ * `isFixPlan` (PRD 1131) is the job's own persisted classification stamp
+ * (see lib/fixPlanSlug.cjs's resolveIsFixPlan) — an explicit true/false wins
+ * over the slug; only a row with the field entirely absent (persisted
+ * before this change shipped) falls back to the legacy slug-only heuristic.
+ * Exported for tests.
  */
-function isFixPlanBeyondDepthCap(slug, investigationDepth) {
-  if (!isFixPlanSlug(slug)) return false;
+function isFixPlanBeyondDepthCap(slug, investigationDepth, isFixPlan) {
+  if (!resolveIsFixPlan(slug, isFixPlan)) return false;
   if (investigationDepth == null) return true;
   return investigationDepth >= MAX_INVESTIGATION_DEPTH + 1;
 }
@@ -6081,12 +7274,18 @@ function isUnresolvableNeedsReview(job, { hasRunDir }) {
  * ('no-plan', 'error', and unstamped/undefined) — mirrors the retry
  * eligibility rule in selectAutoFixTargets so a job can never be retry-
  * eligible there and simultaneously un-annotatable here.
+ *
+ * A parent stamped `autoFixReopened: true` (its dead fix-plan child earned
+ * it exactly one further attempt — see isFixPlanDead) is a separate
+ * exhaustion path: it is spent as soon as that second investigation
+ * concludes with ANY outcome, including another 'plan' — a reopened parent
+ * never gets a third attempt, so unlike the fresh case a 'plan' outcome does
+ * not exempt it here.
  */
 function isExhaustedAutoFix(job) {
-  return !!job && job.status === 'needs_review'
-    && job.autoFixAttempted === true
-    && job.autoFixOutcome !== 'plan'
-    && (job.autoFixRetries ?? 0) >= 1;
+  if (!job || job.status !== 'needs_review' || job.autoFixAttempted !== true) return false;
+  if (job.autoFixReopened === true) return job.autoFixOutcome != null;
+  return job.autoFixOutcome !== 'plan' && (job.autoFixRetries ?? 0) >= 1;
 }
 
 /**
@@ -6102,6 +7301,31 @@ function isPlanUnqueued(job, queuedSlugs) {
   return !queuedSlugs.has(fixSlugFor(job));
 }
 
+// Terminal-and-not-completed statuses a fix-plan child can die in — see
+// isFixPlanDead.
+const DEAD_FIX_CHILD_STATUSES = new Set(['needs_review', 'failed', 'quarantined', 'skipped']);
+
+/**
+ * Pure predicate: a parent stuck at outcome 'plan' whose own fix-plan child
+ * (fixSlugFor(job)) has ITSELF died — reached a terminal non-completed
+ * status — with nothing left in the ladder that will ever revisit either
+ * row again (selectAutoFixTargets skips a 'plan' outcome outright, and
+ * isPlanUnqueued only fires when the child never reached the queue at all,
+ * which isn't true once a dead child row exists). `job.autoFixReopened`
+ * gates this to exactly once per parent — once stamped, this always returns
+ * false so the parent can never be reopened a second time. Exported for
+ * tests.
+ */
+function isFixPlanDead(job, jobsInProject) {
+  if (!job || job.status !== 'needs_review') return false;
+  if (job.autoFixOutcome !== 'plan') return false;
+  if (job.autoFixReopened === true) return false;
+  const fixSlug = fixSlugFor(job);
+  const child = (jobsInProject || []).find((j) => j.slug === fixSlug);
+  if (!child) return false;
+  return DEAD_FIX_CHILD_STATUSES.has(child.status);
+}
+
 /**
  * Pure predicate: is this job eligible for the boot re-verify self-heal? Only
  * needs_review jobs with a run log (own or backfilled via resolveRunId) AND a
@@ -6238,6 +7462,11 @@ function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRu
   const slugsInQueue = new Set(jobs.map((j) => j.slug));
   return jobs.filter((job) => {
     if (job.status !== 'needs_review') return false;
+    // A job parked here because it was blocked by a sibling's foreign WIP
+    // three times in a row (never its own regression) has nothing for a
+    // fix-plan investigation to diagnose — there is no code defect to
+    // author a PRD against, only another job's still-uncommitted tree.
+    if (job.blockedByForeignWip === true) return false;
     // A stale re-run whose work already shipped (rcaReport's 'already-shipped'
     // class) must never buy a fix-plan PRD — there is nothing to fix, and the
     // correct recovery (archiving the PRD) is a human/reconcile action, not
@@ -6247,16 +7476,30 @@ function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRu
     // bounded `--resume` attempt must never also become a fix-plan target
     // in the same pass — see spawnInvestigation's own identical guard.
     if (selectResumeRecoveryTarget(job)) return false;
+    // Mechanical recovery (PRD 1130): a job eligible for a pure-git retry
+    // must never also become a fix-plan target — it needs no plan and no
+    // model. Defensive: today's single mechanically-resolvable verdict
+    // (worktree_integration_failed) is already excluded below via the depth
+    // cap, but this must hold even if that stops being true.
+    if (selectMechanicalRecoveryTarget(job)) return false;
     const runId = job.runId || resolveJobRunId(job);
     if (!runId) return false;
-    if (isFixPlanBeyondDepthCap(job.slug, job.investigationDepth)) return false;
+    if (isFixPlanBeyondDepthCap(job.slug, job.investigationDepth, job.isFixPlan)) return false;
+    // A dead fix-plan child (PRD 1129) earns its parent exactly one further
+    // attempt, bypassing the normal 'plan' exclusion and the fix-slug/queue
+    // membership checks below — those checks exist to stop a FRESH
+    // investigation from clobbering a live sibling, but here the sibling is
+    // dead and reusing its slug is the whole point of the reopen.
+    const dead = isFixPlanDead(job, jobs);
     if (job.autoFixAttempted) {
-      const retryEligible = job.autoFixOutcome === 'no-plan'
+      const retryEligible = dead
+        || job.autoFixOutcome === 'no-plan'
         || job.autoFixOutcome === 'error'
         || job.autoFixOutcome == null;
       if (!retryEligible) return false;
-      if ((job.autoFixRetries ?? 0) >= 1) return false;
+      if (!dead && (job.autoFixRetries ?? 0) >= 1) return false;
     }
+    if (dead) return true;
     const fixSlug = fixSlugFor(job);
     if (fixSlugExists(fixSlug)) return false;
     if (slugsInQueue.has(fixSlug)) return false;
@@ -6366,7 +7609,15 @@ async function reverifyNeedsReview() {
     // Still needs_review after the existing heal pass — widen the evidence
     // window before giving up on it entirely (unchanged heal semantics for
     // rows that already qualified above; this only adds an annotation).
-    if (stillOpen) {
+    // Skipped when a fix-plan investigation was already minted for this row
+    // (job.autoFixAttempted) — PRD 1136: 'looks done, confirm before
+    // archiving' and 'a -fix- child is already investigating this' are two
+    // different claims about the SAME evidence, and stamping both leaves a
+    // human reading two contradictory signals off one row. autoFixAttempted
+    // is stamped synchronously in spawnJob's same-tick auto-fix branch,
+    // always before this periodic/boot pass can run against the same row, so
+    // this check reliably catches the only order that can occur.
+    if (stillOpen && job.autoFixAttempted !== true) {
       const looksDone = await computeLooksDone(job);
       if (looksDone) {
         looksDoneUpdates.push({ slug: job.slug, cwd: job.cwd, looksDone, fromFailed: false });
@@ -6435,7 +7686,7 @@ async function reverifyNeedsReview() {
   const promotedPrds = [];
   await mutate((s) => {
     for (const job of s.jobs) {
-      if (job.status !== 'completed' || !isFixPlanSlug(job.slug)) continue;
+      if (job.status !== 'completed' || !resolveIsFixPlan(job.slug, job.isFixPlan)) continue;
       const orig = healTargetForFix(job.slug, s.jobs);
       if (!orig) continue;
       const priorStatus = orig.status;
@@ -6519,6 +7770,23 @@ async function reverifyNeedsReview() {
     ? await readQueue()
     : afterHealForAnnotate;
 
+  // Mechanical recovery (PRD 1130): evaluated first, ahead of both
+  // resume-first recovery and auto-fix below — catches a job whose
+  // mechanically-resolvable verdict this periodic pass finds still eligible
+  // (e.g. one already parked before this rung shipped, or one the same-tick
+  // check in spawnJob missed because the app restarted in between). Depth
+  // never disqualifies it, so it runs regardless of investigationDepth.
+  {
+    for (const job of queueForResumeAndAutofix.jobs) {
+      const target = selectMechanicalRecoveryTarget(job);
+      if (!target) continue;
+      console.log(`[scheduler] mechanical-recovery: needs_review ${job.slug} → re-integrating ${target.branch}`);
+      performMechanicalRecovery(job, target).catch((e) => {
+        console.error('[scheduler] performMechanicalRecovery error', job.slug, e);
+      });
+    }
+  }
+
   // Resume-first recovery (PRD 1111): before any fix-plan investigation is
   // authored below, offer the bounded one-attempt `--resume` dispatch to any
   // needs_review job this periodic pass finds still eligible — e.g. one the
@@ -6537,6 +7805,26 @@ async function reverifyNeedsReview() {
     }
   }
 
+  // Leftover quarantine (PRD 1128), periodic pass: catches a job parked
+  // needs_review with resume recovery already spent BEFORE this feature
+  // shipped, or one the same-tick check in spawnJob missed because the app
+  // restarted in between. Stamps the one-attempt marker in its own mutate
+  // BEFORE the async git work starts (same race-closing rule as the resume
+  // loop above and spawnJob's own dispatch stamp).
+  {
+    for (const job of queueForResumeAndAutofix.jobs) {
+      const quarantineTarget = selectLeftoverQuarantineTarget(job);
+      if (!quarantineTarget) continue;
+      console.log(`[scheduler] leftover-quarantine: needs_review ${job.slug} → quarantining ${quarantineTarget.paths.length} leftover path(s)`);
+      mutate((s) => {
+        const j = s.jobs.find((x) => x.slug === job.slug);
+        if (j) j.leftoverQuarantineAttempted = true;
+      }).then(() => performLeftoverQuarantine(job, quarantineTarget.paths)).catch((e) => {
+        console.error('[scheduler] performLeftoverQuarantine error', job.slug, e);
+      });
+    }
+  }
+
   // Auto-fix: spawn a fix-plan investigation for each job still in
   // needs_review after the heal pass (kill-switch: SM_AUTOFIX_DISABLE=1).
   // spawnInvestigation early-returns once investigationsInFlight reaches
@@ -6550,23 +7838,30 @@ async function reverifyNeedsReview() {
       const runId = job.runId || resolveRunId(job);
       const runDir = path.join(RUNS_DIR, runId);
       const isRetryAttempt = job.autoFixAttempted === true;
+      const isDeadFixPlanReopen = isFixPlanDead(job, queueForResumeAndAutofix.jobs);
+      const deadChild = isDeadFixPlanReopen
+        ? queueForResumeAndAutofix.jobs.find((j) => j.slug === fixSlugFor(job))
+        : null;
       // Persist the attempt BEFORE spawning — a crash mid-investigation still
       // counts it (mirrors orphanRetries). Safe even when the slot is busy: the
       // investigation is queued and drained as slots free, so it is genuinely
-      // attempted rather than silently dropped.
+      // attempted rather than silently dropped. autoFixReopened is stamped in
+      // this SAME mutate so a crash between selection and dispatch can never
+      // leave the parent re-eligible for a second reopen (PRD 1129).
       await mutate((s) => {
         const j = s.jobs.find((x) => x.slug === job.slug);
         if (j) {
           j.autoFixAttempted = true;
           if (!j.runId && runId) j.runId = runId;
+          if (isDeadFixPlanReopen) j.autoFixReopened = true;
           if (isRetryAttempt) {
             j.autoFixRetries = (j.autoFixRetries ?? 0) + 1;
             delete j.autoFixOutcome;
           }
         }
       });
-      console.log(`[scheduler] auto-fix: needs_review ${job.slug} → authoring fix-plan (${isRetryAttempt ? 'retry' : '1/1'})`);
-      spawnInvestigation(job, runDir).catch((e) => {
+      console.log(`[scheduler] auto-fix: needs_review ${job.slug} → authoring fix-plan (${isRetryAttempt ? 'retry' : '1/1'}${isDeadFixPlanReopen ? ', dead fix-plan child reopen' : ''})`);
+      spawnInvestigation(job, runDir, { deadChild }).catch((e) => {
         console.error('[scheduler] auto-fix spawnInvestigation error', job.slug, e);
       });
     }
@@ -7657,6 +8952,36 @@ const remote = {
       return { ok: false, error: `job status is "${job.status}" — only a not-yet-running PRD (status "pending"/"quarantined", or no queue row yet) may be edited` };
     }
 
+    // Write-time FK check for a patched dependsOn (PRD 1124), reusing the
+    // SAME resolution rule scheduler_create_prd's prdCreate.cjs applies (exact
+    // slug, else bare-name after stripping one leading `NN-`) so update and
+    // create can never disagree about what a dependsOn entry resolves to. An
+    // explicit empty array CLEARS the dependency and skips validation — there
+    // is nothing to resolve. A listPrds() read failure is skipped-with-a-
+    // warning, matching createPrd's tolerance for an I/O hiccup.
+    if (frontmatter && Array.isArray(frontmatter.dependsOn) && frontmatter.dependsOn.length) {
+      let listing;
+      try {
+        listing = await this.listPrds({ cwd, limit: Number.MAX_SAFE_INTEGER });
+      } catch (e) {
+        console.warn(`[scheduler] updatePrd: dependsOn validation skipped (listPrds failed): ${e?.message ?? e}`);
+        listing = null;
+      }
+      if (listing) {
+        const candidateSlugs = (listing.prds ?? []).map((p) => p.slug);
+        for (const dep of frontmatter.dependsOn) {
+          if (resolveDepSlug(dep, candidateSlugs).length > 0) continue;
+          const near = findNearMatches(dep, candidateSlugs);
+          const suggestion = near.length ? ` Closest existing slug(s): ${near.join(', ')}.` : '';
+          return {
+            ok: false,
+            error: `dependsOn entry "${dep}" does not resolve to any existing PRD in this project.${suggestion} ` +
+              'Pass the bare name (preferred) or the exact NN-prefixed slug of an existing PRD.',
+          };
+        }
+      }
+    }
+
     let dir = null;
     let filePath = null;
     if (cwd) {
@@ -7787,4 +9112,162 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
   });
 }
 
-module.exports = { classifyQueueStarvation, runQueueStarvationWatchdog, QUEUE_STARVATION_MS, computeBlockedChains, stripAppOwnedChurn, findOverrunningJobs, JOB_OVERRUN_FACTOR, JOB_OVERRUN_FLOOR_MS, registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, healRefusalReason, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, IDLE_OUTPUT_KILL_MS, BASH_DEFAULT_TIMEOUT_MS, BASH_MAX_TIMEOUT_MS, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isFailedUnverifiedShaped, computeLooksDone, isPromotableOriginal, selectAutoFixTargets, applyRcaClassification, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, isExhaustedAutoFix, isPlanUnqueued, fixSlugFor, healTargetForFix, buildInvestigationPrompt, isGitRepoSync, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, leftoverFieldsFrom, applyLeftoverFields, LEFTOVER_PATHS_CAP, capDirtyPaths, buildForeignWipSection, PRE_RUN_DIRTY_PATHS_CAP, FOREIGN_WIP_DELIMITER, FOREIGN_WIP_END_DELIMITER, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, resolveVerifyPrdPath, resolveFixPlanPath, resolveNotifyPrd, runPrdMigration, consolidateAllFlatPrds, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult, spawnJob, listPrdsInternal, computeStallSummary, findStaleQuarantinedJobs, QUARANTINE_ESCALATE_MS, applyClearQueueVictims, PIDLESS_SPAWN_GRACE_MS, findStrandedInvestigations, INVESTIGATION_MAX_MS, stashList, parseStashLine, pathsChangedSince, restoreSpecificStash, evaluateSharedTreeGuard, checkSharedTreeGuard, uncommittedChanges, gitHead, selectResumeRecoveryTarget, buildResumeRecoveryPreamble, buildClaudeSpawnArgs, spawnResumeRecovery, spawnInvestigation, computeLaunchHolds, handleLaunchFailure, applyLaunchFailure, setPaused, clearPause, tickQueue, runDueJobs, isCooldownSuppressed, nextRapidRateLimitCount, CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD, RAPID_RATE_LIMIT_WINDOW_MS, MANUAL_PAUSE_COOLDOWN_MS, RUNS_DIR, pickRunDir };
+module.exports = {
+  classifyQueueStarvation,
+  runQueueStarvationWatchdog,
+  QUEUE_STARVATION_MS,
+  computeBlockedChains,
+  stripAppOwnedChurn,
+  findOverrunningJobs,
+  JOB_OVERRUN_FACTOR,
+  JOB_OVERRUN_FLOOR_MS,
+  registerScheduleHandlers,
+  attachWindow,
+  init,
+  ROOT,
+  PRDS_DIR,
+  healRefusalReason,
+  writeQueue,
+  reconcile,
+  reconcileSourcePromptId,
+  allocateParallelGroup,
+  selectHistoryJobs,
+  parsePorcelain,
+  FINISH_PROTOCOL,
+  IDLE_OUTPUT_KILL_MS,
+  BASH_DEFAULT_TIMEOUT_MS,
+  BASH_MAX_TIMEOUT_MS,
+  remote,
+  pickNextBatch,
+  pickForProject,
+  reapDeadRunningJobs,
+  runBranchSweep,
+  pollRecoveryClearSource,
+  memoryLimitedBatchSize,
+  availableForJobs,
+  reverifyNeedsReview,
+  isRescanCandidate,
+  isFailedUnverifiedShaped,
+  computeLooksDone,
+  isPromotableOriginal,
+  selectAutoFixTargets,
+  applyRcaClassification,
+  isEligibleForImmediateAutoFix,
+  resolveRunId,
+  isUnresolvableNeedsReview,
+  isExhaustedAutoFix,
+  isPlanUnqueued,
+  isFixPlanDead,
+  fixSlugFor,
+  healTargetForFix,
+  buildInvestigationPrompt,
+  isGitRepoSync,
+  committedInWindow,
+  computeCommittedDuringRun,
+  classifySigtermWithCommit,
+  evaluateFinalizeDrop,
+  evaluateDispatchSidecarReconcile,
+  isQueueRowRegression,
+  readRunOutcomeSidecars,
+  isFixPlanSlug,
+  classifyDiscoveredFixPlan,
+  resolveIsFixPlan,
+  isFixPlanBeyondDepthCap,
+  MAX_INVESTIGATION_DEPTH,
+  forceTickOutcome,
+  applyPauseCleared,
+  detectNetworkErrorInLog,
+  detectRateLimitInLog,
+  classifyFailureOutcome,
+  commitGuardVerdict,
+  findSatisfyingCommitOnMain,
+  leftoverFieldsFrom,
+  applyLeftoverFields,
+  LEFTOVER_PATHS_CAP,
+  capDirtyPaths,
+  buildForeignWipSection,
+  PRE_RUN_DIRTY_PATHS_CAP,
+  FOREIGN_WIP_DELIMITER,
+  FOREIGN_WIP_END_DELIMITER,
+  TRANSIENT_RETRY_CAP,
+  buildScheduleStatePayload,
+  partitionBootOrphans,
+  applyOrphanOutcome,
+  BOOT_ORPHAN_KILL_GRACE_MS,
+  registerAdminRoutes,
+  notifyOriginatingTab,
+  notifyNeedsReview,
+  isNotifiableTerminalStatus,
+  extractResultTextFromLog,
+  candidatePrdsDirs,
+  candidateArchivedPrdsDirs,
+  resolveArchivedPrdStatus,
+  prdDirForCwd,
+  prdPathForJob,
+  archivedPrdPathForJob,
+  archivedTwinExists,
+  findPrdDir,
+  resolveVerifyPrdPath,
+  resolveFixPlanPath,
+  resolveNotifyPrd,
+  runPrdMigration,
+  consolidateAllFlatPrds,
+  shouldSkipInvestigationForCleanRun,
+  archiveCompletedPrd,
+  retireCompletedSlugs,
+  SCHEDULER_BOOTED_AT,
+  SCHEDULER_CODE_SHA,
+  resetJobFields,
+  executeJob,
+  prdArchivedSkipResult,
+  spawnJob,
+  listPrdsInternal,
+  computeStallSummary,
+  findStaleQuarantinedJobs,
+  QUARANTINE_ESCALATE_MS,
+  applyClearQueueVictims,
+  PIDLESS_SPAWN_GRACE_MS,
+  findStrandedInvestigations,
+  INVESTIGATION_MAX_MS,
+  stashList,
+  parseStashLine,
+  pathsChangedSince,
+  restoreSpecificStash,
+  evaluateSharedTreeGuard,
+  checkSharedTreeGuard,
+  uncommittedChanges,
+  gitHead,
+  isBranchAlreadyIntegrated,
+  selectResumeRecoveryTarget,
+  buildResumeRecoveryPreamble,
+  buildClaudeSpawnArgs,
+  spawnResumeRecovery,
+  selectMechanicalRecoveryTarget,
+  performMechanicalRecovery,
+  MECHANICALLY_RESOLVABLE_VERDICTS,
+  selectLeftoverQuarantineTarget,
+  quarantineLeftovers,
+  performLeftoverQuarantine,
+  spawnInvestigation,
+  computeLaunchHolds,
+  computeDepHistorySatisfaction,
+  handleLaunchFailure,
+  applyLaunchFailure,
+  setPaused,
+  clearPause,
+  tickQueue,
+  runDueJobs,
+  isCooldownSuppressed,
+  nextRapidRateLimitCount,
+  CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD,
+  RAPID_RATE_LIMIT_WINDOW_MS,
+  MANUAL_PAUSE_COOLDOWN_MS,
+  RUNS_DIR,
+  pickRunDir,
+  resolveRateLimitPauseReset,
+  computeEffectiveResumeAt,
+  computeResumeDelay,
+  FOREIGN_WIP_BLOCK_STREAK_LIMIT,
+  validateForeignWipBlockClaim,
+  requeueForeignWipBlockedJobs,
+};