claude-code-session-manager 0.86.0 → 0.87.0

package/src/main/__tests__/scheduler-job-budget.test.cjs

@@ -0,0 +1,172 @@
+/**
+ * scheduler-job-budget.test.cjs — per-job wall-clock budget derived from the
+ * PRD's own `estimateMinutes`, and the classifier that parks an over-budget
+ * job `needs_review` (never 'failed', never silently 'completed').
+ *
+ * Closes the gap `findOverrunningJobs` deliberately leaves open (escalation
+ * only, never kills — see its own header): p50/p90/max across 606 run-meta
+ * records since 2026-08-25 was 13m/60m/240m against a concurrencyCap of 4,
+ * so a chatty-but-runaway executor that keeps emitting output (never
+ * tripping IDLE_OUTPUT_KILL_MS) could hold a dispatch slot for hours with
+ * nothing to notice or act on it.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-job-budget.test.cjs
+ */
+
+'use strict';
+
+// vitest, NOT node:test — this repo's suite is vitest-only (CLAUDE.md).
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const {
+  computeJobBudgetMs,
+  classifyBudgetKill,
+  isJobBudgetExempt,
+  shouldKillForBudget,
+  resolveBudgetKillOutcome,
+  selectAutoFixTargets,
+  JOB_BUDGET_FACTOR,
+  JOB_BUDGET_FLOOR_MS,
+  JOB_BUDGET_CEILING_MS,
+} = require('../scheduler.cjs');
+
+// ---------- computeJobBudgetMs: both clamps ----------
+
+test('computeJobBudgetMs: a mid-size estimate is factor*estimate, no clamp hit', () => {
+  // 30m * 3 = 90m — comfortably between the 45m floor and the 180m ceiling.
+  const budgetMs = computeJobBudgetMs(30);
+  assert.strictEqual(budgetMs, 90 * 60_000);
+});
+
+test('computeJobBudgetMs: the floor clamp — a tiny/missing/zero estimate never goes below 45m', () => {
+  // 5m * 3 = 15m, well under the 45m floor.
+  assert.strictEqual(computeJobBudgetMs(5), JOB_BUDGET_FLOOR_MS);
+  // Missing/zero estimate is treated as 0 — the floor dominates, no special-casing.
+  assert.strictEqual(computeJobBudgetMs(0), JOB_BUDGET_FLOOR_MS);
+  assert.strictEqual(computeJobBudgetMs(null), JOB_BUDGET_FLOOR_MS);
+  assert.strictEqual(computeJobBudgetMs(undefined), JOB_BUDGET_FLOOR_MS);
+});
+
+test('computeJobBudgetMs: the ceiling clamp — a huge estimate never exceeds 180m', () => {
+  // 200m * 3 = 600m, way past the 180m ceiling.
+  assert.strictEqual(computeJobBudgetMs(200), JOB_BUDGET_CEILING_MS);
+});
+
+test('computeJobBudgetMs: honors caller overrides when neither clamp is hit', () => {
+  const budgetMs = computeJobBudgetMs(5, { factor: 2, floorMs: 1000, ceilingMs: 3_600_000 });
+  assert.strictEqual(budgetMs, 10 * 60_000);
+});
+
+test('JOB_BUDGET_FACTOR/FLOOR/CEILING are the named constants the AC requires (3x, 45m, 180m)', () => {
+  assert.strictEqual(JOB_BUDGET_FACTOR, 3);
+  assert.strictEqual(JOB_BUDGET_FLOOR_MS, 45 * 60_000);
+  assert.strictEqual(JOB_BUDGET_CEILING_MS, 180 * 60_000);
+});
+
+// ---------- shouldKillForBudget: under vs over budget ----------
+
+test('shouldKillForBudget: a job under budget is untouched', () => {
+  assert.strictEqual(shouldKillForBudget(44 * 60_000, 45 * 60_000), false);
+});
+
+test('shouldKillForBudget: a job at or past its budget fires', () => {
+  assert.strictEqual(shouldKillForBudget(45 * 60_000, 45 * 60_000), true);
+  assert.strictEqual(shouldKillForBudget(241 * 60_000, 90 * 60_000), true);
+});
+
+// ---------- classifyBudgetKill: the needs_review park + evidence threading ----------
+
+test('classifyBudgetKill: a job not killed by the budget watchdog is untouched (returns null)', () => {
+  assert.strictEqual(classifyBudgetKill({ killedByWatchdog: 'idle-tail', exitCode: 143 }, null), null);
+  assert.strictEqual(classifyBudgetKill({ killedByWatchdog: null, exitCode: 0 }, null), null);
+  assert.strictEqual(classifyBudgetKill(null, null), null);
+});
+
+test('classifyBudgetKill: an over-budget job parks needs_review with the exact reason string, no evidence', () => {
+  const res = {
+    killedByWatchdog: 'budget',
+    exitCode: 143,
+    budgetKillReason: 'wall-clock budget exceeded: ran 241m against a 90m budget (estimateMinutes=30)',
+  };
+  const decision = classifyBudgetKill(res, null);
+  assert.strictEqual(decision.status, 'needs_review');
+  assert.strictEqual(decision.reason, 'wall-clock budget exceeded: ran 241m against a 90m budget (estimateMinutes=30)');
+  assert.strictEqual(decision.landedCommit, null);
+});
+
+test('classifyBudgetKill: an over-budget job with a verified landed commit is still adjudicated on git evidence, not discarded', () => {
+  const res = {
+    killedByWatchdog: 'budget',
+    exitCode: 143,
+    budgetKillReason: 'wall-clock budget exceeded: ran 91m against a 90m budget (estimateMinutes=30)',
+  };
+  const decision = classifyBudgetKill(res, 'deadbeef1234567890');
+  // Never 'failed' or 'completed' just because a commit landed — still parked
+  // for review, but the evidence is threaded onto the row rather than dropped.
+  assert.strictEqual(decision.status, 'needs_review');
+  assert.strictEqual(decision.landedCommit, 'deadbeef1234567890');
+});
+
+// ---------- isJobBudgetExempt: quietMachine + explicit opt-out ----------
+
+test('isJobBudgetExempt: a quietMachine job is exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({ quietMachine: true }), true);
+});
+
+test('isJobBudgetExempt: a PRD with an explicit budgetExempt opt-out is exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({ budgetExempt: true }), true);
+});
+
+test('isJobBudgetExempt: an ordinary job is not exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({}), false);
+  assert.strictEqual(isJobBudgetExempt({ quietMachine: false, budgetExempt: false }), false);
+});
+
+// ---------- resolveBudgetKillOutcome: the watchdog-tick vs natural-exit race ----------
+
+test('resolveBudgetKillOutcome: a genuine signal kill (exit 143) is trusted', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: true, durationMs: 91 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, 'budget');
+  assert.strictEqual(outcome.budgetKillReason, 'wall-clock budget exceeded: ran 91m against a 90m budget (estimateMinutes=30)');
+});
+
+test('resolveBudgetKillOutcome: a race where the child exits cleanly (exit 0) in the same tick is NOT trusted as a budget kill', () => {
+  // The watchdog's action() fired (stamping ctx.killedByWatchdog='budget')
+  // but the agent had already exited on its own with exit 0 — killTree()
+  // was a no-op against an already-dead pid. Must never misclassify a
+  // genuinely successful run as needs_review.
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: false, durationMs: 90 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, null);
+  assert.strictEqual(outcome.budgetKillReason, null);
+});
+
+test('resolveBudgetKillOutcome: a race where the child fails on its own (exit 1, unrelated) is NOT trusted as a budget kill', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: false, durationMs: 90 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, null);
+});
+
+test('resolveBudgetKillOutcome: no watchdog fired at all — untouched', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'idle-tail', killedBySignal: true, durationMs: 25 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, 'idle-tail');
+  assert.strictEqual(outcome.budgetKillReason, null);
+});
+
+// ---------- selectAutoFixTargets: a budget-killed job never gets auto-retried ----------
+
+test('selectAutoFixTargets: a budget_exceeded needs_review job is excluded — it parks for a human/ladder decision, never a fix-plan', () => {
+  const jobs = [
+    { slug: '10-budget-victim', status: 'needs_review', verifierVerdict: 'budget_exceeded', runId: 'r1' },
+    { slug: '11-ordinary', status: 'needs_review', verifierVerdict: 'transcript_errors', runId: 'r2' },
+  ];
+  const targets = selectAutoFixTargets(jobs, { fixSlugExists: () => false });
+  assert.ok(!targets.some((t) => t.slug === '10-budget-victim'));
+  assert.ok(targets.some((t) => t.slug === '11-ordinary'));
+});

package/src/main/__tests__/scheduler-looks-done.test.cjs

@@ -33,7 +33,7 @@ const { execFileSync } = require('node:child_process');
 const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'looks-done-test-'));
 process.env.HOME = tmpHome;
 
-const { reverifyNeedsReview, computeLooksDone, findSatisfyingCommitOnMain } = require('../scheduler.cjs');
+const { reverifyNeedsReview, computeLooksDone, applyNeedsReviewAutoResolve, findSatisfyingCommitOnMain } = require('../scheduler.cjs');
 const { resolvePrdWriteDir } = require('../lib/prdLocations.cjs');
 const { bustCwdCache } = require('../lib/queueStore.cjs');
 
@@ -127,7 +127,10 @@ test('failed + no result event (unverified-shaped) + later commit touching decla
   writeRunLog('run-171', '171-example', ['[scheduler] starting 171-example']); // no result event
 
   await wait(1100); // git --since has 1s resolution
-  commitFile(projectCwd, 'src/foo.js', 'hello', 'fix 171');
+  // Must name this job's own slug to be attributable (see
+  // attributeLandedCommits's 'slug trailer' rule) — path overlap alone is no
+  // longer evidence.
+  commitFile(projectCwd, 'src/foo.js', 'hello', 'fix 171-example');
 
   await reverifyNeedsReview();
 
@@ -136,8 +139,9 @@ test('failed + no result event (unverified-shaped) + later commit touching decla
   assert.equal(jobs[0].status, 'needs_review', 'looksDone never auto-completes — only surfaces for a human');
   assert.ok(jobs[0].looksDone, 'expected a looksDone annotation');
   assert.equal(jobs[0].looksDone.commits.length, 1);
+  assert.equal(jobs[0].looksDone.rule, 'slug trailer');
   assert.deepEqual(jobs[0].looksDone.paths, ['src/foo.js']);
-  assert.match(jobs[0].error, /looks done — 1 commit/);
+  assert.match(jobs[0].error, /looks done \(slug trailer\) — 1 commit/);
 });
 
 test('failed + a real result event (genuine gate failure) → not a candidate, stays failed untouched', async () => {
@@ -379,3 +383,89 @@ test('computeLooksDone: non-git cwd → null without throwing (git-unavailable)'
   const looksDone = await computeLooksDone(job);
   assert.equal(looksDone, null);
 });
+
+// --- Attribution regression (PRD 1204/1205 incident, 2026-09-13) ---
+//
+// Two PRDs in the SAME Epic declaring the same hot file: sibling job B lands
+// a commit on that path while job A is parked in needs_review. Path overlap
+// alone must never read as job A's own evidence — that's exactly how 1204's
+// row cited 1205's commit 5dadf3c as "looks done" while 1204's real
+// implementing commit (164184e) sat unnoticed.
+
+test('sibling PRD commit on the same declared path is not attributable — computeLooksDone returns null, applyNeedsReviewAutoResolve never promotes to completed', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-1204-sibling-incident');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-1204-sibling-incident-slug');
+  writePrd(projectCwd, '1204-job-a', [
+    '# Implementation notes',
+    'Edit `src/main/scheduler.cjs`.',
+  ].join('\n'));
+
+  const startedAt = new Date().toISOString();
+  await wait(1100);
+  // Sibling job B's commit: touches job A's declared path, but names neither
+  // job A's slug nor any `sm-job/1204-job-a` branch, and job A's row carries
+  // no landedCommit of its own.
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'sibling change', 'feat(scheduler): restructure the backlog into Epic groups (1205-job-b)');
+
+  const jobA = {
+    slug: '1204-job-a',
+    cwd: projectCwd,
+    status: 'needs_review',
+    startedAt,
+    autoFixAttempted: true,
+    autoFixOutcome: 'no-plan',
+    autoFixRetries: 1,
+    exhaustedResolveAttempts: 0,
+    statusHistory: [{ to: 'needs_review', at: new Date(Date.now() - 45 * 60_000).toISOString() }],
+  };
+
+  const looksDone = await computeLooksDone(jobA);
+  assert.equal(looksDone, null, 'a sibling\'s path-overlapping commit must never be credited as job A\'s own evidence');
+
+  const outcome = applyNeedsReviewAutoResolve(jobA);
+  assert.equal(outcome, 'requeued', 'with no attributable evidence, the row must fall through to the existing requeue path, never complete');
+  assert.equal(jobA.status, 'pending');
+});
+
+test('this job\'s OWN attributable commit (landedCommit) still produces looksDone and still promotes to completed', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-1204-own-commit');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-1204-own-commit-slug');
+  writePrd(projectCwd, '1204-job-a2', [
+    '# Implementation notes',
+    'Edit `src/main/scheduler.cjs`.',
+  ].join('\n'));
+
+  const startedAt = new Date().toISOString();
+  await wait(1100);
+  // A sibling commit lands on the same path first...
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'sibling change', 'feat(scheduler): unrelated sibling work');
+  // ...then this job's OWN commit lands, exactly as spawnJob's finalize step
+  // would have recorded it on job.landedCommit.
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'this job\'s own change', 'fix(scheduler): attribution fix');
+  const ownSha = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const jobA = {
+    slug: '1204-job-a2',
+    cwd: projectCwd,
+    status: 'needs_review',
+    startedAt,
+    landedCommit: ownSha,
+    autoFixAttempted: true,
+    autoFixOutcome: 'no-plan',
+    autoFixRetries: 1,
+    exhaustedResolveAttempts: 0,
+    statusHistory: [{ to: 'needs_review', at: new Date(Date.now() - 45 * 60_000).toISOString() }],
+  };
+
+  const looksDone = await computeLooksDone(jobA);
+  assert.ok(looksDone, 'this job\'s own landedCommit must be recognized as attributable evidence');
+  assert.equal(looksDone.rule, 'landedCommit');
+  assert.deepEqual(looksDone.commits, [ownSha], 'only this job\'s own commit is evidence — never the sibling\'s');
+
+  jobA.looksDone = looksDone;
+  const outcome = applyNeedsReviewAutoResolve(jobA);
+  assert.equal(outcome, 'completed', 'strong, attributable evidence must still promote the row');
+  assert.equal(jobA.status, 'completed');
+});

package/src/main/__tests__/scheduler-porcelain-rename.test.cjs

@@ -0,0 +1,164 @@
+/**
+ * scheduler-porcelain-rename.test.cjs — PRD 1187/1186-follow-on: a staged
+ * rename ("R  old -> new") was parsed by `parsePorcelainEntries` as ONE fused
+ * path string `"old -> new"`. That string can never match a real path in
+ * `dirtyAfter`, `pathsCommittedDuringRun`, or an `fs.existsSync` check, so
+ * every staged rename in a shared-tree-guard baseline was structurally
+ * guaranteed to be reported reverted — even when it was cleanly committed
+ * during the run. On 2026-09-12 this flagged 45 paths and parked a clean,
+ * committed run (job `1187-autoresolve-guard-verdict-parks`):
+ *
+ *   "job discarded pre-existing state in the shared tree: 45 path(s)
+ *   reverted with no commit to explain it
+ *   (scripts/__tests__/manual-chapter-links.test.cjs ->
+ *   web/manual/__tests__/chapter-links.test.cjs, ...)" — exit 0, landedCommit
+ *   recorded, nothing actually lost.
+ *
+ * Every test below is written to FAIL against the pre-fix implementation
+ * (`path: l.slice(3)`, no rename/quote parsing at all).
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-porcelain-rename.test.cjs
+ */
+
+'use strict';
+
+import { test, expect } from 'vitest';
+const scheduler = require('../scheduler.cjs');
+const { parsePorcelainEntries, evaluateSharedTreeGuard } = scheduler;
+
+// --- parsePorcelainEntries: rename/copy lines split into real components ---
+
+test('parsePorcelainEntries: a plain staged rename splits into new path + oldPath, not one fused string', () => {
+  const entries = parsePorcelainEntries('R  old.txt -> new.txt\n');
+  expect(entries).toEqual([{ code: 'R ', path: 'new.txt', oldPath: 'old.txt' }]);
+});
+
+test('parsePorcelainEntries: a rename-with-worktree-modification (RM) line still splits correctly', () => {
+  const entries = parsePorcelainEntries('RM old.txt -> new.txt\n');
+  expect(entries).toEqual([{ code: 'RM', path: 'new.txt', oldPath: 'old.txt' }]);
+});
+
+test('parsePorcelainEntries: a copy line (C) splits the same way as a rename', () => {
+  const entries = parsePorcelainEntries('C  old.txt -> copy.txt\n');
+  expect(entries).toEqual([{ code: 'C ', path: 'copy.txt', oldPath: 'old.txt' }]);
+});
+
+test('parsePorcelainEntries: a NEW path containing a space is quoted by git and must be unquoted', () => {
+  // Real `git status --porcelain` output for `git mv new.txt "renamed with space.txt"`.
+  const entries = parsePorcelainEntries('R  new.txt -> "renamed with space.txt"\n');
+  expect(entries).toEqual([{ code: 'R ', path: 'renamed with space.txt', oldPath: 'new.txt' }]);
+});
+
+test('parsePorcelainEntries: an OLD path containing a space is quoted independently of the new path', () => {
+  const entries = parsePorcelainEntries('R  "old with space.txt" -> new.txt\n');
+  expect(entries).toEqual([{ code: 'R ', path: 'new.txt', oldPath: 'old with space.txt' }]);
+});
+
+test('parsePorcelainEntries: a non-ASCII path is quoted with per-byte octal escapes and must decode back to UTF-8', () => {
+  // Real recorded `git status --porcelain` output for a rename onto
+  // "résumé file.txt" — git's default core.quotepath escapes each raw UTF-8
+  // byte >= 0x80 as \NNN octal: 'é' is UTF-8 bytes 0xC3 0xA9 -> \303\251.
+  const line = 'R  new.txt -> "r\\303\\251sum\\303\\251 file.txt"\n';
+  const entries = parsePorcelainEntries(line);
+  expect(entries).toEqual([{ code: 'R ', path: 'résumé file.txt', oldPath: 'new.txt' }]);
+});
+
+test('parsePorcelainEntries: non-rename entries are unaffected (no oldPath, path as before)', () => {
+  const entries = parsePorcelainEntries(' M src/foo.js\n?? untracked.txt\n');
+  expect(entries).toEqual([
+    { code: ' M', path: 'src/foo.js' },
+    { code: '??', path: 'untracked.txt' },
+  ]);
+});
+
+test('parsePorcelainEntries: a quoted plain (non-rename) path is also unquoted, not left with literal quotes', () => {
+  const entries = parsePorcelainEntries('?? "plain space.txt"\n');
+  expect(entries).toEqual([{ code: '??', path: 'plain space.txt' }]);
+});
+
+// --- The exact 1187 shape: committed rename must not be flagged reverted ---
+
+test('evaluateSharedTreeGuard: a staged rename that is committed during the run is NOT reported reverted (real 1187 case)', () => {
+  const oldPath = 'scripts/__tests__/manual-chapter-links.test.cjs';
+  const newPath = 'web/manual/__tests__/chapter-links.test.cjs';
+  const dirtyBefore = parsePorcelainEntries(`R  ${oldPath} -> ${newPath}\n`);
+  // git diff --name-only <headBefore>..<headAfter> reports only the NEW path
+  // for a committed rename (verified against real git 2.43 behavior).
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [], // fully committed, nothing left dirty
+    pathsCommittedDuringRun: [newPath],
+  });
+  expect(result.reverted).toEqual([]);
+});
+
+test('evaluateSharedTreeGuard: a batch of committed renames (the real 45-path shape) are all cleared, none reverted', () => {
+  const pairs = [
+    ['scripts/__tests__/manual-chapter-links.test.cjs', 'web/manual/__tests__/chapter-links.test.cjs'],
+    ['scripts/foo-old.js', 'src/foo-new.js'],
+    ['docs/old-name.md', 'docs/new-name.md'],
+  ];
+  const porcelain = pairs.map(([o, n]) => `R  ${o} -> ${n}`).join('\n') + '\n';
+  const dirtyBefore = parsePorcelainEntries(porcelain);
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [],
+    pathsCommittedDuringRun: pairs.map(([, n]) => n),
+  });
+  expect(result.reverted).toEqual([]);
+});
+
+// --- The guard's real purpose survives: an UNDONE rename still parks ---
+
+test('evaluateSharedTreeGuard: a staged rename that is UNDONE (old path restored, new path gone, nothing committed) IS still reported reverted', () => {
+  // This test must FAIL if the fix is implemented as "blanket skip rename
+  // entries" (dropping every rename-coded entry from consideration would
+  // make `reverted` come back empty here, exactly like the committed case
+  // above — but here nothing was committed to explain the disappearance).
+  const dirtyBefore = parsePorcelainEntries('R  old.txt -> new.txt\n');
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [], // clean again — reverted to HEAD, old.txt restored, new.txt gone
+    pathsCommittedDuringRun: [], // nothing committed
+  });
+  expect(result.reverted).toEqual(['new.txt']);
+});
+
+// --- The two already-fixed false-positive classes stay fixed (pinned here
+// too, using parsePorcelainEntries as the real entry point rather than
+// hand-built fixtures, so a future change to the parser can't silently
+// regress them without failing a test right next to the rename fix). ---
+
+test('evaluateSharedTreeGuard: nowIgnored still works for a real parsePorcelainEntries untracked baseline entry', () => {
+  const dirtyBefore = parsePorcelainEntries('?? session-manager-operations/logs/errors-2026-09-12.jsonl\n');
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [],
+    pathsCommittedDuringRun: ['.gitignore'],
+    existsAfter: ['session-manager-operations/logs/errors-2026-09-12.jsonl'],
+  });
+  expect(result.reverted).toEqual([]);
+  expect(result.nowIgnored).toEqual(['session-manager-operations/logs/errors-2026-09-12.jsonl']);
+});
+
+test('evaluateSharedTreeGuard: a genuine deletion of an untracked path (from a real parsePorcelainEntries entry) is still reverted', () => {
+  const dirtyBefore = parsePorcelainEntries('?? data/scratch.txt\n');
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [],
+    pathsCommittedDuringRun: [],
+    existsAfter: [],
+  });
+  expect(result.reverted).toEqual(['data/scratch.txt']);
+  expect(result.nowIgnored).toEqual([]);
+});

package/src/main/__tests__/scheduler-reap-dead-running-jobs.test.cjs

@@ -148,6 +148,48 @@ test('reapDeadRunningJobs reaps a pidless row older than PIDLESS_SPAWN_GRACE_MS
   assert.ok(pidlessEvent, 'reaping a pidless row must leave an audit trace');
 });
 
+test('reapDeadRunningJobs: a pidless row past grace with a landedCommit already recorded is routed to needs_review, not failed, naming the commit sha (PRD 1173)', async () => {
+  const projectCwd = path.join(tmpHome, 'c3-project-pidless-with-landed-commit');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const staleStartedAt = new Date(Date.now() - PIDLESS_SPAWN_GRACE_MS - 60_000).toISOString();
+  const landedSha = 'f3e35a7f9e49f13a9eb8c338b0d086160e32a87f';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'shipped-but-pidless',
+      status: 'running',
+      cwd: projectCwd,
+      runId: 'run-shipped-but-pidless',
+      startedAt: staleStartedAt,
+      landedCommit: landedSha,
+      // no runtime key at all — the spawn never got far enough to record one
+    },
+  ]);
+  // Empty run dir, same shape as the sibling 'failed' test below — the
+  // landedCommit evidence must be what changes the outcome, not the log.
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', 'run-shipped-but-pidless'), { recursive: true });
+
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'shipped-but-pidless');
+  assert.equal(row.status, 'needs_review', 'a row with proof of landed work must never be transitioned to failed by the pidless branch');
+  assert.equal(row.landedCommit, landedSha, 'the pre-existing landedCommit must be preserved on the row');
+  assert.match(row.error, new RegExp(landedSha), 'the reason must name the recorded commit sha');
+  assert.equal(row.verifierVerdict, 'pidless_reap_with_landed_commit');
+
+  // Scan the whole audit log for THIS slug's event rather than slicing by a
+  // byte offset from statSync — a prior test's audit entries can contain
+  // multi-byte characters (e.g. an em dash in a reaper reason string), and
+  // slicing a utf8-decoded JS string (UTF-16 code units) at a byte offset
+  // then silently corrupts the boundary. The slug is unique to this test.
+  const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  const pidlessEvent = auditLines.find((e) => e.kind === 'job_reaped_pidless' && e.slug === 'shipped-but-pidless');
+  assert.ok(pidlessEvent, 'reaping this row must still leave an audit trace');
+  assert.equal(pidlessEvent.landedCommit, landedSha, 'the audit event must carry the landed-commit evidence so the decision is reconstructable from the audit log alone');
+});
+
 test('reapDeadRunningJobs clears runId on a pidless reap whose run dir holds only a sibling slug\'s files', async () => {
   const projectCwd = path.join(tmpHome, 'c2-project-batch-sibling');
   fs.mkdirSync(projectCwd, { recursive: true });
@@ -573,3 +615,121 @@ test('reapDeadRunningJobs: a non-git cwd skips the integration check entirely, p
   assert.equal(row.status, 'completed', 'a non-git cwd must keep today\'s behaviour — the check is meaningless there');
   assert.equal(row.verifierVerdict, undefined);
 });
+
+// ---------- Reaper landed-commit evidence gate (job 1192 incident) ----------
+//
+// job 1192 shipped a real 3-file commit (7bf5fa3f...) and was still
+// stamped 'failed' by reapDeadRunningJobs because a `landedCommit` field
+// being present was never actually verified against the repo. These cover
+// the dead-pid branch specifically (runtime.pid recorded, process
+// confirmed dead) rather than the pidless branch: a pidless row with a
+// non-empty landedCommit is already fully owned by PRD 1173's
+// resolvePidlessFailureOverride (routes to needs_review, tested above) —
+// this PRD's gate exists for the shape 1173 doesn't cover, where the
+// reaper would otherwise fall straight through to 'failed' with no
+// evidence check of any kind.
+
+test('reapDeadRunningJobs: a dead-pid reap with a git-resolvable landedCommit transitions to completed, naming the reap cause and the evidence, source reapDeadRunningJobs:landed', async () => {
+  const projectCwd = path.join(tmpHome, 'n-project-landed-commit-evidence');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  fs.writeFileSync(path.join(projectCwd, 'shipped.txt'), 'done\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'ship the PRD work'], projectCwd);
+  const landedSha = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const runId = 'run-landed-commit-evidence';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'landed-but-reaped',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 }, // guaranteed-dead pid
+      landedCommit: landedSha,
+    },
+  ]);
+  // Empty run dir → classifyRunOutcome finds no result event → 'no_result'
+  // → without this PRD's gate this would stamp 'failed' despite the real
+  // commit already sitting on HEAD.
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'landed-but-reaped');
+  assert.equal(row.status, 'completed', 'a resolvable landedCommit must promote the reap to completed, not failed');
+  assert.equal(row.landedCommit, landedSha);
+  assert.equal(row.exitCode, 0);
+  assert.equal(row.error, null);
+  const lastTransition = row.statusHistory[row.statusHistory.length - 1];
+  assert.equal(lastTransition.source, 'reapDeadRunningJobs:landed');
+  assert.match(lastTransition.reason, /process gone/, 'the reap cause must still be named');
+  assert.match(lastTransition.reason, new RegExp(landedSha), 'the evidence sha must be named');
+  assert.match(lastTransition.reason, /resolves/);
+});
+
+test('reapDeadRunningJobs: a dead-pid reap with an unresolvable (stale) landedCommit keeps today\'s behaviour exactly — failed, same reason shape, same source', async () => {
+  const projectCwd = path.join(tmpHome, 'o-project-stale-landed-commit');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const staleSha = '0123456789abcdef0123456789abcdef01234567'; // well-formed sha, never committed anywhere
+  const runId = 'run-stale-landed-commit';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'stale-landed-commit',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      landedCommit: staleSha,
+    },
+  ]);
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'stale-landed-commit');
+  assert.equal(row.status, 'failed', 'a landedCommit that does not resolve in the repo must never be trusted as evidence');
+  assert.equal(row.landedCommit, staleSha, 'the stale field is left on the row untouched, never cleared');
+  assert.match(row.error, /reaped: process gone \(outcome=no_result\)/);
+  assert.doesNotMatch(row.error, /resolves/);
+  const lastTransition = row.statusHistory[row.statusHistory.length - 1];
+  assert.equal(lastTransition.source, 'reapDeadRunningJobs', 'no evidence found — source must stay the plain reaper source, not :landed');
+});
+
+test('reapDeadRunningJobs: a landedCommit that cannot be git-resolved because the row cwd is not a usable git repo falls back to failed without throwing out of the reaper', async () => {
+  const projectCwd = path.join(tmpHome, 'p-project-unresolvable-cwd');
+  // Deliberately NOT initRepo(projectCwd) — no `.git` at all, the same
+  // "cwd git resolution cannot possibly succeed" shape a deleted/torn-down
+  // worktree checkout would produce (git itself errors identically for
+  // "not a git repository" and "no such directory" — both must be caught
+  // and treated as no-evidence, never thrown out of the reaper).
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const runId = 'run-unresolvable-cwd';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'unresolvable-cwd-job',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      landedCommit: '89abcdef89abcdef89abcdef89abcdef89abcdef',
+    },
+  ]);
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await assert.doesNotReject(() => reapDeadRunningJobs(), 'a bounded git spawn failure/timeout must never escape the reaper as an unhandled rejection');
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'unresolvable-cwd-job');
+  assert.equal(row.status, 'failed', 'an unresolvable cwd must fall back to failed, exactly like no evidence at all');
+});