claude-code-session-manager 0.85.0 → 0.87.0

package/src/main/__tests__/scheduler-guard-verdict-autoresolve.test.cjs

@@ -0,0 +1,344 @@
+/**
+ * scheduler-guard-verdict-autoresolve.test.cjs — needs_review ladder gap
+ * (2026-09-12, PRD 1181 shape).
+ *
+ * Auto-fix investigations only ever launch for FAILING runs — a job that
+ * exits 0 and gets parked by a post-run GUARD verdict (commit-guard
+ * 'silent_no_op', shared-tree-guard 'shared_tree_reverted') never has
+ * job.autoFixAttempted set, so isExhaustedAutoFix(job) is false forever and
+ * the row is invisible to the existing needs_review auto-resolve ladder —
+ * it sits in needs_review permanently, blocking every dependsOn row behind
+ * it, until a human clears it by hand. PRD 1181 proved it: exit 0, commit
+ * aff5607 landed, parked on a guard verdict, needed a human.
+ *
+ * This file covers the widened entry gate (isGuardParkedWithoutAutoFix /
+ * isEligibleForNeedsReviewAutoResolve) that admits these rows to the SAME
+ * ladder (selectExhaustedNeedsReviewTargets / applyNeedsReviewAutoResolve)
+ * the exhausted-auto-fix path already uses, keyed on landedCommit +
+ * looksDone evidence instead of a spent auto-fix attempt — and the closed
+ * set of verdicts eligible for this (GUARD_VERDICT_EVIDENCE_ELIGIBLE)
+ * excludes 'worktree_integration_failed', whose damage IS a commit (one
+ * stranded on an unmerged branch), so a landedCommit there is not evidence
+ * against the verdict.
+ *
+ * scheduler-needs-review-autoresolve.test.cjs's own suite covers the
+ * pre-existing exhausted-auto-fix ladder and must keep passing UNCHANGED —
+ * this file only adds new coverage for the second door into the same ladder.
+ *
+ * HOME is overridden to a tmp dir BEFORE requiring scheduler.cjs — same
+ * reason as scheduler-needs-review-autoresolve.test.cjs (appendAuditEvent
+ * writes under $HOME/.claude/session-manager/audit-log.jsonl).
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-guard-verdict-autoresolve.test.cjs
+ */
+
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'guard-verdict-autoresolve-test-'));
+process.env.HOME = tmpHome;
+
+const { execFileSync } = require('node:child_process');
+
+const {
+  selectExhaustedNeedsReviewTargets,
+  applyNeedsReviewAutoResolve,
+  NEEDS_REVIEW_RESOLVE_CAP,
+  GUARD_VERDICT_EVIDENCE_ELIGIBLE,
+  isGuardParkedWithoutAutoFix,
+  isEligibleForNeedsReviewAutoResolve,
+  isExhaustedAutoFix,
+  reverifyNeedsReview,
+} = require('../scheduler.cjs');
+
+const { pickForProject } = require('../lib/schedulerBatch.cjs');
+const { resolvePrdWriteDir } = require('../lib/prdLocations.cjs');
+const { bustCwdCache } = require('../lib/queueStore.cjs');
+
+const MIN_MS = 60_000;
+const THRESHOLD_MS = 30 * MIN_MS;
+
+function guardParkedJob(overrides = {}) {
+  return {
+    slug: '1181-guard-parked-row',
+    cwd: '/home/user/project',
+    status: 'needs_review',
+    exitCode: 0,
+    verifierVerdict: 'silent_no_op',
+    landedCommit: 'aff5607abc123',
+    statusHistory: [{ to: 'needs_review', at: new Date(Date.now() - 45 * MIN_MS).toISOString() }],
+    ...overrides,
+  };
+}
+
+// --- enumeration: which guard verdicts are eligible ---
+
+test('GUARD_VERDICT_EVIDENCE_ELIGIBLE contains exactly the benign guard verdicts, never worktree_integration_failed', () => {
+  assert.ok(GUARD_VERDICT_EVIDENCE_ELIGIBLE.has('silent_no_op'));
+  assert.ok(GUARD_VERDICT_EVIDENCE_ELIGIBLE.has('shared_tree_reverted'));
+  assert.equal(GUARD_VERDICT_EVIDENCE_ELIGIBLE.has('worktree_integration_failed'), false);
+});
+
+// --- isGuardParkedWithoutAutoFix / isEligibleForNeedsReviewAutoResolve ---
+
+test('a guard-verdict park with no auto-fix history is guard-parked-without-autofix', () => {
+  const job = guardParkedJob();
+  assert.equal(isGuardParkedWithoutAutoFix(job), true);
+  assert.equal(isExhaustedAutoFix(job), false, 'never went through auto-fix — must not double-count as exhausted');
+  assert.equal(isEligibleForNeedsReviewAutoResolve(job), true);
+});
+
+test('a row that DID get an auto-fix investigation is left to the exhausted-auto-fix door, not this one', () => {
+  const job = guardParkedJob({ autoFixAttempted: true, autoFixOutcome: 'no-plan', autoFixRetries: 1 });
+  assert.equal(isGuardParkedWithoutAutoFix(job), false);
+  assert.equal(isExhaustedAutoFix(job), true);
+  assert.equal(isEligibleForNeedsReviewAutoResolve(job), true, 'still eligible overall, via the OTHER door');
+});
+
+test('(c) worktree_integration_failed is never guard-parked-without-autofix, whatever evidence it carries', () => {
+  const job = guardParkedJob({ verifierVerdict: 'worktree_integration_failed' });
+  assert.equal(isGuardParkedWithoutAutoFix(job), false);
+  assert.equal(isEligibleForNeedsReviewAutoResolve(job), false);
+});
+
+test('a needs_review row with an unrecognized verifierVerdict and no auto-fix history is not eligible', () => {
+  const job = guardParkedJob({ verifierVerdict: 'transcript_errors' });
+  assert.equal(isGuardParkedWithoutAutoFix(job), false);
+  assert.equal(isEligibleForNeedsReviewAutoResolve(job), false);
+});
+
+// --- selectExhaustedNeedsReviewTargets: the widened selector ---
+
+test('a fresh guard-parked row (under threshold) is not selected', () => {
+  const job = guardParkedJob({
+    statusHistory: [{ to: 'needs_review', at: new Date(Date.now() - 2 * MIN_MS).toISOString() }],
+  });
+  assert.equal(selectExhaustedNeedsReviewTargets([job], Date.now(), THRESHOLD_MS).length, 0);
+});
+
+test('a guard-parked row past threshold, under the cap, is selected', () => {
+  const job = guardParkedJob();
+  const found = selectExhaustedNeedsReviewTargets([job], Date.now(), THRESHOLD_MS);
+  assert.equal(found.length, 1);
+  assert.equal(found[0].slug, '1181-guard-parked-row');
+});
+
+test('(c) worktree_integration_failed is never selected, even past threshold with a landedCommit', () => {
+  const job = guardParkedJob({ verifierVerdict: 'worktree_integration_failed' });
+  assert.equal(selectExhaustedNeedsReviewTargets([job], Date.now(), THRESHOLD_MS).length, 0);
+});
+
+// --- applyNeedsReviewAutoResolve: the three-branch policy, entered via the guard door ---
+
+test('(a) the 1181 shape — exit 0 + guard verdict + landedCommit + looksDone — auto-completes', () => {
+  const job = guardParkedJob({
+    looksDone: { commits: ['aff5607'], paths: ['src/main/scheduler.cjs'], detectedAt: new Date().toISOString() },
+  });
+  const outcome = applyNeedsReviewAutoResolve(job);
+  assert.equal(outcome, 'completed');
+  assert.equal(job.status, 'completed');
+  assert.match(job.statusHistory.at(-1).reason, /silent_no_op/, 'the reason must name the evidence, not just "auto-resolved"');
+});
+
+test('(b) the same shape WITHOUT looksDone does not auto-complete on the first pass — bounded requeue instead', () => {
+  const job = guardParkedJob({ exhaustedResolveAttempts: 0 });
+  assert.equal(job.looksDone, undefined);
+  const outcome = applyNeedsReviewAutoResolve(job);
+  assert.equal(outcome, 'requeued');
+  assert.equal(job.status, 'pending');
+  assert.equal(job.exhaustedResolveAttempts, 1);
+  assert.match(job.statusHistory.at(-1).reason, /silent_no_op/);
+});
+
+test('a guard-parked row with no evidence, cap spent, auto-skips with the guard verdict named in job.error', () => {
+  const job = guardParkedJob({ exhaustedResolveAttempts: NEEDS_REVIEW_RESOLVE_CAP });
+  const outcome = applyNeedsReviewAutoResolve(job);
+  assert.equal(outcome, 'skipped');
+  assert.equal(job.status, 'skipped');
+  assert.equal(job.needsReviewAutoResolvedSkip, true);
+  assert.match(job.error, /silent_no_op/, 'a human reading the queue must see WHY, not a generic auto-resolved label');
+  assert.doesNotMatch(job.error, /exhausted auto-fix path/, 'this row never went through auto-fix — must not claim it did');
+});
+
+test('(c) worktree_integration_failed never auto-completes on landed-commit + looksDone evidence', () => {
+  const job = guardParkedJob({
+    verifierVerdict: 'worktree_integration_failed',
+    looksDone: { commits: ['aff5607'], paths: ['src/main/scheduler.cjs'], detectedAt: new Date().toISOString() },
+  });
+  const outcome = applyNeedsReviewAutoResolve(job);
+  assert.equal(outcome, null, 'this verdict has no door into this ladder at all');
+  assert.equal(job.status, 'needs_review', 'must stay parked — its own mechanical-recovery path owns this verdict, not this ladder');
+});
+
+test('the pre-existing exhausted-auto-fix ladder is unaffected: same branch, same cap, same audit shape', () => {
+  const job = {
+    slug: 'exhausted-row',
+    cwd: '/home/user/project',
+    status: 'needs_review',
+    autoFixAttempted: true,
+    autoFixOutcome: 'no-plan',
+    autoFixRetries: 1,
+    exhaustedResolveAttempts: 1,
+    looksDone: { commits: ['abc1234'], paths: ['src/main/scheduler.cjs'], detectedAt: new Date().toISOString() },
+  };
+  const outcome = applyNeedsReviewAutoResolve(job);
+  assert.equal(outcome, 'completed');
+  assert.match(job.statusHistory.at(-1).reason, /verifier annotation shows work landed/);
+});
+
+// --- (d) chain drain: a downstream dependsOn row becomes eligible once the guard-parked blocker resolves ---
+
+test('(d) a dependsOn chain drains once a guard-parked blocker (no auto-fix, no evidence, cap spent) auto-skips', () => {
+  const now = Date.now();
+  const rowA = { slug: 'a-first', cwd: '/home/user/project', status: 'completed' };
+  const rowB = guardParkedJob({
+    slug: 'b-middle',
+    exhaustedResolveAttempts: NEEDS_REVIEW_RESOLVE_CAP,
+    dependsOn: ['a-first'],
+  });
+  const rowC = { slug: 'c-last', cwd: '/home/user/project', status: 'pending', dependsOn: ['b-middle'] };
+  const jobs = [rowA, rowB, rowC];
+
+  const before = pickForProject(jobs, new Set(), 5);
+  assert.equal(before.batch.length, 0, 'C must not be eligible while B still sits in needs_review');
+
+  const targets = selectExhaustedNeedsReviewTargets(jobs, now, THRESHOLD_MS);
+  assert.equal(targets.length, 1);
+  assert.equal(targets[0].slug, 'b-middle');
+  const outcome = applyNeedsReviewAutoResolve(rowB);
+  assert.equal(outcome, 'skipped');
+
+  const after = pickForProject(jobs, new Set(), 5);
+  assert.ok(after.batch.some((j) => j.slug === 'c-last'), 'C must become eligible once B is auto-skipped');
+});
+
+// --- end-to-end: reverifyNeedsReview computes looksDone for a guard-parked row ---
+
+function git(args, cwd) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8' });
+}
+
+function initRepo(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  git(['init', '-q'], dir);
+  git(['config', 'user.email', 'test@example.com'], dir);
+  git(['config', 'user.name', 'Test'], dir);
+  fs.writeFileSync(path.join(dir, 'README.md'), 'hello\n', 'utf8');
+  git(['add', '-A'], dir);
+  git(['commit', '-q', '-m', 'initial'], dir);
+}
+
+function commitFile(dir, relPath, content, message) {
+  const abs = path.join(dir, relPath);
+  fs.mkdirSync(path.dirname(abs), { recursive: true });
+  fs.writeFileSync(abs, content);
+  git(['add', relPath], dir);
+  git(['commit', '-q', '-m', message], dir);
+}
+
+function registerActiveProject(cwd, slug) {
+  const slugDir = path.join(tmpHome, '.claude', 'projects', slug);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
+  bustCwdCache();
+}
+
+function writeProjectQueue(cwd, jobs) {
+  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({ jobs }, null, 2));
+  return path.join(stateDir, 'queue.json');
+}
+
+function writePrd(cwd, slug, body) {
+  const dir = resolvePrdWriteDir(cwd);
+  fs.mkdirSync(dir, { recursive: true });
+  const text = `---\ntitle: Test PRD\ncwd: ${cwd}\nestimateMinutes: 30\n---\n${body}\n`;
+  fs.writeFileSync(path.join(dir, `${slug}.md`), text);
+}
+
+async function wait(ms) {
+  await new Promise((r) => setTimeout(r, ms));
+}
+
+test('reverifyNeedsReview computes looksDone for a guard-parked (silent_no_op) row with no auto-fix history', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-guard-parked');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-guard-parked-slug');
+  writePrd(projectCwd, '1181-guard-parked', [
+    '# Implementation notes',
+    'Edit `src/thing.js`.',
+  ].join('\n'));
+
+  const startedAt = new Date().toISOString();
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: '1181-guard-parked',
+      status: 'needs_review',
+      cwd: projectCwd,
+      runId: 'run-1181',
+      startedAt,
+      finishedAt: new Date().toISOString(),
+      exitCode: 0,
+      verifierVerdict: 'silent_no_op',
+      landedCommit: 'deadbeef',
+      error: 'commit-guard: made no commit on an already-clean tree',
+    },
+  ]);
+
+  await wait(1100); // git --since has 1s resolution
+  // Must be attributable to THIS job (see attributeLandedCommits) — path
+  // overlap alone is no longer evidence. The row's own `landedCommit`
+  // ('deadbeef') is a stale/unresolvable placeholder, so this falls to the
+  // 'slug trailer' rule by naming the job's own slug in the commit message.
+  commitFile(projectCwd, 'src/thing.js', 'hello', 'the actual fix for 1181-guard-parked landed');
+
+  await reverifyNeedsReview();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  assert.equal(jobs.length, 1);
+  assert.equal(jobs[0].status, 'needs_review', 'looksDone alone never auto-completes — only applyNeedsReviewAutoResolve does');
+  assert.ok(jobs[0].looksDone, 'expected a looksDone annotation computed for this guard-parked row');
+  assert.equal(jobs[0].looksDone.commits.length, 1);
+  assert.equal(jobs[0].looksDone.rule, 'slug trailer');
+});
+
+test('reverifyNeedsReview never computes looksDone for a worktree_integration_failed row', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-stranded-branch');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-stranded-branch-slug');
+  writePrd(projectCwd, '1181-stranded', [
+    '# Implementation notes',
+    'Edit `src/thing.js`.',
+  ].join('\n'));
+
+  const startedAt = new Date().toISOString();
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: '1181-stranded',
+      status: 'needs_review',
+      cwd: projectCwd,
+      runId: 'run-stranded',
+      startedAt,
+      finishedAt: new Date().toISOString(),
+      exitCode: 0,
+      verifierVerdict: 'worktree_integration_failed',
+      landedCommit: 'deadbeef',
+      error: 'worktree branch integration failed',
+    },
+  ]);
+
+  await wait(1100);
+  commitFile(projectCwd, 'src/thing.js', 'hello', 'unrelated later commit');
+
+  await reverifyNeedsReview();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  assert.equal(jobs.length, 1);
+  assert.equal(jobs[0].looksDone, undefined, 'a stranded-branch verdict must never be treated as evidence-gatherable');
+  assert.equal(jobs[0].status, 'needs_review');
+});

package/src/main/__tests__/scheduler-job-budget.test.cjs

@@ -0,0 +1,172 @@
+/**
+ * scheduler-job-budget.test.cjs — per-job wall-clock budget derived from the
+ * PRD's own `estimateMinutes`, and the classifier that parks an over-budget
+ * job `needs_review` (never 'failed', never silently 'completed').
+ *
+ * Closes the gap `findOverrunningJobs` deliberately leaves open (escalation
+ * only, never kills — see its own header): p50/p90/max across 606 run-meta
+ * records since 2026-08-25 was 13m/60m/240m against a concurrencyCap of 4,
+ * so a chatty-but-runaway executor that keeps emitting output (never
+ * tripping IDLE_OUTPUT_KILL_MS) could hold a dispatch slot for hours with
+ * nothing to notice or act on it.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-job-budget.test.cjs
+ */
+
+'use strict';
+
+// vitest, NOT node:test — this repo's suite is vitest-only (CLAUDE.md).
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const {
+  computeJobBudgetMs,
+  classifyBudgetKill,
+  isJobBudgetExempt,
+  shouldKillForBudget,
+  resolveBudgetKillOutcome,
+  selectAutoFixTargets,
+  JOB_BUDGET_FACTOR,
+  JOB_BUDGET_FLOOR_MS,
+  JOB_BUDGET_CEILING_MS,
+} = require('../scheduler.cjs');
+
+// ---------- computeJobBudgetMs: both clamps ----------
+
+test('computeJobBudgetMs: a mid-size estimate is factor*estimate, no clamp hit', () => {
+  // 30m * 3 = 90m — comfortably between the 45m floor and the 180m ceiling.
+  const budgetMs = computeJobBudgetMs(30);
+  assert.strictEqual(budgetMs, 90 * 60_000);
+});
+
+test('computeJobBudgetMs: the floor clamp — a tiny/missing/zero estimate never goes below 45m', () => {
+  // 5m * 3 = 15m, well under the 45m floor.
+  assert.strictEqual(computeJobBudgetMs(5), JOB_BUDGET_FLOOR_MS);
+  // Missing/zero estimate is treated as 0 — the floor dominates, no special-casing.
+  assert.strictEqual(computeJobBudgetMs(0), JOB_BUDGET_FLOOR_MS);
+  assert.strictEqual(computeJobBudgetMs(null), JOB_BUDGET_FLOOR_MS);
+  assert.strictEqual(computeJobBudgetMs(undefined), JOB_BUDGET_FLOOR_MS);
+});
+
+test('computeJobBudgetMs: the ceiling clamp — a huge estimate never exceeds 180m', () => {
+  // 200m * 3 = 600m, way past the 180m ceiling.
+  assert.strictEqual(computeJobBudgetMs(200), JOB_BUDGET_CEILING_MS);
+});
+
+test('computeJobBudgetMs: honors caller overrides when neither clamp is hit', () => {
+  const budgetMs = computeJobBudgetMs(5, { factor: 2, floorMs: 1000, ceilingMs: 3_600_000 });
+  assert.strictEqual(budgetMs, 10 * 60_000);
+});
+
+test('JOB_BUDGET_FACTOR/FLOOR/CEILING are the named constants the AC requires (3x, 45m, 180m)', () => {
+  assert.strictEqual(JOB_BUDGET_FACTOR, 3);
+  assert.strictEqual(JOB_BUDGET_FLOOR_MS, 45 * 60_000);
+  assert.strictEqual(JOB_BUDGET_CEILING_MS, 180 * 60_000);
+});
+
+// ---------- shouldKillForBudget: under vs over budget ----------
+
+test('shouldKillForBudget: a job under budget is untouched', () => {
+  assert.strictEqual(shouldKillForBudget(44 * 60_000, 45 * 60_000), false);
+});
+
+test('shouldKillForBudget: a job at or past its budget fires', () => {
+  assert.strictEqual(shouldKillForBudget(45 * 60_000, 45 * 60_000), true);
+  assert.strictEqual(shouldKillForBudget(241 * 60_000, 90 * 60_000), true);
+});
+
+// ---------- classifyBudgetKill: the needs_review park + evidence threading ----------
+
+test('classifyBudgetKill: a job not killed by the budget watchdog is untouched (returns null)', () => {
+  assert.strictEqual(classifyBudgetKill({ killedByWatchdog: 'idle-tail', exitCode: 143 }, null), null);
+  assert.strictEqual(classifyBudgetKill({ killedByWatchdog: null, exitCode: 0 }, null), null);
+  assert.strictEqual(classifyBudgetKill(null, null), null);
+});
+
+test('classifyBudgetKill: an over-budget job parks needs_review with the exact reason string, no evidence', () => {
+  const res = {
+    killedByWatchdog: 'budget',
+    exitCode: 143,
+    budgetKillReason: 'wall-clock budget exceeded: ran 241m against a 90m budget (estimateMinutes=30)',
+  };
+  const decision = classifyBudgetKill(res, null);
+  assert.strictEqual(decision.status, 'needs_review');
+  assert.strictEqual(decision.reason, 'wall-clock budget exceeded: ran 241m against a 90m budget (estimateMinutes=30)');
+  assert.strictEqual(decision.landedCommit, null);
+});
+
+test('classifyBudgetKill: an over-budget job with a verified landed commit is still adjudicated on git evidence, not discarded', () => {
+  const res = {
+    killedByWatchdog: 'budget',
+    exitCode: 143,
+    budgetKillReason: 'wall-clock budget exceeded: ran 91m against a 90m budget (estimateMinutes=30)',
+  };
+  const decision = classifyBudgetKill(res, 'deadbeef1234567890');
+  // Never 'failed' or 'completed' just because a commit landed — still parked
+  // for review, but the evidence is threaded onto the row rather than dropped.
+  assert.strictEqual(decision.status, 'needs_review');
+  assert.strictEqual(decision.landedCommit, 'deadbeef1234567890');
+});
+
+// ---------- isJobBudgetExempt: quietMachine + explicit opt-out ----------
+
+test('isJobBudgetExempt: a quietMachine job is exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({ quietMachine: true }), true);
+});
+
+test('isJobBudgetExempt: a PRD with an explicit budgetExempt opt-out is exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({ budgetExempt: true }), true);
+});
+
+test('isJobBudgetExempt: an ordinary job is not exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({}), false);
+  assert.strictEqual(isJobBudgetExempt({ quietMachine: false, budgetExempt: false }), false);
+});
+
+// ---------- resolveBudgetKillOutcome: the watchdog-tick vs natural-exit race ----------
+
+test('resolveBudgetKillOutcome: a genuine signal kill (exit 143) is trusted', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: true, durationMs: 91 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, 'budget');
+  assert.strictEqual(outcome.budgetKillReason, 'wall-clock budget exceeded: ran 91m against a 90m budget (estimateMinutes=30)');
+});
+
+test('resolveBudgetKillOutcome: a race where the child exits cleanly (exit 0) in the same tick is NOT trusted as a budget kill', () => {
+  // The watchdog's action() fired (stamping ctx.killedByWatchdog='budget')
+  // but the agent had already exited on its own with exit 0 — killTree()
+  // was a no-op against an already-dead pid. Must never misclassify a
+  // genuinely successful run as needs_review.
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: false, durationMs: 90 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, null);
+  assert.strictEqual(outcome.budgetKillReason, null);
+});
+
+test('resolveBudgetKillOutcome: a race where the child fails on its own (exit 1, unrelated) is NOT trusted as a budget kill', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: false, durationMs: 90 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, null);
+});
+
+test('resolveBudgetKillOutcome: no watchdog fired at all — untouched', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'idle-tail', killedBySignal: true, durationMs: 25 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, 'idle-tail');
+  assert.strictEqual(outcome.budgetKillReason, null);
+});
+
+// ---------- selectAutoFixTargets: a budget-killed job never gets auto-retried ----------
+
+test('selectAutoFixTargets: a budget_exceeded needs_review job is excluded — it parks for a human/ladder decision, never a fix-plan', () => {
+  const jobs = [
+    { slug: '10-budget-victim', status: 'needs_review', verifierVerdict: 'budget_exceeded', runId: 'r1' },
+    { slug: '11-ordinary', status: 'needs_review', verifierVerdict: 'transcript_errors', runId: 'r2' },
+  ];
+  const targets = selectAutoFixTargets(jobs, { fixSlugExists: () => false });
+  assert.ok(!targets.some((t) => t.slug === '10-budget-victim'));
+  assert.ok(targets.some((t) => t.slug === '11-ordinary'));
+});

package/src/main/__tests__/scheduler-looks-done.test.cjs

@@ -33,7 +33,7 @@ const { execFileSync } = require('node:child_process');
 const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'looks-done-test-'));
 process.env.HOME = tmpHome;
 
-const { reverifyNeedsReview, computeLooksDone, findSatisfyingCommitOnMain } = require('../scheduler.cjs');
+const { reverifyNeedsReview, computeLooksDone, applyNeedsReviewAutoResolve, findSatisfyingCommitOnMain } = require('../scheduler.cjs');
 const { resolvePrdWriteDir } = require('../lib/prdLocations.cjs');
 const { bustCwdCache } = require('../lib/queueStore.cjs');
 
@@ -127,7 +127,10 @@ test('failed + no result event (unverified-shaped) + later commit touching decla
   writeRunLog('run-171', '171-example', ['[scheduler] starting 171-example']); // no result event
 
   await wait(1100); // git --since has 1s resolution
-  commitFile(projectCwd, 'src/foo.js', 'hello', 'fix 171');
+  // Must name this job's own slug to be attributable (see
+  // attributeLandedCommits's 'slug trailer' rule) — path overlap alone is no
+  // longer evidence.
+  commitFile(projectCwd, 'src/foo.js', 'hello', 'fix 171-example');
 
   await reverifyNeedsReview();
 
@@ -136,8 +139,9 @@ test('failed + no result event (unverified-shaped) + later commit touching decla
   assert.equal(jobs[0].status, 'needs_review', 'looksDone never auto-completes — only surfaces for a human');
   assert.ok(jobs[0].looksDone, 'expected a looksDone annotation');
   assert.equal(jobs[0].looksDone.commits.length, 1);
+  assert.equal(jobs[0].looksDone.rule, 'slug trailer');
   assert.deepEqual(jobs[0].looksDone.paths, ['src/foo.js']);
-  assert.match(jobs[0].error, /looks done — 1 commit/);
+  assert.match(jobs[0].error, /looks done \(slug trailer\) — 1 commit/);
 });
 
 test('failed + a real result event (genuine gate failure) → not a candidate, stays failed untouched', async () => {
@@ -379,3 +383,89 @@ test('computeLooksDone: non-git cwd → null without throwing (git-unavailable)'
   const looksDone = await computeLooksDone(job);
   assert.equal(looksDone, null);
 });
+
+// --- Attribution regression (PRD 1204/1205 incident, 2026-09-13) ---
+//
+// Two PRDs in the SAME Epic declaring the same hot file: sibling job B lands
+// a commit on that path while job A is parked in needs_review. Path overlap
+// alone must never read as job A's own evidence — that's exactly how 1204's
+// row cited 1205's commit 5dadf3c as "looks done" while 1204's real
+// implementing commit (164184e) sat unnoticed.
+
+test('sibling PRD commit on the same declared path is not attributable — computeLooksDone returns null, applyNeedsReviewAutoResolve never promotes to completed', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-1204-sibling-incident');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-1204-sibling-incident-slug');
+  writePrd(projectCwd, '1204-job-a', [
+    '# Implementation notes',
+    'Edit `src/main/scheduler.cjs`.',
+  ].join('\n'));
+
+  const startedAt = new Date().toISOString();
+  await wait(1100);
+  // Sibling job B's commit: touches job A's declared path, but names neither
+  // job A's slug nor any `sm-job/1204-job-a` branch, and job A's row carries
+  // no landedCommit of its own.
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'sibling change', 'feat(scheduler): restructure the backlog into Epic groups (1205-job-b)');
+
+  const jobA = {
+    slug: '1204-job-a',
+    cwd: projectCwd,
+    status: 'needs_review',
+    startedAt,
+    autoFixAttempted: true,
+    autoFixOutcome: 'no-plan',
+    autoFixRetries: 1,
+    exhaustedResolveAttempts: 0,
+    statusHistory: [{ to: 'needs_review', at: new Date(Date.now() - 45 * 60_000).toISOString() }],
+  };
+
+  const looksDone = await computeLooksDone(jobA);
+  assert.equal(looksDone, null, 'a sibling\'s path-overlapping commit must never be credited as job A\'s own evidence');
+
+  const outcome = applyNeedsReviewAutoResolve(jobA);
+  assert.equal(outcome, 'requeued', 'with no attributable evidence, the row must fall through to the existing requeue path, never complete');
+  assert.equal(jobA.status, 'pending');
+});
+
+test('this job\'s OWN attributable commit (landedCommit) still produces looksDone and still promotes to completed', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-1204-own-commit');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-1204-own-commit-slug');
+  writePrd(projectCwd, '1204-job-a2', [
+    '# Implementation notes',
+    'Edit `src/main/scheduler.cjs`.',
+  ].join('\n'));
+
+  const startedAt = new Date().toISOString();
+  await wait(1100);
+  // A sibling commit lands on the same path first...
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'sibling change', 'feat(scheduler): unrelated sibling work');
+  // ...then this job's OWN commit lands, exactly as spawnJob's finalize step
+  // would have recorded it on job.landedCommit.
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'this job\'s own change', 'fix(scheduler): attribution fix');
+  const ownSha = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const jobA = {
+    slug: '1204-job-a2',
+    cwd: projectCwd,
+    status: 'needs_review',
+    startedAt,
+    landedCommit: ownSha,
+    autoFixAttempted: true,
+    autoFixOutcome: 'no-plan',
+    autoFixRetries: 1,
+    exhaustedResolveAttempts: 0,
+    statusHistory: [{ to: 'needs_review', at: new Date(Date.now() - 45 * 60_000).toISOString() }],
+  };
+
+  const looksDone = await computeLooksDone(jobA);
+  assert.ok(looksDone, 'this job\'s own landedCommit must be recognized as attributable evidence');
+  assert.equal(looksDone.rule, 'landedCommit');
+  assert.deepEqual(looksDone.commits, [ownSha], 'only this job\'s own commit is evidence — never the sibling\'s');
+
+  jobA.looksDone = looksDone;
+  const outcome = applyNeedsReviewAutoResolve(jobA);
+  assert.equal(outcome, 'completed', 'strong, attributable evidence must still promote the row');
+  assert.equal(jobA.status, 'completed');
+});