claude-code-session-manager 0.86.0 → 0.87.0

package/src/main/scheduler.cjs

@@ -60,7 +60,9 @@ const { readTail } = require('./lib/fileTail.cjs');
 const {
   claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs,
   findLiveProcessForJob, logHasOutput, resolvePidlessGateOutcome, resolveCommitGuardOutcome,
+  readSpawnedPidFromLog, readLogMtimeMs,
 } = require('./lib/reaperHelpers.cjs');
+const { resolveProjectRoot } = require('./lib/opsOwnership.cjs');
 const { sweepStrandedJobBranches } = require('./lib/branchSweep.cjs');
 const { detectRateLimitInLog } = require('./lib/rateLimitDetect.cjs');
 const { stripAppOwnedChurn } = require('./lib/jobDirtFilter.cjs');
@@ -89,9 +91,13 @@ const {
   USAGE_REFRESH_INTERVAL_MS,
   MAX_JOB_DURATION_MS,
   BROADCAST_COALESCE_MS,
+  RECONCILE_SLOW_PASS_MS,
   QUARANTINE_ESCALATE_MS: QUARANTINE_ESCALATE_MS_DEFAULT,
   JOB_OVERRUN_FACTOR: JOB_OVERRUN_FACTOR_DEFAULT,
   JOB_OVERRUN_FLOOR_MS: JOB_OVERRUN_FLOOR_MS_DEFAULT,
+  JOB_BUDGET_FACTOR: JOB_BUDGET_FACTOR_DEFAULT,
+  JOB_BUDGET_FLOOR_MS: JOB_BUDGET_FLOOR_MS_DEFAULT,
+  JOB_BUDGET_CEILING_MS: JOB_BUDGET_CEILING_MS_DEFAULT,
   PIDLESS_SPAWN_GRACE_MS,
   INVESTIGATION_MAX_MS,
   STARVATION_ESCALATE_MS,
@@ -100,12 +106,27 @@ const {
 const QUARANTINE_ESCALATE_MS = process.env.SM_QUARANTINE_ESCALATE_HOURS
   ? Number(process.env.SM_QUARANTINE_ESCALATE_HOURS) * 60 * 60_000
   : QUARANTINE_ESCALATE_MS_DEFAULT;
-const JOB_OVERRUN_FACTOR = process.env.SM_JOB_OVERRUN_FACTOR
-  ? Number(process.env.SM_JOB_OVERRUN_FACTOR)
-  : JOB_OVERRUN_FACTOR_DEFAULT;
-const JOB_OVERRUN_FLOOR_MS = process.env.SM_JOB_OVERRUN_FLOOR_MINUTES
-  ? Number(process.env.SM_JOB_OVERRUN_FLOOR_MINUTES) * 60_000
-  : JOB_OVERRUN_FLOOR_MS_DEFAULT;
+// Shared by every SM_*-env-overridable numeric constant below (bare factors
+// use unitMs=1; minute-denominated knobs use unitMs=60_000) — one parse rule
+// instead of one hand-copied ternary per constant.
+function numEnvOverride(envVar, unitMs, fallback) {
+  const raw = process.env[envVar];
+  return raw ? Number(raw) * unitMs : fallback;
+}
+const JOB_OVERRUN_FACTOR = numEnvOverride('SM_JOB_OVERRUN_FACTOR', 1, JOB_OVERRUN_FACTOR_DEFAULT);
+const JOB_OVERRUN_FLOOR_MS = numEnvOverride('SM_JOB_OVERRUN_FLOOR_MINUTES', 60_000, JOB_OVERRUN_FLOOR_MS_DEFAULT);
+// Same three numbers as JOB_OVERRUN_FACTOR/JOB_OVERRUN_FLOOR_MS today (3x,
+// 45min) is coincidental, not structural — this triad ACTS (kills) where
+// JOB_OVERRUN_* only ever escalates (see JOB_OVERRUN_FACTOR's own header);
+// tune them independently, don't re-couple on a future pass just because the
+// defaults happen to match right now.
+const JOB_BUDGET_FACTOR = numEnvOverride('SM_JOB_BUDGET_FACTOR', 1, JOB_BUDGET_FACTOR_DEFAULT);
+const JOB_BUDGET_FLOOR_MS = numEnvOverride('SM_JOB_BUDGET_FLOOR_MINUTES', 60_000, JOB_BUDGET_FLOOR_MS_DEFAULT);
+const JOB_BUDGET_CEILING_MS = numEnvOverride('SM_JOB_BUDGET_CEILING_MINUTES', 60_000, JOB_BUDGET_CEILING_MS_DEFAULT);
+// A running job past this fraction of its own budget gets a durable
+// `budgetWarning` stamp on its row (see the budget watchdog below) so the
+// renderer can warn BEFORE the kill, not only after.
+const BUDGET_WARNING_FRACTION = 0.75;
 const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD, DEP_HISTORY_FAIL_OPEN } = require('./lib/schedulerBatch.cjs');
 const { runDefinitionOfDoneOnDrain } = require('./lib/dodDrainHook.cjs');
 const { writeRcaReport, extractRcaBlock } = require('./lib/rcaReport.cjs');
@@ -151,8 +172,9 @@ const { reconcileEpicWorktreesOnBoot } = require('./lib/epicWorktreeBoot.cjs');
 const queueStore = require('./lib/queueStore.cjs');
 const { splitFrontmatter, parsePrdFile, serializePrdFile } = require('./lib/prdFrontmatter.cjs');
 const { resolveDepSlug, findNearMatches } = require('./lib/depSlugResolve.cjs');
+const { computeDispositionRewrite } = require('./lib/prdDisposition.cjs');
 const { migratePrds, consolidateFlatPrds, legacyAdoptExistingPrds } = require('./lib/prdMigration.cjs');
-const { allProjectCwds } = require('../../scripts/lib/activeSessions.cjs');
+const { allProjectCwds } = require('./lib/activeSessions.cjs');
 
 // Captured once at module load so every run's meta sidecar can record how
 // stale the running process is relative to on-disk source (incident: PRD
@@ -311,22 +333,95 @@ only post-AC work. If a review finding can't be fixed within scope, commit what
 you have, describe the finding in the commit body, and note the follow-up in your
 final result.`;
 
-// Parse \`git status --porcelain\` output into a list of changed paths. Pure +
-// exported for unit testing. Each porcelain line is "XY<space>PATH" (2 status
-// chars + space), so the path starts at index 3; rename lines ("R  a -> b")
-// keep the "a -> b" tail, which is fine for a human-facing dirty-file list.
-function parsePorcelain(stdout) {
+// Unquote a single git porcelain v1 path token. Defined once in
+// gitWorktree.cjs (which this file already requires — the reverse would be
+// circular, since gitWorktree.cjs's own salvageDirtyDelta needs the exact
+// same unquoting) and reused here rather than re-implemented, so the two
+// porcelain consumers in this codebase can never drift apart.
+const { unquotePorcelainPath } = gitWorktree;
+
+// Split a rename/copy porcelain path field ("old -> new") into its two real
+// paths. Each side is independently quoted per unquotePorcelainPath's rule —
+// only the side that needs escaping is wrapped in quotes, the literal " -> "
+// arrow between them never is. Returns null when no " -> " separator is
+// found (a malformed/unexpected line) so the caller can fall back to treating
+// the whole field as one opaque path rather than guessing.
+function splitRenamePorcelainField(field) {
+  const arrow = ' -> ';
+  let head;
+  let rest;
+  if (field[0] === '"') {
+    let end = -1;
+    for (let i = 1; i < field.length; i += 1) {
+      if (field[i] === '\\') { i += 1; continue; }
+      if (field[i] === '"') { end = i; break; }
+    }
+    if (end === -1) return null;
+    head = field.slice(0, end + 1);
+    rest = field.slice(end + 1);
+  } else {
+    const idx = field.indexOf(arrow);
+    if (idx === -1) return null;
+    // An unquoted path containing a literal " -> " substring (git only
+    // quotes for a quote/backslash/control-byte/non-ASCII byte — a plain
+    // ASCII arrow inside a filename is never quoted) makes the true
+    // old/new boundary genuinely ambiguous from this text alone: the first
+    // occurrence could be the real separator, or it could be sitting
+    // inside the old path with the real separator later in the field.
+    // Guessing wrong silently corrupts oldPath/path for downstream
+    // fs.existsSync/Set-membership checks, which is worse than the
+    // existing "malformed line" fallback below — so more than one
+    // occurrence falls back to treating the whole field as one opaque
+    // path, same as any other line this function can't confidently parse.
+    if (field.indexOf(arrow, idx + arrow.length) !== -1) return null;
+    head = field.slice(0, idx);
+    rest = field.slice(idx);
+  }
+  if (!rest.startsWith(arrow)) return null;
+  return { oldPath: unquotePorcelainPath(head), path: unquotePorcelainPath(rest.slice(arrow.length)) };
+}
+
+// Parse `git status --porcelain` output into `{ code, path }` entries (plus
+// `oldPath` for a rename/copy). Pure + exported for unit testing. Each
+// porcelain line is "XY<space>PATH"; a staged rename/copy line is
+// "XY<space>OLD -> NEW" instead — X (index status) is 'R' or 'C' — and NEW is
+// the path git will report in any later `git status` call, so callers that
+// key off `.path` (dirtyAfter membership, pathsCommittedDuringRun membership,
+// fs.existsSync) must compare against NEW, never the fused "OLD -> NEW"
+// string. `oldPath` is retained on the entry for callers that need the
+// original path too. `code` is the raw 2-char status (e.g. '??' for
+// untracked) — callers that need to distinguish "untracked" from
+// "tracked-but-modified" (the shared-tree guard's revert-vs-now-ignored
+// split) read it off the entry instead of re-deriving it later.
+function parsePorcelainEntries(stdout) {
   return String(stdout || '')
     .split('\n')
     .filter((l) => l.length > 0)
-    .map((l) => l.slice(3))
-    .filter(Boolean);
+    .map((l) => {
+      const code = l.slice(0, 2);
+      const field = l.slice(3);
+      if (code.includes('R') || code.includes('C')) {
+        const split = splitRenamePorcelainField(field);
+        if (split) return { code, path: split.path, oldPath: split.oldPath };
+      }
+      return { code, path: unquotePorcelainPath(field) };
+    })
+    .filter((e) => e.path);
 }
 
-// Return the list of uncommitted paths in cwd, or null when the guard does not
-// apply (cwd is not a git work tree, git is missing, or the call errors). Never
-// throws — a guard failure must not fail an otherwise-successful job.
-function uncommittedChanges(cwd) {
+// Parse `git status --porcelain` output into a list of changed paths. Pure +
+// exported for unit testing.
+function parsePorcelain(stdout) {
+  return parsePorcelainEntries(stdout).map((e) => e.path);
+}
+
+// Same as uncommittedChanges but keeps each path's porcelain status code —
+// the shared-tree guard's baseline needs this to tell "was untracked" apart
+// from "was tracked-and-modified" (see evaluateSharedTreeGuard). Returns null
+// when the guard does not apply (cwd is not a git work tree, git is missing,
+// or the call errors); never throws — a guard failure must not fail an
+// otherwise-successful job.
+function uncommittedChangesWithStatus(cwd) {
   return new Promise((resolve) => {
     if (!cwd) { resolve(null); return; }
     execFile(
@@ -334,13 +429,24 @@ function uncommittedChanges(cwd) {
       ['-C', cwd, 'status', '--porcelain'],
       { timeout: 10_000, windowsHide: true },
       (err, stdout) => {
-        if (err) { resolve(null); return; } // not a repo / git missing → skip
-        resolve(parsePorcelain(stdout));
+        if (err) { resolve(null); return; }
+        resolve(parsePorcelainEntries(stdout));
       },
     );
   });
 }
 
+// Return the list of uncommitted paths in cwd, or null under the same
+// conditions as uncommittedChangesWithStatus (never throws). Kept as a thin
+// path-only projection of that call rather than its own execFile, so a future
+// fix to the git invocation (timeout, error handling) can't land in one and
+// silently miss the other.
+function uncommittedChanges(cwd) {
+  return uncommittedChangesWithStatus(cwd).then((entries) => (
+    entries === null ? null : entries.map((e) => e.path)
+  ));
+}
+
 // Return the current HEAD commit sha in cwd, or null on any error. Used by the
 // commit-guard to detect whether the job self-committed during its run (HEAD
 // moved) — in which case leftover working-tree dirt is presumptively from a
@@ -429,17 +535,52 @@ function restoreSpecificStash(cwd, ref) {
 //   - reverted: a path that was dirty in the baseline, is clean now, and was
 //     not touched by any commit landed during the run — the job reset/
 //     checked-out over pre-existing uncommitted work without stashing it.
-// Pure/no I/O — the guard's git calls happen at the call site
-// (checkSharedTreeGuard). Exported for unit testing.
-function evaluateSharedTreeGuard({ stashBefore, stashAfter, dirtyBefore, dirtyAfter, pathsCommittedDuringRun }) {
+//
+// A THIRD outcome is not a revert at all: an untracked path can drop out of
+// `git status` because the run committed a `.gitignore` change that now
+// matches it — the file is untouched on disk, just no longer visible to git
+// (Incident: 2026-09-12, PRD 1181 added a bare `logs/` ignore pattern, eleven
+// untracked `session-manager-operations/logs/*` paths vanished from status,
+// and an otherwise-perfect run was parked in needs_review for a human who had
+// nothing to decide). `dirtyBefore` entries therefore carry each path's
+// porcelain status code (`{ code, path }`, from parsePorcelainEntries) so this
+// function can tell "was untracked" apart from "was tracked-and-modified":
+//   - a TRACKED path (any code other than '??') leaving the dirty set always
+//     means its content was restored to HEAD — still `reverted`, even though
+//     the file still exists on disk, because for a tracked file "exists" is
+//     not the question; "matches what the human left uncommitted" is.
+//   - an UNTRACKED path ('??') leaving the dirty set is `reverted` only if it
+//     no longer exists on disk; if it still exists, it merely became ignored
+//     and is reported separately as `nowIgnored`.
+// Plain path strings are still accepted in `dirtyBefore` for callers that
+// have no status code (e.g. the stash-detection pass, which always passes an
+// empty array) — an entry with no `code` is treated as tracked, matching the
+// old behavior exactly.
+//
+// Pure/no I/O — status-code parsing and on-disk existence checks both happen
+// at the call site (checkSharedTreeGuard); this function never stats the
+// filesystem. Exported for unit testing.
+function evaluateSharedTreeGuard({ stashBefore, stashAfter, dirtyBefore, dirtyAfter, pathsCommittedDuringRun, existsAfter }) {
   const beforeHashes = new Set((stashBefore || []).map((l) => parseStashLine(l)?.hash).filter(Boolean));
   const newStashes = (stashAfter || [])
     .map(parseStashLine)
     .filter((e) => e && !beforeHashes.has(e.hash));
   const dirtyAfterSet = new Set(dirtyAfter || []);
   const committedSet = new Set(pathsCommittedDuringRun || []);
-  const reverted = (dirtyBefore || []).filter((p) => !dirtyAfterSet.has(p) && !committedSet.has(p));
-  return { newStashes, reverted };
+  const existsSet = new Set(existsAfter || []);
+  const reverted = [];
+  const nowIgnored = [];
+  for (const entry of dirtyBefore || []) {
+    const p = typeof entry === 'string' ? entry : entry.path;
+    const code = typeof entry === 'string' ? undefined : entry.code;
+    if (dirtyAfterSet.has(p) || committedSet.has(p)) continue;
+    if (code === '??' && existsSet.has(p)) {
+      nowIgnored.push(p);
+    } else {
+      reverted.push(p);
+    }
+  }
+  return { newStashes, reverted, nowIgnored };
 }
 
 // Post-run shared-tree guard for an IN-PLACE job (worktree.ok === false —
@@ -489,18 +630,40 @@ async function checkSharedTreeGuard({ cwd, stashBaseline, dirtyBaseline, headBef
     // restored stash is not ALSO reported as an unexplained revert (it was
     // explained — by the stash this guard just restored).
     const dirtyAfter = await module.exports.uncommittedChanges(cwd);
-    const { reverted } = module.exports.evaluateSharedTreeGuard({
+    // Existence check for the "now ignored, not reverted" split (2026-09-12
+    // incident) — only untracked baseline entries need it; a tracked path
+    // leaving the dirty set is always a revert regardless of disk state (see
+    // evaluateSharedTreeGuard). Scoped to entries carrying a status code —
+    // plain path strings (no code) fall back to the old always-reverted path.
+    const untrackedBaselinePaths = (dirtyBaseline || [])
+      .filter((e) => e && typeof e === 'object' && e.code === '??')
+      .map((e) => e.path);
+    // A large untracked baseline (the 2026-09-12 incident's shared tree had
+    // ~240 such paths) makes this a lot of stat calls — fs.promises.access
+    // run concurrently instead of fs.existsSync run synchronously one at a
+    // time keeps this off the event loop instead of blocking every other
+    // in-flight scheduler/IPC task for the duration.
+    const existsChecks = await Promise.all(
+      untrackedBaselinePaths.map((p) => fsp.access(path.join(cwd, p)).then(() => true, () => false)),
+    );
+    const existsAfter = untrackedBaselinePaths.filter((_, i) => existsChecks[i]);
+    const { reverted, nowIgnored } = module.exports.evaluateSharedTreeGuard({
       stashBefore: stashBaseline,
       stashAfter,
       dirtyBefore: dirtyBaseline,
       dirtyAfter,
       pathsCommittedDuringRun,
+      existsAfter,
     });
     if (reverted.length) {
       result.reverted = reverted;
       console.error(`[scheduler] ${slug}: shared-tree guard: ${reverted.length} path(s) reverted in the shared tree with no commit to explain it (${reverted.slice(0, 3).join(', ')})`);
     }
-    return (result.restoredStash || result.restoreFailed || result.ambiguousStashes || result.reverted) ? result : null;
+    if (nowIgnored.length) {
+      result.nowIgnored = nowIgnored;
+      console.log(`[scheduler] ${slug}: shared-tree guard: ${nowIgnored.length} path(s) no longer shown by git status but still present on disk — likely a new ignore rule, not a revert (${nowIgnored.slice(0, 3).join(', ')})`);
+    }
+    return (result.restoredStash || result.restoreFailed || result.ambiguousStashes || result.reverted || result.nowIgnored) ? result : null;
   } catch (e) {
     console.error(`[scheduler] ${slug}: shared-tree guard error`, e);
     return null;
@@ -1152,8 +1315,9 @@ function ensureDirs() {
  * reconcile()-level call is what makes "anything written to the retired flat
  * prds/ dir is swept into prds-archived/ without being executed" actually
  * true regardless of which of reconcile's several callers (tickQueue's poll,
- * job completion, the schedule:state/schedule:rescan IPC handlers,
- * rescheduleTimer) triggers the pass: a PRD dropped in the flat dir has no
+ * job completion, the schedule:rescan/schedule:adopt-prd IPC handlers,
+ * broadcast()'s coalescer, rescheduleTimer) triggers the pass — schedule:state
+ * no longer reconciles on read. A PRD dropped in the flat dir has no
  * queue row yet at that point, so it is never in LIVE_JOB_STATUSES and this
  * sweep archives it before reconcile can ever turn it into a pending job.
  */
@@ -1217,7 +1381,22 @@ async function runPrdMigration() {
   // on every pass, but stays here so a fresh boot's very first log line
   // still reports the initial sweep — see consolidateAllFlatPrds's own
   // comment for why reconcile() is the load-bearing call site.)
-  await consolidateAllFlatPrds(allProjectCwds());
+  //
+  // Deferred off scheduler.init()'s synchronous critical path: allProjectCwds()
+  // is a synchronous ~270ms directory scan, and awaiting it inline here
+  // competed with the renderer's first IPC round trips (schedule.state,
+  // billing.fetch, teams.list) for the event loop during boot. Dropping the
+  // await doesn't weaken the consolidation guarantee — consolidateAllFlatPrds
+  // also runs at the top of every reconcile() (see its own comment above),
+  // and a flat PRD can only ever execute via tickQueue, which always
+  // reconciles first, so nothing dropped in the flat dir can run before a
+  // reconcile() pass sweeps it regardless of whether this boot-time pass has
+  // finished yet.
+  setImmediate(() => {
+    consolidateAllFlatPrds(allProjectCwds()).catch((e) => {
+      logs.writeLine({ level: 'warn', scope: 'scheduler', message: 'deferred flat-PRD consolidation failed', meta: { error: e?.message } });
+    });
+  });
 
   // Rollout migration for the PRD-authoring-lockdown feature: stamp every
   // pre-existing PRD as legacy-adopted BEFORE reconcile() ever runs its
@@ -1655,6 +1834,99 @@ function findOverrunningJobs(jobs, now, { factor, floorMs } = {}) {
   return out;
 }
 
+/**
+ * computeJobBudgetMs(estimateMinutes, { factor, floorMs, ceilingMs }) → number
+ *
+ * Pure. `budgetMs = clamp(estimateMinutes * factor, floorMs, ceilingMs)` — see
+ * JOB_BUDGET_FACTOR's header comment (schedulerConfig.cjs) for the measured
+ * p50/p90/max this is calibrated against. A missing/zero/non-finite estimate
+ * is treated as 0, which the floor clamp then dominates — "jobs with a
+ * missing estimate get the floor" falls straight out of the clamp, no
+ * special-casing needed.
+ */
+function computeJobBudgetMs(estimateMinutes, { factor, floorMs, ceilingMs } = {}) {
+  const f = typeof factor === 'number' && factor > 0 ? factor : JOB_BUDGET_FACTOR;
+  const floor = typeof floorMs === 'number' && floorMs >= 0 ? floorMs : JOB_BUDGET_FLOOR_MS;
+  const ceiling = typeof ceilingMs === 'number' && ceilingMs > 0 ? ceilingMs : JOB_BUDGET_CEILING_MS;
+  const est = Number(estimateMinutes);
+  const minutes = Number.isFinite(est) && est > 0 ? est : 0;
+  return Math.min(Math.max(minutes * f * 60_000, floor), ceiling);
+}
+
+/**
+ * classifyBudgetKill(res, landedCommitEvidence) → { status, reason, landedCommit } | null
+ *
+ * Pure. `res` is executeJob's resolved outcome — only fires when
+ * `res.killedByWatchdog === 'budget'` (stamped by the budget watchdog inside
+ * executeJob, never inferred from exit code/duration alone, so it can never
+ * collide with an ordinary idle-tail/deadman/external kill). ALWAYS routes to
+ * needs_review — never 'failed' (spawnJob's ordinary non-zero-exit default)
+ * and never silently 'completed' (executeJob's onExit excludes
+ * killedByWatchdog === 'budget' from the result=success → exit 0 mapping
+ * idle-tail/deadman get) — so a budget kill is a visible, actionable park,
+ * never a retry (classifyFailureOutcome/selectAutoFixTargets only ever see
+ * 'failed'/ordinary needs_review rows, not this one — see
+ * selectAutoFixTargets' own budget_exceeded exclusion) and never a discard:
+ * `landedCommitEvidence`, when the caller resolved one via the SAME
+ * commit-guard evidence check the plain sigterm/exit paths already use, is
+ * threaded onto the row as `landedCommit` so a job that HAD already
+ * committed before overrunning is still adjudicated on its git evidence.
+ */
+function classifyBudgetKill(res, landedCommitEvidence) {
+  if (!res || res.killedByWatchdog !== 'budget') return null;
+  return {
+    status: 'needs_review',
+    reason: res.budgetKillReason || `wall-clock budget exceeded (exit ${res.exitCode})`,
+    landedCommit: landedCommitEvidence || null,
+  };
+}
+
+/**
+ * isJobBudgetExempt(job) → boolean
+ *
+ * Pure. `quietMachine: true` PRDs (their whole point is running alone,
+ * un-contended, for a timing-sensitive measurement) and any PRD with an
+ * explicit `budgetExempt: true` opt-out have no wall-clock kill ceiling.
+ */
+function isJobBudgetExempt(job) {
+  return job?.quietMachine === true || job?.budgetExempt === true;
+}
+
+/** Pure predicate the budget watchdog's shouldFire calls — single source of
+ * truth for "has this job run past its own budget" so it's unit-testable
+ * without spinning up real timers. */
+function shouldKillForBudget(elapsedMs, budgetMs) {
+  return elapsedMs >= budgetMs;
+}
+
+/**
+ * resolveBudgetKillOutcome({ killedByWatchdog, killedBySignal, durationMs, jobBudgetMs, estimateMinutes })
+ *   → { killedByWatchdog: 'budget'|null, budgetKillReason: string|null }
+ *
+ * Pure. `ctx.killedByWatchdog` is stamped by the budget watchdog's action()
+ * the instant its periodic shouldFire() observes elapsedMs >= jobBudgetMs —
+ * but that setInterval tick and the child's real 'exit' event both run on
+ * the SAME single-threaded event loop, so it's possible to observe the
+ * budget threshold crossed and call ctx.killTree() in the same window the
+ * agent happens to exit cleanly (exit 0) or fails on its own for an
+ * unrelated reason — ctx.killTree() against an already-exited pid is a
+ * silent no-op (ESRCH, caught), but the flag would still read 'budget'
+ * unless gated here. Only trusted when the exit SHAPE actually looks like a
+ * signal kill (killedBySignal — mirrors the exact same check onExit already
+ * uses for its own mappedToSuccess exclusion), so a clean exit=0 or an
+ * ordinary unrelated non-zero failure racing the watchdog's tick is never
+ * misclassified as a budget kill downstream.
+ */
+function resolveBudgetKillOutcome({ killedByWatchdog, killedBySignal, durationMs, jobBudgetMs, estimateMinutes }) {
+  if (killedByWatchdog !== 'budget' || !killedBySignal) {
+    return { killedByWatchdog: killedByWatchdog === 'budget' ? null : (killedByWatchdog ?? null), budgetKillReason: null };
+  }
+  return {
+    killedByWatchdog: 'budget',
+    budgetKillReason: `wall-clock budget exceeded: ran ${Math.round(durationMs / 60_000)}m against a ${Math.round(jobBudgetMs / 60_000)}m budget (estimateMinutes=${estimateMinutes ?? 0})`,
+  };
+}
+
 /**
  * findStrandedInvestigations(jobs, now, maxMs, isAlive = claudePidAlive)
  *   → [{ slug, cwd, ageMs, restoreStatus }]
@@ -1874,7 +2146,7 @@ async function listPrdFiles() {
   ensureDirs();
   const dirs = candidatePrdsDirs();
   const perDir = await Promise.all(dirs.map((dir) => prdParser.listPrdFiles(dir)));
-  return perDir.flat().sort();
+  return { files: perDir.flat().sort(), dirCount: dirs.length };
 }
 
 /**
@@ -2018,16 +2290,31 @@ async function reconcile(state) {
   if (state && state.unreadable) {
     throw new Error(`reconcile skipped: queue.json unreadable (${state.unreadable})`);
   }
+  // Per-phase timing (PRD: reconcile evidence trail) — plain Date.now() diffs,
+  // matching the ad-hoc elapsedMs idiom already used in health.cjs/
+  // definitionOfDone.cjs. Only logged when the total exceeds
+  // RECONCILE_SLOW_PASS_MS (see the warn emission at the bottom of this
+  // function); a normal-speed pass logs nothing.
+  const reconcileStartMs = Date.now();
+  const phaseMs = {};
+
   // Sweep the retired flat prds/ dir BEFORE scanning it below. reconcile()
-  // has several callers besides tickQueue's ~60s poll (broadcast,
-  // rescheduleTimer, the schedule:state IPC handler, schedule:rescan) — this
+  // has several callers besides tickQueue's ~60s poll (broadcast()'s
+  // coalescer, rescheduleTimer, schedule:rescan, schedule:adopt-prd) — this
   // lives here, not in any one caller, so the "a hand-written PRD in the flat
   // dir is swept before it can become a job" guarantee holds regardless of
   // which caller triggers this reconcile pass. A freshly hand-written file
   // has no queue row yet, so it is never "live" and gets archived here
   // instead of ever reaching the onDisk scan below.
+  let phaseStartMs = Date.now();
   await consolidateAllFlatPrds(allProjectCwds());
-  const files = await listPrdFiles();
+  phaseMs.flatPrdSweep = Date.now() - phaseStartMs;
+
+  phaseStartMs = Date.now();
+  const { files, dirCount } = await listPrdFiles();
+  phaseMs.prdDirResolve = Date.now() - phaseStartMs;
+
+  phaseStartMs = Date.now();
   const onDisk = new Map();
   for (const f of files) {
     try {
@@ -2039,6 +2326,7 @@ async function reconcile(state) {
       console.warn('[scheduler] failed to parse', f, e?.message);
     }
   }
+  phaseMs.parseLoop = Date.now() - phaseStartMs;
 
   const next = [];
   const seen = new Set();
@@ -2104,7 +2392,9 @@ async function reconcile(state) {
       // membership, so moving the file between Epic dirs must re-point the row.
       epicId: p.epicId ?? job.epicId ?? null,
       dependsOn: p.dependsOn,
+      disposition: p.disposition ?? null,
       quietMachine: p.quietMachine === true,
+      budgetExempt: p.budgetExempt === true,
       originSessionId: job.originSessionId
         ?? resolveOriginSessionId(p.cwd, p.epicId ?? reconcileSourcePromptId(job, p.sourcePromptId)),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
@@ -2159,9 +2449,11 @@ async function reconcile(state) {
   // ScheduleJobSchema (e.g. the 1021/1022 incident's `"status": "queued"`) —
   // see the repair pass below, right after historyBySlug is available.
   const invalidJobs = Array.isArray(state.invalidJobs) ? state.invalidJobs : [];
+  phaseStartMs = Date.now();
   const historyBySlug = (unmatchedSlugs.length > 0 || terminalDroppedNeedingHistoryCheck.length > 0 || invalidJobs.length > 0)
     ? await queueHistory.historyTerminalBySlug()
     : new Map();
+  phaseMs.historyLookup = Date.now() - phaseStartMs;
 
   // Backfill: any terminal job dropped above whose slug isn't already in
   // history.jsonl gets written now, before its row is gone for good. This is
@@ -2217,7 +2509,9 @@ async function reconcile(state) {
       sourceTabId: p.sourceTabId ?? inv.row?.sourceTabId ?? null,
       epicId: p.epicId ?? inv.row?.epicId ?? null,
       dependsOn: p.dependsOn,
+      disposition: p.disposition ?? null,
       quietMachine: p.quietMachine === true,
+      budgetExempt: p.budgetExempt === true,
       originSessionId: inv.row?.originSessionId ?? resolveOriginSessionId(p.cwd, p.epicId ?? p.sourcePromptId),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
       agentType: p.agentType ?? inv.row?.agentType ?? null,
@@ -2339,7 +2633,9 @@ async function reconcile(state) {
       sourceTabId: p.sourceTabId,
       epicId: p.epicId ?? null,
       dependsOn: p.dependsOn,
+      disposition: p.disposition ?? null,
       quietMachine: p.quietMachine === true,
+      budgetExempt: p.budgetExempt === true,
       originSessionId: resolveOriginSessionId(p.cwd, p.epicId ?? p.sourcePromptId),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
       agentType: p.agentType ?? null,
@@ -2436,7 +2732,8 @@ async function reconcile(state) {
   // small. Append BEFORE dropping so a crash between the two can't lose a
   // record — appendHistory dedupes by slug+runId, so a replay of the same
   // batch on next boot is a safe no-op.
-  const nowMs = Date.now();
+  phaseStartMs = Date.now();
+  const nowMs = phaseStartMs;
   const { hot, toArchive } = queueHistory.partitionJobs(sorted, nowMs);
   if (toArchive.length > 0) {
     await queueHistory.appendHistory(toArchive);
@@ -2472,6 +2769,17 @@ async function reconcile(state) {
   } catch (e) {
     console.warn('[scheduler] autoArchiveCompleted failed', e?.message);
   }
+  phaseMs.queueWrite = Date.now() - phaseStartMs;
+
+  const totalMs = Date.now() - reconcileStartMs;
+  if (totalMs > RECONCILE_SLOW_PASS_MS) {
+    logs.writeLine({
+      level: 'warn',
+      scope: 'scheduler',
+      message: `reconcile() pass took ${totalMs}ms (threshold ${RECONCILE_SLOW_PASS_MS}ms)`,
+      meta: { totalMs, phaseMs, prdFileCount: files.length, resolvedDirCount: dirCount },
+    });
+  }
 
   return state;
 }
@@ -2678,16 +2986,19 @@ function attachWindow(w) { mainWindow = w; }
 
 /**
  * Build the snapshot payload consumed by both the `schedule:state` IPC
- * handler and the `schedule:state` broadcast event. The IPC return adds a
- * `paths` map (renderer uses it for "open folder" actions); broadcast omits
- * it because subscribers don't need to re-derive paths on every tick.
+ * handler and the `schedule:state` broadcast event.
  */
-function buildScheduleStatePayload(state, { withPaths = false } = {}) {
+function buildScheduleStatePayload(state) {
   const payload = {
     config: state.config,
     jobs: state.jobs,
     scheduledFor: state.scheduledFor,
     lastRunAt: state.lastRunAt,
+    // Distinct from lastRunAt (only stamped when a batch actually launches):
+    // stamped every time tickQueue reaches the picker at all. See
+    // classifyQueueHealth/classifyQueueStarvation's header comments for why
+    // the two must never merge.
+    lastDispatchAttemptAt: state.lastDispatchAttemptAt ?? null,
     nextReset: getNextResetCached(),
     paused: state.paused,
     // Launch circuit breaker (issue #11): which personas cannot launch right
@@ -2718,9 +3029,6 @@ function buildScheduleStatePayload(state, { withPaths = false } = {}) {
       };
     })(),
   };
-  if (withPaths) {
-    payload.paths = { root: ROOT, prds: PRDS_DIR, runs: RUNS_DIR, queue: queueStore.MACHINE_STATE_PATH };
-  }
   return payload;
 }
 
@@ -2731,20 +3039,33 @@ function buildScheduleStatePayload(state, { withPaths = false } = {}) {
 // per mutation. Callers where latency matters (pause/resume, job
 // start/finish/reap/reset) pass `{ flush: true }` to bypass the window and
 // send immediately.
+// getPayload is the coalescer's ONLY entry point back into queue state, so
+// routing the reconcile+write pair through it (rather than broadcast() doing
+// its own bare readQueue/reconcile/writeQueue) is what makes a burst of
+// broadcast() calls cost exactly one reconcile + one write per coalesce
+// window. It goes through mutate() (not a bare read/write pair) so it
+// serializes against every other concurrent mutation and inherits mutate's
+// pre-fn `state.unreadable` bail — never write a state derived from a failed
+// read. `module.exports.reconcile` (not the bare local binding) is the seam
+// tests spy on, matching this file's existing testable-seam convention (see
+// module.exports.stashList/evaluateSharedTreeGuard/committedInWindow above).
 const broadcastCoalescer = createBroadcastCoalescer({
   delayMs: BROADCAST_COALESCE_MS,
   send: (payload) => {
     if (!mainWindow || mainWindow.isDestroyed()) return;
     sendIfAlive(mainWindow, 'schedule:state', payload);
   },
-  getPayload: async () => buildScheduleStatePayload(await readQueue()),
+  getPayload: () => mutate(async (state) => {
+    await module.exports.reconcile(state);
+    return buildScheduleStatePayload(state);
+  }),
 });
 
+// Reconcile is unconditional — even with no window attached (a
+// scheduler-passive or headless instance), discovery must still run so
+// on-disk PRDs get onboarded. Only the actual IPC push is window-gated,
+// inside the coalescer's own `send`.
 async function broadcast(opts = {}) {
-  if (!mainWindow || mainWindow.isDestroyed()) return;
-  const state = await readQueue();
-  await reconcile(state);
-  await writeQueue(state);
   if (opts.flush) {
     await broadcastCoalescer.flush();
   } else {
@@ -3044,7 +3365,7 @@ const BOOT_ORPHAN_KILL_GRACE_MS = 6000;
  * process may still be writing to it, so reading now risks misclassifying a
  * job that is about to emit result:success as no_result and double-running it.
  * Ported from reconcileQueueOffline's cross-tick escalation (see
- * scripts/lib/watchdogHelpers.cjs) — here it's a single deferred window since
+ * src/main/lib/watchdogHelpers.cjs) — here it's a single deferred window since
  * this process stays up to revisit it, rather than a separate short-lived
  * watchdog process needing another tick.
  */
@@ -3064,17 +3385,26 @@ function partitionBootOrphans(jobs, isAlive = claudePidAlive) {
 }
 
 /**
- * applyOrphanOutcome(job, outcome, killNote?) → void
+ * applyOrphanOutcome(job, outcome, killNote?, confirmedLandedCommit?) → void
  *
  * Mutates `job` in place to finalize a boot-orphaned 'running' job given its
  * classified run outcome: success/failed finalize terminally; no_result/unknown
  * re-queues to pending bounded by ORPHAN_REQUEUE_CAP. The status-mutation
  * semantics (and the cap-exhaustion boundary) match the now-deleted
- * reconcileQueueOffline (scripts/lib/watchdogHelpers.cjs) verbatim; killNote
+ * reconcileQueueOffline (src/main/lib/watchdogHelpers.cjs) verbatim; killNote
  * plumbing differs slightly (see call sites) since this path always knows
  * pid liveness up front rather than re-checking per tick.
+ *
+ * `confirmedLandedCommit` is the same evidence-before-failure gate
+ * reapDeadRunningJobs applies (see resolveLandedCommitEvidence): a job that
+ * dies while the app itself is offline is classified 'failed' from its log
+ * tail alone, exactly like the pre-fix reap path was — so without this, an
+ * orphaned job that actually landed a real commit is reachable via boot
+ * reconciliation even though the live reap path is now guarded. Callers
+ * must resolve this (a git spawn) BEFORE calling mutate(), never inside it —
+ * pass null to skip the gate (e.g. when the outcome isn't 'failed').
  */
-function applyOrphanOutcome(job, outcome, killNote = '') {
+function applyOrphanOutcome(job, outcome, killNote = '', confirmedLandedCommit = null) {
   const now = new Date().toISOString();
   if (outcome === 'success') {
     transitionJob(job, 'completed', { reason: 'boot orphan reconciliation: run succeeded', source: 'applyOrphanOutcome' });
@@ -3083,9 +3413,16 @@ function applyOrphanOutcome(job, outcome, killNote = '') {
     job.finishedAt = now;
     delete job.runtime;
   } else if (outcome === 'failed') {
-    transitionJob(job, 'failed', { reason: `orphaned: app restarted while running${killNote}`, source: 'applyOrphanOutcome' });
-    job.exitCode = job.exitCode ?? 1;
-    job.error = `orphaned: app restarted while running${killNote}`;
+    if (confirmedLandedCommit) {
+      transitionJob(job, 'completed', { reason: `orphaned: app restarted while running${killNote}, but landedCommit ${confirmedLandedCommit} resolves — completed on evidence`, source: 'applyOrphanOutcome:landed' });
+      job.exitCode = 0;
+      job.error = null;
+      job.landedCommit = confirmedLandedCommit;
+    } else {
+      transitionJob(job, 'failed', { reason: `orphaned: app restarted while running${killNote}`, source: 'applyOrphanOutcome' });
+      job.exitCode = job.exitCode ?? 1;
+      job.error = `orphaned: app restarted while running${killNote}`;
+    }
     job.finishedAt = now;
     delete job.runtime;
   } else {
@@ -3093,6 +3430,13 @@ function applyOrphanOutcome(job, outcome, killNote = '') {
     if (tries < ORPHAN_REQUEUE_CAP) {
       resetJobFields(job, `orphaned: app restarted mid-run, re-queued (attempt ${tries + 1}/${ORPHAN_REQUEUE_CAP})${killNote}`, { source: 'applyOrphanOutcome' });
       job.orphanRetries = tries + 1;
+    } else if (confirmedLandedCommit) {
+      transitionJob(job, 'completed', { reason: `orphaned: app restarted while running, exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts${killNote}, but landedCommit ${confirmedLandedCommit} resolves — completed on evidence`, source: 'applyOrphanOutcome:landed' });
+      job.exitCode = 0;
+      job.error = null;
+      job.landedCommit = confirmedLandedCommit;
+      job.finishedAt = now;
+      delete job.runtime;
     } else {
       transitionJob(job, 'failed', { reason: `orphaned: app restarted while running, exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts${killNote}`, source: 'applyOrphanOutcome' });
       job.exitCode = job.exitCode ?? 1;
@@ -3980,6 +4324,60 @@ async function pathExistsInTree(cwd, treeish, p) {
   }
 }
 
+/**
+ * resolveLandedCommitEvidence(cwd, sha, sinceIso) → Promise<boolean>
+ *
+ * Bounded, non-fatal proof that `sha` is a real, resolvable commit in the
+ * repo at `cwd`, committed no earlier than `sinceIso` — `git cat-file -e
+ * <sha>^{commit}` plus a `git log -1 --format=%cI` timestamp check, both via
+ * execGitAt's existing spawn+timeout bound (never shell:true, never an
+ * unbounded execSync). This is the evidence gate reapDeadRunningJobs (PRD:
+ * reaper must consult completion evidence) adds ahead of stamping a reaped
+ * row 'failed': a landedCommit field being non-empty is not proof by itself
+ * (job 1192 had one and still got reaped 'failed') — only a git-verified
+ * resolution is.
+ *
+ * The timestamp bound matters because `landedCommit` deliberately survives
+ * resetJobFields (see the comment there) so a re-fired run can consult it as
+ * priorLandedCommit — which means a STALE landedCommit from an earlier
+ * dispatch of the same slug can still be sitting on the row when a LATER
+ * dispatch dies for real. Without `sinceIso`, that stale-but-real sha would
+ * satisfy `cat-file -e` and wrongly promote a genuine failure to
+ * 'completed'. Passing the current dispatch's `row.startedAt` as `sinceIso`
+ * closes that: only a commit landed during THIS run counts as evidence.
+ *
+ * `cwd` is normalized through opsOwnership's resolveProjectRoot first (the
+ * same "never trust a raw agent cwd" reasoning delegationReadiness.cjs
+ * already relies on) so a row reaped while its cwd is an ephemeral worktree
+ * checkout resolves the commit against the real project root instead.
+ *
+ * Never throws: a missing sha, a resolveProjectRoot failure (ephemeral cwd,
+ * thrown error), a spawn failure, a timeout, or a cwd that no longer exists
+ * on disk all resolve to `false` — the caller's safe default is 'failed',
+ * exactly like today, whenever this can't positively prove landing.
+ */
+async function resolveLandedCommitEvidence(cwd, sha, sinceIso) {
+  if (!sha || typeof sha !== 'string') return false;
+  try {
+    const root = resolveProjectRoot(cwd);
+    await execGitAt(root, ['cat-file', '-e', `${sha}^{commit}`], { timeout: 10_000 });
+    if (sinceIso) {
+      const since = new Date(sinceIso).getTime();
+      if (Number.isFinite(since)) {
+        const committedIso = (await execGitAt(root, ['log', '-1', '--format=%cI', sha], { timeout: 10_000 })).trim();
+        const committedAt = new Date(committedIso).getTime();
+        // A commit dated before this dispatch even started can only be a
+        // stale sha surviving from an earlier life of the row — never
+        // evidence that THIS dispatch landed anything.
+        if (Number.isFinite(committedAt) && committedAt < since) return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Commit exactly `paths` (must already be dirty on disk) onto a dedicated
  * `sm-salvage/<slug>` ref, built from `headBefore` (or current HEAD when
@@ -4522,6 +4920,56 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
       },
     };
 
+    // Wall-clock budget watchdog: unlike idleTailWatchdog above (which only
+    // fires when the log mtime STALLS), this fires on total elapsed wall-
+    // clock time regardless of whether the job keeps writing output — the
+    // gap a chatty-but-runaway executor slips through (see
+    // computeJobBudgetMs's header for the measured p50/p90/max this budget
+    // is calibrated against). `quietMachine` jobs and any PRD with an
+    // explicit `budgetExempt: true` opt out entirely — logged once here so
+    // an unbounded job is never silently unbounded.
+    const jobBudgetMs = computeJobBudgetMs(job.estimateMinutes);
+    const budgetExempt = isJobBudgetExempt(job);
+    if (budgetExempt) {
+      safeLog(`[scheduler] wall-clock budget watchdog EXEMPT for ${job.slug} ` +
+        `(${job.quietMachine === true ? 'quietMachine' : 'budgetExempt'}) — no wall-clock kill ceiling this run\n`);
+    }
+    let budgetWarningStamped = false;
+    const budgetWatchdog = {
+      label: 'budget',
+      intervalMs: IDLE_CHECK_INTERVAL_MS,
+      shouldFire(ctx) {
+        if (budgetExempt) return false;
+        const elapsedMs = Date.now() - ctx.startedAt;
+        if (!budgetWarningStamped && elapsedMs >= jobBudgetMs * BUDGET_WARNING_FRACTION) {
+          budgetWarningStamped = true;
+          // Fire-and-forget (side effect inside a sync predicate, same pattern
+          // resultTailWatchdog's shouldFire already uses for agentResultSubtype)
+          // — exposes the warning on the row well before the kill fires, so
+          // the renderer can show it without waiting for the next tick.
+          mutate((state) => {
+            const j = state.jobs.find((x) => x.slug === job.slug);
+            if (!j) return;
+            j.budgetWarning = { budgetMs: jobBudgetMs, elapsedMs, at: new Date().toISOString() };
+          }).catch((e) => console.warn('[scheduler] budget-warning stamp failed', job.slug, e?.message));
+        }
+        return shouldKillForBudget(elapsedMs, jobBudgetMs);
+      },
+      action(ctx) {
+        const elapsedMs = Date.now() - ctx.startedAt;
+        ctx.safeLog(`\n[scheduler] wall-clock budget watchdog: ran ${Math.round(elapsedMs / 60_000)}m ` +
+          `(> ${Math.round(jobBudgetMs / 60_000)}m budget, estimateMinutes=${job.estimateMinutes ?? 0}) — SIGTERM process group\n`);
+        ctx.killedByWatchdog = 'budget';
+        ctx.killTree('SIGTERM');
+        const budgetKillTimer = setTimeout(() => {
+          ctx.safeLog(`\n[scheduler] budget watchdog: still alive ${Math.round(POST_RESULT_KILL_MS/1000)}s after SIGTERM — SIGKILL\n`);
+          ctx.killTree('SIGKILL');
+        }, POST_RESULT_KILL_MS);
+        if (budgetKillTimer.unref) budgetKillTimer.unref();
+        ctx.addTimer(budgetKillTimer);
+      },
+    };
+
     // ---------- spawn ----------
 
     const { child } = withChildAndLog({
@@ -4552,8 +5000,8 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
           detached: true,
         },
       },
-      watchdogs: [resultTailWatchdog, deadmanWatchdog, idleTailWatchdog],
-      onExit({ exitCode, signal, killedByWatchdog: _kbw, error, spawnFailed, leakedDescendants, safeLog: sl }) {
+      watchdogs: [resultTailWatchdog, deadmanWatchdog, idleTailWatchdog, budgetWatchdog],
+      onExit({ exitCode, signal, killedByWatchdog, error, spawnFailed, leakedDescendants, safeLog: sl }) {
         const durationMs = Date.now() - startedAt;
         const leaked = leakedDescendants ?? [];
         if (leaked.length > 0) {
@@ -4583,7 +5031,11 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
         // and 137 (128+SIGKILL) in case the process exited via signal-as-code.
         let effectiveCode = exitCode;
         const killedBySignal = signal === 'SIGTERM' || signal === 'SIGKILL' || exitCode === 143 || exitCode === 137 || exitCode === null;
-        const mappedToSuccess = agentResultSubtype === 'success' && killedBySignal;
+        // A budget kill must NEVER be laundered into a clean exit=0, even when
+        // the agent had already emitted result=success before it fired — the
+        // AC requires it always park needs_review, never silently 'completed'.
+        // idle-tail/deadman/result-tail kills keep the existing success-mapping.
+        const mappedToSuccess = agentResultSubtype === 'success' && killedBySignal && killedByWatchdog !== 'budget';
         if (mappedToSuccess) {
           effectiveCode = 0;
           sl(`\n[scheduler] mapping exit code=${exitCode} signal=${signal} → 0 ` +
@@ -4606,6 +5058,16 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
           sl(`\n[scheduler] LAUNCH FAILURE (${launchFailed.kind}${launchFailed.httpStatus ? ` HTTP ${launchFailed.httpStatus}` : ''}): ` +
             `${launchFailed.message} — no turn was taken; this is not a PRD failure\n`);
         }
+        // Formatted once, here, off the FINAL durationMs (more accurate than
+        // the watchdog action's own snapshot at kill time) — matches the
+        // reason string format the AC requires verbatim. See
+        // resolveBudgetKillOutcome's own header for why this is gated on
+        // killedBySignal, not on killedByWatchdog alone.
+        const budgetKillOutcome = resolveBudgetKillOutcome({
+          killedByWatchdog, killedBySignal, durationMs, jobBudgetMs, estimateMinutes: job.estimateMinutes,
+        });
+        const { budgetKillReason } = budgetKillOutcome;
+        const effectiveKilledByWatchdog = budgetKillOutcome.killedByWatchdog;
         // Sync write: child 'exit' handler must flush meta before resolve()
         // so the spawnJob mutate() that follows sees the persisted exit code.
         config.writeJsonSync(metaPath, {
@@ -4616,10 +5078,14 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
           launchEnvApplied: launchEnv && Object.keys(launchEnv).length ? Object.keys(launchEnv) : [],
           startedAt, finishedAt: Date.now(), durationMs, leakedDescendants: leaked,
           agentResultSubtype, mappedFromSignal: mappedToSuccess ? signal || `code=${exitCode}` : null,
+          killedByWatchdog: effectiveKilledByWatchdog, budgetKillReason,
           schedulerBootedAt: SCHEDULER_BOOTED_AT, schedulerCodeSha: SCHEDULER_CODE_SHA,
           originSessionId, contextDigestApplied,
         });
-        resolve({ exitCode: effectiveCode, durationMs, rateLimited, networkError, launchFailure: launchFailed, resultStats, leakedDescendants: leaked, sessionId });
+        resolve({
+          exitCode: effectiveCode, durationMs, rateLimited, networkError, launchFailure: launchFailed, resultStats,
+          leakedDescendants: leaked, sessionId, killedByWatchdog: effectiveKilledByWatchdog, budgetKillReason,
+        });
       },
     });
 
@@ -4627,8 +5093,27 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
       safeLog(`[scheduler] spawned pid=${child.pid} sessionId=${sessionId} (process group)\n\n`);
       // Make this job the OOM killer's preferred victim over Electron.
       biasJobOomScore(child.pid);
-      // Fire-and-forget pid persistence — best effort.
-      if (onPid) onPid(child.pid, sessionId, cwd).catch(() => {});
+      // Persist runtime.pid with one retry — still fire-and-forget (must
+      // never block the spawn), but a final failure is now loud instead of
+      // silently swallowed. A silent failure here is exactly what let the
+      // pidless-grace reaper terminalize a live, working job (runtime.pid
+      // never landed, so selectReapableJobs had no way to tell "never
+      // spawned" from "spawned but unrecorded").
+      if (onPid) {
+        (async () => {
+          try {
+            await onPid(child.pid, sessionId, cwd);
+          } catch (firstErr) {
+            try {
+              await onPid(child.pid, sessionId, cwd);
+            } catch (finalErr) {
+              const message = finalErr?.message ?? String(finalErr);
+              console.error(`[scheduler] FAILED to persist runtime.pid for ${job.slug} pid=${child.pid}: ${message}`);
+              appendAuditEvent('job_pid_persist_failed', { slug: job.slug, cwd, pid: child.pid, error: message });
+            }
+          }
+        })();
+      }
     }
   });
 }
@@ -5550,8 +6035,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
 
     // Commit-guard baseline: snapshot the working tree BEFORE the run so the
     // post-run check flags only paths THIS job left dirty, not pre-existing WIP.
+    // Captured once, with status codes, so the shared-tree guard below can
+    // tell "was untracked" apart from "was tracked-and-modified" (2026-09-12
+    // incident) without a second `git status` call; every other consumer of
+    // `guardBaseline` still gets the plain path-string array it always did.
     const guardCwd = job.cwd || defaultCwd;
-    const guardBaseline = await uncommittedChanges(guardCwd);
+    const guardBaselineEntries = await uncommittedChangesWithStatus(guardCwd);
+    const guardBaseline = guardBaselineEntries ? guardBaselineEntries.map((e) => e.path) : guardBaselineEntries;
     const guardHeadBefore = await gitHead(guardCwd);
     // Shared-tree stash guard baseline (incident 2026-09-01): captured
     // unconditionally, before worktree isolation is even attempted, so an
@@ -5603,6 +6093,22 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       console.log(`[scheduler] ${job.slug}: isolated in worktree ${worktree.dir} (branch ${worktree.branch})`);
     } else {
       console.log(`[scheduler] ${job.slug}: running in main tree (worktree not used: ${worktree.reason})`);
+      // A job losing worktree isolation must never be a silent downgrade
+      // discoverable only by reading queue.json afterwards — every genuine
+      // fallback (never the deliberate SM_JOB_WORKTREE_DISABLE opt-out) is
+      // logged at warn in the durable ops error log, with the job slug, cwd,
+      // and specific reason attached.
+      if (!jobWorktree.isWorktreeDisabled()) {
+        try {
+          appendError({
+            cwd: job.cwd || defaultCwd,
+            scope: 'scheduler',
+            level: 'warn',
+            message: `${job.slug}: worktree isolation fell back to the SHARED working tree — ${worktree.reason}`,
+            meta: { slug: job.slug, cwd: job.cwd || defaultCwd, reason: worktree.reason },
+          });
+        } catch { /* durable logging must never break dispatch */ }
+      }
     }
     // dispatchPhase stamp folded into a single unconditional mutate covering
     // both branches above — the degraded-isolation fallback flag (skipped
@@ -5997,7 +6503,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       sharedTreeGuard = await module.exports.checkSharedTreeGuard({
         cwd: guardCwd,
         stashBaseline,
-        dirtyBaseline: guardBaseline,
+        dirtyBaseline: guardBaselineEntries,
         headBefore: guardHeadBefore,
         slug: job.slug,
       });
@@ -6024,6 +6530,10 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     // narrowly to exit 143 — never applied to other non-zero exit codes or to
     // rateLimited (already handled separately, above).
     let sigtermCommitFound = false;
+    // Verified SHA twin of sigtermCommitFound's boolean — only the budget-kill
+    // path (below) threads this onto the row's landedCommit; classifySigtermWithCommit's
+    // own needs_review branch is unchanged and keeps using the boolean alone.
+    let sigtermLandedCommitEvidence = null;
     if (res.exitCode === 143 && !res.rateLimited) {
       const guardHeadAtSigterm = await gitHead(guardCwd);
       sigtermCommitFound = await computeCommittedDuringRun(
@@ -6033,6 +6543,10 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
         job.startedAt,
         new Date().toISOString(),
       );
+      if (guardHeadBefore && guardHeadAtSigterm && guardHeadAtSigterm !== guardHeadBefore) {
+        const verified = await resolveLandedCommitEvidence(guardCwd, guardHeadAtSigterm, job.startedAt);
+        if (verified) sigtermLandedCommitEvidence = guardHeadAtSigterm;
+      }
     }
 
     // BLOCKED_BY_FOREIGN_WIP claim scan: the executor exits non-zero for this
@@ -6054,6 +6568,27 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
       }
     }
 
+    // Evidence gate for a PLAIN non-zero exit — not SIGTERM-with-commit
+    // (classifySigtermWithCommit above already routes exit 143 to
+    // needs_review when a commit landed) and not rate-limited (handled
+    // separately). A process that dies non-zero for any OTHER reason
+    // (crash during post-commit cleanup, an overrun watchdog's SIGKILL) is
+    // observed directly by THIS exit handler — it never reaches
+    // reapDeadRunningJobs' own git-verified landedCommit evidence gate, so
+    // without this check the exact bug that gate exists to prevent (job
+    // 1192: a landedCommit non-empty is not proof by itself, but discarding
+    // proof of real landed work with no evidence check at all is worse)
+    // recurs here, one call site over. Computed outside mutate() (I/O) like
+    // every other pre-finalize git check above.
+    let plainExitLandedCommitEvidence = null;
+    if (res.exitCode !== 0 && res.exitCode !== 143 && !res.rateLimited) {
+      const headAtPlainExit = await gitHead(guardCwd);
+      if (guardHeadBefore && headAtPlainExit && headAtPlainExit !== guardHeadBefore) {
+        const verified = await resolveLandedCommitEvidence(guardCwd, headAtPlainExit, job.startedAt);
+        if (verified) plainExitLandedCommitEvidence = headAtPlainExit;
+      }
+    }
+
     let actuallyFailed = false;
     let failedJobSnapshot = null;
     let needsInvestigationNow = false;
@@ -6124,7 +6659,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           // Determine effective status, applying the verifier verdict for exit=0 runs.
           let effectiveStatus;
           let sigtermOverrideReason = null;
-          const sigtermOverride = res.exitCode !== 0
+          // Wall-clock budget kill — checked FIRST and unconditionally wins:
+          // never 'failed', never silently 'completed', and (via
+          // sigtermLandedCommitEvidence/plainExitLandedCommitEvidence, whichever
+          // this exit code populated) still adjudicated on git evidence rather
+          // than discarded. See classifyBudgetKill's own header.
+          const budgetKill = classifyBudgetKill(res, sigtermLandedCommitEvidence || plainExitLandedCommitEvidence);
+          const sigtermOverride = (!budgetKill && res.exitCode !== 0)
             ? classifySigtermWithCommit(res.exitCode, sigtermCommitFound)
             : null;
           // Validated against the LIVE row's own foreign-WIP manifest — never
@@ -6132,7 +6673,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           // launder a real regression into a block (PRD: give the executor a
           // first-class verdict for "the gate failed on a sibling's in-flight
           // file", but VALIDATE the claim rather than trust it).
-          const foreignWipValidation = (!sigtermOverride && foreignWipClaimedPaths !== null)
+          const foreignWipValidation = (!budgetKill && !sigtermOverride && foreignWipClaimedPaths !== null)
             ? validateForeignWipBlockClaim(foreignWipClaimedPaths, s.jobs[i2])
             : null;
           // Consecutive-block streak: cleared by default on every outcome and
@@ -6141,7 +6682,12 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           // between two blocks always resets "in a row" back to zero.
           const priorForeignWipBlockCount = s.jobs[i2].foreignWipBlockCount ?? 0;
           delete s.jobs[i2].foreignWipBlockCount;
-          if (sigtermOverride) {
+          if (budgetKill) {
+            effectiveStatus = budgetKill.status;
+            sigtermOverrideReason = budgetKill.reason;
+            s.jobs[i2].verifierVerdict = 'budget_exceeded';
+            if (budgetKill.landedCommit) jobLandedCommitThisRun = budgetKill.landedCommit;
+          } else if (sigtermOverride) {
             effectiveStatus = sigtermOverride.status;
             sigtermOverrideReason = sigtermOverride.reason;
           } else if (foreignWipValidation && foreignWipValidation.ok) {
@@ -6176,7 +6722,17 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             effectiveStatus = 'failed';
             sigtermOverrideReason = `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP rejected — unlisted path(s) not in the disclosed foreign-WIP manifest: ${foreignWipValidation.invalidPaths.join(', ') || '(no FOREIGN_WIP_PATHS line)'}`;
           } else if (res.exitCode !== 0) {
-            effectiveStatus = 'failed';
+            if (plainExitLandedCommitEvidence) {
+              // Same conservative posture as the SIGTERM+commit case above:
+              // a landed commit doesn't prove every AC line passed, so this
+              // still routes to needs_review for a human/reverify pass,
+              // never silently to completed.
+              effectiveStatus = 'needs_review';
+              sigtermOverrideReason = `exited ${res.exitCode} after landing a git-verified commit — verify AC before treating as done`;
+              jobLandedCommitThisRun = plainExitLandedCommitEvidence;
+            } else {
+              effectiveStatus = 'failed';
+            }
           } else if (
             !verifyResult
             || COMPLETED_EQUIVALENT_VERDICTS.has(verifyResult.verdict)
@@ -6205,15 +6761,14 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           const finalizeReason = (effectiveStatus === 'completed' && verifyResult?.verdict === 'already_satisfied_on_main')
             ? verifyResult.reason
             : (sigtermOverrideReason ?? `run finished with exit ${res.exitCode}`);
-          transitionJob(s.jobs[i2], effectiveStatus, { reason: finalizeReason, source: 'spawnJob:finalize' });
-          s.jobs[i2].finishedAt = new Date().toISOString();
-          s.jobs[i2].exitCode = res.exitCode;
-          s.jobs[i2].leakedDescendants = res.leakedDescendants ?? [];
-          if (salvagePatch) {
-            s.jobs[i2].salvagePatch = salvagePatch;
-          } else {
-            delete s.jobs[i2].salvagePatch;
-          }
+          // error/verifierVerdict are stamped BEFORE transitionJob() below —
+          // needsReviewLedger's buildNeedsReviewEntryLine reads job.
+          // verifierVerdict/heldReason/error synchronously off `job` the
+          // instant transitionJob() runs (it's called inside transitionJob,
+          // not deferred), so setting these after that call fed the durable
+          // needs_review ledger stale/leftover values from before this run,
+          // defeating its whole `byReason` rollup for the two escalation
+          // paths that land here.
           s.jobs[i2].error = (effectiveStatus === 'needs_review' || s.jobs[i2].blockedByForeignWip === true)
             ? (verifyResult?.reason ?? sigtermOverrideReason ?? null)
             // A failed job (non-zero exit) never consults verifyResult above,
@@ -6231,18 +6786,28 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             s.jobs[i2].landedCommit = jobLandedCommitThisRun;
           }
           // Persist the verifier's verdict string so the renderer can show it.
-          // 'blocked_by_foreign_wip_streak' is set above from the sigterm/
-          // exit-code path, never from verifyResult (which stays null on a
-          // non-zero exit) — never clobber it here.
+          // 'blocked_by_foreign_wip_streak'/'budget_exceeded' are set above
+          // from the sigterm/exit-code path, never from verifyResult (which
+          // stays null on a non-zero exit) — never clobber either here.
           if (verifyResult?.verdict && verifyResult.verdict !== 'clean') {
             s.jobs[i2].verifierVerdict = verifyResult.verdict;
-          } else if (s.jobs[i2].verifierVerdict !== 'blocked_by_foreign_wip_streak') {
+          } else if (!['blocked_by_foreign_wip_streak', 'budget_exceeded'].includes(s.jobs[i2].verifierVerdict)) {
             delete s.jobs[i2].verifierVerdict;
           }
+          transitionJob(s.jobs[i2], effectiveStatus, { reason: finalizeReason, source: 'spawnJob:finalize' });
+          s.jobs[i2].finishedAt = new Date().toISOString();
+          s.jobs[i2].exitCode = res.exitCode;
+          s.jobs[i2].leakedDescendants = res.leakedDescendants ?? [];
+          if (salvagePatch) {
+            s.jobs[i2].salvagePatch = salvagePatch;
+          } else {
+            delete s.jobs[i2].salvagePatch;
+          }
           // Closed-set outcome taxonomy (issue #11 list A2) so a queue row
           // says WHY it ended without anyone opening the transcript.
           s.jobs[i2].terminalReason = launchFailure.deriveTerminalReason({
             effectiveStatus, exitCode: res.exitCode, verifyResult, sigtermOverride, worktreeIntegrationFailure,
+            budgetKill: !!budgetKill,
           });
           delete s.jobs[i2].launchFailure;
           delete s.jobs[i2].heldReason;
@@ -7023,6 +7588,119 @@ function classifyQueueStarvationByProject({ jobs, paused, runningSet: runningSlu
   return verdicts;
 }
 
+/**
+ * classifyQueueHealth({ jobs, paused, launchBlocks, runningSet, freeSlots,
+ *                        totalSlots, lastDispatchAttemptAtMs, now, cwd, thresholdMs })
+ *   → { kind, cwd, pending, dispatchable, blockedChains, needsReviewCount, runningCount, ... }
+ *
+ * Single source of truth for the Scheduler page's queue-health header: the
+ * one thing a human staring at a stale-looking queue needs is "which of the
+ * genuinely different causes is this" (all slots busy? every pending row
+ * blocked on a dependency? the dispatch driver itself never ticked?) — this
+ * function names that cause instead of leaving the renderer to re-derive it.
+ *
+ * Reuses classifyQueueStarvation for the blocked/stalled read so the header
+ * can never disagree with runQueueStarvationWatchdog's own decision to force
+ * a tick: both are handed the same lastDispatchAttemptAt-based idle clock and
+ * the same computeBlockedChains walk under the hood. Called here with
+ * `thresholdMs: 0` first (a live header must say "blocked" the instant every
+ * pending row is dependency-stuck, not wait out the watchdog's own 10-minute
+ * grace period) — the returned `idleMs` is then compared against the REAL
+ * `thresholdMs` to decide 'stalled' vs the healthy 'running' default, which
+ * is exactly the comparison classifyQueueStarvation would make internally.
+ *
+ * `pending`/`dispatchable`/`blockedChains`/`needsReviewCount` are always
+ * populated (via computeBlockedChains — the exact primitive
+ * classifyQueueStarvation itself calls) regardless of kind, so a 'saturated'
+ * or 'running' header can still say how much of the backlog is dependency-
+ * blocked, not just the kinds where that's the headline cause.
+ *
+ * Kinds, in the priority order they're checked (paused is a decision, not a
+ * stall; an open launch breaker explains an otherwise-inexplicable
+ * non-dispatch before slot/dependency causes are even considered):
+ *   'paused'         — the scheduler itself is paused.
+ *   'launch-blocked' — a pending row's persona has an active circuit-breaker
+ *                       entry (lib/launchFailure.cjs).
+ *   'idle'           — nothing pending in this scope.
+ *   'saturated'      — pending work exists but every session slot is in use.
+ *   'blocked'        — nothing running, slots free, every pending row's
+ *                       dependsOn chain terminates in a non-completed row.
+ *   'stalled'        — nothing running, slots free, at least one row is
+ *                       dispatchable right now, and the dispatch driver has
+ *                       been idle >= thresholdMs (agrees with the watchdog).
+ *   'running'        — the healthy default: work is flowing, or the driver
+ *                       hasn't been idle long enough to call a stall yet.
+ *
+ * Pure, no IO. `cwd` scopes jobs/pending/blocked/needsReview to one project
+ * (the Scheduler nav row is PROJECT-face — see CLAUDE.md); `freeSlots` /
+ * `totalSlots` / `launchBlocks` stay machine-wide inputs by design, same as
+ * WindowStrip's existing scopeCwd split.
+ */
+function classifyQueueHealth({
+  jobs, paused, launchBlocks, runningSet: runningSlugs, freeSlots, totalSlots,
+  lastDispatchAttemptAtMs, now, cwd = null, thresholdMs = QUEUE_STARVATION_MS,
+} = {}) {
+  const rows = (Array.isArray(jobs) ? jobs : []).filter(Boolean);
+  const projectJobs = cwd ? rows.filter((j) => j.cwd === cwd) : rows;
+  const pendingRows = projectJobs.filter((j) => j.status === 'pending');
+  const runningRows = projectJobs.filter((j) => j.status === 'running' || runningSlugs?.has?.(j.slug));
+  const needsReviewCount = projectJobs.filter((j) => j.status === 'needs_review').length;
+
+  // computeBlockedChains is the SAME primitive classifyQueueStarvation calls
+  // internally, computed once here so EVERY kind (not just 'blocked'/
+  // 'stalled') carries real dispatchable-vs-blocked counts instead of a null.
+  const blockedChains = computeBlockedChains(projectJobs);
+  const blockedTotal = blockedChains.reduce((n, c) => n + c.blocked, 0);
+  const dispatchable = Math.max(0, pendingRows.length - blockedTotal);
+  const base = {
+    cwd, pending: pendingRows.length, dispatchable, blockedChains, needsReviewCount, runningCount: runningRows.length,
+  };
+
+  if (paused) return { ...base, kind: 'paused', reason: paused.reason ?? null };
+
+  // launch-blocked: only a persona a PENDING row in this scope actually uses
+  // — a breaker open for a persona nothing here needs is not this scope's
+  // problem (matches WindowStrip's own unconditional-banner-per-block read).
+  const neededAgentTypes = new Set(pendingRows.map((j) => launchFailure.launchBlockKeyFor(j)));
+  for (const [key, block] of Object.entries(launchBlocks ?? {})) {
+    if (block && neededAgentTypes.has(key)) {
+      return { ...base, kind: 'launch-blocked', agentType: key, block };
+    }
+  }
+
+  if (pendingRows.length === 0) return { ...base, kind: 'idle' };
+
+  // classifyQueueStarvation only ever classifies while nothing is running
+  // (its own runningCount > 0 guard) — that boundary is also exactly where
+  // slot saturation, not dependency shape, is the honest cause.
+  if (runningRows.length > 0) {
+    if (Number.isFinite(freeSlots) && freeSlots <= 0) {
+      return { ...base, kind: 'saturated', totalSlots: totalSlots ?? null };
+    }
+    return { ...base, kind: 'running' };
+  }
+
+  // Nothing running: hand the SAME rows + idle clock to classifyQueueStarvation
+  // (thresholdMs: 0 — a live header must say "blocked" the instant every
+  // pending row is dependency-stuck, not wait out the watchdog's own grace
+  // period) purely for its idleMs reading; its own dispatchable/blockedChains
+  // are mathematically identical to `base`'s (same computeBlockedChains walk
+  // over the same rows), so `base` already carries them.
+  const immediate = classifyQueueStarvation({
+    jobs: projectJobs, paused: false, runningCount: 0,
+    lastRunAtMs: lastDispatchAttemptAtMs, now, thresholdMs: 0,
+  });
+  // pending.length is already > 0 above, so `immediate` can only be null when
+  // lastDispatchAttemptAtMs is itself in the future (clock skew) — fall back
+  // to computing idleMs the same way rather than asserting a kind we can't
+  // back up with a real number.
+  const idleMs = immediate ? immediate.idleMs
+    : (Number.isFinite(lastDispatchAttemptAtMs) ? now - lastDispatchAttemptAtMs : Infinity);
+  if (dispatchable === 0) return { ...base, kind: 'blocked', idleMs };
+  const kind = idleMs >= thresholdMs ? 'stalled' : 'running';
+  return { ...base, kind, idleMs };
+}
+
 /**
  * The watchdog half: acts on classifyQueueStarvationByProject. Called from
  * the heartbeat, which already runs on its own timer independent of the
@@ -7254,12 +7932,19 @@ async function reapDeadRunningJobs() {
     // status:"running" with no slug left in runningSet to trigger reconciliation.
     // queue.json is the source of truth for which jobs are actually running.
     const state = await readQueue();
+    // Shared by the log-evidence injections below and the reapable-processing
+    // loop further down — same `j.runId` → run log path formula either way.
+    const logPathForJob = (j) => (j?.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null);
     const { reapable, warnings, recovered } = selectReapableJobs(state.jobs, Date.now(), {
       pidAlive: claudePidAlive,
       grace: PIDLESS_SPAWN_GRACE_MS,
       findLiveProcess: (j) => findLiveProcessForJob(j, {
         worktreeDir: jobWorktree.worktreeDirFor(j.cwd || state.config?.defaultCwd || DEFAULT_PROJECT_CWD, j.slug),
+        runCwd: j.runtime?.cwd || j.cwd,
       }),
+      getLogPid: (j) => readSpawnedPidFromLog(logPathForJob(j)),
+      getLogMtimeMs: (j) => readLogMtimeMs(logPathForJob(j)),
+      logFreshWindowMs: IDLE_OUTPUT_KILL_MS,
     });
     for (const w of warnings) {
       console.warn(`[scheduler] reapDeadRunningJobs: ${w.reason} slug=${w.slug} — leaving row alone`);
@@ -7284,11 +7969,9 @@ async function reapDeadRunningJobs() {
     }
 
     const dead = [];
-    for (const { slug, pid, pidless, reason } of reapable) {
+    for (const { slug, pid, pidless, reason, failureOverride } of reapable) {
       const j = state.jobs.find((x) => x.slug === slug);
-      const logPath = j?.runId
-        ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`)
-        : null;
+      const logPath = logPathForJob(j);
       // Absent/empty run dir → classifyRunOutcome finds no result event →
       // 'no_result' → non-success below → filed as failed, never completed.
       const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
@@ -7307,7 +7990,7 @@ async function reapDeadRunningJobs() {
       // re-derived so a phantom link never survives the reap.
       const hasOwnArtifact = pidless ? logHasOutput(logPath) : true;
       const gateOutcome = pidless ? resolvePidlessGateOutcome(outcome, hasOwnArtifact) : mapOutcomeToGateOutcome(outcome);
-      dead.push({ slug, pid, outcome, gateOutcome, pidless, reason, logPath, noOwnArtifact: pidless && !hasOwnArtifact });
+      dead.push({ slug, pid, outcome, gateOutcome, pidless, reason, logPath, noOwnArtifact: pidless && !hasOwnArtifact, failureOverride });
     }
 
     queueHealthSweepCycle += 1;
@@ -7405,8 +8088,44 @@ async function reapDeadRunningJobs() {
       integrationResults.set(d.slug, { effectiveSuccess, landedCommit, notLandedInfo });
     }
 
+    // Evidence-before-failure guard for a row about to be stamped 'failed'
+    // (this PRD — job 1192 shipped a real 3-file commit and was still
+    // reaped 'failed' because this check did not exist): a `landedCommit`
+    // already recorded on the row is only ever stamped from an actual HEAD
+    // advance or a proven branch-integration (jobLandedCommitThisRun / the
+    // dead-pid integration proof above / the dispatch-time sidecar
+    // backfill) — never speculative — but it can still be STALE by the time
+    // this row is reaped (the branch it named could have been force-pushed
+    // over, or the row could be carrying a sidecar-backfilled sha from a
+    // run that was later discarded). git-resolving it here is what turns
+    // "the field is non-empty" into "this sha is a real commit in this
+    // repo right now". Computed OUTSIDE mutate() for the same reason
+    // integrationResults is above: git spawn work must never run inside
+    // mutate()'s single global serialization chain.
+    //
+    // Scoped to exactly the rows that would otherwise fall through to
+    // 'failed' below: a 'success' outcome is already resolved by
+    // integrationResults above (never reaches 'failed'), a rate-limited
+    // death is retryable and never terminal, and a pidless row that already
+    // carries a `failureOverride` (PRD 1173) is already diverted to
+    // needs_review — this gate must never re-litigate either of those.
+    const landedCommitEvidence = new Map();
+    // Each row's evidence check is an independent read-only `git cat-file`/
+    // `git log` pair with no shared mutable state between iterations, so
+    // this runs the whole dead-job batch concurrently rather than one
+    // dispatch's git-spawn latency at a time.
+    await Promise.all(dead.map(async (d) => {
+      if (d.outcome === 'rate_limited' || d.outcome === 'success') return;
+      if (d.pidless && d.failureOverride) return;
+      const row = state.jobs.find((x) => x.slug === d.slug);
+      if (!row?.landedCommit) return;
+      const rowCwd = row.cwd || state.config?.defaultCwd || DEFAULT_PROJECT_CWD;
+      const resolved = await resolveLandedCommitEvidence(rowCwd, row.landedCommit, row.startedAt);
+      if (resolved) landedCommitEvidence.set(d.slug, row.landedCommit);
+    }));
+
     await mutate(async (s) => {
-      for (const { slug, pid, outcome, gateOutcome, pidless, reason, noOwnArtifact } of dead) {
+      for (const { slug, pid, outcome, gateOutcome, pidless, reason, noOwnArtifact, failureOverride } of dead) {
         const idx = s.jobs.findIndex((x) => x.slug === slug);
         if (idx < 0 || s.jobs[idx].status !== 'running') continue; // race guard
         const rateLimited = outcome === 'rate_limited';
@@ -7465,6 +8184,20 @@ async function reapDeadRunningJobs() {
             notLandedInfo = ir.notLandedInfo;
           }
         }
+        // Evidence-before-failure guard for the pidless-reap path (PRD 1173):
+        // a pidless reap about to stamp 'failed' purely because runtime.pid
+        // was never recorded must first check whether this row already
+        // carries a landedCommit from an earlier dispatch of the same slug
+        // (landedCommit survives a reset — see the comment near
+        // resetJobFields). Diverted to needs_review, never silently
+        // 'completed' — see resolvePidlessFailureOverride's header in
+        // reaperHelpers.cjs for why needs_review is the correct destination.
+        // Scoped strictly to the pidless branch: dead-pid and rate-limited
+        // rows are untouched, and a pidless row that already resolved to
+        // effectiveSuccess/notLandedInfo above is left alone too.
+        if (pidless && !effectiveSuccess && !rateLimited && !notLandedInfo && failureOverride) {
+          notLandedInfo = { verdict: failureOverride.verdict, reason: failureOverride.reason };
+        }
 
         const leftoverSuffix = deltaPaths && deltaPaths.length
           ? ` — left ${deltaPaths.length} files uncommitted`
@@ -7472,9 +8205,20 @@ async function reapDeadRunningJobs() {
         const baseReason = notLandedInfo
           ? `reaped: ${notLandedInfo.reason}`
           : (pidless ? reason : `reaped: process gone (outcome=${outcome})`);
+        // Evidence gate (this PRD): a row that would otherwise fall through
+        // to 'failed' below, but whose landedCommit was proven to resolve
+        // via git cat-file BEFORE this mutate() ran (see landedCommitEvidence
+        // above), gets promoted to 'completed' instead — the row already
+        // shipped real work, so a bookkeeping gap (no runtime.pid recorded)
+        // must never override git-verified evidence with a false failure.
+        const confirmedLandedCommit = (!effectiveSuccess && !notLandedInfo && !rateLimited)
+          ? (landedCommitEvidence.get(slug) || null)
+          : null;
         const transitionReason = rateLimited
           ? `reaped: rate limit detected — reset to pending, not failed (outcome=${outcome})${leftoverSuffix}`
-          : baseReason + leftoverSuffix;
+          : confirmedLandedCommit
+            ? `${baseReason}, but landedCommit ${confirmedLandedCommit} resolves — completed on evidence${leftoverSuffix}`
+            : baseReason + leftoverSuffix;
 
         if (rateLimited) {
           // Retryable, never terminal (PRD 1117) — same resetJobFields path
@@ -7483,17 +8227,27 @@ async function reapDeadRunningJobs() {
           // paused-for-rate-limit reset: fresh runId/startedAt/exitCode.
           resetJobFields(s.jobs[idx], transitionReason, { source: 'reapDeadRunningJobs:rate-limit' });
         } else {
-          const targetStatus = effectiveSuccess ? 'completed' : (notLandedInfo ? 'needs_review' : 'failed');
-          transitionJob(s.jobs[idx], targetStatus, { reason: transitionReason, source: 'reapDeadRunningJobs' });
-          s.jobs[idx].exitCode = effectiveSuccess ? 0 : (s.jobs[idx].exitCode ?? 1);
-          s.jobs[idx].finishedAt = new Date().toISOString();
-          s.jobs[idx].error = effectiveSuccess ? null : `${transitionReason} (outcome=${outcome})`;
-          s.jobs[idx].gateOutcome = gateOutcome;
+          const landed = effectiveSuccess || Boolean(confirmedLandedCommit);
+          const targetStatus = effectiveSuccess
+            ? 'completed'
+            : (notLandedInfo ? 'needs_review' : (confirmedLandedCommit ? 'completed' : 'failed'));
+          const source = confirmedLandedCommit ? 'reapDeadRunningJobs:landed' : 'reapDeadRunningJobs';
+          // error/verifierVerdict are stamped BEFORE transitionJob() below —
+          // see the identical ordering fix (and its rationale) in spawnJob's
+          // finalize path: transitionJob's needs_review ledger entry reads
+          // these fields off `job` synchronously the instant it runs, so
+          // setting them after fed the ledger a stale/leftover reason.
+          s.jobs[idx].error = landed ? null : `${transitionReason} (outcome=${outcome})`;
           if (notLandedInfo) {
             s.jobs[idx].verifierVerdict = notLandedInfo.verdict;
           } else {
             delete s.jobs[idx].verifierVerdict;
           }
+          transitionJob(s.jobs[idx], targetStatus, { reason: transitionReason, source });
+          s.jobs[idx].exitCode = landed ? 0 : (s.jobs[idx].exitCode ?? 1);
+          s.jobs[idx].finishedAt = new Date().toISOString();
+          s.jobs[idx].gateOutcome = gateOutcome;
+          if (confirmedLandedCommit) s.jobs[idx].landedCommit = confirmedLandedCommit;
           if (landedCommit) s.jobs[idx].landedCommit = landedCommit;
         }
         // A pidless spawn that never wrote its own '<slug>.log' into the
@@ -7529,7 +8283,14 @@ async function reapDeadRunningJobs() {
           appendAuditEvent('job_reaped_rate_limited', { slug, cwd: s.jobs[idx].cwd ?? null });
         } else if (pidless) {
           console.log(`[scheduler] reaped pidless zombie job slug=${slug} outcome=${outcome}`);
-          appendAuditEvent('job_reaped_pidless', { slug, cwd: s.jobs[idx].cwd ?? null, outcome, graceMs: PIDLESS_SPAWN_GRACE_MS });
+          appendAuditEvent('job_reaped_pidless', {
+            slug,
+            cwd: s.jobs[idx].cwd ?? null,
+            outcome,
+            graceMs: PIDLESS_SPAWN_GRACE_MS,
+            landedCommit: s.jobs[idx].landedCommit ?? null,
+            verifierVerdict: s.jobs[idx].verifierVerdict ?? null,
+          });
         } else {
           console.log(`[scheduler] reaped dead job slug=${slug} pid=${pid} outcome=${outcome}`);
         }
@@ -7724,6 +8485,12 @@ function selectHistoryJobs(jobs, limit, historyEntries = []) {
   const seen = new Set(hot.map((j) => `${j.slug}|${j.runId ?? ''}`));
   const archived = (Array.isArray(historyEntries) ? historyEntries : []).filter((j) => {
     if (!j) return false;
+    // needs_review_entry/needs_review_resolution lines (needsReviewLedger.cjs)
+    // share history.jsonl with terminal job rows but carry no `status` — the
+    // History view (SchedulerHistoryView.tsx) renders ScheduleJob rows, so a
+    // ledger line slipping through here would show up as a statusless,
+    // meaningless row in that table.
+    if (j.kind && j.kind !== 'terminal') return false;
     const key = `${j.slug}|${j.runId ?? ''}`;
     if (seen.has(key)) return false;
     seen.add(key);
@@ -7849,6 +8616,69 @@ function isExhaustedAutoFix(job) {
   return job.autoFixOutcome !== 'plan' && (job.autoFixRetries ?? 0) >= 1;
 }
 
+/**
+ * Verdicts from the POST-RUN GUARDS (commit-guard / shared-tree guard) that a
+ * later, independently-checkable commit/looksDone signal can meaningfully
+ * confirm or refute. Auto-fix investigations only ever launch for FAILING
+ * runs (see isExhaustedAutoFix above and selectAutoFixTargets) — a job parked
+ * by one of these GUARD verdicts exits 0 and never has autoFixAttempted set,
+ * so it is invisible to isExhaustedAutoFix and can sit in needs_review
+ * forever with nothing to spend and nothing to exhaust (PRD 1181, 2026-09-12:
+ * exit 0, commit aff5607 landed, parked on a shared-tree verdict, cleared
+ * only by a human).
+ *
+ * 'worktree_integration_failed' is deliberately EXCLUDED — its damage IS a
+ * commit: one stranded on an unmerged `sm-job/<slug>` branch. A `landedCommit`
+ * existing is not evidence against that verdict, it is a restatement of it,
+ * so admitting it here would auto-complete a row whose work never actually
+ * reached the target branch. It already has its own dedicated, git-native
+ * resolution path (selectMechanicalRecoveryTarget / performMechanicalRecovery
+ * — a real re-attempted merge) and must never be pulled into this ladder.
+ *
+ * 'pidless_reap_with_landed_commit' (PRD 1173, resolvePidlessFailureOverride
+ * in reaperHelpers.cjs) is included: it parks on the exact same shape (exit
+ * never observed / no autoFixAttempted, real landedCommit evidence) as
+ * 'silent_no_op' and 'shared_tree_reverted', and this ladder never trusts
+ * landedCommit alone anyway — applyNeedsReviewAutoResolve only resolves once
+ * job.looksDone independently reconfirms via a fresh commits-since-this-run
+ * scan, which is exactly the "does the commit correspond to THIS dispatch"
+ * re-verification resolvePidlessFailureOverride's own header says the
+ * pidless-reap path itself cannot do. Omitting it here reproduces the same
+ * "nothing to spend, nothing to exhaust" needs_review stall this PRD exists
+ * to fix, just for a third verdict.
+ */
+const GUARD_VERDICT_EVIDENCE_ELIGIBLE = new Set(['silent_no_op', 'shared_tree_reverted', 'pidless_reap_with_landed_commit']);
+
+/**
+ * Pure predicate, no I/O: a needs_review row parked directly by one of the
+ * GUARD_VERDICT_EVIDENCE_ELIGIBLE verdicts, that never went through an
+ * auto-fix investigation at all (autoFixAttempted is not true) — the
+ * structural gap this PRD closes, distinct from isExhaustedAutoFix's "went
+ * through auto-fix and spent it" case. A job that DID get an auto-fix
+ * investigation is left to isExhaustedAutoFix's own ladder rather than this
+ * one, even if its verifierVerdict happens to also be in the eligible set.
+ * Exported for tests.
+ */
+function isGuardParkedWithoutAutoFix(job) {
+  if (!job || job.status !== 'needs_review') return false;
+  if (job.autoFixAttempted === true) return false;
+  return GUARD_VERDICT_EVIDENCE_ELIGIBLE.has(job.verifierVerdict);
+}
+
+/**
+ * Pure predicate, no I/O: is this needs_review row eligible for the bounded
+ * auto-resolve ladder at all — either because its auto-fix path is genuinely
+ * spent (isExhaustedAutoFix), or because it was parked by a GUARD verdict
+ * that never entered auto-fix in the first place (isGuardParkedWithoutAutoFix).
+ * Both classes share ONE ladder (applyNeedsReviewAutoResolve) rather than a
+ * duplicated one — the ladder itself doesn't care which door a row came
+ * through, only whether it now carries completion evidence (job.looksDone).
+ * Exported for tests.
+ */
+function isEligibleForNeedsReviewAutoResolve(job) {
+  return isExhaustedAutoFix(job) || isGuardParkedWithoutAutoFix(job);
+}
+
 /**
  * Pure predicate: an investigation produced a fix plan (autoFixOutcome ===
  * 'plan') but its fix-plan slug is not present among `queuedSlugs` — the
@@ -7996,17 +8826,26 @@ function isRescanCandidate(job) {
  * selectResumeRecoveryTarget / selectAutoFixTargets) so the guard can never
  * again be narrower than the work reverifyNeedsReview performs.
  *
- * Cost: selectMechanicalRecoveryTarget/selectResumeRecoveryTarget are pure
- * (no I/O). selectAutoFixTargets is called with an injected fixSlugExists
- * that always returns false — cheap and deliberately over-inclusive (a false
- * positive here just means one extra periodic pass, never a missed one) so
- * this guard never pays selectAutoFixTargets's production fs.existsSync scan
- * per tick. resolveRunId's IO only fires for rows missing job.runId, same as
+ * Widened again (this PRD): a `needs_review` row parked directly by a GUARD
+ * verdict with no auto-fix history (isGuardParkedWithoutAutoFix) is not an
+ * isRescanCandidate either — RESCANNABLE_VERDICTS covers transcript-verifier
+ * verdicts, not commit-guard/shared-tree-guard verdicts — but
+ * reverifyNeedsReview's looksDone-annotation pass now runs for it too (see
+ * that function). Same rule as always: never let this guard be narrower than
+ * the work reverifyNeedsReview actually performs.
+ *
+ * Cost: selectMechanicalRecoveryTarget/selectResumeRecoveryTarget and
+ * isGuardParkedWithoutAutoFix are pure (no I/O). selectAutoFixTargets is
+ * called with an injected fixSlugExists that always returns false — cheap
+ * and deliberately over-inclusive (a false positive here just means one
+ * extra periodic pass, never a missed one) so this guard never pays
+ * selectAutoFixTargets's production fs.existsSync scan per tick.
+ * resolveRunId's IO only fires for rows missing job.runId, same as
  * isRescanCandidate already incurs above.
  */
 function shouldRunPeriodicReverify(jobs) {
   if (!Array.isArray(jobs)) return false;
-  if (jobs.some((j) => isRescanCandidate(j))) return true;
+  if (jobs.some((j) => isRescanCandidate(j) || isGuardParkedWithoutAutoFix(j))) return true;
   if (jobs.some((j) => selectMechanicalRecoveryTarget(j) || selectResumeRecoveryTarget(j))) return true;
   return selectAutoFixTargets(jobs, { fixSlugExists: () => false }).length > 0;
 }
@@ -8172,9 +9011,11 @@ function needsReviewAutoResolveDisabled() {
  * selectExhaustedNeedsReviewTargets(jobs, now, thresholdMs) →
  *   [{ slug, cwd, ageMs, attempts }]
  *
- * Pure selector — no IO. Selects `needs_review` rows whose auto-fix path is
- * genuinely spent (isExhaustedAutoFix), whose newest statusHistory entry
- * with `to === 'needs_review'` is older than `thresholdMs`, and whose
+ * Pure selector — no IO. Selects `needs_review` rows eligible for the
+ * bounded auto-resolve ladder (isEligibleForNeedsReviewAutoResolve — either
+ * auto-fix genuinely spent, or parked by a GUARD verdict that never entered
+ * auto-fix at all), whose newest statusHistory entry with `to ===
+ * 'needs_review'` is older than `thresholdMs`, and whose
  * exhaustedResolveAttempts counter has not yet spent its cap.
  *
  * The inclusion bound is inclusive of the cap itself (`<= CAP`, not `<
@@ -8188,7 +9029,7 @@ function selectExhaustedNeedsReviewTargets(jobs, now, thresholdMs) {
   const targets = [];
   for (const j of jobs ?? []) {
     if (j.status !== 'needs_review') continue;
-    if (!isExhaustedAutoFix(j)) continue;
+    if (!isEligibleForNeedsReviewAutoResolve(j)) continue;
     if ((j.exhaustedResolveAttempts ?? 0) > NEEDS_REVIEW_RESOLVE_CAP) continue;
     const history = j.statusHistory || [];
     let entry = null;
@@ -8224,17 +9065,26 @@ function selectExhaustedNeedsReviewTargets(jobs, now, thresholdMs) {
  * failed-autoreset loop above) so a stale target computed before this
  * mutate() pass can never double-apply. Returns the outcome, or null if the
  * race guard rejected it.
+ *
+ * A row can reach here through either door (isEligibleForNeedsReviewAutoResolve):
+ * auto-fix genuinely exhausted, or parked directly by a GUARD_VERDICT_EVIDENCE_
+ * ELIGIBLE verdict with no auto-fix history at all. `originIsGuardParked` picks
+ * which door this particular row came through, purely to make the requeue/skip
+ * reason text (and the Queue UI's job.error) name the RIGHT evidence — a
+ * guard-parked row was never "exhausted auto-fix" and must never claim to be.
  */
 function applyNeedsReviewAutoResolve(j) {
-  if (!j || j.status !== 'needs_review' || !isExhaustedAutoFix(j)) return null;
+  if (!j || j.status !== 'needs_review' || !isEligibleForNeedsReviewAutoResolve(j)) return null;
   if ((j.exhaustedResolveAttempts ?? 0) > NEEDS_REVIEW_RESOLVE_CAP) return null;
+  const originIsGuardParked = !isExhaustedAutoFix(j) && isGuardParkedWithoutAutoFix(j);
 
   if (j.looksDone) {
     const attempt = j.exhaustedResolveAttempts ?? 0;
-    transitionJob(j, 'completed', {
-      reason: `needs_review auto-resolve: verifier annotation shows work landed (${j.looksDone.commits.length} commit(s) since this run touch the PRD's declared paths)`,
-      source: 'needsReviewAutoResolve',
-    });
+    const reason = originIsGuardParked
+      ? `needs_review auto-resolve: guard verdict '${j.verifierVerdict}' with landed commit and looksDone evidence (${j.looksDone.rule}) — `
+        + `${j.looksDone.commits.length} commit(s) attributable to this job's own run touch the PRD's declared paths, work landed`
+      : `needs_review auto-resolve: verifier annotation shows work landed (${j.looksDone.rule} — ${j.looksDone.commits.length} commit(s) attributable to this job's own run touch the PRD's declared paths)`;
+    transitionJob(j, 'completed', { reason, source: 'needsReviewAutoResolve' });
     appendAuditEvent('needs_review_auto_resolved', { slug: j.slug, cwd: j.cwd ?? null, outcome: 'completed', attempt });
     return 'completed';
   }
@@ -8243,18 +9093,22 @@ function applyNeedsReviewAutoResolve(j) {
   if (attemptsSoFar < NEEDS_REVIEW_RESOLVE_CAP) {
     const attempt = attemptsSoFar + 1;
     j.exhaustedResolveAttempts = attempt;
-    transitionJob(j, 'pending', {
-      reason: `needs_review auto-resolve: exhausted auto-fix, no completion evidence — requeued for one more run (attempt ${attempt}/${NEEDS_REVIEW_RESOLVE_CAP})`,
-      source: 'needsReviewAutoResolve',
-    });
+    const reason = originIsGuardParked
+      ? `needs_review auto-resolve: guard verdict '${j.verifierVerdict}' with no completion evidence yet — `
+        + `requeued for one more run (attempt ${attempt}/${NEEDS_REVIEW_RESOLVE_CAP})`
+      : `needs_review auto-resolve: exhausted auto-fix, no completion evidence — requeued for one more run (attempt ${attempt}/${NEEDS_REVIEW_RESOLVE_CAP})`;
+    transitionJob(j, 'pending', { reason, source: 'needsReviewAutoResolve' });
     appendAuditEvent('needs_review_auto_resolved', { slug: j.slug, cwd: j.cwd ?? null, outcome: 'requeued', attempt });
     return 'requeued';
   }
 
   j.needsReviewAutoResolvedSkip = true;
-  j.error = `needs_review auto-resolve: exhausted auto-fix path (autoFixOutcome=${j.autoFixOutcome ?? 'none'}, `
-    + `autoFixRetries=${j.autoFixRetries ?? 0}) with no completion evidence after ${NEEDS_REVIEW_RESOLVE_CAP} `
-    + `requeue attempt(s) — auto-skipped to unblock downstream dependsOn rows`;
+  j.error = originIsGuardParked
+    ? `needs_review auto-resolve: guard verdict '${j.verifierVerdict}' with no completion evidence after `
+      + `${NEEDS_REVIEW_RESOLVE_CAP} requeue attempt(s) — auto-skipped to unblock downstream dependsOn rows`
+    : `needs_review auto-resolve: exhausted auto-fix path (autoFixOutcome=${j.autoFixOutcome ?? 'none'}, `
+      + `autoFixRetries=${j.autoFixRetries ?? 0}) with no completion evidence after ${NEEDS_REVIEW_RESOLVE_CAP} `
+      + `requeue attempt(s) — auto-skipped to unblock downstream dependsOn rows`;
   transitionJob(j, 'skipped', {
     reason: `needs_review auto-resolve: cap exhausted (${NEEDS_REVIEW_RESOLVE_CAP}/${NEEDS_REVIEW_RESOLVE_CAP} requeue attempts) — auto-skipped`,
     source: 'needsReviewAutoResolve',
@@ -8320,6 +9174,11 @@ function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRu
     // fix-plan investigation to diagnose — there is no code defect to
     // author a PRD against, only another job's still-uncommitted tree.
     if (job.blockedByForeignWip === true) return false;
+    // A budget-killed job parks for a human/ladder decision, never an
+    // auto-fix investigation or auto-retry — the run didn't fail, it simply
+    // overran its own estimate; there's no code defect to diagnose (Out of
+    // scope: "retrying or auto-resuming a budget-killed job" for this PRD).
+    if (job.verifierVerdict === 'budget_exceeded') return false;
     // A stale re-run whose work already shipped (rcaReport's 'already-shipped'
     // class) must never buy a fix-plan PRD — there is nothing to fix, and the
     // correct recovery (archiving the PRD) is a human/reconcile action, not
@@ -8379,35 +9238,153 @@ function isEligibleForImmediateAutoFix(job, allJobs, fixSlugExists) {
 }
 
 /**
- * Widened evidence check (PRD 1102): does at least one commit land AFTER
- * this job's run window that touches a path the PRD itself declares? Scoped
- * to the PRD's own declared paths (never the whole repo) so a sibling job's
- * unrelated commit is not credited to this one — see healRefusalReason's own
+ * attributeLandedCommits(job, pathCommits, cwd) → { commits, rule } | null
+ *
+ * Narrows a set of PATH-overlapping commits (computeLooksDone's
+ * `landedSinceRun` result — any commit touching the PRD's declared paths,
+ * regardless of who authored it) down to the subset actually attributable to
+ * THIS job's own run. Path overlap alone is not attribution: inside one Epic,
+ * sibling PRDs routinely declare the same hot file, so a sibling's commit is
+ * indistinguishable from this job's own by path alone (the incident this
+ * function exists to close — PRD 1204's parked row cited PRD 1205's commit
+ * 5dadf3c as its own evidence).
+ *
+ * Three rules, tried strongest-first, first match wins:
+ *
+ *  1. 'landedCommit' — the row's own `job.landedCommit`, re-verified here via
+ *     `resolveLandedCommitEvidence` against THIS job's `startedAt`. This is
+ *     the strongest signal because it is not inferred from `git log` at all:
+ *     it is the sha spawnJob's own finalize step observed THIS dispatch's
+ *     worktree/branch landing (see resolveLandedCommitEvidence's own header
+ *     for why it also guards against a stale sha surviving a reset). Trusted
+ *     independent of whether it appears in `pathCommits` — it is definitionally
+ *     this job's own work, not something discovered by scanning history.
+ *  2. 'job branch' — a path-overlapping commit reachable from (an ancestor of
+ *     or equal to) this job's own `sm-job/<slug>` branch tip. Still
+ *     job-specific even though it IS a `git log` scan: a sibling's commit can
+ *     never be an ancestor of THIS job's own branch ref. In practice this
+ *     branch is deleted on successful integration (gitWorktree.cjs's
+ *     `cleanupWorktree`), so this mainly fires when integration failed and
+ *     the branch was deliberately kept for recovery, or reverify runs before
+ *     cleanup — a narrower window than rule 1, hence checked second.
+ *  3. 'slug trailer' — a path-overlapping commit whose message contains this
+ *     job's slug verbatim. Weakest of the three (a coincidental substring
+ *     match is possible, and nothing stamps this automatically today), so it
+ *     is the last resort when the two structural signals above found
+ *     nothing.
+ *
+ * Deliberately NOT a rule: raw path overlap by itself (the bug this function
+ * fixes) and `committedInWindow`-style time-window-only evidence — a sibling
+ * job running concurrently in the very same window is exactly as invisible to
+ * a time bound as it is to a path filter, so neither narrows attribution.
+ *
+ * Never throws: a missing ref, an unresolvable sha, or any git failure for a
+ * given commit/rule is treated as "that commit doesn't satisfy this rule",
+ * never as a fabricated match.
+ */
+async function attributeLandedCommits(job, pathCommits, cwd) {
+  if (job?.landedCommit && await resolveLandedCommitEvidence(cwd, job.landedCommit, job.startedAt)) {
+    return { commits: [job.landedCommit], rule: 'landedCommit' };
+  }
+
+  const branch = `sm-job/${job?.slug}`;
+  const branchCommits = [];
+  for (const sha of pathCommits) {
+    try {
+      await execGitAt(cwd, ['merge-base', '--is-ancestor', sha, branch], { timeout: 10_000 });
+      branchCommits.push(sha);
+    } catch { /* not an ancestor of this job's own branch, or branch doesn't exist */ }
+  }
+  if (branchCommits.length) return { commits: branchCommits, rule: 'job branch' };
+
+  if (job?.slug) {
+    const trailerCommits = [];
+    for (const sha of pathCommits) {
+      try {
+        const msg = await execGitAt(cwd, ['log', '-1', '--format=%B', sha], { timeout: 10_000 });
+        if (msg.includes(job.slug)) trailerCommits.push(sha);
+      } catch { /* unresolvable sha */ }
+    }
+    if (trailerCommits.length) return { commits: trailerCommits, rule: 'slug trailer' };
+  }
+
+  return null;
+}
+
+/**
+ * Widened evidence check (PRD 1102, narrowed to per-job attribution by a
+ * later PRD): does at least one commit ATTRIBUTABLE TO THIS JOB land AFTER
+ * its run window and touch a path the PRD itself declares? Scoped to the
+ * PRD's own declared paths (never the whole repo) so a sibling job's
+ * unrelated commit is never even considered — see healRefusalReason's own
  * rationale for why unscoped, repo-wide evidence is not attribution.
  *
+ * Path overlap alone is NOT evidence (see attributeLandedCommits's header):
+ * a sibling PRD in the same Epic routinely declares the same hot file, so
+ * `landedSinceRun`'s raw result is only a candidate list — the returned
+ * annotation is null unless `attributeLandedCommits` narrows it to at least
+ * one commit this job can actually claim.
+ *
  * Returns null (no annotation, never fabricated) when the PRD names no
- * paths — the caller then has only the existing, already-computed
- * committedInWindow signal to go on, same as before this PRD.
+ * paths, when no commit touches a declared path at all, or when
+ * path-overlapping commits exist but none are attributable to this job — the
+ * caller then has only the existing, already-computed committedInWindow
+ * signal to go on, same as before this PRD.
+ *
+ * `fetchedCwds` (optional) lets a caller iterating many candidates in one
+ * pass (reverifyNeedsReview) dedupe the `git fetch --all --prune` across
+ * candidates that share a `cwd` — several `needs_review` rows for the same
+ * project is the common case a backlog produces, and each fetch is up to
+ * ~20s, so re-fetching the same repo once per row multiplies that pass's
+ * wall-clock cost for zero new evidence. Omitted (or a fresh Set per call)
+ * simply always fetches, unchanged from before this cache existed.
  *
- * @returns {Promise<{commits: string[], paths: string[], detectedAt: string} | null>}
+ * @returns {Promise<{commits: string[], paths: string[], detectedAt: string, rule: string} | null>}
  */
-async function computeLooksDone(job) {
+async function computeLooksDone(job, fetchedCwds) {
   const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
   const paths = declaredPathsForPrd(prdPath);
   if (!paths.length) return null;
-  await fetchAllRefs(job.cwd);
+  if (!fetchedCwds || !fetchedCwds.has(job.cwd)) {
+    await fetchAllRefs(job.cwd);
+    if (fetchedCwds) fetchedCwds.add(job.cwd);
+  }
   const commits = await landedSinceRun(job.cwd, job.startedAt, paths);
   if (!commits.length) return null;
-  return { commits, paths, detectedAt: new Date().toISOString() };
+  const attributed = await attributeLandedCommits(job, commits, job.cwd);
+  if (!attributed) return null;
+  return { commits: attributed.commits, paths, detectedAt: new Date().toISOString(), rule: attributed.rule };
 }
 
 async function reverifyNeedsReview() {
   const snap = await readQueue();
-  const candidates = snap.jobs.filter(isRescanCandidate);
+  // isGuardParkedWithoutAutoFix rows are NOT isRescanCandidate (their
+  // verifierVerdict is a commit-guard/shared-tree-guard verdict, not a
+  // RESCANNABLE_VERDICTS transcript-verifier one) — included here so this
+  // pass also computes their looksDone evidence, the widened half of the
+  // guard-verdict auto-resolve gap this PRD closes. Handled in its own
+  // branch below (no transcript rescan — there is no transcript verdict to
+  // rescan) rather than through the isRescanCandidate machinery.
+  const candidates = snap.jobs.filter((j) => isRescanCandidate(j) || isGuardParkedWithoutAutoFix(j));
   const healed = [];
   const leftForReview = [];
   const looksDoneUpdates = [];
+  // Shared across every computeLooksDone call in this one pass — dedupes
+  // the `git fetch --all --prune` per distinct cwd (see computeLooksDone's
+  // header) rather than re-fetching the same repo once per candidate row.
+  const fetchedCwds = new Set();
   for (const job of candidates) {
+    if (!isRescanCandidate(job) && isGuardParkedWithoutAutoFix(job)) {
+      // Guard-verdict park, never auto-fixed: only evidence gathering, never
+      // a transcript rescan (there was never a transcript-verifier verdict
+      // here) and never a direct heal — applyNeedsReviewAutoResolve is the
+      // sole place that turns this annotation into a status change.
+      const looksDone = await computeLooksDone(job, fetchedCwds);
+      if (looksDone) {
+        looksDoneUpdates.push({ slug: job.slug, cwd: job.cwd, looksDone, fromFailed: false });
+      }
+      continue;
+    }
     if (job.status === 'failed') {
       // A failed row never runs the transcript-verifier rescan below — that
       // machinery (verifyRun/COMPLETED_EQUIVALENT_VERDICTS) exists to
@@ -8416,7 +9393,7 @@ async function reverifyNeedsReview() {
       // completing-direction constraint). The only thing a failed candidate
       // can gain here is a looksDone annotation + a failed → needs_review
       // transition, for a human to confirm.
-      const looksDone = await computeLooksDone(job);
+      const looksDone = await computeLooksDone(job, fetchedCwds);
       if (looksDone) {
         looksDoneUpdates.push({ slug: job.slug, cwd: job.cwd, looksDone, fromFailed: true });
       } else {
@@ -8471,7 +9448,7 @@ async function reverifyNeedsReview() {
     // always before this periodic/boot pass can run against the same row, so
     // this check reliably catches the only order that can occur.
     if (stillOpen && job.autoFixAttempted !== true) {
-      const looksDone = await computeLooksDone(job);
+      const looksDone = await computeLooksDone(job, fetchedCwds);
       if (looksDone) {
         looksDoneUpdates.push({ slug: job.slug, cwd: job.cwd, looksDone, fromFailed: false });
       }
@@ -8485,14 +9462,14 @@ async function reverifyNeedsReview() {
         if (!u) continue;
         if (u.fromFailed) {
           transitionJob(j, 'needs_review', {
-            reason: 'looks done — commit(s) since this run touch this PRD\'s declared paths; confirm before archiving',
+            reason: `looks done (${u.looksDone.rule}) — commit(s) attributable to this job's own run touch this PRD's declared paths; confirm before archiving`,
             source: 'reverifyNeedsReview:looksDone',
           });
         }
         if (j.status !== 'needs_review') continue;
         j.looksDone = u.looksDone;
         const shaList = u.looksDone.commits.slice(0, 5).map((c) => c.slice(0, 7)).join(', ');
-        j.error = `looks done — ${u.looksDone.commits.length} commit(s) since this run touch this PRD's paths (${shaList}); confirm before archiving`;
+        j.error = `looks done (${u.looksDone.rule}) — ${u.looksDone.commits.length} commit(s) attributable to this job's own run touch this PRD's paths (${shaList}); confirm before archiving`;
       }
     });
     console.log(`[scheduler] boot reverify: looksDone annotated for ${looksDoneUpdates.length} row(s): ${looksDoneUpdates.map((u) => u.slug).join(', ')}`);
@@ -8764,11 +9741,21 @@ function registerScheduleHandlers() {
   ensureDirs();
   supervisor.registerHandlers();
 
+  // Cheap read only — no reconcile(), no writeQueue(). The renderer treats
+  // this as a fast call behind a 5s deadline (scheduleState.ts's
+  // withTimeout), but reconcile() does a cross-project PRD discovery walk
+  // plus a disk write, which could blow that deadline and, worse, throw
+  // outright on a torn queue.json (reconcile refuses to run against
+  // `state.unreadable`) — turning a recoverable read into a rejected IPC and
+  // an error toast. Discovery still runs on a fixed cadence elsewhere:
+  // tickQueue (every POLL_INTERVAL_MS, 60s), rescheduleTimer, broadcast()'s
+  // coalescer (getPayload), schedule:rescan and schedule:adopt-prd. Worst
+  // case, a PRD dropped on disk while the Scheduler tab is open surfaces
+  // here within ~POLL_INTERVAL_MS + BROADCAST_COALESCE_MS (~60.2s) — via
+  // tickQueue's reconcile + its trailing broadcast() — not via this handler.
   ipcMain.handle('schedule:state', async () => {
     const state = await readQueue();
-    await reconcile(state);
-    await writeQueue(state);
-    return buildScheduleStatePayload(state, { withPaths: true });
+    return buildScheduleStatePayload(state);
   });
 
   // Session-Manager-wide claude -p slot pool (lib/sessionSlots.cjs) —
@@ -8811,6 +9798,57 @@ function registerScheduleHandlers() {
     };
   });
 
+  // Queue-health header (PRD): the one honest read of "why does the queue
+  // look stale" — reuses classifyQueueHealth so the UI and the starvation
+  // watchdog can never disagree. `cwd` is optional (null = machine-wide,
+  // matching WindowStrip's own scopeCwd fallback).
+  ipcMain.handle('schedule:queue-health', async (_e, payload) => {
+    const cwd = (payload && typeof payload.cwd === 'string') ? payload.cwd : null;
+    const state = await readQueue();
+    if (state.unreadable) {
+      return { unknown: true, reason: state.unreadable };
+    }
+    const now = Date.now();
+    const slotSnapshot = sessionSlots.snapshot();
+    const freeSlots = Math.max(0, slotSnapshot.total - slotSnapshot.inUse);
+    const verdict = classifyQueueHealth({
+      jobs: state.jobs,
+      paused: state.paused,
+      launchBlocks: state.launchBlocks,
+      runningSet,
+      freeSlots,
+      totalSlots: slotSnapshot.total,
+      lastDispatchAttemptAtMs: Date.parse(state.lastDispatchAttemptAt ?? ''),
+      now,
+      cwd,
+    });
+    // Oldest running job across the whole machine (any project) — the
+    // number that actually explains slot saturation, alongside the
+    // machine-wide slot pool itself.
+    let oldestRunningAgeMs = null;
+    for (const j of state.jobs) {
+      if (j.status !== 'running' && !runningSet.has(j.slug)) continue;
+      const startedAtMs = j.startedAt ? Date.parse(j.startedAt) : NaN;
+      if (!Number.isFinite(startedAtMs)) continue;
+      const age = now - startedAtMs;
+      if (oldestRunningAgeMs === null || age > oldestRunningAgeMs) oldestRunningAgeMs = age;
+    }
+    return {
+      unknown: false,
+      now,
+      verdict,
+      slots: {
+        inUse: slotSnapshot.inUse,
+        total: slotSnapshot.total,
+        free: freeSlots,
+        source: slotSnapshot.envOverride ? 'env' : 'pool',
+      },
+      oldestRunningAgeMs,
+      lastRunAt: state.lastRunAt ?? null,
+      lastDispatchAttemptAt: state.lastDispatchAttemptAt ?? null,
+    };
+  });
+
   ipcMain.handle('schedule:force-tick', async () => {
     // Bypass the billing-poll gate entirely — fire pending jobs immediately regardless of meter state.
     // Clears any existing pause first (same semantics as run-now).
@@ -8889,6 +9927,21 @@ function registerScheduleHandlers() {
     return { ok: true, kind: 'info', message: `Adopted ${slug} — it will run as a normal pending job` };
   }));
 
+  // Scheduler UI's "change disposition" action (scheduler wave-disposition
+  // PRD): promotes an appended wave to its own head, or re-attaches a head
+  // behind another chain. Thin wrapper over remote.setPrdDisposition, which
+  // validates the rewrite (cycle-safety, running/completed rows untouched)
+  // before delegating to the same remote.updatePrd every other PRD edit
+  // path uses — see that method's own comment in this file.
+  ipcMain.handle('schedule:set-prd-disposition', validated(schemas.scheduleSetPrdDisposition, async ({ slug, cwd, disposition, dependsOn }) => {
+    if (!(await safeSlugPath(slug))) return { ok: false, kind: 'error', message: 'invalid slug' };
+    const result = await remote.setPrdDisposition({ slug, cwd, disposition, dependsOn });
+    if (!result.ok) return { ok: false, kind: 'error', message: result.error ?? 'disposition change failed' };
+    appendAuditEvent('scheduler_prd_disposition_set', { slug, cwd: cwd ?? null, disposition, source: 'ipc:schedule:set-prd-disposition' });
+    await broadcast({ flush: true });
+    return { ok: true, kind: 'info', message: `${slug} is now ${disposition === 'new-head' ? 'an independent head' : 'attached behind the chosen chain'}` };
+  }));
+
   ipcMain.handle('schedule:run-now', async () => {
     // Manual run-now overrides any auto-pause. Clear it first.
     await clearPause('run-now');
@@ -8901,9 +9954,11 @@ function registerScheduleHandlers() {
     return { ok: true };
   });
 
-  // Re-scan prds/ folder and merge into queue.json. The `schedule:state`
-  // handler already reconciles on read, but this gives the renderer an
-  // explicit refresh path that also broadcasts so all views update.
+  // Re-scan prds/ folder and merge into queue.json. `schedule:state` is a
+  // cheap read with no reconcile of its own — this is the renderer's
+  // explicit, immediate discovery path (mutate() + reconcile() + broadcast())
+  // for "I just dropped a PRD on disk and want it to show up now" rather than
+  // waiting for tickQueue's next ~60s pass.
   ipcMain.handle('schedule:rescan', async () => {
     const { added, removed } = await mutate(async (state) => {
       const before = new Set(state.jobs.map((j) => j.slug));
@@ -9132,6 +10187,18 @@ async function init() {
       const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
       bootOutcomes.set(j.slug, logPath ? classifyRunOutcome(logPath) : 'unknown');
     }
+    // Same evidence-before-failure gate reapDeadRunningJobs applies, resolved
+    // BEFORE mutate() for the same reason (git spawn work must never run
+    // inside mutate()'s single global serialization chain) — an orphaned job
+    // classified 'failed'/'unknown' from its log tail alone can still have
+    // actually landed a real commit before the app restarted mid-run.
+    const bootLandedCommitEvidence = new Map();
+    await Promise.all(bootSnap.jobs.map(async (j) => {
+      if (!immediateSlugs.includes(j.slug) || j.status !== 'running') return;
+      if (bootOutcomes.get(j.slug) === 'success' || !j.landedCommit) return;
+      const resolved = await resolveLandedCommitEvidence(j.cwd || DEFAULT_PROJECT_CWD, j.landedCommit, j.startedAt);
+      if (resolved) bootLandedCommitEvidence.set(j.slug, j.landedCommit);
+    }));
     const bootReconciledCompletions = [];
     await mutate((state) => {
       for (const j of state.jobs) {
@@ -9139,7 +10206,7 @@ async function init() {
         const outcome = bootOutcomes.get(j.slug) ?? 'unknown';
         const pid = j.runtime?.pid;
         const killNote = pid ? ` (orphan pid=${pid}: dead)` : '';
-        applyOrphanOutcome(j, outcome, killNote);
+        applyOrphanOutcome(j, outcome, killNote, bootLandedCommitEvidence.get(j.slug) || null);
         if (j.status === 'completed') bootReconciledCompletions.push({ slug: j.slug, cwd: j.cwd });
         console.log(`[scheduler] boot reconcile: slug=${j.slug} outcome=${outcome} → status=${j.status}`);
       }
@@ -9163,9 +10230,18 @@ async function init() {
       if (result === 'killed') {
         console.log(`[scheduler] boot: SIGTERM'd orphan claude pid=${pid} for ${slug} — deferring finalize ${BOOT_ORPHAN_KILL_GRACE_MS}ms`);
       }
-      setTimeout(() => {
+      setTimeout(async () => {
         const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
         const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
+        // Same evidence-before-failure gate as the immediate-orphan path
+        // above, resolved before mutate() for the same reason (git spawn
+        // work must never run inside mutate()'s serialization chain). Uses
+        // the captured pre-kill snapshot's landedCommit/cwd/startedAt — the
+        // race guard below already confirms `cur` is still this same run
+        // (runId === bootRunId) before this evidence is applied.
+        const confirmedLandedCommit = (outcome !== 'success' && j.landedCommit)
+          ? (await resolveLandedCommitEvidence(j.cwd || DEFAULT_PROJECT_CWD, j.landedCommit, j.startedAt) ? j.landedCommit : null)
+          : null;
         let deferredCompletedCwd;
         mutate((state) => {
           const cur = state.jobs.find((x) => x.slug === slug);
@@ -9174,7 +10250,7 @@ async function init() {
           // that new run is not the boot orphan we SIGTERM'd and must not be
           // touched by this stale classification.
           if (!cur || cur.status !== 'running' || cur.runId !== bootRunId) return;
-          applyOrphanOutcome(cur, outcome, killNote);
+          applyOrphanOutcome(cur, outcome, killNote, confirmedLandedCommit);
           console.log(`[scheduler] boot reconcile (deferred): slug=${slug} outcome=${outcome} → status=${cur.status}`);
           deferredCompletedCwd = cur.status === 'completed' ? cur.cwd : undefined;
         }).then(() => {
@@ -9610,7 +10686,9 @@ async function listPrdsInternal() {
           estimateMinutes: parsed.estimateMinutes,
           sourcePromptId: parsed.sourcePromptId,
           epicId: parsed.epicId ?? null,
+          dependsOn: parsed.dependsOn ?? null,
           agentType: parsed.agentType ?? null,
+          disposition: parsed.disposition ?? null,
           mtimeMs: stat.mtimeMs,
           archived,
         };
@@ -10007,6 +11085,33 @@ const remote = {
     }
   },
 
+  // Backs the Scheduler UI's "change disposition" action (scheduler
+  // wave-disposition PRD): promoting an appended wave to its own head, or
+  // re-attaching a head behind another chain. `dependsOn` for a 'new-head'
+  // disposition is ignored (cleared unconditionally); for 'append' it's the
+  // caller's chosen target chain's terminal slug(s) — the renderer computes
+  // that from the SAME backlog tree (lib/backlogTree.ts) it already renders,
+  // so this function only has to validate the rewrite is safe, never
+  // re-derive "the" terminal itself.
+  //
+  // Validates via prdDisposition.cjs's computeDispositionRewrite (row not
+  // running/completed, no already-satisfied blocker being rewritten out from
+  // under it, no dependsOn cycle) BEFORE delegating the actual write to this
+  // SAME updatePrd — so a rejected rewrite never reaches the filesystem, and
+  // an accepted one gets updatePrd's own dependsOn FK re-validation for free.
+  async setPrdDisposition({ slug, cwd, disposition, dependsOn }) {
+    let listing;
+    try {
+      listing = await this.listPrds({ cwd, fields: 'full', limit: Number.MAX_SAFE_INTEGER });
+    } catch (e) {
+      return { ok: false, error: `could not read project PRDs: ${e?.message ?? e}` };
+    }
+    const rows = listing.prds ?? [];
+    const rewrite = computeDispositionRewrite({ slug, disposition, dependsOn: dependsOn ?? [], rows });
+    if (!rewrite.ok) return rewrite;
+    return this.updatePrd({ slug, cwd, frontmatter: { dependsOn: rewrite.dependsOn, disposition } });
+  },
+
   // Cancels a job that hasn't finished yet. A 'running' job's process group
   // is SIGTERM'd (reusing killOrphanClaudePid — the same kill path boot
   // reconciliation uses for an orphaned running job) before its queue row is
@@ -10034,18 +11139,38 @@ const remote = {
     if (wasRunning && pid) {
       killOrphanClaudePid(pid);
     }
+    // Evidence-before-failure guard, scoped to an actually-running job being
+    // killed here (a 'pending' cancel has no live process, so nothing new
+    // could have landed since its last stamp — and 'needs_review' is not
+    // even a legal transition from 'pending', see LEGAL_TRANSITIONS): the
+    // same reapDeadRunningJobs evidence gate (job 1192 — a landedCommit
+    // being non-empty is not proof by itself, but discarding proof of real
+    // landed work with no check at all is worse) applies here too. A
+    // dead-pid reap of a job that landed a commit (e.g. via the
+    // dispatch-time sidecar backfill) is routed to needs_review/completed;
+    // a deliberate cancel of that same state deserves no less.
+    const confirmedLandedCommit = (wasRunning && job.landedCommit)
+      ? ((await resolveLandedCommitEvidence(job.cwd || DEFAULT_PROJECT_CWD, job.landedCommit, job.startedAt))
+        ? job.landedCommit
+        : null)
+      : null;
+    const targetStatus = confirmedLandedCommit ? 'needs_review' : 'failed';
+    const cancelReason = confirmedLandedCommit
+      ? `cancelled via admin API, but landedCommit ${confirmedLandedCommit} resolves — verify before treating as done`
+      : 'cancelled via admin API';
     await mutate((s) => {
       const idx = s.jobs.findIndex((j) => j.slug === slug);
       if (idx < 0) return;
       const j = s.jobs[idx];
-      transitionJob(j, 'failed', { reason: 'cancelled via admin API', source: 'remote:cancelJob' });
-      j.error = 'cancelled via admin API';
+      transitionJob(j, targetStatus, { reason: cancelReason, source: 'remote:cancelJob' });
+      j.error = cancelReason;
       j.finishedAt = new Date().toISOString();
       j.exitCode = j.exitCode ?? null;
+      if (confirmedLandedCommit) j.verifierVerdict = 'cancelled_with_landed_commit';
       delete j.runtime;
     });
     await broadcast({ flush: true });
-    return { ok: true, slug, status: 'failed', wasRunning, cwd: job.cwd ?? null };
+    return { ok: true, slug, status: targetStatus, wasRunning, cwd: job.cwd ?? null };
   },
 
   // Exposes the module-level allocateParallelGroup (PRD 548) to callers that
@@ -10092,6 +11217,7 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
 module.exports = {
   classifyQueueStarvation,
   classifyQueueStarvationByProject,
+  classifyQueueHealth,
   runQueueStarvationWatchdog,
   QUEUE_STARVATION_MS,
   selectStarveEscalations,
@@ -10102,6 +11228,15 @@ module.exports = {
   findOverrunningJobs,
   JOB_OVERRUN_FACTOR,
   JOB_OVERRUN_FLOOR_MS,
+  computeJobBudgetMs,
+  classifyBudgetKill,
+  isJobBudgetExempt,
+  shouldKillForBudget,
+  resolveBudgetKillOutcome,
+  JOB_BUDGET_FACTOR,
+  JOB_BUDGET_FLOOR_MS,
+  JOB_BUDGET_CEILING_MS,
+  BUDGET_WARNING_FRACTION,
   registerScheduleHandlers,
   attachWindow,
   init,
@@ -10115,10 +11250,12 @@ module.exports = {
   healRefusalReason,
   writeQueue,
   reconcile,
+  broadcast,
   reconcileSourcePromptId,
   allocateParallelGroup,
   selectHistoryJobs,
   parsePorcelain,
+  parsePorcelainEntries,
   FINISH_PROTOCOL,
   IDLE_OUTPUT_KILL_MS,
   BASH_DEFAULT_TIMEOUT_MS,
@@ -10148,6 +11285,7 @@ module.exports = {
   isRescanCandidate,
   isFailedUnverifiedShaped,
   computeLooksDone,
+  attributeLandedCommits,
   isPromotableOriginal,
   selectAutoFixTargets,
   applyRcaClassification,
@@ -10155,6 +11293,9 @@ module.exports = {
   resolveRunId,
   isUnresolvableNeedsReview,
   isExhaustedAutoFix,
+  GUARD_VERDICT_EVIDENCE_ELIGIBLE,
+  isGuardParkedWithoutAutoFix,
+  isEligibleForNeedsReviewAutoResolve,
   isPlanUnqueued,
   isFixPlanDead,
   fixSlugFor,
@@ -10240,6 +11381,7 @@ module.exports = {
   evaluateSharedTreeGuard,
   checkSharedTreeGuard,
   uncommittedChanges,
+  uncommittedChangesWithStatus,
   gitHead,
   isBranchAlreadyIntegrated,
   selectResumeRecoveryTarget,