claude-code-session-manager 0.121.0 → 0.122.1

package/src/main/lib/epic/delegationReadiness.cjs

@@ -303,18 +303,84 @@ async function checkSchedulerMcpLive({ cwd, homeDir, schedulerMcpCheck }) {
   };
 }
 
+const DEV_PLUGIN_MARKETPLACE = 'session-manager';
+const DEV_PLUGIN_REINSTALL_FIX = 'Restart Session Manager to reinstall the session-manager-dev plugin';
+
+/** installPath of the dev plugin from installed_plugins.json, or null. */
+function readDevPluginInstallPath(homeDir) {
+  const data = readJsonOrSync(path.join(homeDir, '.claude', 'plugins', 'installed_plugins.json'), null);
+  const entries = data?.plugins?.[DEV_PLUGIN_ENABLED_KEY];
+  if (!Array.isArray(entries)) return null;
+  for (const e of entries) {
+    if (e && typeof e.installPath === 'string' && e.installPath) return e.installPath;
+  }
+  return null;
+}
+
+/** Source path of the 'session-manager' marketplace from known_marketplaces.json, or null. */
+function readDevMarketplacePath(homeDir) {
+  const data = readJsonOrSync(path.join(homeDir, '.claude', 'plugins', 'known_marketplaces.json'), null);
+  const m = data?.[DEV_PLUGIN_MARKETPLACE];
+  const p = m?.source?.path ?? m?.installLocation;
+  return typeof p === 'string' && p ? p : null;
+}
+
 function checkDevPlugin({ homeDir }) {
   const settings = readJsonOrSync(path.join(homeDir, '.claude', 'settings.json'), null);
-  const ok = settings?.enabledPlugins?.[DEV_PLUGIN_ENABLED_KEY] === true;
+  const enabled = settings?.enabledPlugins?.[DEV_PLUGIN_ENABLED_KEY] === true;
+  const base = { id: 'dev-plugin', label: 'session-manager-dev plugin enabled' };
+
+  if (!enabled) {
+    return {
+      ...base,
+      ok: false,
+      detail: `${DEV_PLUGIN_ENABLED_KEY} missing from ~/.claude/settings.json enabledPlugins`,
+      fix: 'Enable in Plugins tab: session-manager-dev (Session Manager)',
+    };
+  }
+
+  const installPath = readDevPluginInstallPath(homeDir);
+  if (!installPath) {
+    return {
+      ...base,
+      ok: false,
+      detail: `${DEV_PLUGIN_ENABLED_KEY} enabled but not recorded in ~/.claude/plugins/installed_plugins.json`,
+      fix: DEV_PLUGIN_REINSTALL_FIX,
+    };
+  }
+  const skillFile = path.join(installPath, 'skills', 'develop', 'SKILL.md');
+  if (!fs.existsSync(skillFile)) {
+    return {
+      ...base,
+      ok: false,
+      detail: `${DEV_PLUGIN_ENABLED_KEY} enabled but ${skillFile} is missing`,
+      fix: DEV_PLUGIN_REINSTALL_FIX,
+    };
+  }
+
+  const marketplacePath = readDevMarketplacePath(homeDir);
+  if (!marketplacePath) {
+    return {
+      ...base,
+      ok: false,
+      detail: `'${DEV_PLUGIN_MARKETPLACE}' marketplace not registered in ~/.claude/plugins/known_marketplaces.json`,
+      fix: DEV_PLUGIN_REINSTALL_FIX,
+    };
+  }
+  if (!fs.existsSync(marketplacePath)) {
+    return {
+      ...base,
+      ok: false,
+      detail: `'${DEV_PLUGIN_MARKETPLACE}' marketplace folder ${marketplacePath} no longer exists`,
+      fix: DEV_PLUGIN_REINSTALL_FIX,
+    };
+  }
 
   return {
-    id: 'dev-plugin',
-    label: 'session-manager-dev plugin enabled',
-    ok,
-    detail: ok
-      ? `${DEV_PLUGIN_ENABLED_KEY} enabled in ~/.claude/settings.json`
-      : `${DEV_PLUGIN_ENABLED_KEY} missing from ~/.claude/settings.json enabledPlugins`,
-    fix: ok ? null : 'Enable in Plugins tab: session-manager-dev (Session Manager)',
+    ...base,
+    ok: true,
+    detail: `${DEV_PLUGIN_ENABLED_KEY} enabled in ~/.claude/settings.json and installed on disk`,
+    fix: null,
   };
 }
 
@@ -795,6 +861,7 @@ async function ensureGuardsInstalled(cwd, { homeDir = os.homedir() } = {}) {
 }
 
 module.exports = {
+  checkDevPlugin,
   checkDelegationReadiness,
   ensureGuardsInstalled,
   logAutoInstallEvent,

package/src/main/lib/mcpToolCatalog.cjs

@@ -111,12 +111,10 @@ const MCP_TOOL_CATALOG = [
       + 'them with `dependsOn` instead.',
     whenToUse: 'Use whenever new work should be queued into an already-approved Epic — this is the /develop path.',
     whenNotToUse: 'TWO DISTINCT FAILURE MODES if this tool is not usable — do not conflate them: '
-      + '(a) this tool call is PRESENT in your tool list but ERRORS as app-not-running / admin '
-      + 'API unreachable — that is the ONLY case where hand-authoring the PRD file directly on '
-      + 'disk is an acceptable DEGRADED, LAST-RESORT fallback; the caller MUST say so explicitly '
-      + 'and visibly in its report (which file, why the tool was unreachable, that it needs '
-      + 'verification) since the server-side validation, atomic NN allocation, and '
-      + 'Epic-existence check this tool performs did not run for that file. '
+      + '(a) this tool call is PRESENT in your tool list but ERRORS — NEVER hand-write a PRD file. '
+      + 'On "not running" (admin API unreachable): stop, ask the human to start the app, then retry the same call. '
+      + 'On "did not answer": the app is busy and the PRD may already exist — check with scheduler_list_prds '
+      + '(no status filter) or retry the same slug. '
       + '(b) this tool is ABSENT from your tool list entirely — you were never offered it, so '
       + 'there is no error to catch. That means the session-manager-scheduler MCP server is not '
       + 'registered for this project: a MISCONFIGURATION, not an offline app. In that case DO '
@@ -127,7 +125,6 @@ const MCP_TOOL_CATALOG = [
     exampleArgs: {
       title: 'Add unit tests for the retry backoff helper',
       cwd: '/home/bilko/Projects/session-manager',
-      estimateMinutes: 10,
       goal: 'Cover retryWithBackoff.cjs edge cases (zero retries, max-delay clamp) that currently have no test.',
       acceptanceCriteria: ['New test file exercises zero-retry and max-delay-clamp cases', 'Typecheck passes', 'Unit tests pass'],
       implementationNotes: 'See src/main/lib/retryWithBackoff.cjs and its existing __tests__ sibling for the pattern to extend.',
@@ -401,7 +398,7 @@ const MCP_RECIPES = [
     title: 'Queue work into an already-approved Epic (/develop)',
     steps: [
       'Confirm an Epic already exists for this work (proposed or active) — scheduler_create_prd never mints one.',
-      'Call scheduler_create_prd with sourcePromptId set to that Epic id, plus title/cwd/estimateMinutes/goal/acceptanceCriteria/implementationNotes.',
+      'Call scheduler_create_prd with sourcePromptId set to that Epic id, plus title/cwd/goal/acceptanceCriteria/implementationNotes/gate/files.',
       'The response has enqueued:false — the queue row is derived by the scheduler\'s next reconcile pass (~1 minute), not by this call.',
       'Optionally call scheduler_list_prds with cwd/status to confirm the PRD picked up a job row.',
     ],

package/src/main/lib/persona-macro/shippedPersonaSeeds.cjs

@@ -124,6 +124,17 @@ const SHIPPED_PERSONA_SEEDS = deepFreeze({
         tools: "Read, Grep, Glob, Bash, Edit, Write",
       },
     },
+    {
+      commit: "2129verify",
+      bodySha256: "82b93c1da9a5e3b7dfcfadd1b4689d988a4bd19de2d897ebd3f3158969d741fc",
+      fm: {
+        description: "Executes exactly one already-scoped PRD at a time, headless, start to finish — reads the PRD's Goal/Acceptance Criteria/Implementation notes and standards.md, implements it, verifies against its own AC, and reports. Has no visibility into the overall plan — that's architect's job. This is the default persona a scheduled PRD runs as: the scheduler resolves a PRD's `agentType` frontmatter field (default `dev-lead`) to this file and launches the headless executor AS this persona via `--append-system-prompt`.",
+        model: "sonnet",
+        effort: "medium",
+        title: "Engineering — Software Engineer",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
   ],
   "project-home-builder": [
     {

package/src/main/lib/prd/prdCreate.cjs

@@ -32,6 +32,7 @@ const { resolveDepSlug, findNearMatches } = require('./depSlugResolve.cjs');
 const { resolveEpicPrdWriteDir } = require('./prdLocations.cjs');
 const { isFixPlanSlug } = require('../scheduler/fixPlanSlug.cjs');
 const { isIncomplete, resolveChainTerminals, isValidPlanId, mintPlanId, resolveInheritedPlanId } = require('./prdDisposition.cjs');
+const { splitFrontmatter } = require('./prdFrontmatter.cjs');
 const { sizingWarnings } = require('./prdSizing.cjs');
 const { execGit } = require('../git/gitExec.cjs');
 const { extractRepoPathCandidates, worktreeReachWarnings } = require('./prdWorktreeReach.cjs');
@@ -88,7 +89,9 @@ function buildPrdBody(input) {
   // No `parallelGroup` frontmatter key (PRD_AUTHORING.md §5) — the NN-
   // filename prefix is the single source of truth for grouping; adding a
   // second one here would let the two drift out of sync.
-  const fmLines = ['---', `title: ${title}`, `cwd: ${cwd}`, `estimateMinutes: ${estimateMinutes}`];
+  const fmLines = ['---', `title: ${title}`, `cwd: ${cwd}`];
+  // Optional: only a finite positive integer is written; absent => budget's 45-min floor.
+  if (Number.isInteger(estimateMinutes) && estimateMinutes > 0) fmLines.push(`estimateMinutes: ${estimateMinutes}`);
   // Provenance stamp (PRD-authoring lockdown): every PRD written through this
   // function — the sole in-process implementation behind both the admin
   // HTTP create-prd route and the renderer's chat:create-prd IPC handler —
@@ -222,7 +225,18 @@ async function worktreeReachAdvisory(input, cwd) {
  * on failure — `status` is the HTTP status code the caller should map errors to
  * (400/409/500), left to the caller since only the HTTP route needs it.
  */
+const inFlightCreates = new Set();
+
 async function createPrd(input, remote) {
+  const ctl = { key: null };
+  try {
+    return await createPrdInner(input, remote, ctl);
+  } finally {
+    if (ctl.key) inFlightCreates.delete(ctl.key);
+  }
+}
+
+async function createPrdInner(input, remote, ctl) {
   // cwd is untrusted AND, since this PRD, optional — a caller inside an
   // Epic's git worktree naturally passes its worktree pwd (or omits cwd
   // entirely and relies on originClaudeSessionId/sourcePromptId). Resolve the
@@ -448,6 +462,16 @@ async function createPrd(input, remote) {
   // Finished rows leave queue.json, so an author can re-issue a landed PRD under a fresh NN.
   // Refused before NN allocation so it burns no number. Fix plans are exempt.
   if (input.sourcePromptId && !isFixPlanSlug(`0-${slug}`)) {
+    const inFlightKey = `${input.sourcePromptId}\u0000${slug}`;
+    if (inFlightCreates.has(inFlightKey)) {
+      return {
+        ok: false,
+        status: 409,
+        error: `A create for slug "${slug}" in this Epic is still in progress — wait for it to finish, then retry the same call`,
+      };
+    }
+    inFlightCreates.add(inFlightKey);
+    ctl.key = inFlightKey;
     let epicDirs = [];
     try {
       const prdsDir = resolveEpicPrdWriteDir(cwd, input.sourcePromptId);
@@ -458,6 +482,28 @@ async function createPrd(input, remote) {
       try { names = await fsp.readdir(dir); } catch { /* missing dir counts as empty */ }
       const dup = names.find((n) => n.endsWith('.md') && n.slice(0, -3).replace(/^\d+-/, '') === slug);
       if (dup) {
+        let existingTitle = null;
+        try {
+          existingTitle = splitFrontmatter(await fsp.readFile(path.join(dir, dup), 'utf8')).fm.title ?? null;
+        } catch { /* unreadable — treat as different */ }
+        if (existingTitle !== null && String(existingTitle).trim() === String(input.title ?? '').trim()) {
+          const existingSlug = dup.slice(0, -3);
+          let enqueuedExisting = false;
+          try {
+            if (typeof remote.getJob === 'function') enqueuedExisting = Boolean(await remote.getJob(existingSlug));
+          } catch { /* non-fatal */ }
+          return {
+            ok: true,
+            alreadyExisted: true,
+            nn: Number((/^(\d+)-/.exec(dup) || [])[1]),
+            filename: dup,
+            prdPath: path.join(dir, dup),
+            epicId: input.sourcePromptId,
+            enqueued: enqueuedExisting,
+            note: 'PRD was not written again: this Epic already has that file with the same title, which usually means an earlier call\'s response was lost, so treat it as created.',
+            warnings: [],
+          };
+        }
         return {
           ok: false,
           status: 409,
@@ -718,6 +764,7 @@ function registerAdminRoute(adminHttp, remote) {
     // Mirror createPrd()'s own honest shape verbatim — never re-add a
     // 'status' field here. See createPrd's return above for why.
     sendJson(res, 200, {
+      ...(result.alreadyExisted ? { alreadyExisted: true } : {}),
       nn: result.nn,
       filename: result.filename,
       prdPath: result.prdPath ?? null,

package/src/main/lib/prd/prdSizing.cjs

@@ -11,7 +11,6 @@
 'use strict';
 
 const SIZING_LIMITS = {
-  estimateMinutes: 15,
   acLines: 8,
   acLineChars: 400,
   bodyChars: 7000,
@@ -30,18 +29,12 @@ const TIMEOUT_CMD_RE = /\btimeout\s+\d+/gi;
  * treated as empty/absent rather than thrown on, since this is advisory only.
  */
 function sizingWarnings(input) {
-  const { estimateMinutes, goal, implementationNotes } = input || {};
+  const { goal, implementationNotes } = input || {};
   const acceptanceCriteria = Array.isArray(input?.acceptanceCriteria) ? input.acceptanceCriteria : [];
   const acLines = acceptanceCriteria.filter((line) => typeof line === 'string');
 
   const warnings = [];
 
-  if (typeof estimateMinutes === 'number' && estimateMinutes > SIZING_LIMITS.estimateMinutes) {
-    warnings.push(
-      `estimateMinutes (${estimateMinutes}) exceeds the ${SIZING_LIMITS.estimateMinutes}-minute sizing limit — split this PRD into smaller work items.`,
-    );
-  }
-
   if (acceptanceCriteria.length > SIZING_LIMITS.acLines) {
     warnings.push(
       `acceptanceCriteria has ${acceptanceCriteria.length} lines, exceeding the ${SIZING_LIMITS.acLines}-line sizing limit — split into smaller, single-purpose PRDs.`,

package/src/main/lib/runSeeders.cjs

@@ -0,0 +1,21 @@
+// Runs first-boot seeders one at a time. `claude plugin install` and
+// `claude mcp add --scope user` both rewrite Claude's config files; run
+// concurrently, one write can drop the other's entry after its marker says done.
+// A failing step is logged and never skips the steps after it.
+
+/**
+ * @param {Array<{ name: string, run: () => Promise<unknown> }>} steps
+ * @returns {Promise<void>}
+ */
+async function runSeedersSerially(steps) {
+  for (const step of steps) {
+    try {
+      await step.run();
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      console.error(`[seed] ${step.name} failed: ${message}`);
+    }
+  }
+}
+
+module.exports = { runSeedersSerially };

package/src/main/lib/scheduler/loopEfficiency.cjs

@@ -0,0 +1,109 @@
+/**
+ * loopEfficiency.cjs — pure calculator for the scheduler's real throughput
+ * metric: validated PRDs per unit of usage, per project.
+ *
+ * Why: the scheduler is bound by the account's usage window, not by slots, so
+ * "verified PRDs per usage %" (and $ per verified PRD) is what matters. Also
+ * makes the "wasted runs <= 5%" target in scheduler-operations.md computable.
+ *
+ * Pure: no I/O, no Date.now(), no mutation of inputs.
+ * Complexity O(R + V + P log P): one pass over runs, one over validations,
+ * then a sort of the P project rows.
+ */
+
+'use strict';
+
+const path = require('path');
+const { COMPLETED_EQUIVALENT_VERDICTS } = require('./terminalRunOutcome.cjs');
+
+/** @param {unknown} t @param {number} fromMs @param {number} toMs */
+function inWindow(t, fromMs, toMs) {
+  return typeof t === 'number' && Number.isFinite(t) && t >= fromMs && t < toMs;
+}
+
+/** @param {unknown} slug */
+function normSlug(slug) {
+  return String(slug == null ? '' : slug).replace(/^\d+-/, '');
+}
+
+/**
+ * @param {{
+ *   runs?: Array<{ cwd: string, slug: string, startedAtMs: number, costUsd?: number, verdict: string | null }>,
+ *   validations?: Array<{ cwd: string, slug: string, verdict: 'VERIFIED' | 'REFUTED', atMs: number }>,
+ *   fromMs: number,
+ *   toMs: number,
+ *   weeklyUtilizationPct?: number | null,
+ * }} input
+ */
+function computeLoopEfficiency({ runs, validations, fromMs, toMs, weeklyUtilizationPct }) {
+  /** @type {Map<string, { cwd: string, runs: number, wastedRuns: number, executorUsd: number, last: Map<string, { atMs: number, verdict: string }> }>} */
+  const byCwd = new Map();
+  const bucket = (/** @type {string} */ cwd) => {
+    let b = byCwd.get(cwd);
+    if (!b) {
+      b = { cwd, runs: 0, wastedRuns: 0, executorUsd: 0, last: new Map() };
+      byCwd.set(cwd, b);
+    }
+    return b;
+  };
+
+  for (const r of runs || []) {
+    if (!r || !inWindow(r.startedAtMs, fromMs, toMs)) continue;
+    const b = bucket(String(r.cwd));
+    b.runs += 1;
+    const v = r.verdict;
+    if (v != null && v !== 'clean' && !COMPLETED_EQUIVALENT_VERDICTS.has(v)) b.wastedRuns += 1;
+    const cost = Number(r.costUsd);
+    if (Number.isFinite(cost)) b.executorUsd += cost;
+  }
+
+  for (const v of validations || []) {
+    if (!v || !inWindow(v.atMs, fromMs, toMs)) continue;
+    const b = bucket(String(v.cwd));
+    const key = normSlug(v.slug);
+    const prev = b.last.get(key);
+    if (!prev || v.atMs >= prev.atMs) b.last.set(key, { atMs: v.atMs, verdict: v.verdict });
+  }
+
+  const rows = [];
+  const totals = { runs: 0, wastedRuns: 0, verified: 0, refuted: 0, executorUsd: 0, wastedRunRate: 0 };
+  for (const b of byCwd.values()) {
+    let verified = 0;
+    let refuted = 0;
+    for (const { verdict } of b.last.values()) {
+      if (verdict === 'VERIFIED') verified += 1;
+      else if (verdict === 'REFUTED') refuted += 1;
+    }
+    rows.push({
+      cwd: b.cwd,
+      project: path.basename(b.cwd),
+      runs: b.runs,
+      wastedRuns: b.wastedRuns,
+      verified,
+      refuted,
+      executorUsd: b.executorUsd,
+      usdPerVerified: verified > 0 ? b.executorUsd / verified : null,
+    });
+    totals.runs += b.runs;
+    totals.wastedRuns += b.wastedRuns;
+    totals.verified += verified;
+    totals.refuted += refuted;
+    totals.executorUsd += b.executorUsd;
+  }
+  totals.wastedRunRate = totals.runs > 0 ? totals.wastedRuns / totals.runs : 0;
+
+  rows.sort((a, b) => b.executorUsd - a.executorUsd || (a.project < b.project ? -1 : a.project > b.project ? 1 : 0));
+
+  const pct = typeof weeklyUtilizationPct === 'number' ? weeklyUtilizationPct : NaN;
+  const hasPct = Number.isFinite(pct) && pct > 0;
+  return {
+    fromMs,
+    toMs,
+    rows,
+    totals,
+    weeklyUtilizationPct: weeklyUtilizationPct == null ? null : weeklyUtilizationPct,
+    verifiedPerUsagePct: hasPct ? totals.verified / pct : null,
+  };
+}
+
+module.exports = { computeLoopEfficiency };

package/src/main/lib/scheduler/queueHistory.cjs

@@ -11,7 +11,8 @@
 // disk. appendHistory/readHistory own the actual fs I/O.
 
 const path = require('path');
-const fsp = require('fs').promises;
+const fs = require('fs');
+const fsp = fs.promises;
 const { HISTORY_RETENTION_MS } = require('./schedulerConfig.cjs');
 const { projectHistoryPath, stateCwds } = require('./queueStore.cjs');
 const { queueHistoryPath } = require('./schedulerPaths.cjs');
@@ -288,6 +289,47 @@ async function readHistoryFile(target, cap) {
   }
 }
 
+/**
+ * Sync bounded tail read of one history file: newest-first parsed rows, at
+ * most `maxRows` (clamped [1,500]) drawn from at most the last `maxBytes`
+ * bytes (default 1 MB). Missing/unreadable file -> []. Never throws.
+ */
+function readHistoryFileTailSync(target, { maxRows = 500, maxBytes = 1024 * 1024 } = {}) {
+  const cap = Math.max(1, Math.min(500, Math.floor(maxRows) || 500));
+  let fd;
+  try {
+    fd = fs.openSync(target, 'r');
+    const { size } = fs.fstatSync(fd);
+    if (size === 0) return [];
+    const length = Math.min(Math.max(1, maxBytes), size);
+    const start = size - length;
+    const buf = Buffer.alloc(length);
+    fs.readSync(fd, buf, 0, length, start);
+    let text = buf.toString('utf8');
+    if (start > 0) {
+      // Chunk may begin mid-line; drop the partial first fragment.
+      const firstNl = text.indexOf('\n');
+      text = firstNl === -1 ? '' : text.slice(firstNl + 1);
+    }
+    const lines = text.split('\n').map((l) => l.trim()).filter(Boolean).slice(-cap);
+    const parsed = [];
+    for (const line of lines) {
+      try {
+        parsed.push(JSON.parse(line));
+      } catch {
+        // corrupt/partial line — skip
+      }
+    }
+    return parsed.reverse();
+  } catch {
+    return [];
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* ignore */ }
+    }
+  }
+}
+
 // mtime-gated cache, same convention as scheduler/prdParser.cjs's dirCache —
 // repeated reconcile() calls between appends hit the cache instead of
 // re-reading/re-parsing a JSONL file that only grows over time.
@@ -467,6 +509,7 @@ module.exports = {
   appendHistory,
   slimHistoryRow,
   readHistory,
+  readHistoryFileTailSync,
   historyTerminalBySlug,
   completedSlugsForCwd,
 };

package/src/main/lib/scheduler/queueStore.cjs

@@ -11,7 +11,7 @@
  *   - Per-project history:    `<cwd>/session-manager-operations/scheduler/state/history.jsonl`
  *     (owned by queueHistory.cjs, path resolved here)
  *   - Machine runtime state:  `~/.claude/session-manager/scheduler-machine.json`
- *     (config, paused/rate-limit, scheduledFor, lastRunAt — these are
+ *     (config, paused/rate-limit, lastRunAt — these are
  *     Session-Manager runtime concerns, like the sessionSlots pool, not any
  *     one project's data. Run logs under scheduled-plans/runs/ stay
  *     machine-local for the same reason: they're execution artifacts of this
@@ -230,7 +230,6 @@ function bustCwdCache() {
 function shapeMachine(data) {
   return {
     config: data.config || {},
-    scheduledFor: data.scheduledFor ?? null,
     lastRunAt: data.lastRunAt ?? null,
     // Distinct from lastRunAt (stamped only when tickQueue actually launches a
     // job): this is stamped every time tickQueue gets far enough to evaluate
@@ -451,7 +450,7 @@ function shapeJobs(raw, file) {
 }
 
 /**
- * readMergedSync(opts?) → { config, jobs, scheduledFor, lastRunAt, paused,
+ * readMergedSync(opts?) → { config, jobs, lastRunAt, paused,
  * unreadable?, unreadablePath?, unreadableCwds, sourceCwds }.
  *
  * `unreadable` is reserved for the machine-runtime file alone (a machine-wide
@@ -462,7 +461,7 @@ function shapeJobs(raw, file) {
  * writeSplit can persist "this project now has zero jobs".
  */
 function readMergedSync(opts) {
-  const out = { config: {}, jobs: [], scheduledFor: null, lastRunAt: null, lastDispatchAttemptAt: null, paused: null, drain: null, launchBlocks: {}, launchMitigations: {}, invalidJobs: [], unreadableCwds: [] };
+  const out = { config: {}, jobs: [], lastRunAt: null, lastDispatchAttemptAt: null, paused: null, drain: null, launchBlocks: {}, launchMitigations: {}, invalidJobs: [], unreadableCwds: [] };
   const sourceCwds = [];
   const machine = loadMachineStateSync();
   if (machine.shaped) {
@@ -496,7 +495,7 @@ function readMergedSync(opts) {
 
 /** Async twin of readMergedSync for IPC hot paths. */
 async function readMerged(opts) {
-  const out = { config: {}, jobs: [], scheduledFor: null, lastRunAt: null, lastDispatchAttemptAt: null, paused: null, drain: null, launchBlocks: {}, launchMitigations: {}, invalidJobs: [], unreadableCwds: [] };
+  const out = { config: {}, jobs: [], lastRunAt: null, lastDispatchAttemptAt: null, paused: null, drain: null, launchBlocks: {}, launchMitigations: {}, invalidJobs: [], unreadableCwds: [] };
   const sourceCwds = [];
   const machine = await loadMachineState();
   if (machine.shaped) {
@@ -547,7 +546,6 @@ function defineSources(state, sourceCwds) {
 async function writeSplit(state, defaultCwd) {
   await writeJsonAtomic(schedulerPaths.machineStatePath(), {
     config: state.config,
-    scheduledFor: state.scheduledFor ?? null,
     lastRunAt: state.lastRunAt ?? null,
     lastDispatchAttemptAt: state.lastDispatchAttemptAt ?? null,
     paused: state.paused ?? null,
@@ -581,70 +579,6 @@ async function writeSplit(state, defaultCwd) {
   bustCwdCache();
 }
 
-// ---------- legacy migration ----------
-
-/**
- * migrateLegacyGlobalQueue(defaultCwd) — one-time boot split of the retired
- * global queue.json into per-project shards. Shard rows win over legacy rows
- * with the same slug (the shard is newer by construction). The legacy file is
- * renamed to `queue.json.retired-<epoch>` so a rollback can recover it but no
- * reader ever consults it again. Machine fields (config/paused/...) migrate
- * only when no machine file exists yet. Idempotent: no legacy file → no-op.
- */
-async function migrateLegacyGlobalQueue(defaultCwd) {
-  let raw;
-  try {
-    raw = await fsp.readFile(schedulerPaths.legacyQueuePath(), 'utf8');
-  } catch {
-    return { migrated: false };
-  }
-  let legacy;
-  try {
-    legacy = JSON.parse(raw);
-  } catch (e) {
-    console.error(`[queueStore] legacy queue.json unparseable — leaving in place: ${e?.message}`);
-    return { migrated: false, error: e?.message };
-  }
-
-  if (!fs.existsSync(schedulerPaths.machineStatePath())) {
-    await writeJsonAtomic(schedulerPaths.machineStatePath(), {
-      config: legacy.config || {},
-      scheduledFor: legacy.scheduledFor ?? null,
-      lastRunAt: legacy.lastRunAt ?? null,
-      paused: legacy.paused ?? null,
-    });
-  }
-
-  const legacyJobs = Array.isArray(legacy.jobs) ? legacy.jobs : [];
-  const byCwd = new Map();
-  for (const job of legacyJobs) {
-    const cwd = job.cwd || defaultCwd;
-    if (!cwd) continue;
-    if (!byCwd.has(cwd)) byCwd.set(cwd, []);
-    byCwd.get(cwd).push(job);
-  }
-  let moved = 0;
-  for (const [cwd, jobs] of byCwd) {
-    const file = queuePathOrSkip(cwd, 'legacy split');
-    if (!file) continue;
-    let existing = [];
-    try { existing = shapeJobs(await fsp.readFile(file, 'utf8'), file).jobs; } catch { /* fresh shard */ }
-    const have = new Set(existing.map((j) => j.slug));
-    const merged = [...existing, ...jobs.filter((j) => !have.has(j.slug))];
-    try {
-      await writeJsonAtomic(file, { jobs: merged });
-      moved += merged.length - existing.length;
-    } catch (e) {
-      console.error(`[queueStore] legacy split: failed to write ${file}: ${e?.message}`);
-      return { migrated: false, error: e?.message };
-    }
-  }
-
-  await fsp.rename(schedulerPaths.legacyQueuePath(), `${schedulerPaths.legacyQueuePath()}.retired-${Date.now()}`);
-  bustCwdCache();
-  return { migrated: true, moved, projects: byCwd.size };
-}
-
 module.exports = {
   STATE_SUBPATH,
   projectStateDir,
@@ -656,7 +590,6 @@ module.exports = {
   readMerged,
   readMergedSync,
   writeSplit,
-  migrateLegacyGlobalQueue,
   writeJsonAtomic,
   writeJsonAtomicSync,
   findLongestValidJsonPrefix,
@@ -664,4 +597,3 @@ module.exports = {
 
 // Lazy path getters (SM_SCHEDULER_HOME resolved at read, never at require).
 Object.defineProperty(module.exports, 'MACHINE_STATE_PATH', { get: schedulerPaths.machineStatePath, enumerable: true });
-Object.defineProperty(module.exports, 'LEGACY_QUEUE_PATH', { get: schedulerPaths.legacyQueuePath, enumerable: true });

package/src/main/lib/scheduler/rcaReport.cjs

@@ -12,7 +12,7 @@
  * It used to file a `proposed` Epic per parked job; Epics are now created in
  * exactly one place — the human pressing New Epic (see epicMint.cjs's
  * SINGLE-CREATOR LAW). Surfacing the parked job back to a human is the
- * scheduler's job (notifyNeedsReview → appendResponseEventIfKnown), which
+ * scheduler's job (flushDueReviewNotices → appendResponseEventIfKnown), which
  * routes it into the Epic that AUTHORED the PRD rather than opening a
  * sibling Epic about it.
  *

package/src/main/lib/scheduler/refireCap.cjs

@@ -0,0 +1,40 @@
+/**
+ * refireCap.cjs — pure decision for a job the post-run verifier downgraded
+ * back to `pending` (verdict `halt` / `deps_unmet`).
+ *
+ * Why: scheduler.cjs re-fired such jobs with no counter, so any verifier
+ * disagreement re-ran a billed `claude -p` forever (Bilko-Launch-Kit,
+ * 2026-10-11: 125 runs, 846 turns, $28 in 3.5 hours). This helper decides,
+ * from the job's consecutive-downgrade count, whether to re-fire or park.
+ *
+ * Pure: no I/O, no mutation of inputs. Complexity O(1).
+ */
+
+'use strict';
+
+/** Max consecutive post-run downgrades that are still re-fired. */
+const MAX_CONSECUTIVE_VERIFY_REFIRES = 2;
+
+/**
+ * @param {{ verifyRefireCount?: unknown }} job
+ * @param {{ verdict?: string, reason?: string }} verifyResult
+ * @param {{ cap?: number }} [opts]
+ * @returns {{ action: 'refire', nextCount: number }
+ *   | { action: 'park', nextCount: number, verdict: 'refire_capped', reason: string }}
+ */
+function decideVerifyDowngrade(job, verifyResult, { cap = MAX_CONSECUTIVE_VERIFY_REFIRES } = {}) {
+  const raw = job && job.verifyRefireCount;
+  const count = Number.isInteger(raw) && raw > 0 ? raw : 0;
+  const nextCount = count + 1;
+  const effectiveCap = Math.max(0, cap);
+  if (nextCount <= effectiveCap) return { action: 'refire', nextCount };
+  const vr = verifyResult || {};
+  return {
+    action: 'park',
+    nextCount,
+    verdict: 'refire_capped',
+    reason: `re-fire cap: ${nextCount} consecutive post-run downgrades (${vr.verdict}: ${vr.reason})`,
+  };
+}
+
+module.exports = { MAX_CONSECUTIVE_VERIFY_REFIRES, decideVerifyDowngrade };

package/src/main/lib/scheduler/reviewNotice.cjs

@@ -5,7 +5,7 @@
  * notice (this PRD).
  *
  * Before this module, a park into `needs_review` told the authoring Epic
- * immediately (scheduler.cjs's notifyNeedsReview), BEFORE the scheduler's own
+ * immediately at park time, BEFORE the scheduler's own
  * recovery ladder (mechanical re-integration, resume, quarantine, auto-fix,
  * gate re-run, bounded auto-resolve) ever got a chance to run. Most parks
  * heal on their own, so that immediate message was usually a false alarm.