claude-code-session-manager 0.119.1 → 0.120.0

package/src/main/lib/opsRetentionSettings.cjs

@@ -0,0 +1,183 @@
+/**
+ * opsRetentionSettings — machine-level retention policy for the ops sweeps.
+ *
+ * Storage: ~/.claude/session-manager/ops-retention.json
+ * Shape (DEFAULTS): { runLogs:{maxAgeDays,keepPerSlug}, runsArchiveDays, auditLogMonths,
+ *   reservedMarkersKeep }
+ * Archived transcripts are kept forever (fixed policy, not a setting).
+ *
+ * Top-level in lib/ (no domain fits: read by scheduler, telemetry and epic sweeps alike).
+ * preview() runs the sweeps' own eligibility code in dry-run mode — it deletes nothing.
+ * Modelled on updaterSettings.cjs: frozen DEFAULTS, never-throwing read, strict write.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const atomicFs = require('./util/atomicFs.cjs');
+
+const DEFAULTS = Object.freeze({
+  runLogs: Object.freeze({ maxAgeDays: 14, keepPerSlug: 3 }),
+  runsArchiveDays: 30,
+  auditLogMonths: 6,
+  reservedMarkersKeep: 100,
+});
+
+// [min, max] per integer field; out-of-range values clamp, non-integers round.
+const BOUNDS = Object.freeze({
+  'runLogs.maxAgeDays': [3, 3650],
+  'runLogs.keepPerSlug': [1, 1000],
+  runsArchiveDays: [1, 3650],
+  auditLogMonths: [1, 120],
+  reservedMarkersKeep: [1, 100000],
+});
+
+function storePath() {
+  return path.join(require('./scheduler/schedulerPaths.cjs').claudeHome(), 'session-manager', 'ops-retention.json');
+}
+
+const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+
+function clamp(key, v) {
+  const [min, max] = BOUNDS[key];
+  return Math.min(max, Math.max(min, Math.round(v)));
+}
+
+/**
+ * Strict patch validation (used by write() and the IPC set handler). Returns a
+ * partial settings object with clamped integers; throws on unknown keys,
+ * or wrong types.
+ */
+function validatePatch(patch) {
+  if (!isObj(patch)) throw new Error('Invalid ops retention config');
+  const out = {};
+  const num = (key, v) => {
+    if (typeof v !== 'number' || !Number.isFinite(v)) throw new Error(`Invalid ops retention config: ${key}`);
+    return clamp(key, v);
+  };
+  for (const [k, v] of Object.entries(patch)) {
+    if (k === 'runLogs') {
+      if (!isObj(v)) throw new Error('Invalid ops retention config: runLogs');
+      out.runLogs = {};
+      for (const [rk, rv] of Object.entries(v)) {
+        if (rk !== 'maxAgeDays' && rk !== 'keepPerSlug') throw new Error(`Invalid ops retention config: runLogs.${rk}`);
+        out.runLogs[rk] = num(`runLogs.${rk}`, rv);
+      }
+    } else if (k === 'runsArchiveDays' || k === 'auditLogMonths' || k === 'reservedMarkersKeep') {
+      out[k] = num(k, v);
+    } else {
+      throw new Error(`Invalid ops retention config: unknown key ${k}`);
+    }
+  }
+  return out;
+}
+
+/** Lenient field-by-field sanitize of on-disk data: bad fields are dropped, not fatal. */
+function sanitizeStored(data) {
+  if (!isObj(data)) return null;
+  const out = {};
+  const int = (key, v) => (typeof v === 'number' && Number.isFinite(v) ? clamp(key, v) : undefined);
+  if (isObj(data.runLogs)) {
+    const m = int('runLogs.maxAgeDays', data.runLogs.maxAgeDays);
+    const k = int('runLogs.keepPerSlug', data.runLogs.keepPerSlug);
+    if (m !== undefined || k !== undefined) {
+      out.runLogs = {
+        maxAgeDays: m !== undefined ? m : DEFAULTS.runLogs.maxAgeDays,
+        keepPerSlug: k !== undefined ? k : DEFAULTS.runLogs.keepPerSlug,
+      };
+    }
+  }
+  for (const key of ['runsArchiveDays', 'auditLogMonths', 'reservedMarkersKeep']) {
+    const v = int(key, data[key]);
+    if (v !== undefined) out[key] = v;
+  }
+  return out;
+}
+
+/** What is explicitly stored (sanitized), or null when absent/corrupt. Never throws. */
+function readStored() {
+  try {
+    const raw = JSON.parse(fs.readFileSync(storePath(), 'utf8'));
+    return sanitizeStored(raw);
+  } catch (e) {
+    if (e.code !== 'ENOENT') console.warn('[opsRetentionSettings] read failed:', e.message);
+    return null;
+  }
+}
+
+function withDefaults(stored) {
+  const s = stored || {};
+  return {
+    runLogs: { ...DEFAULTS.runLogs, ...(s.runLogs || {}) },
+    runsArchiveDays: s.runsArchiveDays ?? DEFAULTS.runsArchiveDays,
+    auditLogMonths: s.auditLogMonths ?? DEFAULTS.auditLogMonths,
+    reservedMarkersKeep: s.reservedMarkersKeep ?? DEFAULTS.reservedMarkersKeep,
+  };
+}
+
+/** Effective settings. Never throws: missing/corrupt file yields DEFAULTS. */
+function read() {
+  return withDefaults(readStored());
+}
+
+/** Validate + merge `patch` over the current settings and persist the full object. */
+function write(patch) {
+  const valid = validatePatch(patch);
+  const cur = read();
+  const next = {
+    ...cur,
+    ...valid,
+    runLogs: { ...cur.runLogs, ...(valid.runLogs || {}) },
+  };
+  atomicFs.writeJsonAtomicSync(storePath(), next, { mode: 0o600 });
+  return next;
+}
+
+/**
+ * Dry-run report of what each policy would free, via the sweeps' own
+ * eligibility code. Read-only. opts: { now, runsDir, plansRoot, jobs, liveKeys }.
+ */
+function preview(opts) {
+  const o = opts || {};
+  const schedulerPaths = require('./scheduler/schedulerPaths.cjs');
+  const runLogRetention = require('./scheduler/runLogRetention.cjs');
+  const staleTmpSweep = require('./scheduler/staleTmpSweep.cjs');
+  const s = read();
+  const now = typeof o.now === 'number' ? o.now : Date.now();
+  const runsDir = o.runsDir || schedulerPaths.runsDir();
+  const plansRoot = o.plansRoot || schedulerPaths.scheduledPlansRoot();
+
+  let liveKeys = o.liveKeys;
+  if (!liveKeys) {
+    let jobs = o.jobs;
+    if (!jobs) {
+      try {
+        jobs = require('./scheduler/queueStore.cjs').readMergedSync().jobs || [];
+      } catch {
+        jobs = [];
+      }
+    }
+    liveKeys = runLogRetention.liveKeysFromJobs(jobs, { runsDir });
+  }
+  const report = runLogRetention.computeReport(runsDir, { ...s.runLogs }, { now, liveKeys });
+  const archive = staleTmpSweep.pruneRunsArchive(path.join(plansRoot, 'runs-archive'), {
+    maxAgeDays: s.runsArchiveDays,
+    now,
+    dryRun: true,
+  });
+  const tmp = staleTmpSweep.sweepStaleTmp(plansRoot, { now, dryRun: true });
+  return {
+    runLogs: { files: report.eligible.reduce((n, e) => n + e.removeFiles.length, 0) + report.dodFiles.length, bytes: report.eligibleSummary.bytes },
+    runsArchive: { entries: archive.removedFiles, bytes: archive.freedBytes },
+    tmp: { files: tmp.removedFiles, bytes: tmp.freedBytes },
+  };
+}
+
+function registerIpc(ipcMain) {
+  ipcMain.handle('opsRetention:get', () => read());
+  ipcMain.handle('opsRetention:set', (_e, patch) => write(patch));
+  ipcMain.handle('opsRetention:preview', () => preview());
+}
+
+module.exports = { storePath, read, readStored, write, validatePatch, preview, registerIpc, DEFAULTS, BOUNDS };

package/src/main/lib/prd/prdWorktreeReach.cjs

@@ -3,8 +3,8 @@
  *
  * Incident: burrow PRD 1516-fb-bilko-first-pumpkin named a gitignored runtime path by RELATIVE
  * path (downloads/fb-tracker.db) and an install-cron.sh that baked a worktree path. Scheduled
- * PRDs run in an isolated git job worktree holding only tracked files plus symlinked dependency
- * dirs (DEFAULT_DEP_DIRS), so that path pointed at a file that did not exist there and the job
+ * PRDs run in an isolated git job worktree holding only tracked files plus symlinked or (pnpm) worktree-local
+ * dependency dirs (DEFAULT_DEP_DIRS), so that path pointed at a file that did not exist there and the job
  * parked needs_human.
  *
  * Two exports: `extractRepoPathCandidates(text)` pulls repo-relative path-looking tokens out of

package/src/main/lib/prd/workTypeLibrary.cjs

@@ -27,6 +27,8 @@ const WORK_TYPES = Object.freeze([
   'discussion',
   'build',
   'project-home-builder',
+  'art',
+  'portfolio',
 ]);
 
 const WorkTypeSchema = z.enum(WORK_TYPES);
@@ -37,17 +39,19 @@ const WorkTypeSchema = z.enum(WORK_TYPES);
 // legacy-drop preprocessing.
 const LEGACY_WORK_TYPES = Object.freeze(['bilko-host-publisher']);
 
-// A 'discussion'-tagged ticket never reaches PRD authoring (a domain
+// 'discussion' and 'portfolio' tickets never reach PRD authoring (a domain
 // invariant unrelated to the Epic/PRD tag unification above), so the PRD
 // frontmatter `tag` field — parsed in prdFrontmatter.cjs/.ts and patched via
-// ipcSchemas.cjs's adminPrdFrontmatterPatch — excludes it even though
+// ipcSchemas.cjs's adminPrdFrontmatterPatch — excludes them even though
 // WorkTypeSchema itself (used at PRD-create time) does not.
-const PRD_WORK_TYPES = Object.freeze(WORK_TYPES.filter((t) => t !== 'discussion'));
+const NON_PRD_WORK_TYPES = Object.freeze(['discussion', 'portfolio']);
+const PRD_WORK_TYPES = Object.freeze(WORK_TYPES.filter((t) => !NON_PRD_WORK_TYPES.includes(t)));
 const PrdWorkTypeSchema = z.enum(PRD_WORK_TYPES);
 
 module.exports = {
   WORK_TYPES,
   WorkTypeSchema,
+  NON_PRD_WORK_TYPES,
   PRD_WORK_TYPES,
   PrdWorkTypeSchema,
   LEGACY_WORK_TYPES,

package/src/main/lib/process/procGroupRss.cjs

@@ -0,0 +1,61 @@
+// @ts-check
+'use strict';
+
+/**
+ * procGroupRss.cjs — summed resident memory (MB) of every process in a
+ * process group, read from /proc (Linux only).
+ *
+ * Why: the scheduler's memory gate double-counted running jobs (2026-10-18).
+ * Each job reserves 2500 MB, but part of that is already consumed and thus
+ * already missing from MemAvailable; subtracting the full reservation again
+ * counts it twice. Scheduler jobs are spawned `detached: true`, so a job's
+ * pid leads its own process group and its tsc/vite/node children share that
+ * pgid — summing the group's RSS tells the gate how much is already used.
+ *
+ * Parsing: /proc/<pid>/stat is `pid (comm) state ppid pgrp ... rss ...` and
+ * comm may contain spaces and parentheses, so split only after the LAST ')'.
+ * In the remainder (0-based): state=0, ppid=1, pgrp=2, rss=21 (pages).
+ */
+
+const fs = require('node:fs');
+
+const PGRP_IDX = 2;
+const RSS_IDX = 21;
+
+/**
+ * @param {number} pgid
+ * @param {{ procRoot?: string, pageSizeKb?: number }} [opts]
+ * @returns {number} integer MB (floor); 0 on any non-applicable/failed case
+ */
+function processGroupRssMb(pgid, opts = {}) {
+  if (!Number.isInteger(pgid) || pgid <= 0) return 0;
+  if (process.platform !== 'linux') return 0;
+  const procRoot = opts.procRoot ?? '/proc';
+  const pageSizeKb = opts.pageSizeKb ?? 4;
+
+  let names;
+  try {
+    names = fs.readdirSync(procRoot);
+  } catch {
+    return 0;
+  }
+
+  let totalKb = 0;
+  for (const name of names) {
+    if (!/^\d+$/.test(name)) continue;
+    try {
+      const stat = fs.readFileSync(`${procRoot}/${name}/stat`, 'utf8');
+      const close = stat.lastIndexOf(')');
+      if (close < 0) continue;
+      const fields = stat.slice(close + 1).trim().split(/\s+/);
+      if (Number(fields[PGRP_IDX]) !== pgid) continue;
+      const rssPages = Number(fields[RSS_IDX]);
+      if (Number.isFinite(rssPages) && rssPages > 0) totalKb += rssPages * pageSizeKb;
+    } catch {
+      // vanished or unreadable entry — skip it
+    }
+  }
+  return Math.floor(totalKb / 1024);
+}
+
+module.exports = { processGroupRssMb };

package/src/main/lib/scheduler/queueHistory.cjs

@@ -111,9 +111,72 @@ function partitionJobs(jobs, nowMs, opts = {}) {
   return { hot, toArchive };
 }
 
+const SLIM_ARRAY_FIELDS = ['preRunDirtyPaths', 'guardBaseline', 'leftoverPaths'];
+const SALVAGE_PATCH_MAX_BYTES = 2048;
+// Dedupe only needs recent rows: a crash-replay re-submits the batch that was
+// just appended, so the tail of the file always contains its keys.
+const DEDUPE_TAIL_BYTES = 2 * 1024 * 1024;
+
 /**
- * Append-only JSONL write, deduped by slug+runId against what's already on
- * disk. The dedupe exists for crash-safety: reconcile() appends BEFORE
+ * Pure: returns a copy of `row` with the bulky snapshot arrays
+ * (preRunDirtyPaths, guardBaseline, leftoverPaths) replaced by `<field>Count`,
+ * and a salvagePatch string over 2 KB replaced by `salvagePatchBytes`. Every
+ * other field passes through unchanged. Rows without those fields are
+ * returned as-is (same shape, no extra keys).
+ */
+function slimHistoryRow(row) {
+  if (!row || typeof row !== 'object') return row;
+  let out = row;
+  const slim = () => (out === row ? (out = { ...row }) : out);
+  for (const f of SLIM_ARRAY_FIELDS) {
+    if (Array.isArray(row[f])) {
+      const o = slim();
+      o[`${f}Count`] = row[f].length;
+      delete o[f];
+    }
+  }
+  if (typeof row.salvagePatch === 'string') {
+    const bytes = Buffer.byteLength(row.salvagePatch, 'utf8');
+    if (bytes > SALVAGE_PATCH_MAX_BYTES) {
+      const o = slim();
+      o.salvagePatchBytes = bytes;
+      delete o.salvagePatch;
+    }
+  }
+  return out;
+}
+
+/** Text of the last `maxBytes` of a file, cut to whole lines ('' if absent). */
+async function readTailText(target, maxBytes) {
+  let fh;
+  try {
+    fh = await fsp.open(target, 'r');
+  } catch (e) {
+    if (e.code === 'ENOENT') return '';
+    throw e;
+  }
+  try {
+    const { size } = await fh.stat();
+    if (size === 0) return '';
+    const len = Math.min(maxBytes, size);
+    const start = size - len;
+    const buf = Buffer.alloc(len);
+    await fh.read(buf, 0, len, start);
+    let text = buf.toString('utf8');
+    if (start > 0) {
+      // Window may begin mid-line; drop the partial first fragment.
+      const nl = text.indexOf('\n');
+      text = nl === -1 ? '' : text.slice(nl + 1);
+    }
+    return text;
+  } finally {
+    await fh.close();
+  }
+}
+
+/**
+ * Append-only JSONL write, deduped by slug+runId against the last 2 MB of
+ * what's already on disk. Rows are slimmed (slimHistoryRow) before writing. The dedupe exists for crash-safety: reconcile() appends BEFORE
  * dropping archived jobs from state.jobs, so a crash between those two steps
  * replays the same batch through partitionJobs on the next boot — dedupe
  * here is what stops that replay from double-writing history.
@@ -133,12 +196,7 @@ async function appendHistory(entries) {
 
   let appended = 0;
   for (const [target, group] of byPath) {
-    let existingText = '';
-    try {
-      existingText = await fsp.readFile(target, 'utf8');
-    } catch (e) {
-      if (e.code !== 'ENOENT') throw e;
-    }
+    const existingText = await readTailText(target, DEDUPE_TAIL_BYTES);
 
     const existingKeys = new Set();
     if (existingText) {
@@ -156,7 +214,7 @@ async function appendHistory(entries) {
     if (fresh.length === 0) continue;
 
     await fsp.mkdir(path.dirname(target), { recursive: true });
-    const text = fresh.map((e) => JSON.stringify(e)).join('\n') + '\n';
+    const text = fresh.map((e) => JSON.stringify(slimHistoryRow(e))).join('\n') + '\n';
     await fsp.appendFile(target, text, 'utf8');
     appended += fresh.length;
   }
@@ -407,6 +465,7 @@ module.exports = {
   historyPath,
   partitionJobs,
   appendHistory,
+  slimHistoryRow,
   readHistory,
   historyTerminalBySlug,
   completedSlugsForCwd,

package/src/main/lib/scheduler/runLogRetention.cjs

@@ -24,21 +24,32 @@
  * directory from being fully removed, but never blocks removal of a claimed
  * slug's own files.
  *
- * SAFETY MODEL (the point of this module — see the PRD that added it):
+ * FILE KINDS. Each (runId, slug) entry owns two kinds of file:
+ *   - BULK: `<slug>.log`, `<slug>.supervisor.json`, `<slug>*.patch`,
+ *     `root-cause-<slug>.md` — the space hogs.
+ *   - METADATA: `<slug>.meta.json`, `<slug>.verdicts.json`,
+ *     `<slug>.outcome.json` — tiny; terminalRunOutcome.cjs reads the newest
+ *     run's copies as the re-run guard fallback.
+ *
+ * SEMANTICS (age-driven):
  *   - Retention is ON by default (DEFAULT_RUN_LOG_RETENTION) when settings
  *     carry no `schedulerRunLogRetention`. An explicit `enabled: false` (or a
  *     config with no non-empty policy) opts out: computeReport, and
  *     applyRetention when opted out, only READ the filesystem.
- *   - An entry belonging to a job that is currently live — status `pending`
- *     (queued), `running`, `needs_review`, or `investigating` (the exact
- *     literals scheduler.cjs uses; see LIVE_STATUSES) — is never eligible,
- *     regardless of age or count policy.
- *   - The most recent entry for any given slug is never eligible, even past
- *     an age cap — every PRD keeps at least its latest evidence.
- *   - Age and count policies are COMBINABLE and combine conservatively
- *     (AND): when both are set, an entry must clear both floors to be
- *     eligible. A policy is a safety floor, not a removal trigger — setting
- *     one dimension should never make the other one weaker.
+ *   - A LIVE entry (status pending/running/needs_review/investigating — see
+ *     LIVE_STATUSES) loses nothing, regardless of age or count.
+ *   - With `maxAgeDays` set, age alone decides: a non-live entry older than
+ *     maxAgeDays loses its BULK files even when it is the slug's newest/only
+ *     run. `keepPerSlug` applies within the age window only — entries younger
+ *     than maxAgeDays are always kept, so it never rescues an old entry.
+ *   - With only `keepPerSlug` set (no maxAgeDays), bulk files of entries ranked
+ *     beyond the newest N are eligible.
+ *   - METADATA is removed only from entries that are bulk-eligible AND not the
+ *     slug's newest run: the newest run of every slug always keeps its
+ *     meta/verdicts/outcome files.
+ *   - A directory left holding only definition-of-done-*.md files (batch-keyed,
+ *     claimed by no entry) whose mtime is older than maxAgeDays is removed with
+ *     them; a directory left empty is removed.
  */
 
 const fs = require('node:fs');
@@ -135,19 +146,26 @@ function scanRunEntries(runsDir) {
     const metaFiles = files.filter((f) => f.endsWith(META_SUFFIX));
     for (const metaFile of metaFiles) {
       const slug = metaFile.slice(0, -META_SUFFIX.length);
-      const relatedNames = files.filter(
-        (f) => f === metaFile || f === `${slug}.log` || f === `${slug}.supervisor.json` || f === `root-cause-${slug}.md`
-      );
+      const isBulk = (f) =>
+        f === `${slug}.log` ||
+        f === `${slug}.supervisor.json` ||
+        f === `root-cause-${slug}.md` ||
+        (f.startsWith(`${slug}.`) && f.endsWith('.patch'));
+      const isMetadata = (f) =>
+        f === metaFile || f === `${slug}.verdicts.json` || f === `${slug}.outcome.json`;
+      const relatedNames = files.filter((f) => isBulk(f) || isMetadata(f));
 
       let sizeBytes = 0;
       let mtimeMs = null;
       const filePaths = [];
+      const fileInfos = [];
       for (const name of relatedNames) {
         const fp = path.join(dir, name);
         filePaths.push(fp);
         try {
           const st = fs.statSync(fp);
           sizeBytes += st.size;
+          fileInfos.push({ path: fp, size: st.size, kind: isBulk(name) ? 'bulk' : 'metadata' });
           if (mtimeMs === null || st.mtimeMs > mtimeMs) mtimeMs = st.mtimeMs;
         } catch {
           // file vanished mid-scan — skip its contribution
@@ -168,6 +186,7 @@ function scanRunEntries(runsDir) {
         slug,
         dir,
         files: filePaths,
+        fileInfos,
         sizeBytes,
         timeMs: recordedAtMs ?? mtimeMs ?? 0,
       });
@@ -206,10 +225,23 @@ function computeEligibility(entries, policy, opts) {
     const isMostRecent = rank === 0;
     const isLive = liveKeys.has(`${e.slug}|${e.runId}`);
     const ageDays = (now - e.timeMs) / DAY_MS;
-    const ageOk = maxAgeDays == null || ageDays > maxAgeDays;
-    const countOk = keepPerSlug == null || rank >= keepPerSlug;
-    const eligible = hasPolicy && !isLive && !isMostRecent && ageOk && countOk;
-    return { ...e, ageDays, rank, isMostRecent, isLive, eligible };
+    // Age alone decides when set; keepPerSlug only governs count-only policies.
+    const retained = maxAgeDays != null ? !(ageDays > maxAgeDays) : !(rank >= keepPerSlug);
+    const bulkEligible = hasPolicy && !isLive && !retained;
+    const metaEligible = bulkEligible && !isMostRecent;
+    const infos = e.fileInfos || [];
+    const removeFiles = infos.filter((f) => (f.kind === 'bulk' ? bulkEligible : metaEligible));
+    return {
+      ...e,
+      ageDays,
+      rank,
+      isMostRecent,
+      isLive,
+      bulkEligible,
+      metaEligible,
+      removeFiles,
+      eligible: removeFiles.length > 0,
+    };
   });
 }
 
@@ -228,27 +260,66 @@ function computeReport(runsDir, policy, opts) {
   const oldestRunAt = entries.length ? Math.min(...entries.map((e) => e.timeMs)) : null;
 
   const eligible = evaluated.filter((e) => e.eligible);
-  const eligibleBytes = eligible.reduce((sum, e) => sum + e.sizeBytes, 0);
+  let bulkBytes = 0;
+  let metadataBytes = 0;
+  for (const e of eligible) {
+    for (const f of e.removeFiles) {
+      if (f.kind === 'bulk') bulkBytes += f.size;
+      else metadataBytes += f.size;
+    }
+  }
+
+  // A directory is fully removable when, after the eligible files are
+  // unlinked, nothing remains except definition-of-done reports older than
+  // maxAgeDays (which go with it). Any other leftover (a non-eligible entry's
+  // files, an unclaimed file, a young DoD report) keeps the directory alive.
+  const maxAgeDays = policy && policy.maxAgeDays;
+  const removing = new Set();
+  for (const e of eligible) for (const f of e.removeFiles) removing.add(f.path);
 
-  // A directory is fully removable only when every file physically present
-  // in it belongs to an eligible entry — an unclaimed file (a DoD report, or
-  // a slug entry that isn't eligible) keeps the directory itself alive even
-  // though the eligible entries' own files can still be unlinked.
+  let allDirs;
+  try {
+    allDirs = fs.readdirSync(runsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path.join(runsDir, d.name));
+  } catch {
+    allDirs = [];
+  }
   const removableDirs = [];
-  for (const dir of dirSet) {
+  const dodFiles = [];
+  for (const dir of allDirs) {
     let actualFiles;
     try {
       actualFiles = fs.readdirSync(dir);
     } catch {
       continue;
     }
-    if (actualFiles.length === 0) continue;
-    const claimedEligible = new Set();
-    for (const e of evaluated) {
-      if (e.dir !== dir || !e.eligible) continue;
-      for (const fp of e.files) claimedEligible.add(path.basename(fp));
+    if (actualFiles.length === 0) continue; // empty orphans: sweepOrphanDirs
+    const dirDod = [];
+    let removable = true;
+    for (const f of actualFiles) {
+      const fp = path.join(dir, f);
+      if (removing.has(fp)) continue;
+      if (maxAgeDays != null && /^definition-of-done-.*\.md$/.test(f)) {
+        try {
+          const st = fs.statSync(fp);
+          if ((now - st.mtimeMs) / DAY_MS > maxAgeDays) {
+            dirDod.push({ path: fp, size: st.size, kind: 'metadata' });
+            continue;
+          }
+        } catch {
+          // vanished — treat as gone
+          continue;
+        }
+      }
+      removable = false;
+      break;
+    }
+    if (removable) {
+      removableDirs.push(dir);
+      for (const d of dirDod) {
+        dodFiles.push(d);
+        metadataBytes += d.size;
+      }
     }
-    if (actualFiles.every((f) => claimedEligible.has(f))) removableDirs.push(dir);
   }
 
   return {
@@ -262,16 +333,30 @@ function computeReport(runsDir, policy, opts) {
       oldestRunAt,
     },
     eligible,
-    eligibleSummary: { count: eligible.length, bytes: eligibleBytes },
+    eligibleSummary: {
+      count: eligible.length,
+      bytes: bulkBytes + metadataBytes,
+      bulkBytes,
+      metadataBytes,
+    },
+    dodFiles,
     removableDirs,
   };
 }
 
 /**
- * The effective retention config: the caller's `schedulerRunLogRetention`
- * when present, else DEFAULT_RUN_LOG_RETENTION.
+ * The effective retention config: ops-retention.json `runLogs` when stored,
+ * else the caller's `schedulerRunLogRetention` when present, else DEFAULT_RUN_LOG_RETENTION.
  */
 function resolveRetentionConfig(settings) {
+  // Machine-level ops-retention.json wins over the legacy scheduler-machine.json key.
+  // Lazy require: opsRetentionSettings requires this module (preview).
+  try {
+    const stored = require('../opsRetentionSettings.cjs').readStored();
+    if (stored && stored.runLogs) return { enabled: true, policy: { ...stored.runLogs } };
+  } catch {
+    // unreadable settings never block retention — fall through to legacy/default
+  }
   const cfg = settings && settings.schedulerRunLogRetention;
   return cfg == null ? DEFAULT_RUN_LOG_RETENTION : cfg;
 }
@@ -409,16 +494,17 @@ function applyRetention(runsDir, settings, opts) {
   let freedBytes = 0;
   const errors = [];
 
-  for (const entry of report.eligible) {
-    for (const fp of entry.files) {
-      try {
-        const st = fs.statSync(fp);
-        fs.unlinkSync(fp);
-        removedFiles += 1;
-        freedBytes += st.size;
-      } catch (e) {
-        if (e && e.code !== 'ENOENT') errors.push({ path: fp, error: e.message });
-      }
+  const toRemove = [];
+  for (const entry of report.eligible) for (const f of entry.removeFiles) toRemove.push(f.path);
+  for (const f of report.dodFiles) toRemove.push(f.path);
+  for (const fp of toRemove) {
+    try {
+      const st = fs.statSync(fp);
+      fs.unlinkSync(fp);
+      removedFiles += 1;
+      freedBytes += st.size;
+    } catch (e) {
+      if (e && e.code !== 'ENOENT') errors.push({ path: fp, error: e.message });
     }
   }
 

package/src/main/lib/scheduler/schedulerBatch.cjs

@@ -430,9 +430,12 @@ function enqueueTimestamp(job) {
  * nothing. A single project can therefore never drain every free slot while
  * another project with eligible work gets none in the same tick.
  *   1. fewest jobs currently `running` in that project, ascending;
- *   2. tiebreak: the oldest pending job's enqueue timestamp
+ *   2. tiebreak: the oldest DISPATCHABLE pending job's enqueue timestamp
  *      (enqueueTimestamp — createdAt → queuedAt → statusHistory → startedAt),
- *      ascending, unprovable ages last;
+ *      ascending, unprovable ages last. Rows blocked by an unfinished
+ *      dependsOn do NOT count (a project with only blocked rows gets
+ *      Infinity). 2026-10-18: Game-Academy's dep-blocked 02:16Z row kept it
+ *      ahead of Self's runnable 02:50Z rows, so it took every freed slot.
  *   3. final deterministic tiebreak: the project cwd string.
  *
  * WHY NOT THE PRD NUMBER. The previous sort key was each project's lowest
@@ -576,8 +579,9 @@ function pickNextBatch(allJobs, running, freeSlots, quietOpts = {}) {
       projectJobs.filter((j) => running.has(j.slug)).map((j) => j.slug),
     );
     const runningCount = projectJobs.filter((j) => j.status === 'running').length;
+    const satisfied = satisfiedSlugsFor(cwd);
     const oldestPendingMs = projectJobs
-      .filter(pickable)
+      .filter((j) => pickable(j) && !findBlockingDep(j, projectJobs, satisfied))
       .reduce((min, j) => Math.min(min, enqueueTimestamp(j)), Infinity);
     candidates.push({ cwd, view, runningSlugsInProject, runningCount, oldestPendingMs, active: true });
   }