claude-code-session-manager 0.112.0 → 0.113.0

package/src/main/lib/feedback-remote/crossProjectFeedback.cjs

@@ -33,7 +33,19 @@
  * feedback Epic is born 'proposed' like every other Epic (epicMint.cjs's
  * BORN-PROPOSED check applies to this mint authority verbatim), so the human
  * in the RECEIVING project is still the one who decides whether a single token
- * gets spent. An agent can ask; it cannot start.
+ * gets spent. An agent can ask; it cannot start on its own say-so.
+ *
+ * The one exception is a VERIFIED HUMAN REQUEST. When the human themselves
+ * asked, in chat, for work in another project, making them re-confirm in the
+ * receiving project is pure friction. So `autoStart: true` plus a
+ * `humanRequestQuote` is honored only when main can check the quote against
+ * humanPromptLedger (prompts chat:run recorded with human origin) for the
+ * originating chat session — `input.originClaudeSessionId`, taken from the MCP
+ * server's env, set only for interactive chat runs, never for scheduler jobs —
+ * AND that human prompt names the target project. Even then the Epic is still
+ * minted 'proposed'; it is only stamped `source.autoApprove` and the renderer
+ * is told to approve-and-start it through its normal approveProposed path.
+ * Anything unverifiable degrades to the ordinary proposal.
  *
  * Guards, all fail-closed:
  *   - both cwds go through config.cjs's validatePath (allowedRoots = home)
@@ -90,6 +102,7 @@ const MAX_SERIES_KEY_CHARS = 60;
 const MAX_SERIES_TITLE_CHARS = 120;
 const MAX_SERIES_TOTAL = 50;
 const MAX_ORIGIN_ASK_CHARS = 300;
+const MAX_HUMAN_QUOTE_CHARS = 2000;
 const KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 
 /** Bound on how many `~/.claude/projects/` folders listFeedbackTargets will
@@ -349,6 +362,18 @@ function validateFeedbackInput(input = {}) {
     series = { key, title: stitle, index: sr.index, total: sr.total };
   }
 
+  if (input.autoStart !== undefined && input.autoStart !== null && typeof input.autoStart !== 'boolean') {
+    return bad(400, 'autoStart must be a boolean');
+  }
+  let humanRequestQuote = '';
+  if (input.humanRequestQuote !== undefined && input.humanRequestQuote !== null) {
+    if (typeof input.humanRequestQuote !== 'string') return bad(400, 'humanRequestQuote must be a string');
+    humanRequestQuote = input.humanRequestQuote.trim();
+    if (humanRequestQuote.length > MAX_HUMAN_QUOTE_CHARS) {
+      return bad(400, `humanRequestQuote is ${humanRequestQuote.length} chars; cap is ${MAX_HUMAN_QUOTE_CHARS}`);
+    }
+  }
+
   const referencePaths = Array.isArray(input.referencePaths) ? input.referencePaths : [];
   if (referencePaths.length > MAX_REFERENCES) {
     return bad(400, `too many referencePaths (${referencePaths.length}); cap is ${MAX_REFERENCES}`);
@@ -410,6 +435,8 @@ function validateFeedbackInput(input = {}) {
       acceptanceCriteria: lists.acceptanceCriteria,
       outOfScope: lists.outOfScope,
       series,
+      autoStart: input.autoStart === true,
+      humanRequestQuote,
       referencePaths: referencePaths.map((p) => String(p)),
       fromEpicId: input.fromEpicId ? String(input.fromEpicId) : null,
       agentType: input.agentType ? String(input.agentType) : DEFAULT_FEEDBACK_AGENT,
@@ -418,6 +445,44 @@ function validateFeedbackInput(input = {}) {
   };
 }
 
+/** Tell every renderer window to approve-and-start a granted auto-start Epic.
+ *  Electron is required lazily so unit tests never need it. */
+function defaultNotifyRenderer(payload) {
+  try {
+    const { BrowserWindow } = require('electron');
+    for (const win of BrowserWindow.getAllWindows()) {
+      try {
+        win.webContents.send('promptSessions:inbound-auto-approve', payload);
+      } catch { /* window going away */ }
+    }
+  } catch { /* not running under Electron */ }
+}
+
+/**
+ * verifyAutoStart(v, originClaudeSessionId) → { granted: true, quote } | { granted: false, reason }
+ *
+ * Every check is fail-closed. The session identity is ONLY the caller-supplied
+ * originClaudeSessionId (MCP env), never a field an agent can pick freely.
+ */
+function verifyAutoStart(v, originClaudeSessionId) {
+  if (!v.autoStart) return { granted: false, reason: 'autoStart was not requested' };
+  if (!v.humanRequestQuote) return { granted: false, reason: 'no humanRequestQuote was given' };
+  if (!originClaudeSessionId) {
+    return { granted: false, reason: 'no originClaudeSessionId — only interactive chat sessions can auto-start' };
+  }
+  const { findHumanPromptContaining } = require('./humanPromptLedger.cjs');
+  const found = findHumanPromptContaining(originClaudeSessionId, v.humanRequestQuote);
+  if (!found) {
+    return { granted: false, reason: 'humanRequestQuote was not found in a prompt the human typed in this chat session' };
+  }
+  const prompt = found.text.toLowerCase();
+  const base = path.basename(v.toCwd).toLowerCase();
+  if (!(base && prompt.includes(base)) && !prompt.includes(v.toCwd.toLowerCase())) {
+    return { granted: false, reason: `the human's prompt does not name the receiving project (${path.basename(v.toCwd)})` };
+  }
+  return { granted: true, quote: v.humanRequestQuote };
+}
+
 /**
  * openFeedbackSession(input, deps?) → { ok, status?, error?, epicId, toCwd, ... }
  *
@@ -427,8 +492,8 @@ function validateFeedbackInput(input = {}) {
  * best-effort: a failure there never invalidates a delivered proposal, it just
  * reports `receiptOnOriginEpic: false`.
  *
- * `deps` exists so tests can inject the two side-effecting collaborators
- * without an Electron/main-process boot.
+ * `deps` exists so tests can inject the side-effecting collaborators
+ * (ensureEpic, appendResponseEventIfKnown, notifyRenderer) without an Electron/main-process boot.
  */
 async function openFeedbackSession(input, deps = {}) {
   const mint = deps.ensureEpic || ensureEpic;
@@ -439,10 +504,19 @@ async function openFeedbackSession(input, deps = {}) {
     // boot the main process.
     || ((...args) => require('../../promptSessionEvents.cjs').appendResponseEventIfKnown(...args));
 
+  const notify = deps.notifyRenderer || defaultNotifyRenderer;
+
   const checked = validateFeedbackInput(input);
   if (!checked.ok) return checked;
   const v = checked.value;
 
+  const originClaudeSessionId =
+    typeof input.originClaudeSessionId === 'string' && input.originClaudeSessionId
+      ? input.originClaudeSessionId
+      : null;
+  const auto = verifyAutoStart(v, originClaudeSessionId);
+  const verifiedAt = new Date().toISOString();
+
   // The MCP client can't know its own Epic id — it only inherits the claude
   // session id chatRunner.cjs stamps on the `claude -p` child. Resolve it
   // through prdCreate.cjs's existing resolver rather than a second copy of
@@ -488,6 +562,16 @@ async function openFeedbackSession(input, deps = {}) {
         producer: 'cross-project-feedback',
         fromCwd: v.fromCwd,
         ...(v.fromEpicId ? { fromEpicId: v.fromEpicId } : {}),
+        ...(auto.granted
+          ? {
+              autoApprove: {
+                requestedBy: 'human',
+                quote: auto.quote,
+                verifiedAt,
+                fromClaudeSessionId: originClaudeSessionId,
+              },
+            }
+          : {}),
         proposal: {
           motivation: v.motivation,
           originAsk,
@@ -511,8 +595,16 @@ async function openFeedbackSession(input, deps = {}) {
     tag: v.tag,
     title: v.title,
     series: v.series,
+    autoStartGranted: auto.granted,
+    autoStartReason: auto.granted ? 'verified human request' : auto.reason,
   });
 
+  if (auto.granted) {
+    try {
+      notify({ cwd: v.toCwd, epicId: minted.epicId });
+    } catch { /* the Epic is delivered either way; a human can still approve it */ }
+  }
+
   let receiptOnOriginEpic = false;
   if (v.fromEpicId) {
     try {
@@ -522,7 +614,9 @@ async function openFeedbackSession(input, deps = {}) {
         `Feedback delivered to ${v.toCwd} as a proposed session (${minted.epicId}): "${v.title}"`
         + (v.series ? ` [${seriesLine(v.series)}]` : '')
         + '. '
-        + 'It will not run until a human in that project approves it.',
+        + (auto.granted
+          ? 'It was auto-approved at the human\'s explicit request and is starting in that project.'
+          : 'It will not run until a human in that project approves it.'),
       );
     } catch {
       receiptOnOriginEpic = false;
@@ -535,14 +629,18 @@ async function openFeedbackSession(input, deps = {}) {
     toCwd: v.toCwd,
     fromCwd: v.fromCwd,
     tag: v.tag,
-    status: 'proposed',
+    status: auto.granted ? 'auto-approved' : 'proposed',
+    ...(v.autoStart ? { autoStart: auto.granted ? { granted: true } : { granted: false, reason: auto.reason } } : {}),
     receiptOnOriginEpic,
     // Say plainly what did NOT happen, same posture as create-prd's
     // `enqueued: false` — never let a caller report this as "work started".
-    note:
-      'Delivered as a PROPOSED session in the receiving project\'s Sessions queue. Nothing runs and no '
-      + 'tokens are spent until a human in that project presses Approve & start. There is no callback: '
-      + 'if you need an answer, ask the human to follow up.',
+    note: auto.granted
+      ? 'Auto-approved at the human\'s explicit request (verified against their chat prompt): the session '
+        + 'is starting in the receiving project. There is no callback: if you need an answer, ask the human '
+        + 'to follow up.'
+      : 'Delivered as a PROPOSED session in the receiving project\'s Sessions queue. Nothing runs and no '
+        + 'tokens are spent until a human in that project presses Approve & start. There is no callback: '
+        + 'if you need an answer, ask the human to follow up.',
     goalText,
   };
 }

package/src/main/lib/feedback-remote/humanPromptLedger.cjs

@@ -0,0 +1,93 @@
+'use strict';
+
+/**
+ * humanPromptLedger.cjs — in-memory record of prompts a HUMAN typed into each
+ * chat claude session, keyed by claudeSessionId.
+ *
+ * Why it exists. The cross-project feedback conduit (crossProjectFeedback.cjs)
+ * may auto-approve a receiving-project session only when the human explicitly
+ * asked for it. An agent's say-so is not evidence of that. This ledger is the
+ * ONLY evidence that a human — not an agent, not an external/Web Remote
+ * injection, not an inbound proposal's agent-written opening prompt — typed a
+ * given prompt. Callers record only prompts that arrived from the human's own
+ * chat input, then ask `findHumanPromptContaining` whether a quoted request
+ * really appears in one.
+ *
+ * In-memory by design. Losing the ledger on restart only degrades auto-approve
+ * back to the ordinary 'proposed' path — it fails closed, so nothing is
+ * persisted to disk.
+ *
+ * Bounds: 10 prompts per session, 24h TTL, 200 sessions (least-recently-
+ * recorded evicted), 20000 chars per stored prompt. Pure Node, no Electron.
+ */
+
+const MIN_QUOTE_CHARS = 20;
+const MAX_PER_SESSION = 10;
+const TTL_MS = 24 * 60 * 60 * 1000;
+const MAX_SESSIONS = 200;
+const MAX_TEXT_CHARS = 20000;
+
+/** @type {Map<string, Array<{ text: string, norm: string, at: number }>>} */
+const ledger = new Map();
+
+/** @param {string} s */
+function normalize(s) {
+  return s.replace(/\s+/g, ' ').trim().toLowerCase();
+}
+
+/**
+ * @param {unknown} claudeSessionId
+ * @param {unknown} text
+ * @param {number} [now]
+ */
+function recordHumanPrompt(claudeSessionId, text, now = Date.now()) {
+  try {
+    if (typeof claudeSessionId !== 'string' || !claudeSessionId) return;
+    if (typeof text !== 'string' || !text.trim()) return;
+    const stored = text.slice(0, MAX_TEXT_CHARS);
+    const prior = (ledger.get(claudeSessionId) || []).filter((e) => now - e.at <= TTL_MS);
+    prior.push({ text: stored, norm: normalize(stored), at: now });
+    while (prior.length > MAX_PER_SESSION) prior.shift();
+    // Re-insert so Map order is least-recently-recorded first.
+    ledger.delete(claudeSessionId);
+    ledger.set(claudeSessionId, prior);
+    while (ledger.size > MAX_SESSIONS) {
+      const oldest = ledger.keys().next().value;
+      if (oldest === undefined) break;
+      ledger.delete(oldest);
+    }
+  } catch {
+    /* never throws */
+  }
+}
+
+/**
+ * @param {unknown} claudeSessionId
+ * @param {unknown} quote
+ * @param {number} [now]
+ * @returns {{ text: string, at: number } | null}
+ */
+function findHumanPromptContaining(claudeSessionId, quote, now = Date.now()) {
+  try {
+    if (typeof claudeSessionId !== 'string' || typeof quote !== 'string') return null;
+    const q = normalize(quote);
+    if (q.length < MIN_QUOTE_CHARS) return null;
+    const entries = ledger.get(claudeSessionId);
+    if (!entries) return null;
+    const live = entries.filter((e) => now - e.at <= TTL_MS);
+    if (live.length === 0) ledger.delete(claudeSessionId);
+    else if (live.length !== entries.length) ledger.set(claudeSessionId, live);
+    for (let i = live.length - 1; i >= 0; i--) {
+      if (live[i].norm.includes(q)) return { text: live[i].text, at: live[i].at };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function _resetForTests() {
+  ledger.clear();
+}
+
+module.exports = { recordHumanPrompt, findHumanPromptContaining, MIN_QUOTE_CHARS, _resetForTests };

package/src/main/lib/mcpToolCatalog.cjs

@@ -243,7 +243,11 @@ const MCP_TOOL_CATALOG = [
       + '`acceptanceCriteria`; put evidence, symptom and references in `body`. Name the file in THEIR repo '
       + 'that looks responsible if you know it. When one request is split into several proposals, send '
       + 'them ALL with one shared `series` {key, title, total} (plus each one\'s `index`) and summarise '
-      + 'the overall plan in each motivation.',
+      + 'the overall plan in each motivation. TWO MODES: (1) agent-initiated (your own idea) = PROPOSED, a '
+      + 'human in the receiving project must approve it; pass neither autoStart nor humanRequestQuote. '
+      + '(2) human-requested = the human in THIS conversation explicitly asked for the work in that other '
+      + 'project: pass `autoStart: true` plus `humanRequestQuote`, copied VERBATIM from their own message, '
+      + 'which must name the target project. An unverified request silently falls back to PROPOSED.',
     whenNotToUse: 'WHEN NOT TO USE IT: for work in the project you are ALREADY in, run /develop inside the Epic you '
       + 'are already in — this tool refuses toCwd === fromCwd outright.',
     exampleArgs: {
@@ -258,11 +262,13 @@ const MCP_TOOL_CATALOG = [
       series: { key: 'shared-admin-api-f', title: 'Shared admin API field F', index: 1, total: 2 },
       body: 'Symptom: X. Observed while doing Y in session-manager. Expected: Z. Suspected file: <path in their repo>.',
     },
-    notes: 'WHAT THIS DOES NOT DO: it does not start anything, queue a PRD, or spend a token. The session '
+    notes: 'WHAT THIS DOES NOT DO: it never writes code or queues a PRD itself. Agent-initiated, the session '
       + 'lands as `proposed` and runs only if a human in the RECEIVING project presses "Approve & start". '
+      + 'With a verified autoStart + humanRequestQuote the result status is `auto-approved` and the session '
+      + 'starts on its own; otherwise it stays proposed (check the note for the reason). '
       + 'There is no callback and no reply channel — do not wait for an answer, and do not tell the user '
       + 'the other project has "been fixed" or "is working on it". Report only that the proposal was '
-      + 'delivered.',
+      + 'delivered, or that the session was auto-approved and is starting.',
   },
   {
     name: 'project_home_write',

package/src/main/lib/prd/depSlugResolve.cjs

@@ -30,6 +30,21 @@ function resolveDepSlug(depSlug, candidateSlugs) {
   return candidateSlugs.filter((slug) => bareSlug(slug) === bare);
 }
 
+/**
+ * Is this dep ROW satisfied? `completed`, or a `skipped` row stamped
+ * `needsReviewAutoResolvedSkip` — the bounded needs_review auto-resolve's
+ * terminal decision (scheduler.cjs applyNeedsReviewAutoResolve), deliberately
+ * not a permanent block. Shared by schedulerBatch.findBlockingDep (dispatch)
+ * and runVerify.checkDeps (post-run): when they disagreed, the picker fired a
+ * dependent of an auto-skipped row and the verifier downgraded every finished
+ * run back to pending on "is skipped (need completed)" — an unbounded billed
+ * re-run loop (Bilko-Launch-Kit validator, ~20 runs, 2026-10-11).
+ */
+function isSatisfiedDepRow(row) {
+  return row?.status === 'completed'
+    || (row?.status === 'skipped' && row.needsReviewAutoResolvedSkip === true);
+}
+
 /**
  * Levenshtein edit distance. O(n*m) in the two strings' lengths — fine here
  * since it only ever runs over short slug strings (<= 60 chars, PRD_CREATE_SLUG_RE's
@@ -69,4 +84,4 @@ function findNearMatches(depSlug, candidateSlugs, limit = 3) {
     .map((entry) => entry.slug);
 }
 
-module.exports = { bareSlug, resolveDepSlug, findNearMatches };
+module.exports = { bareSlug, resolveDepSlug, findNearMatches, isSatisfiedDepRow };

package/src/main/lib/scheduler/finalizeReason.cjs

@@ -0,0 +1,30 @@
+'use strict';
+
+/**
+ * finalizeReason.cjs — the statusHistory reason for a job's running→terminal
+ * finalize transition. Pure; no I/O.
+ */
+
+/**
+ * @param {{
+ *   effectiveStatus: string,
+ *   verifyResult?: { verdict?: string, reason?: string } | null,
+ *   sigtermOverrideReason?: string | null,
+ *   exitCode?: number | null,
+ * }} input
+ * @returns {string}
+ */
+function finalizeReasonFor({ effectiveStatus, verifyResult, sigtermOverrideReason, exitCode }) {
+  if (sigtermOverrideReason) return sigtermOverrideReason;
+  if (effectiveStatus === 'completed' && verifyResult?.verdict === 'already_satisfied_on_main') {
+    return String(verifyResult.reason);
+  }
+  if (effectiveStatus === 'needs_review' && verifyResult?.verdict) {
+    return verifyResult.reason
+      ? `needs_review: ${verifyResult.verdict} — ${verifyResult.reason}`
+      : `needs_review: ${verifyResult.verdict}`;
+  }
+  return `run finished with exit ${exitCode}`;
+}
+
+module.exports = { finalizeReasonFor };

package/src/main/lib/scheduler/flatSweepThrottle.cjs

@@ -0,0 +1,17 @@
+'use strict';
+
+/** Retired flat `scheduler/prds/` sweep runs at most once per hour per process. */
+const FLAT_SWEEP_INTERVAL_MS = 60 * 60 * 1000;
+
+/**
+ * @param {number} nowMs
+ * @param {number | null} lastRunMs null = never ran this process (always run)
+ * @param {number} [intervalMs]
+ * @returns {boolean}
+ */
+function shouldRunFlatSweep(nowMs, lastRunMs, intervalMs = FLAT_SWEEP_INTERVAL_MS) {
+  if (lastRunMs === null || lastRunMs === undefined) return true;
+  return nowMs - lastRunMs >= intervalMs;
+}
+
+module.exports = { shouldRunFlatSweep, FLAT_SWEEP_INTERVAL_MS };

package/src/main/lib/scheduler/runLogRetention.cjs

@@ -1,8 +1,7 @@
 'use strict';
 
 /**
- * runLogRetention.cjs — computes (and, only when explicitly opted in,
- * applies) a retention policy over `scheduled-plans/runs/`.
+ * runLogRetention.cjs — computes and applies a retention policy over `scheduled-plans/runs/`.
  *
  * That directory is a machine-level Session-Manager runtime artifact store
  * (execution logs of the scheduler's own `claude -p` runs), not anything
@@ -26,10 +25,10 @@
  * slug's own files.
  *
  * SAFETY MODEL (the point of this module — see the PRD that added it):
- *   - Nothing is ever deleted unless the caller passes settings with
- *     `schedulerRunLogRetention.enabled === true` AND a non-empty policy.
- *     Everywhere else (computeReport, and applyRetention with no opt-in)
- *     this module only READS the filesystem.
+ *   - Retention is ON by default (DEFAULT_RUN_LOG_RETENTION) when settings
+ *     carry no `schedulerRunLogRetention`. An explicit `enabled: false` (or a
+ *     config with no non-empty policy) opts out: computeReport, and
+ *     applyRetention when opted out, only READ the filesystem.
  *   - An entry belonging to a job that is currently live — status `pending`
  *     (queued), `running`, `needs_review`, or `investigating` (the exact
  *     literals scheduler.cjs uses; see LIVE_STATUSES) — is never eligible,
@@ -51,6 +50,16 @@ const schedulerPaths = require('./schedulerPaths.cjs');
 // checks) — 'completed' and 'failed' are the only terminal ones.
 const LIVE_STATUSES = new Set(['pending', 'running', 'needs_review', 'investigating']);
 
+/**
+ * Built-in policy applied when settings carry no `schedulerRunLogRetention`:
+ * drop runs older than 14 days but always keep each slug's newest 3.
+ * (Policy keys follow the module's own names: maxAgeDays / keepPerSlug.)
+ */
+const DEFAULT_RUN_LOG_RETENTION = Object.freeze({
+  enabled: true,
+  policy: Object.freeze({ maxAgeDays: 14, keepPerSlug: 3 }),
+});
+
 const META_SUFFIX = '.meta.json';
 const DAY_MS = 24 * 60 * 60 * 1000;
 
@@ -259,11 +268,21 @@ function computeReport(runsDir, policy, opts) {
 }
 
 /**
- * True only when settings carry an explicit, well-formed opt-in:
- * `schedulerRunLogRetention.enabled === true` plus a non-empty policy.
+ * The effective retention config: the caller's `schedulerRunLogRetention`
+ * when present, else DEFAULT_RUN_LOG_RETENTION.
  */
-function isRetentionEnabled(settings) {
+function resolveRetentionConfig(settings) {
   const cfg = settings && settings.schedulerRunLogRetention;
+  return cfg == null ? DEFAULT_RUN_LOG_RETENTION : cfg;
+}
+
+/**
+ * True when the effective config (see resolveRetentionConfig) has
+ * `enabled === true` plus a non-empty policy. An absent setting resolves to
+ * the default (enabled); an explicit `enabled: false` opts out.
+ */
+function isRetentionEnabled(settings) {
+  const cfg = resolveRetentionConfig(settings);
   if (!cfg || cfg.enabled !== true) return false;
   const policy = cfg.policy;
   return !!policy && (policy.maxAgeDays != null || policy.keepPerSlug != null);
@@ -372,7 +391,7 @@ function sweepOrphanDirs(runsDir, runningRunIds, errors) {
  * nothing removed.
  */
 function applyRetention(runsDir, settings, opts) {
-  const cfg = (settings && settings.schedulerRunLogRetention) || null;
+  const cfg = resolveRetentionConfig(settings);
   const policy = (cfg && cfg.policy) || {};
   const enabled = isRetentionEnabled(settings);
   const liveKeys = resolveLiveKeysForApply(runsDir, opts, enabled);
@@ -381,7 +400,7 @@ function applyRetention(runsDir, settings, opts) {
   if (!enabled) {
     return {
       deleted: false,
-      reason: 'dry-run: schedulerRunLogRetention.enabled is not true (or has no policy)',
+      reason: 'dry-run: schedulerRunLogRetention is disabled (enabled !== true, or has no policy)',
       report,
     };
   }
@@ -424,8 +443,8 @@ function applyRetention(runsDir, settings, opts) {
  * applyRetention's own internal queueStore fallback (resolveLiveKeysForApply
  * above), which exists only as a defensive net for callers who forget to
  * thread live-job info through, not as this module's primary path. Deletion
- * still only happens when the read config carries an explicit
- * schedulerRunLogRetention.enabled === true (see isRetentionEnabled).
+ * happens unless the read config opts out with
+ * schedulerRunLogRetention.enabled === false (see isRetentionEnabled).
  *
  * Intended to be called once per app boot (see index.cjs's deferred 30s
  * startup timer, alongside finalizeClosedDays) — never on its own timer.
@@ -438,6 +457,8 @@ function runBootSweep(opts) {
 }
 
 module.exports = {
+  DEFAULT_RUN_LOG_RETENTION,
+  resolveRetentionConfig,
   LIVE_STATUSES,
   isLiveJob,
   liveKeysFromJobs,

package/src/main/lib/scheduler/schedulerBatch.cjs

@@ -15,7 +15,7 @@
 const path = require('node:path');
 const os = require('node:os');
 const { projectJobCap, quietMachineWaitMs } = require('./schedulerConfig.cjs');
-const { bareSlug } = require('../prd/depSlugResolve.cjs');
+const { bareSlug, isSatisfiedDepRow } = require('../prd/depSlugResolve.cjs');
 
 const DEFAULT_PROJECT_CWD = path.join(os.homedir(), 'Projects', 'session-manager');
 
@@ -127,20 +127,16 @@ function findUnresolvableDepRoots(projectJobs, satisfiedSlugs = new Set()) {
 
 function findBlockingDep(job, projectJobs, satisfiedSlugs = new Set()) {
   const { rowsForDep, isKnownSatisfied } = makeDepResolver(projectJobs, satisfiedSlugs);
-  // A dep row is blocking unless it's 'completed', OR it's a 'skipped' row
-  // stamped `needsReviewAutoResolvedSkip` — the bounded needs_review
-  // auto-resolve terminal decision (scheduler.cjs's
-  // applyNeedsReviewAutoResolve). That skip is deliberately NOT the
+  // A dep row is blocking unless isSatisfiedDepRow — 'completed', or a
+  // `needsReviewAutoResolvedSkip` skip. That skip is deliberately NOT the
   // "PRD source vanished, a human must author a fresh PRD" skip the
-  // heldBySkippedDep messaging above describes — it already got every
-  // bounded chance to resolve itself, so treating it as a permanent
-  // dependsOn block would defeat the whole point of that auto-resolve pass
-  // (a chain that never drains without an operator).
-  const isSatisfiedRow = (dep) => dep.status === 'completed'
-    || (dep.status === 'skipped' && dep.needsReviewAutoResolvedSkip === true);
+  // heldBySkippedDep messaging describes — it already got every bounded
+  // chance to resolve itself, so treating it as a permanent dependsOn block
+  // would defeat the auto-resolve pass. runVerify.checkDeps MUST use the same
+  // predicate, or every run of the dependent is downgraded and re-dispatched.
   return (job.dependsOn ?? []).find((slug) => {
     const rows = rowsForDep(slug);
-    if (rows.length > 0) return rows.some((dep) => !isSatisfiedRow(dep));
+    if (rows.length > 0) return rows.some((dep) => !isSatisfiedDepRow(dep));
     return !isKnownSatisfied(slug);
   });
 }

package/src/main/lib/telemetry/telemetryClient.cjs

@@ -647,18 +647,20 @@ function describeFailureStatus(status) {
   return status === 0 ? 'network error' : `HTTP ${status}`;
 }
 
-function applyFailureBackoff(status) {
+function applyFailureBackoff(status, channel) {
   if (status === 429 || status === 0 || status >= 500) {
     S.consecutiveFailures += 1;
     const ms = Math.min(BACKOFF_BASE_MS * (2 ** (S.consecutiveFailures - 1)), BACKOFF_MAX_MS);
     S.backoffUntil = Date.now() + ms;
     S.lastError = { status, message: describeFailureStatus(status), at: Date.now() };
+    logWarn('telemetry send failed', { channel, status, consecutiveFailures: S.consecutiveFailures, backoffMs: ms });
     return;
   }
   if (status >= 400 && status < 500) {
     // Malformed-contract circuit breaker (includes 401) — not retried.
     S.disabledForProcess = true;
     S.lastError = { status, message: describeFailureStatus(status), at: Date.now() };
+    logWarn('telemetry disabled for process', { status });
   }
 }
 
@@ -705,7 +707,7 @@ async function flushImpl(reason) {
             result.sent.push(r.recordId);
           } else {
             result.failed.push(r.recordId);
-            applyFailureBackoff(res.status);
+            applyFailureBackoff(res.status, channel);
             sawFailure = true;
             break;
           }
@@ -726,7 +728,7 @@ async function flushImpl(reason) {
           }
         } else {
           for (const r of batch) result.failed.push(r.recordId);
-          applyFailureBackoff(res.status);
+          applyFailureBackoff(res.status, channel);
           sawFailure = true;
           break;
         }
@@ -739,7 +741,9 @@ async function flushImpl(reason) {
     if (safeReason === 'daily' && result.failed.length === 0) {
       S.settings = await telemetrySettings.save({ lastDailyFlushAt: new Date().toISOString() });
     }
-  } catch { /* fail-inert */ }
+  } catch (e) {
+    logWarn('telemetry flush threw', { error: e && e.message ? e.message : String(e) });
+  }
   S.lastFlushAt = Date.now();
   S.lastFlushReason = safeReason;
   return result;

package/src/main/lib/util/atomicFs.cjs

@@ -105,7 +105,49 @@ function readJsonOrSync(file, fallback) {
   }
 }
 
+function defaultIsPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e?.code === 'EPERM'; // exists but owned by someone else
+  }
+}
+
+/**
+ * Remove orphaned `<file>.tmp-<pid>-<ts>-<rand>` files left by crashed
+ * writers. Direct children of `dir` only (no recursion); a file goes only when
+ * its mtime is older than `olderThanMs` AND its embedded pid is not alive.
+ * `.corrupt-*` / `.bak*` forensics never match. Never throws.
+ */
+function sweepStaleTmpFiles(dir, { olderThanMs = 3600000, isPidAlive = defaultIsPidAlive } = {}) {
+  const removed = [];
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return { removed };
+  }
+  const now = Date.now();
+  for (const name of names) {
+    try {
+      const m = /\.tmp-(\d+)-/.exec(name);
+      if (!m) continue;
+      if (/\.(corrupt|bak)/.test(name)) continue;
+      const full = path.join(dir, name);
+      const st = fs.lstatSync(full);
+      if (!st.isFile()) continue;
+      if (now - st.mtimeMs <= olderThanMs) continue;
+      if (isPidAlive(Number(m[1]))) continue;
+      fs.unlinkSync(full);
+      removed.push(full);
+    } catch { /* per-file errors are skipped */ }
+  }
+  return { removed };
+}
+
 module.exports = {
+  sweepStaleTmpFiles,
   tmpPathFor,
   writeTextAtomic,
   writeTextAtomicSync,

package/src/main/lib/util/loopDelay.cjs

@@ -11,7 +11,7 @@ const { monitorEventLoopDelay } = require('node:perf_hooks');
 
 const LOOP_DELAY_RESOLUTION_MS = 20;
 // A single beat whose worst loop delay exceeds this is a visible main-thread stall.
-const LOOP_STALL_WARN_MS = 250;
+const LOOP_STALL_WARN_MS = 1000;
 
 const NS_PER_MS = 1e6;
 const toMs = (ns) => Math.round(ns / NS_PER_MS * 10) / 10;