claude-code-session-manager 0.80.0 → 0.82.0

package/src/main/scheduler.cjs

@@ -57,9 +57,14 @@ const { resolveClaudeBin, probeClaudeVersion } = require('./lib/claudeBin.cjs');
 const launchFailure = require('./lib/launchFailure.cjs');
 const { appendError } = require('./lib/opsErrorLog.cjs');
 const { readTail } = require('./lib/fileTail.cjs');
-const { claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs } = require('./lib/reaperHelpers.cjs');
+const {
+  claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs,
+  findLiveProcessForJob, logHasOutput, resolvePidlessGateOutcome, resolveCommitGuardOutcome,
+} = require('./lib/reaperHelpers.cjs');
+const { sweepStrandedJobBranches } = require('./lib/branchSweep.cjs');
 const { detectRateLimitInLog } = require('./lib/rateLimitDetect.cjs');
 const { stripAppOwnedChurn } = require('./lib/jobDirtFilter.cjs');
+const { resolveBindingRateLimitReset } = require('./lib/rateLimitWindow.cjs');
 const { computeQueueHealth } = require('./lib/queueHealth.cjs');
 const { createLoadGate, topCpuConsumers } = require('./lib/loadGate.cjs');
 const { openLog, withChildAndLog } = require('./lib/childWithLog.cjs');
@@ -71,10 +76,10 @@ const { enqueueExternalPrompt } = require('./chatRunner.cjs');
 const { appendResponseEventIfKnown } = require('./promptSessionEvents.cjs');
 const { maybeEnqueueValidationPrompt } = require('./lib/epicValidationHook.cjs');
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
-const { verifyRun } = require('./runVerify.cjs');
+const { verifyRun, parseLog, scanSentinel, scanForeignWipPathsClaim } = require('./runVerify.cjs');
 const { latestTerminalOutcomeForSlug, COMPLETED_EQUIVALENT_VERDICTS } = require('./lib/terminalRunOutcome.cjs');
 const { isFixPlanSlug, classifyDiscoveredFixPlan, resolveIsFixPlan } = require('./lib/fixPlanSlug.cjs');
-const { landedSinceRun } = require('./lib/landedSinceRun.cjs');
+const { landedSinceRun, landedOnMainSince } = require('./lib/landedSinceRun.cjs');
 const { declaredPathsForPrd } = require('./lib/prdDeclaredPaths.cjs');
 const logs = require('./logs.cjs');
 const { schemas, validated, SCHEDULE_SLUG_RE } = require('./ipcSchemas.cjs');
@@ -268,9 +273,10 @@ deferring it.
    Your own work must still never be left uncommitted — this only changes
    which paths get staged, never whether you commit.
 5. VERDICT SENTINEL — as the LAST LINE of your final result text, emit exactly
-   one of these two lines (no trailing text after it):
+   one of these lines (no trailing text after it):
      SCHEDULER_VERDICT: PASS
      SCHEDULER_VERDICT: FAIL <one-line reason>
+     SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP
    Print PASS only when the AC gate is green AND the commit from step 4 landed.
    Print FAIL (and exit 1) if the AC gate was red or the commit could not land.
    NEVER print PASS on a red AC gate — a lying PASS turns the verifier from a
@@ -278,6 +284,22 @@ deferring it.
    landed commit lets the verifier override incidental transcript noise (grep
    results containing "Error", a TDD red-test run early in the session, debug
    Tracebacks) so those do not false-trip a needs_review downgrade.
+   Print BLOCKED_BY_FOREIGN_WIP (and exit 1) ONLY when your own AC gate failed
+   because it ran against a SIBLING job's in-flight, uncommitted file — never
+   because of your own regression — AND every failing path is one this prompt
+   already disclosed to you as foreign (see the "FOREIGN WORKING-TREE STATE"
+   section above, if present). It MUST be accompanied by a second line naming
+   every such path:
+     FOREIGN_WIP_PATHS: <path1>, <path2>, ...
+   The scheduler independently validates every listed path against the exact
+   foreign-WIP manifest it disclosed to you. Only list a path that (a) this
+   prompt already told you is foreign WIP, not yours, AND (b) is why your own
+   AC gate failed — never a path you own, and never a path that failed for
+   some other reason of your own making. Any listed path NOT in that manifest
+   downgrades this whole verdict back to FAIL, with your claim rejected. This
+   is not an escape hatch for your own broken code: claiming it for a
+   regression you introduced, or for a path you never received as foreign
+   WIP, is a lying verdict exactly like a false PASS.
 
 A job that exits with uncommitted changes is treated as INCOMPLETE and flagged
 for review. Do NOT add work beyond the acceptance criteria — this protocol is the
@@ -571,6 +593,52 @@ async function computeCommittedDuringRun(cwd, headBefore, headAfter, startedAt,
   return module.exports.committedInWindow(cwd, startedAt, untilIso);
 }
 
+/**
+ * Read-only check: is a job's `sm-job/<slug>` worktree branch already fully
+ * integrated into `cwd`'s current HEAD — i.e. every commit on the branch is
+ * an ancestor of (or equal to) HEAD? Mirrors gitWorktree.cjs's own
+ * integrateBranch() no-op detection (`mergeBase === branchHead`) exactly, but
+ * deliberately never calls integrateBranch itself: this is used by
+ * reapDeadRunningJobs to PROVE a dead job's work already landed, never to
+ * perform the landing — attempting a real merge from an audit check is a
+ * mutating action with its own conflict/timing risk, and "land the still-
+ * stranded branch" is explicitly a separate, later decision (mechanical
+ * recovery, or a human), not something a reap pass should do on its own
+ * initiative. See reapDeadRunningJobs's own header comment for why the
+ * conservative failure direction here is needs_review, never a silent merge.
+ *
+ * Returns:
+ *  - true  — branch exists and is fully contained in HEAD (already
+ *    integrated by a prior pass, or a genuine no-op branch that never
+ *    diverged from its base — both cases legitimately "landed").
+ *  - false — branch exists and still holds commits not in HEAD (a real
+ *    stranded deliverable, e.g. the PRD 1118 shape).
+ *  - null  — branch does not exist at all (never a worktree run — an
+ *    in-place run, or SM_JOB_WORKTREE_DISABLE), or the git calls errored.
+ * Never throws.
+ */
+function isBranchAlreadyIntegrated(cwd, branch) {
+  return new Promise((resolve) => {
+    if (!cwd || !branch) { resolve(null); return; }
+    execFile(
+      'git', ['-C', cwd, 'rev-parse', '--verify', branch],
+      { timeout: 10_000, windowsHide: true },
+      (err, branchHeadOut) => {
+        if (err) { resolve(null); return; } // branch doesn't exist — not a worktree run
+        const branchHead = String(branchHeadOut || '').trim();
+        execFile(
+          'git', ['-C', cwd, 'merge-base', 'HEAD', branch],
+          { timeout: 10_000, windowsHide: true },
+          (mbErr, mbOut) => {
+            const mergeBase = mbErr ? '' : String(mbOut || '').trim();
+            resolve(mergeBase !== '' && mergeBase === branchHead);
+          },
+        );
+      },
+    );
+  });
+}
+
 /**
  * Override for a SIGTERM'd (143) run when a commit landed in its window.
  * Exit 143 alone doesn't prove the deliverable is missing — the 776/779
@@ -592,6 +660,74 @@ function classifySigtermWithCommit(exitCode, commitFoundInWindow) {
   };
 }
 
+/**
+ * Pure decision for spawnJob's finalize mutate (2026-09-06 incident): given
+ * the row this run is trying to finalize (or its absence) and this run's own
+ * identity, decide whether the finalize must be DROPPED instead of applied.
+ * Never mutates anything itself — callers apply `stampLandedCommit` and emit
+ * the audit event/log line.
+ *
+ *  - row missing entirely (i2 === -1 upstream): always drop, nothing to
+ *    stamp — there is no row left to carry the fact.
+ *  - row present but not 'running': drop the STATUS change (a cancelled row,
+ *    PRD 1024, must never be re-legalized to completed/needs_review by a
+ *    stale exit handler) but still let a genuinely-landed commit be stamped
+ *    as a fact — never a transition — when this run owns the row's current
+ *    runId, or the row doesn't already carry a newer one of its own.
+ *  - row present and 'running': not a drop; caller proceeds to finalize.
+ */
+function evaluateFinalizeDrop({ rowExists, rowStatus, rowRunId, rowLandedCommit, runId, landedCommit }) {
+  if (!rowExists) {
+    return { drop: true, reason: 'row-missing', stampLandedCommit: null };
+  }
+  if (rowStatus !== 'running') {
+    const stampLandedCommit = landedCommit && (rowRunId === runId || !rowLandedCommit) ? landedCommit : null;
+    return { drop: true, reason: 'row-not-running', stampLandedCommit };
+  }
+  return { drop: false, reason: null, stampLandedCommit: null };
+}
+
+/**
+ * Pure decision for spawnJob's dispatch mutate: given a PENDING row about to
+ * be dispatched and the newest terminalRunOutcome sidecar result for its
+ * slug, decide whether this dispatch should be SKIPPED because a prior run
+ * already completed this exact slug — the gap left by reconcile()'s own
+ * anti-resurrection guard, which only ever sees a slug BEFORE it first lands
+ * in s.jobs (2026-09-06 incident: an existing pending row was re-dispatched
+ * three times against already-shipped work).
+ *
+ * Compares the sidecar's finishedAt against THIS row's own last pending
+ * transition (or queuedAt, when the row has never been reset) rather than
+ * merely "a completed sidecar exists somewhere" — so a deliberate human
+ * re-queue of the same slug in a LATER episode (whose queuedAt/pending
+ * transition postdates the earlier completion) still runs.
+ */
+function evaluateDispatchSidecarReconcile({ rowStatus, rowRunId, statusHistory, queuedAt, outcome }) {
+  if (rowStatus !== 'pending') return { skip: false };
+  if (!outcome || outcome.status !== 'completed') return { skip: false };
+  if (outcome.runId === rowRunId) return { skip: false };
+  const lastPendingEntry = Array.isArray(statusHistory)
+    ? [...statusHistory].reverse().find((h) => h.to === 'pending')
+    : null;
+  const lastPendingAt = lastPendingEntry?.at ?? queuedAt ?? null;
+  if (lastPendingAt && (!outcome.finishedAt || outcome.finishedAt < lastPendingAt)) {
+    return { skip: false };
+  }
+  return { skip: true, runId: outcome.runId, finishedAt: outcome.finishedAt };
+}
+
+/**
+ * Pure detector for mutate()'s write-path regression check: transitionJob
+ * only ever APPENDS to statusHistory (capped at STATUS_HISTORY_CAP, never
+ * shrunk below it once reached) — so a running->pending change whose
+ * statusHistory got SHORTER is not a real transition, it's evidence this
+ * row's prior state was lost (e.g. a finalize mutate working off a stale
+ * in-memory snapshot).
+ */
+function isQueueRowRegression({ statusBefore, statusAfter, historyLenBefore, historyLenAfter }) {
+  return statusBefore === 'running' && statusAfter === 'pending' && historyLenAfter < historyLenBefore;
+}
+
 const ROOT = path.join(os.homedir(), '.claude', 'session-manager', 'scheduled-plans');
 const PRDS_DIR = path.join(ROOT, 'prds');
 const RUNS_DIR = path.join(ROOT, 'runs');
@@ -1565,7 +1701,42 @@ function mutate(fn) {
     if (state.unreadable) {
       throw new Error(`queue mutation skipped: queue.json unreadable (${state.unreadable})`);
     }
+    const beforeBySlug = new Map(
+      (state.jobs || []).map((j) => [
+        j.slug,
+        { status: j.status, historyLen: Array.isArray(j.statusHistory) ? j.statusHistory.length : 0 },
+      ]),
+    );
     const ret = await fn(state);
+    // Detection-only regression check: transitionJob only ever APPENDS to
+    // statusHistory (capped at STATUS_HISTORY_CAP, never shrunk below it) —
+    // so a running->pending change whose statusHistory got SHORTER is not a
+    // real transition, it's evidence this row's prior state was lost (e.g. a
+    // finalize mutate working off a stale in-memory snapshot). Never
+    // repaired here — mutate()'s job is to persist, not reconcile.
+    for (const j of state.jobs || []) {
+      const prior = beforeBySlug.get(j.slug);
+      if (!prior) continue;
+      const afterLen = Array.isArray(j.statusHistory) ? j.statusHistory.length : 0;
+      if (isQueueRowRegression({
+        statusBefore: prior.status,
+        statusAfter: j.status,
+        historyLenBefore: prior.historyLen,
+        historyLenAfter: afterLen,
+      })) {
+        console.error(
+          `[scheduler] queue row regressed: slug=${j.slug} running->pending with `
+          + `statusHistory ${prior.historyLen} -> ${afterLen}`,
+        );
+        appendAuditEvent('queue_row_regressed', {
+          slug: j.slug,
+          from: 'running',
+          to: 'pending',
+          historyBefore: prior.historyLen,
+          historyAfter: afterLen,
+        });
+      }
+    }
     await writeQueue(state);
     return ret;
   });
@@ -2166,6 +2337,12 @@ async function reconcile(state) {
     state.jobs = sorted;
   }
 
+  // Auto-requeue any job parked 'skipped' over a validated BLOCKED_BY_FOREIGN_WIP
+  // verdict once the paths that blocked it are no longer dirty in its own cwd —
+  // the only place this check runs, so a sibling landing its commit resumes the
+  // blocked job with no human action, on the very next reconcile() pass.
+  await requeueForeignWipBlockedJobs(state.jobs);
+
   // Auto-archive completed PRDs' .md files out of the live prds/ dir. Runs
   // AFTER the history append above (which is awaited) so a job's queue row
   // is always durably in history.jsonl before its file can be moved — a
@@ -2208,6 +2385,20 @@ function getNextResetCached() {
   return cachedNextReset;
 }
 
+/**
+ * Pure: picks the reset to pause against for a rate-limited run (PRD 1118).
+ * Prefers the BINDING window read off the run's own log — refreshNextReset()
+ * only ever reports five_hour, which is the wrong clock when a
+ * seven_day/seven_day_overage_included window is what actually 429'd
+ * (five_hour can read 0% utilization at the very same moment). Falls back
+ * to the billing-endpoint-derived reset only when the log yields nothing.
+ */
+function resolveRateLimitPauseReset(logPath, billingResetIso) {
+  const logReset = resolveBindingRateLimitReset(logPath);
+  if (logReset != null) return new Date(logReset * 1000).toISOString();
+  return billingResetIso ?? null;
+}
+
 // ---------- health / poll state ----------
 
 let bootedAt = Date.now();
@@ -2491,6 +2682,33 @@ function nextRapidRateLimitCount(prevCount, { rateLimited, durationMs }) {
   return prevCount || 0;
 }
 
+/**
+ * Pure: decides the resumeAt actually armed for a pause. 'network' and
+ * 'rate_limit' (PRD 1118) both get a bounded 30-minute fallback when no
+ * explicit resumeAt is supplied — the live rate_limit failure mode is the
+ * billing usage endpoint itself 429ing while the log yields no binding
+ * window either, which used to leave an indefinite pause with no resume
+ * timer at all (a queue that never comes back on its own).
+ */
+function computeEffectiveResumeAt(reason, resumeAtIso, nowMs = Date.now()) {
+  if (resumeAtIso) return resumeAtIso;
+  if (reason === 'network' || reason === 'rate_limit') {
+    return new Date(nowMs + 30 * 60_000).toISOString();
+  }
+  return null;
+}
+
+/**
+ * Pure: the setTimeout delay for a resume timer, plus whether it overflows
+ * setTimeout's signed-32-bit max (~24.8 days) and must not be armed.
+ * Resume fires 30s after the reset to give the auth/billing endpoint time
+ * to flip.
+ */
+function computeResumeDelay(effectiveResumeAtIso, nowMs = Date.now()) {
+  const delayMs = Math.max(30_000, new Date(effectiveResumeAtIso).getTime() - nowMs + 30_000);
+  return { delayMs, tooFar: delayMs > 0x7fffffff };
+}
+
 async function setPaused(reason, resumeAtIso, opts = {}) {
   const { observedAt = null, force = false } = opts;
   // Honor manual-override cooldown: if the user cleared a pause within the
@@ -2507,11 +2725,7 @@ async function setPaused(reason, resumeAtIso, opts = {}) {
     console.log(`[scheduler] setPaused(${reason}) engaging despite manual override cooldown — triggering run started after the manual clear`);
   }
 
-  // For 'network' with no explicit resumeAt, auto-resume after 30 minutes.
-  let effectiveResumeAt = resumeAtIso;
-  if (reason === 'network' && !resumeAtIso) {
-    effectiveResumeAt = new Date(Date.now() + 30 * 60_000).toISOString();
-  }
+  const effectiveResumeAt = computeEffectiveResumeAt(reason, resumeAtIso);
 
   await mutate((s) => {
     if (s.paused && s.paused.reason === reason) {
@@ -2525,9 +2739,8 @@ async function setPaused(reason, resumeAtIso, opts = {}) {
   if (resumeTimer) { clearTimeout(resumeTimer); resumeTimer = null; }
   if (!effectiveResumeAt) return;
 
-  // Resume 30s after the reset to give the auth/billing endpoint time to flip.
-  const delay = Math.max(30_000, new Date(effectiveResumeAt).getTime() - Date.now() + 30_000);
-  if (delay > 0x7fffffff) {
+  const { delayMs: delay, tooFar } = computeResumeDelay(effectiveResumeAt);
+  if (tooFar) {
     console.warn(`[scheduler] paused (${reason}); resumeAt too far for setTimeout (${delay}ms)`);
     return;
   }
@@ -2636,6 +2849,13 @@ function resetJobFields(job, errorMsg, opts = {}) {
   delete job.leftoverCount;
   delete job.leftoverPathsTruncated;
   delete job.preRunDirtyPaths;
+  // A manual/force reset (e.g. a human clearing a 3-strikes needs_review
+  // park) must not leave the row permanently excluded from the auto-fix
+  // chain (selectAutoFixTargets checks job.blockedByForeignWip) — this run's
+  // BLOCKED_BY_FOREIGN_WIP history is done, the human is taking over.
+  delete job.blockedByForeignWip;
+  delete job.foreignWipBlockedPaths;
+  delete job.foreignWipBlockCount;
   // Deliberately NOT deleting job.landedCommit: it must outlive a reset so a
   // re-fired run of this same slug can pass it to verifyRun as
   // priorLandedCommit (pass_no_commit_prior_run_verified exemption).
@@ -3102,6 +3322,44 @@ function classifyFailureOutcome({ exitCode, networkError, durationMs, transientR
   return { action: 'retry', transientKind, retries };
 }
 
+/**
+ * Evidence gathering for the commit-guard's already-satisfied-on-main
+ * exemption (PRD 1136): does a commit reachable from `main`, landed AFTER
+ * this job's `queuedAt`, touch a path this PRD itself declares? Scoped to
+ * the PRD's own declared paths via declaredPathsForPrd — the same
+ * path-extraction computeLooksDone already uses — so an unrelated commit
+ * elsewhere in the repo is never credited to this job. Returns `[]` (never
+ * fabricates evidence) when the PRD names no paths or has no `queuedAt`.
+ *
+ * Requires EVERY declared path to have landed, not just one — declaredPathsForPrd's
+ * regex matches any backtick-quoted path in the PRD's Implementation notes or
+ * Acceptance criteria, including a path cited only as context (e.g.
+ * `` `src/main/scheduler.cjs:1234` `` pointing at a call site, not a file this
+ * PRD's own work touches). Unlike computeLooksDone's identical path-overlap
+ * heuristic — which only ever annotates a still-needs_review row for a human
+ * to confirm — this check drives an UNATTENDED transition straight to
+ * 'completed', so a single incidental hot-file citation must never be
+ * sufficient evidence on its own (code-review finding, 2026-09-07: a PRD
+ * that cites both its real target file and one hot file purely as context
+ * would auto-complete off any unrelated commit touching that hot file).
+ * Requiring full coverage of the declared-path set trades recall for safety
+ * exactly as this PRD's own constraint demands — a PRD that fails this
+ * stricter check still falls back to the existing needs_review park, never
+ * a false 'completed'.
+ *
+ * @returns {Promise<string[]>} full commit SHAs reachable from main, newest first
+ */
+async function findSatisfyingCommitOnMain(job) {
+  if (!job?.queuedAt) return [];
+  const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
+  const paths = declaredPathsForPrd(prdPath);
+  if (!paths.length) return [];
+  await fetchAllRefs(job.cwd);
+  const perPathCommits = await Promise.all(paths.map((p) => landedOnMainSince(job.cwd, job.queuedAt, [p])));
+  if (perPathCommits.some((commits) => commits.length === 0)) return [];
+  return landedOnMainSince(job.cwd, job.queuedAt, paths);
+}
+
 /**
  * Commit-guard verdict decision. Pure/no I/O so the false-positive defenses
  * can be unit-tested directly rather than only through a live spawnJob run.
@@ -3272,6 +3530,73 @@ function buildForeignWipSection({ preRunDirtyPaths, carriedPaths } = {}) {
   return '';
 }
 
+// A job whose validated BLOCKED_BY_FOREIGN_WIP claim keeps recurring against
+// the same sibling WIP is not making progress by re-firing forever — cap the
+// auto-requeue cycle and hand it to a human instead, naming the paths that
+// never went clean. Matches TRANSIENT_RETRY_CAP's "bounded self-heal, then
+// escalate" shape.
+const FOREIGN_WIP_BLOCK_STREAK_LIMIT = 3;
+
+/**
+ * Pure: validate an executor's BLOCKED_BY_FOREIGN_WIP claim against the exact
+ * foreign-WIP manifest THIS job was disclosed at dispatch time
+ * (preRunDirtyPaths / carriedPaths — PRD 1105). Every claimed path must be a
+ * member of that manifest; a path the job was never told was foreign cannot
+ * be laundered into a block, whether that's a genuine regression the
+ * executor is trying to dodge or an honest mistake. `job` is any object
+ * carrying those two array fields (the live queue row at finalize time).
+ *
+ * Returns `ok: false` for an empty claim too — a BLOCKED_BY_FOREIGN_WIP
+ * verdict with no FOREIGN_WIP_PATHS evidence at all is exactly as
+ * unsubstantiated as one naming an unlisted path.
+ */
+function validateForeignWipBlockClaim(claimedPaths, job) {
+  const manifest = new Set([
+    ...(Array.isArray(job?.preRunDirtyPaths) ? job.preRunDirtyPaths : []),
+    ...(Array.isArray(job?.carriedPaths) ? job.carriedPaths : []),
+  ]);
+  const claimed = Array.isArray(claimedPaths) ? claimedPaths.filter(Boolean) : [];
+  const validPaths = claimed.filter((p) => manifest.has(p));
+  const invalidPaths = claimed.filter((p) => !manifest.has(p));
+  return { ok: claimed.length > 0 && invalidPaths.length === 0, validPaths, invalidPaths };
+}
+
+/**
+ * Auto-requeue jobs parked 'skipped' with a validated BLOCKED_BY_FOREIGN_WIP
+ * verdict once none of the paths that blocked them are still dirty in their
+ * own `cwd` — so a sibling job landing its commit (or a human resolving their
+ * own WIP) resumes the blocked job with no human action needed, on the very
+ * next reconcile() pass. `getDirtyPaths` is injectable (defaults to the real
+ * `uncommittedChanges` git-status wrapper) so this is unit-testable without a
+ * real git repo. Mutates eligible jobs in place via transitionJob; returns
+ * nothing.
+ */
+async function requeueForeignWipBlockedJobs(jobs, { getDirtyPaths = uncommittedChanges } = {}) {
+  const candidates = (Array.isArray(jobs) ? jobs : []).filter(
+    (j) => j && j.status === 'skipped' && j.blockedByForeignWip === true,
+  );
+  for (const job of candidates) {
+    const blockedPaths = Array.isArray(job.foreignWipBlockedPaths) ? job.foreignWipBlockedPaths : [];
+    if (!blockedPaths.length) continue;
+    const dirty = await getDirtyPaths(job.cwd);
+    if (dirty === null) continue; // non-git cwd or git error — best-effort, leave parked
+    const dirtySet = new Set(dirty);
+    const stillDirty = blockedPaths.filter((p) => dirtySet.has(p));
+    if (stillDirty.length === 0) {
+      // resetJobFields (not a bare transitionJob) so the row re-enters
+      // 'pending' with none of the blocked run's stale exitCode/error/
+      // verifierVerdict/finishedAt/leftoverPaths left on it for a viewer to
+      // misread against the new 'pending' status — same reasoning as every
+      // other terminal->pending path in this file. force:true is required
+      // here: resetJobFields refuses skipped->pending without it.
+      resetJobFields(job, `foreign WIP cleared (was blocked on: ${blockedPaths.join(', ')}) — auto-requeued`, {
+        source: 'reconcile-foreign-wip-clear',
+        force: true,
+      });
+    }
+  }
+}
+
 /**
  * Resume-first recovery (PRD 1111). A job parked in needs_review with verdict
  * 'uncommitted_changes' has a live claude session (job.sessionId, minted by
@@ -4297,6 +4622,11 @@ function readRunOutcomeSidecars(runDir, slug) {
   return {
     meta: readJson(path.join(runDir, `${slug}.meta.json`)),
     verdicts: readJson(path.join(runDir, `${slug}.verdicts.json`)),
+    // outcome.json (launchFailure.writeOutcomeSidecar) is the one sidecar
+    // that carries landedCommit — reused by the dispatch-time sidecar-
+    // reconcile guard and the pre-dispatch landedCommit backfill below,
+    // rather than growing a second reader for the same directory.
+    outcome: readJson(path.join(runDir, `${slug}.outcome.json`)),
   };
 }
 
@@ -4895,9 +5225,64 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     // started after the manual clear, not whatever startedAt this row
     // carried from a prior run.
     let dispatchStartedAtMs = null;
+    let dispatchSkippedAlreadyCompleted = false;
     await mutate((s) => {
       const idx = s.jobs.findIndex((x) => x.slug === job.slug);
       if (idx >= 0) {
+        // Anti-resurrection guard for an EXISTING pending row (the gap left
+        // by reconcile()'s own guard, which only ever sees a slug BEFORE it
+        // first lands in s.jobs — 2026-09-06 incident: a finalize dropped
+        // silently three times over left this same slug 'pending' and the
+        // dispatcher re-fired it three more times against work that had
+        // already shipped). Skipped for a resume-recovery dispatch (that
+        // targets a specific prior session on purpose) and for anything not
+        // currently 'pending' (e.g. a needs_review->running recovery row).
+        if (!resumeTarget && s.jobs[idx].status === 'pending') {
+          const outcome = latestTerminalOutcomeForSlug(job.slug, { runsDir: RUNS_DIR });
+          const reconcileDecision = evaluateDispatchSidecarReconcile({
+            rowStatus: s.jobs[idx].status,
+            rowRunId: s.jobs[idx].runId ?? null,
+            statusHistory: s.jobs[idx].statusHistory,
+            queuedAt: s.jobs[idx].queuedAt ?? null,
+            outcome,
+          });
+          if (reconcileDecision.skip) {
+            const sidecar = readRunOutcomeSidecars(path.join(RUNS_DIR, reconcileDecision.runId), job.slug);
+            transitionJob(s.jobs[idx], 'completed', {
+              reason: `prior run ${reconcileDecision.runId} already completed this slug (sidecar-reconciled)`,
+              source: 'spawnJob:dispatch-sidecar-reconcile',
+            });
+            s.jobs[idx].runId = reconcileDecision.runId;
+            s.jobs[idx].finishedAt = reconcileDecision.finishedAt;
+            s.jobs[idx].exitCode = 0;
+            if (sidecar.outcome?.landedCommit) {
+              s.jobs[idx].landedCommit = sidecar.outcome.landedCommit;
+            }
+            appendAuditEvent('job_dispatch_skipped_already_completed', {
+              slug: job.slug,
+              priorRunId: reconcileDecision.runId,
+              cwd: job.cwd || defaultCwd,
+            });
+            console.warn(
+              `[scheduler] ${job.slug}: dispatch skipped — prior run ${reconcileDecision.runId} already `
+              + 'completed this slug (sidecar-reconciled)',
+            );
+            dispatchSkippedAlreadyCompleted = true;
+            return;
+          }
+          // Belt-and-braces (PRD fix-plan step 3): a row about to dispatch
+          // with no landedCommit of its own, whose newest sidecar for this
+          // slug DOES record one, gets it backfilled before spawn so
+          // verifyRun receives a real priorLandedCommit and the
+          // pass_no_commit_prior_run_verified exemption can fire on this
+          // run if it turns out to be another no-op re-verification.
+          if (!s.jobs[idx].landedCommit && outcome?.runId) {
+            const sidecar = readRunOutcomeSidecars(path.join(RUNS_DIR, outcome.runId), job.slug);
+            if (sidecar.outcome?.landedCommit) {
+              s.jobs[idx].landedCommit = sidecar.outcome.landedCommit;
+            }
+          }
+        }
         transitionJob(s.jobs[idx], 'running', {
           reason: resumeTarget ? 'dispatched for resume-recovery' : 'dispatched for execution',
           source: 'spawnJob:dispatch',
@@ -4921,6 +5306,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       }
     });
     await broadcast({ flush: true });
+    if (dispatchSkippedAlreadyCompleted) return;
 
     // Commit-guard baseline: snapshot the working tree BEFORE the run so the
     // post-run check flags only paths THIS job left dirty, not pre-existing WIP.
@@ -5164,7 +5550,9 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     }
 
     if (res.rateLimited) {
-      const resetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const logPath = path.join(runDir, `${job.slug}.log`);
+      const billingResetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const resetIso = resolveRateLimitPauseReset(logPath, billingResetIso);
       const observedAt = dispatchStartedAtMs;
       const prevCount = consecutiveRapidRateLimitsBySlug.get(job.slug) || 0;
       const nextCount = nextRapidRateLimitCount(prevCount, { rateLimited: true, durationMs: res.durationMs });
@@ -5310,9 +5698,22 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           salvagePatch,
         });
         if (guardVerdict) {
-          verifyResult = guardVerdict;
-          const what = newlyDirty.length > 0 ? `left ${newlyDirty.length} files uncommitted` : 'made no commit on an already-clean tree';
-          console.log(`[scheduler] commit-guard: ${job.slug} ${what} → needs_review`);
+          // Already-satisfied-on-main exemption (PRD 1136): resolveCommitGuardOutcome
+          // only ever touches the clean-tree/no-commit shape ('silent_no_op') —
+          // a job that left dirty files behind is a genuine finish-protocol
+          // violation regardless of what already landed on main, so it is
+          // never routed through this check (see that function's own doc).
+          const satisfyingCommits = guardVerdict.verdict === 'silent_no_op'
+            ? await findSatisfyingCommitOnMain(job)
+            : [];
+          const finalVerdict = resolveCommitGuardOutcome(guardVerdict, satisfyingCommits);
+          verifyResult = finalVerdict;
+          if (finalVerdict.verdict === 'already_satisfied_on_main') {
+            console.log(`[scheduler] already-satisfied-on-main: ${job.slug} → completed (${finalVerdict.satisfyingSha})`);
+          } else {
+            const what = newlyDirty.length > 0 ? `left ${newlyDirty.length} files uncommitted` : 'made no commit on an already-clean tree';
+            console.log(`[scheduler] commit-guard: ${job.slug} ${what} → needs_review`);
+          }
         }
       }
     }
@@ -5378,6 +5779,25 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       );
     }
 
+    // BLOCKED_BY_FOREIGN_WIP claim scan: the executor exits non-zero for this
+    // outcome (same as FAIL — see FINISH_PROTOCOL), so it is never seen by the
+    // exit=0-only verifyRun call above; scanned here, against THIS run's own
+    // log, before the generic non-zero-exit -> 'failed' classification below.
+    // Read outside mutate() (I/O); actual manifest validation happens inside
+    // mutate(), against the LIVE row's preRunDirtyPaths/carriedPaths, so a
+    // stale local `job` snapshot can never be the source of truth for it.
+    let foreignWipClaimedPaths = null;
+    if (res.exitCode !== 0 && !res.rateLimited) {
+      try {
+        const { resultEvent, events } = parseLog(path.join(runDir, `${job.slug}.log`));
+        if (scanSentinel(resultEvent, events) === 'blocked_by_foreign_wip') {
+          foreignWipClaimedPaths = scanForeignWipPathsClaim(resultEvent, events);
+        }
+      } catch (e) {
+        console.warn(`[scheduler] ${job.slug}: foreign-WIP verdict scan failed, falling through to ordinary failed classification`, e?.message);
+      }
+    }
+
     let actuallyFailed = false;
     let failedJobSnapshot = null;
     let needsInvestigationNow = false;
@@ -5402,7 +5822,44 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       // scheduleJobTransitions.cjs's LEGAL_TRANSITIONS) and silently
       // undo the cancellation. Skip — the row already reflects its real
       // terminal state.
-      if (i2 >= 0 && s.jobs[i2].status !== 'running') return;
+      const finalizeDrop = evaluateFinalizeDrop({
+        rowExists: i2 >= 0,
+        rowStatus: i2 >= 0 ? s.jobs[i2].status : null,
+        rowRunId: i2 >= 0 ? (s.jobs[i2].runId ?? null) : null,
+        rowLandedCommit: i2 >= 0 ? (s.jobs[i2].landedCommit ?? null) : null,
+        runId,
+        landedCommit: jobLandedCommitThisRun ?? null,
+      });
+      if (finalizeDrop.drop) {
+        // Never silent (2026-09-06 incident: a bare early-return here dropped
+        // three legitimate no-op verifications of an already-shipped PRD with
+        // no trace at all, leaving the row stuck 'pending' so the dispatcher
+        // re-fired it three more times). 'row-not-running' covers a job
+        // already moved off 'running' by someone else (namely
+        // remote.cancelJob, PRD 1024) — re-finalizing anyway could
+        // re-legalize the row via a legal failed->completed/needs_review edge
+        // and silently undo the cancellation, so the STATUS change is still
+        // skipped; only a genuinely-landed commit is stamped as a fact.
+        const logFn = finalizeDrop.reason === 'row-missing' ? console.error : console.warn;
+        logFn(
+          `[scheduler] finalize dropped: slug=${job.slug} runId=${runId} reason=${finalizeDrop.reason} `
+          + `actualStatus=${i2 >= 0 ? s.jobs[i2].status : '(row-missing)'} `
+          + `rowRunId=${i2 >= 0 ? (s.jobs[i2].runId ?? '(none)') : '(none)'}`,
+        );
+        appendAuditEvent('job_finalize_dropped', {
+          slug: job.slug,
+          runId,
+          reason: finalizeDrop.reason,
+          actualStatus: i2 >= 0 ? s.jobs[i2].status : null,
+          rowRunId: i2 >= 0 ? (s.jobs[i2].runId ?? null) : null,
+          landedCommit: jobLandedCommitThisRun ?? null,
+          exitCode: res.exitCode,
+        });
+        if (finalizeDrop.stampLandedCommit) {
+          s.jobs[i2].landedCommit = finalizeDrop.stampLandedCommit;
+        }
+        return;
+      }
       if (i2 >= 0) {
         const treatAsPending = res.rateLimited || (s.paused && s.paused.reason === 'rate_limit');
         if (treatAsPending) {
@@ -5414,14 +5871,66 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           const sigtermOverride = res.exitCode !== 0
             ? classifySigtermWithCommit(res.exitCode, sigtermCommitFound)
             : null;
+          // Validated against the LIVE row's own foreign-WIP manifest — never
+          // the stale outer `job` snapshot — so an unlisted path cannot
+          // launder a real regression into a block (PRD: give the executor a
+          // first-class verdict for "the gate failed on a sibling's in-flight
+          // file", but VALIDATE the claim rather than trust it).
+          const foreignWipValidation = (!sigtermOverride && foreignWipClaimedPaths !== null)
+            ? validateForeignWipBlockClaim(foreignWipClaimedPaths, s.jobs[i2])
+            : null;
+          // Consecutive-block streak: cleared by default on every outcome and
+          // only re-established below inside the validated-block branch —
+          // so a completed run, an ordinary failure, or any other outcome
+          // between two blocks always resets "in a row" back to zero.
+          const priorForeignWipBlockCount = s.jobs[i2].foreignWipBlockCount ?? 0;
+          delete s.jobs[i2].foreignWipBlockCount;
           if (sigtermOverride) {
             effectiveStatus = sigtermOverride.status;
             sigtermOverrideReason = sigtermOverride.reason;
+          } else if (foreignWipValidation && foreignWipValidation.ok) {
+            const blockCount = priorForeignWipBlockCount + 1;
+            s.jobs[i2].foreignWipBlockCount = blockCount;
+            s.jobs[i2].blockedByForeignWip = true;
+            s.jobs[i2].foreignWipBlockedPaths = foreignWipValidation.validPaths;
+            if (blockCount >= FOREIGN_WIP_BLOCK_STREAK_LIMIT) {
+              // Blocked FOREIGN_WIP_BLOCK_STREAK_LIMIT times in a row on the
+              // same tree: auto-requeuing again would spin forever against
+              // paths that never go clean. Park for a human instead — never
+              // routed through the auto-fix chain (selectAutoFixTargets
+              // excludes any job.blockedByForeignWip row), since there is no
+              // fix-plan to author against another job's WIP.
+              effectiveStatus = 'needs_review';
+              s.jobs[i2].verifierVerdict = 'blocked_by_foreign_wip_streak';
+              sigtermOverrideReason = `blocked by foreign WIP ${blockCount} times in a row on persistently-dirty path(s): ${foreignWipValidation.validPaths.join(', ')} — auto-requeue exhausted, parked for human review`;
+            } else {
+              // Terminal-but-retryable, same shape as the existing 'skipped'
+              // status (never counts as failed, never enters the auto-fix
+              // chain, reconcile()'s requeueForeignWipBlockedJobs promotes it
+              // straight back to 'pending' once these exact paths go clean).
+              effectiveStatus = 'skipped';
+              sigtermOverrideReason = `blocked by foreign WIP (attempt ${blockCount}/${FOREIGN_WIP_BLOCK_STREAK_LIMIT}): ${foreignWipValidation.validPaths.join(', ')} — will auto-requeue once these path(s) are no longer dirty`;
+            }
+          } else if (foreignWipValidation && !foreignWipValidation.ok) {
+            // Claimed BLOCKED_BY_FOREIGN_WIP but named a path outside this
+            // job's own disclosed manifest (or named none at all) — downgrade
+            // to an ordinary failure and log the offending paths loudly so the
+            // rejection is never silent.
+            console.warn(`[scheduler] ${job.slug}: SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP downgraded to FAIL — claimed path(s) not in this job's foreign-WIP manifest: ${foreignWipValidation.invalidPaths.join(', ') || '(no FOREIGN_WIP_PATHS line)'}`);
+            effectiveStatus = 'failed';
+            sigtermOverrideReason = `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP rejected — unlisted path(s) not in the disclosed foreign-WIP manifest: ${foreignWipValidation.invalidPaths.join(', ') || '(no FOREIGN_WIP_PATHS line)'}`;
           } else if (res.exitCode !== 0) {
             effectiveStatus = 'failed';
           } else if (
             !verifyResult
             || COMPLETED_EQUIVALENT_VERDICTS.has(verifyResult.verdict)
+            // Already-satisfied-on-main (PRD 1136): a second, independently-
+            // evidenced route to 'completed' alongside COMPLETED_EQUIVALENT_
+            // VERDICTS above — kept as its own explicit check rather than
+            // folded into that shared Set so it can never leak into
+            // reverifyNeedsReview's or runVerify.cjs's unrelated healing
+            // decisions, which consult that Set for a different purpose.
+            || verifyResult.verdict === 'already_satisfied_on_main'
           ) {
             effectiveStatus = 'completed';
           } else if (verifyResult.downgradeTo === 'pending') {
@@ -5433,7 +5942,14 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             effectiveStatus = 'needs_review';
           }
 
-          transitionJob(s.jobs[i2], effectiveStatus, { reason: sigtermOverrideReason ?? `run finished with exit ${res.exitCode}`, source: 'spawnJob:finalize' });
+          // already_satisfied_on_main names the satisfying sha in its own
+          // reason — surface that on the completed row's statusHistory
+          // instead of the generic "run finished with exit 0" every other
+          // completed run gets.
+          const finalizeReason = (effectiveStatus === 'completed' && verifyResult?.verdict === 'already_satisfied_on_main')
+            ? verifyResult.reason
+            : (sigtermOverrideReason ?? `run finished with exit ${res.exitCode}`);
+          transitionJob(s.jobs[i2], effectiveStatus, { reason: finalizeReason, source: 'spawnJob:finalize' });
           s.jobs[i2].finishedAt = new Date().toISOString();
           s.jobs[i2].exitCode = res.exitCode;
           s.jobs[i2].leakedDescendants = res.leakedDescendants ?? [];
@@ -5442,7 +5958,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           } else {
             delete s.jobs[i2].salvagePatch;
           }
-          s.jobs[i2].error = effectiveStatus === 'needs_review'
+          s.jobs[i2].error = (effectiveStatus === 'needs_review' || s.jobs[i2].blockedByForeignWip === true)
             ? (verifyResult?.reason ?? sigtermOverrideReason ?? null)
             // A failed job (non-zero exit) never consults verifyResult above,
             // but a worktree integration failure is still worth surfacing on
@@ -5459,9 +5975,12 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             s.jobs[i2].landedCommit = jobLandedCommitThisRun;
           }
           // Persist the verifier's verdict string so the renderer can show it.
+          // 'blocked_by_foreign_wip_streak' is set above from the sigterm/
+          // exit-code path, never from verifyResult (which stays null on a
+          // non-zero exit) — never clobber it here.
           if (verifyResult?.verdict && verifyResult.verdict !== 'clean') {
             s.jobs[i2].verifierVerdict = verifyResult.verdict;
-          } else {
+          } else if (s.jobs[i2].verifierVerdict !== 'blocked_by_foreign_wip_streak') {
             delete s.jobs[i2].verifierVerdict;
           }
           // Closed-set outcome taxonomy (issue #11 list A2) so a queue row
@@ -6166,6 +6685,55 @@ function runQueueHealthSweep(jobs) {
   }
 }
 
+// Cross-cycle "already attempted" memory for the branch sweep (PRD 1135) —
+// in-memory only, keyed `"<cwd>::<branch>"`. Resets on restart, same as
+// consecutiveRapidRateLimitsBySlug above; the goal is "don't retry a
+// permanently-conflicting branch every cycle forever" while the process
+// stays up, not durability across a restart.
+const branchSweepAttempted = new Set();
+
+/**
+ * Recover any `sm-job/*` branch left stranded (unmerged, owning row terminal
+ * or gone) across every known project — the other half of PRD 1135's
+ * invariant alongside the reaper's liveness check above: that check stops
+ * NEW stranding, this sweep recovers anything stranded before it (or by a
+ * crash the liveness check can't cover). Read-only reporting plus AT MOST one
+ * bounded integrateBranch attempt per branch per process lifetime (see
+ * branchSweepAttempted) — never forces anything, never deletes a branch.
+ * Hangs off the same cadence as runQueueHealthSweep. Never throws.
+ */
+async function runBranchSweep(jobs) {
+  if (process.env.SM_BRANCH_SWEEP_DISABLE === '1') return;
+  try {
+    for (const cwd of allProjectCwds()) {
+      let sweep;
+      try {
+        sweep = await sweepStrandedJobBranches({ cwd, jobs, attemptedBranches: branchSweepAttempted });
+      } catch (e) {
+        console.warn(`[scheduler] branch sweep error for ${cwd}`, e?.message);
+        continue;
+      }
+      for (const r of sweep.results) {
+        if (r.action === 'integrated') {
+          console.log(`[scheduler] branch-sweep: merged stranded branch ${r.branch} into ${cwd} HEAD`);
+          appendAuditEvent('branch_sweep_integrated', { cwd, branch: r.branch, slug: r.slug });
+        } else if (r.action === 'conflict') {
+          console.warn(`[scheduler] branch-sweep: ${r.branch} could not be integrated: ${r.integration?.reason}`);
+          appendAuditEvent('branch_sweep_conflict', { cwd, branch: r.branch, slug: r.slug, reason: r.integration?.reason });
+          if (r.slug) {
+            await mutate((s) => {
+              const j = s.jobs.find((x) => x.slug === r.slug);
+              if (j) j.strandedBranch = r.branch;
+            });
+          }
+        }
+      }
+    }
+  } catch (e) {
+    console.warn('[scheduler] branch sweep error', e?.message);
+  }
+}
+
 /**
  * Scan running jobs, identify those whose claude process is provably dead OR
  * whose spawn never got far enough to record a runtime.pid in the first
@@ -6183,14 +6751,35 @@ async function reapDeadRunningJobs() {
     // status:"running" with no slug left in runningSet to trigger reconciliation.
     // queue.json is the source of truth for which jobs are actually running.
     const state = await readQueue();
-    const { reapable, warnings } = selectReapableJobs(state.jobs, Date.now(), {
+    const { reapable, warnings, recovered } = selectReapableJobs(state.jobs, Date.now(), {
       pidAlive: claudePidAlive,
       grace: PIDLESS_SPAWN_GRACE_MS,
+      findLiveProcess: (j) => findLiveProcessForJob(j, {
+        worktreeDir: jobWorktree.worktreeDirFor(j.cwd || state.config?.defaultCwd || DEFAULT_PROJECT_CWD, j.slug),
+      }),
     });
     for (const w of warnings) {
       console.warn(`[scheduler] reapDeadRunningJobs: ${w.reason} slug=${w.slug} — leaving row alone`);
     }
 
+    // A pidless row whose process was proven alive by the /proc liveness
+    // scan must never be terminalized (2026-09-06 incident — see
+    // findLiveProcessForJob's header). Re-stamp the recovered pid so future
+    // cycles see it as an ordinary live-pid row, and stop here for it.
+    if (recovered.length) {
+      await mutate(async (s) => {
+        for (const r of recovered) {
+          const idx = s.jobs.findIndex((x) => x.slug === r.slug);
+          if (idx < 0 || s.jobs[idx].status !== 'running') continue;
+          s.jobs[idx].runtime = { ...(s.jobs[idx].runtime || {}), pid: r.pid };
+        }
+      });
+      for (const r of recovered) {
+        console.log(`[scheduler] reapDeadRunningJobs: pid=${r.pid} recovered by /proc liveness scan for slug=${r.slug} — row stays running`);
+        appendAuditEvent('job_pid_recovered_by_liveness_scan', { slug: r.slug, pid: r.pid });
+      }
+    }
+
     const dead = [];
     for (const { slug, pid, pidless, reason } of reapable) {
       const j = state.jobs.find((x) => x.slug === slug);
@@ -6201,15 +6790,18 @@ async function reapDeadRunningJobs() {
       // 'no_result' → non-success below → filed as failed, never completed.
       const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
       // A pidless reap means the spawn never got far enough to record a
-      // pid — the gate could not possibly have run, regardless of what
-      // classifyRunOutcome makes of an absent/empty log.
-      const gateOutcome = pidless ? 'never_ran' : mapOutcomeToGateOutcome(outcome);
-      dead.push({ slug, pid, outcome, gateOutcome, pidless, reason });
+      // pid — the gate could not possibly have run. But `never_ran` is only
+      // a true claim when the run dir produced no log output at all; a log
+      // with real content proves the job DID run (see
+      // resolvePidlessGateOutcome's header).
+      const gateOutcome = pidless ? resolvePidlessGateOutcome(outcome, logHasOutput(logPath)) : mapOutcomeToGateOutcome(outcome);
+      dead.push({ slug, pid, outcome, gateOutcome, pidless, reason, logPath });
     }
 
     queueHealthSweepCycle += 1;
     if (queueHealthSweepCycle % QUEUE_HEALTH_SWEEP_EVERY_N_CYCLES === 0) {
       runQueueHealthSweep(state.jobs);
+      await runBranchSweep(state.jobs);
     }
 
     if (dead.length === 0) return;
@@ -6221,8 +6813,9 @@ async function reapDeadRunningJobs() {
     // the same still-active rate limit — the spin loop this PRD exists to
     // stop. Done once, outside mutate(), before finalizing any row below.
     if (dead.some((d) => d.outcome === 'rate_limited')) {
-      const resetIso = await refreshNextReset().catch(() => cachedNextReset);
       const triggering = dead.find((d) => d.outcome === 'rate_limited');
+      const billingResetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const resetIso = resolveRateLimitPauseReset(triggering.logPath, billingResetIso);
       const triggeringRow = triggering ? state.jobs.find((x) => x.slug === triggering.slug) : null;
       const observedAtMs = triggeringRow?.startedAt ? Date.parse(triggeringRow.startedAt) : null;
       // Same rapid-repeat circuit breaker spawnJob's own res.rateLimited
@@ -6242,6 +6835,64 @@ async function reapDeadRunningJobs() {
       await setPaused('rate_limit', resetIso, { observedAt: observedAtMs, force: forceHardPause });
     }
 
+    // Prove integration BEFORE entering mutate() (PRD 1133): the check below
+    // shells out to git — including a full `git fetch --all --prune` (up to
+    // 20s) via computeCommittedDuringRun's committedInWindow, plus up to two
+    // 2s retry sleeps when nothing landed — for every dead job that needs the
+    // in-place fallback. mutate() serializes through ONE global mutateTail
+    // promise chain shared by every project's dispatch/admin/cancel mutation,
+    // same reason the rate-limit handling above already runs outside it — so
+    // doing this git work inside the mutate() callback would stall the whole
+    // scheduler's queue writes for the sum of these calls across every dead
+    // job in the batch (e.g. an app-restart reap that dead-letters several
+    // running jobs at once).
+    const integrationResults = new Map();
+    for (const d of dead) {
+      if (d.outcome !== 'success') continue;
+      const row = state.jobs.find((x) => x.slug === d.slug);
+      if (!row) continue;
+      const rowCwd = row.cwd || state.config?.defaultCwd || DEFAULT_PROJECT_CWD;
+      if (!isGitRepoSync(rowCwd)) continue;
+      const branch = jobWorktree.branchNameFor(d.slug);
+      const integrated = await isBranchAlreadyIntegrated(rowCwd, branch);
+      const headNow = await gitHead(rowCwd);
+      const guardHeadBeforeVal = row.guardHeadBefore || null;
+      let landedCommit = null;
+      let notLandedInfo = null;
+      let effectiveSuccess = true;
+      if (integrated === null) {
+        // No sm-job/<slug> branch — an in-place run (or worktree isolation
+        // disabled). Prove landing via the exact same HEAD-advance evidence
+        // the live commit-guard already uses — reused, not re-derived.
+        const committed = await computeCommittedDuringRun(
+          rowCwd, guardHeadBeforeVal, headNow, row.startedAt, new Date().toISOString(),
+        );
+        if (committed) {
+          if (guardHeadBeforeVal && headNow && headNow !== guardHeadBeforeVal) landedCommit = headNow;
+        } else {
+          effectiveSuccess = false;
+          notLandedInfo = {
+            verdict: 'reaped_without_integration',
+            reason: 'no commit landed during the run window — HEAD never advanced',
+          };
+        }
+      } else if (integrated === true) {
+        if (guardHeadBeforeVal && headNow && headNow !== guardHeadBeforeVal) landedCommit = headNow;
+      } else {
+        // Branch exists and still holds commits never merged into rowCwd's
+        // HEAD — the exact PRD 1118 shape. Never merge it here (see
+        // isBranchAlreadyIntegrated's header comment); park for review
+        // instead, naming the branch so the work is easy to find and land by
+        // hand or via mechanical recovery.
+        effectiveSuccess = false;
+        notLandedInfo = {
+          verdict: 'reaped_without_integration',
+          reason: `worktree branch ${branch} still holds unintegrated work — never merged into ${rowCwd}`,
+        };
+      }
+      integrationResults.set(d.slug, { effectiveSuccess, landedCommit, notLandedInfo });
+    }
+
     await mutate(async (s) => {
       for (const { slug, pid, outcome, gateOutcome, pidless, reason } of dead) {
         const idx = s.jobs.findIndex((x) => x.slug === slug);
@@ -6280,12 +6931,38 @@ async function reapDeadRunningJobs() {
             console.error(`[scheduler] reapDeadRunningJobs: in-place salvage failed for ${slug}`, e);
           }
         }
+        // Prove integration before this reap is allowed to say 'completed'
+        // (PRD 1133): a reaped job's owning process vanished before
+        // spawnJob's own post-run integration/commit-guard ever ran, so
+        // 'outcome=success' alone (a clean result event in the log) is not
+        // proof anything actually landed — the two live incidents this PRD
+        // exists for (1118, starry-night-ships 224) both had exactly that
+        // shape. Only evaluated for a genuinely successful, non-rate-limited
+        // outcome; a non-git cwd (isGitRepoSync false) skips this entirely,
+        // preserving today's behaviour exactly. The actual git work already
+        // ran ABOVE, before this mutate() call, into integrationResults — see
+        // that block's own header comment for why it must not run in here.
+        let effectiveSuccess = success;
+        let landedCommit = null;
+        let notLandedInfo = null;
+        if (success && !rateLimited) {
+          const ir = integrationResults.get(slug);
+          if (ir) {
+            effectiveSuccess = ir.effectiveSuccess;
+            landedCommit = ir.landedCommit;
+            notLandedInfo = ir.notLandedInfo;
+          }
+        }
+
         const leftoverSuffix = deltaPaths && deltaPaths.length
           ? ` — left ${deltaPaths.length} files uncommitted`
           : '';
+        const baseReason = notLandedInfo
+          ? `reaped: ${notLandedInfo.reason}`
+          : (pidless ? reason : `reaped: process gone (outcome=${outcome})`);
         const transitionReason = rateLimited
           ? `reaped: rate limit detected — reset to pending, not failed (outcome=${outcome})${leftoverSuffix}`
-          : (pidless ? reason : `reaped: process gone (outcome=${outcome})`) + leftoverSuffix;
+          : baseReason + leftoverSuffix;
 
         if (rateLimited) {
           // Retryable, never terminal (PRD 1117) — same resetJobFields path
@@ -6294,11 +6971,18 @@ async function reapDeadRunningJobs() {
           // paused-for-rate-limit reset: fresh runId/startedAt/exitCode.
           resetJobFields(s.jobs[idx], transitionReason, { source: 'reapDeadRunningJobs:rate-limit' });
         } else {
-          transitionJob(s.jobs[idx], success ? 'completed' : 'failed', { reason: transitionReason, source: 'reapDeadRunningJobs' });
-          s.jobs[idx].exitCode = success ? 0 : (s.jobs[idx].exitCode ?? 1);
+          const targetStatus = effectiveSuccess ? 'completed' : (notLandedInfo ? 'needs_review' : 'failed');
+          transitionJob(s.jobs[idx], targetStatus, { reason: transitionReason, source: 'reapDeadRunningJobs' });
+          s.jobs[idx].exitCode = effectiveSuccess ? 0 : (s.jobs[idx].exitCode ?? 1);
           s.jobs[idx].finishedAt = new Date().toISOString();
-          s.jobs[idx].error = success ? null : `${transitionReason} (outcome=${outcome})`;
+          s.jobs[idx].error = effectiveSuccess ? null : `${transitionReason} (outcome=${outcome})`;
           s.jobs[idx].gateOutcome = gateOutcome;
+          if (notLandedInfo) {
+            s.jobs[idx].verifierVerdict = notLandedInfo.verdict;
+          } else {
+            delete s.jobs[idx].verifierVerdict;
+          }
+          if (landedCommit) s.jobs[idx].landedCommit = landedCommit;
         }
         delete s.jobs[idx].runtime;
         delete s.jobs[idx].guardBaseline;
@@ -6726,6 +7410,27 @@ function isRescanCandidate(job) {
   return false;
 }
 
+/**
+ * Cheap-guard for the 10-minute periodic reverify tick. MUST be expressed in
+ * terms of isRescanCandidate — not a hand-written status test — because the
+ * two drifted once already: the guard only looked for a `needs_review` row
+ * while isRescanCandidate had grown a `failed`/isFailedUnverifiedShaped arm,
+ * so reverifyNeedsReview's failed → needs_review looksDone branch was
+ * unreachable from the periodic path on any queue holding zero needs_review
+ * rows. A `failed` row with no run log sat wedged for five days with the
+ * self-heal that exists to inspect it never firing (only an app restart, via
+ * the unguarded boot call, could reach it). Reported 2026-09-10 from
+ * social-signals-trader.
+ *
+ * Cost: one extra classifyRunOutcome() log stat per `failed` row, and only
+ * for rows that reach isFailedUnverifiedShaped's log check — bounded by the
+ * failed-row count, and strictly cheaper than firing the whole pass (which
+ * does git fetches via computeLooksDone) on every tick.
+ */
+function shouldRunPeriodicReverify(jobs) {
+  return Array.isArray(jobs) && jobs.some((j) => isRescanCandidate(j));
+}
+
 /**
  * Self-healing pass over needs_review jobs. The verifier runs in-process, so a
  * fix to runVerify.cjs only takes effect for jobs verified AFTER an app
@@ -6778,6 +7483,11 @@ function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRu
   const slugsInQueue = new Set(jobs.map((j) => j.slug));
   return jobs.filter((job) => {
     if (job.status !== 'needs_review') return false;
+    // A job parked here because it was blocked by a sibling's foreign WIP
+    // three times in a row (never its own regression) has nothing for a
+    // fix-plan investigation to diagnose — there is no code defect to
+    // author a PRD against, only another job's still-uncommitted tree.
+    if (job.blockedByForeignWip === true) return false;
     // A stale re-run whose work already shipped (rcaReport's 'already-shipped'
     // class) must never buy a fix-plan PRD — there is nothing to fix, and the
     // correct recovery (archiving the PRD) is a human/reconcile action, not
@@ -6920,7 +7630,15 @@ async function reverifyNeedsReview() {
     // Still needs_review after the existing heal pass — widen the evidence
     // window before giving up on it entirely (unchanged heal semantics for
     // rows that already qualified above; this only adds an annotation).
-    if (stillOpen) {
+    // Skipped when a fix-plan investigation was already minted for this row
+    // (job.autoFixAttempted) — PRD 1136: 'looks done, confirm before
+    // archiving' and 'a -fix- child is already investigating this' are two
+    // different claims about the SAME evidence, and stamping both leaves a
+    // human reading two contradictory signals off one row. autoFixAttempted
+    // is stamped synchronously in spawnJob's same-tick auto-fix branch,
+    // always before this periodic/boot pass can run against the same row, so
+    // this check reliably catches the only order that can occur.
+    if (stillOpen && job.autoFixAttempted !== true) {
       const looksDone = await computeLooksDone(job);
       if (looksDone) {
         looksDoneUpdates.push({ slug: job.slug, cwd: job.cwd, looksDone, fromFailed: false });
@@ -7659,14 +8377,16 @@ async function init() {
     const s = readQueueSync();
     // Periodic self-heal: re-run the verifier over stale needs_review jobs so a
     // job whose work actually landed (committed in-window, no FAIL sentinel)
-    // auto-clears WITHOUT waiting for the next app restart. Cheap-guarded — the
-    // log scan only runs when something is actually flagged. Kill-switch:
+    // auto-clears WITHOUT waiting for the next app restart. Cheap-guarded by
+    // shouldRunPeriodicReverify, which reuses isRescanCandidate so the guard
+    // and the candidate filter can never drift apart again (they did once —
+    // see that function's comment). Kill-switch:
     // SM_REVERIFY_PERIODIC_DISABLE=1 (boot reverify above stays always-on).
     // reverifyNeedsReview's auto-fix loop is capped downstream by
     // MAX_CONCURRENT_INVESTIGATIONS (spawnInvestigation queues/early-returns
     // past it), so this interval firing cannot fan out investigations.
     if (process.env.SM_REVERIFY_PERIODIC_DISABLE !== '1') {
-      if (s.jobs.some((j) => j.status === 'needs_review')) {
+      if (shouldRunPeriodicReverify(s.jobs)) {
         reverifyNeedsReview().catch(() => {});
       }
       // A quarantined row only ever promotes to 'pending' through
@@ -8444,10 +9164,12 @@ module.exports = {
   pickNextBatch,
   pickForProject,
   reapDeadRunningJobs,
+  runBranchSweep,
   pollRecoveryClearSource,
   memoryLimitedBatchSize,
   availableForJobs,
   reverifyNeedsReview,
+  shouldRunPeriodicReverify,
   isRescanCandidate,
   isFailedUnverifiedShaped,
   computeLooksDone,
@@ -8467,6 +9189,10 @@ module.exports = {
   committedInWindow,
   computeCommittedDuringRun,
   classifySigtermWithCommit,
+  evaluateFinalizeDrop,
+  evaluateDispatchSidecarReconcile,
+  isQueueRowRegression,
+  readRunOutcomeSidecars,
   isFixPlanSlug,
   classifyDiscoveredFixPlan,
   resolveIsFixPlan,
@@ -8478,6 +9204,7 @@ module.exports = {
   detectRateLimitInLog,
   classifyFailureOutcome,
   commitGuardVerdict,
+  findSatisfyingCommitOnMain,
   leftoverFieldsFrom,
   applyLeftoverFields,
   LEFTOVER_PATHS_CAP,
@@ -8534,6 +9261,7 @@ module.exports = {
   checkSharedTreeGuard,
   uncommittedChanges,
   gitHead,
+  isBranchAlreadyIntegrated,
   selectResumeRecoveryTarget,
   buildResumeRecoveryPreamble,
   buildClaudeSpawnArgs,
@@ -8560,4 +9288,10 @@ module.exports = {
   MANUAL_PAUSE_COOLDOWN_MS,
   RUNS_DIR,
   pickRunDir,
+  resolveRateLimitPauseReset,
+  computeEffectiveResumeAt,
+  computeResumeDelay,
+  FOREIGN_WIP_BLOCK_STREAK_LIMIT,
+  validateForeignWipBlockClaim,
+  requeueForeignWipBlockedJobs,
 };