claude-code-session-manager 0.121.0 → 0.122.1

package/src/main/scheduler.cjs

@@ -66,6 +66,7 @@ const { headlessPermissionArgs, ensureCliCapsProbed } = require('./lib/claude/cl
 // as the authoritative guarantee.
 ensureCliCapsProbed().catch(() => {});
 const launchFailure = require('./lib/scheduler/launchFailure.cjs');
+const { decideVerifyDowngrade } = require('./lib/scheduler/refireCap.cjs');
 const { finalizeReasonFor } = require('./lib/scheduler/finalizeReason.cjs');
 const { shouldRunFlatSweep, FLAT_SWEEP_INTERVAL_MS } = require('./lib/scheduler/flatSweepThrottle.cjs');
 const { appendError } = require('./lib/telemetry/opsErrorLog.cjs');
@@ -124,15 +125,12 @@ const {
   MAX_JOB_DURATION_MS,
   BROADCAST_COALESCE_MS,
   RECONCILE_SLOW_PASS_MS,
-  QUARANTINE_ESCALATE_MS: QUARANTINE_ESCALATE_MS_DEFAULT,
+  QUARANTINE_ESCALATE_MS,
   PIDLESS_SPAWN_GRACE_MS,
   INVESTIGATION_MAX_MS,
   STARVATION_ESCALATE_MS,
   STARVE_ESCALATION_MS,
 } = require('./lib/scheduler/schedulerConfig.cjs');
-const QUARANTINE_ESCALATE_MS = process.env.SM_QUARANTINE_ESCALATE_HOURS
-  ? Number(process.env.SM_QUARANTINE_ESCALATE_HOURS) * 60 * 60_000
-  : QUARANTINE_ESCALATE_MS_DEFAULT;
 // A running job past this fraction of its own budget gets a durable
 // `budgetWarning` stamp on its row (see the budget watchdog below) so the
 // renderer can warn BEFORE the kill, not only after.
@@ -444,7 +442,6 @@ const DEFAULT_CONFIG = {
   offsetMinutes: 15,
   defaultCwd: DEFAULT_PROJECT_CWD,
   // 'when-available' = poll usage and fire whenever utilization < threshold.
-  // 'on-reset'        = fire offsetMinutes after the next 5h reset (legacy).
   // 'manual'          = only fire on explicit Run now click.
   firePolicy: 'when-available',
   // For 'when-available'. Fire only when BINDING-window utilization < this
@@ -646,7 +643,6 @@ function ensureDirs() {
 // would deadlock the exit path.
 const config = require('./config.cjs');
 const { seedAuthoringGuide } = require('./lib/prd/prdAuthoringSeed.cjs');
-const atomicWriteJsonSync = (p, data) => config.writeJsonSync(p, data);
 
 // ---------- scheduler-state.json (sidecar) ----------
 
@@ -721,9 +717,22 @@ function persistSchedulerState() {
 
 // ---------- heartbeat log ----------
 
+// Memory time series stamped on every heartbeat line (MB, whole numbers).
+function memoryFields() {
+  const m = process.memoryUsage();
+  const mb = (b) => Math.max(0, Math.round((b || 0) / 1048576));
+  return {
+    rssMB: mb(m.rss),
+    heapUsedMB: mb(m.heapUsed),
+    heapTotalMB: mb(m.heapTotal),
+    externalMB: mb(m.external),
+    arrayBuffersMB: mb(m.arrayBuffers),
+  };
+}
+
 function appendHeartbeat(entry) {
   try {
-    const line = JSON.stringify(entry) + '\n';
+    const line = JSON.stringify({ ...memoryFields(), ...entry }) + '\n';
     let size = 0;
     try { size = fs.statSync(schedulerPaths.heartbeatPath()).size; } catch { /* new file */ }
     if (size >= HEARTBEAT_MAX_BYTES) {
@@ -766,10 +775,10 @@ function drainSnapshot(jobs) {
 /**
  * Restart is triggered automatically ONLY when the installed build-info.json
  * differs from the running codeSha (an install/update already happened) —
- * never by polling npm. SM_AUTO_UPGRADE_RESTART=0 disables it.
+ * never by polling npm.
  */
 function maybeAutoRequestRestart() {
-  if (process.env.SM_AUTO_UPGRADE_RESTART === '0' || process.env.SM_DEV === '1') return null;
+  if (process.env.SM_DEV === '1') return null;
   const installed = readInstalledBuildInfo();
   const installedSha = typeof installed?.gitShortSha === 'string' ? installed.gitShortSha : null;
   if (!upgradeDrain.installedBuildDiffers({ running: SCHEDULER_CODE_SHA, installed: installedSha })) return null;
@@ -1109,15 +1118,21 @@ function flagUnreadable(state) {
 // shards under `<cwd>/session-manager-operations/scheduler/state/queue.json`
 // plus one machine-runtime file (config/paused/lastRunAt). Reads merge every
 // shard into the single state object all downstream logic already expects;
-// writes split it back. The old global scheduled-plans/queue.json is retired
-// (split at boot by queueStore.migrateLegacyGlobalQueue).
+// writes split it back. The old global scheduled-plans/queue.json is retired.
 
 // Sync queue read — passed to the supervisor module (which calls it from
 // supervisorTick / applyAction with no await) and the heartbeat interval.
 // IPC handlers and mutate() use readQueue (async) below.
+// Migration: the retired legacy fire policy becomes 'when-available'
+// so an old install keeps dispatching. Persisted by the next mutate() write.
+function normalizeConfig(cfg) {
+  if (cfg && cfg.firePolicy === 'on-reset') return { ...cfg, firePolicy: 'when-available' };
+  return cfg;
+}
+
 function readQueueSync() {
   const s = queueStore.readMergedSync();
-  s.config = { ...DEFAULT_CONFIG, ...(s.config || {}) };
+  s.config = normalizeConfig({ ...DEFAULT_CONFIG, ...(s.config || {}) });
   return flagUnreadable(s);
 }
 
@@ -1126,7 +1141,7 @@ function readQueueSync() {
 // shard reads hands control back to the renderer between files.
 async function readQueue() {
   const s = await queueStore.readMerged();
-  s.config = { ...DEFAULT_CONFIG, ...(s.config || {}) };
+  s.config = normalizeConfig({ ...DEFAULT_CONFIG, ...(s.config || {}) });
   return flagUnreadable(s);
 }
 
@@ -2087,10 +2102,6 @@ async function refreshNextReset() {
   return cachedNextReset;
 }
 
-function getNextResetCached() {
-  return cachedNextReset;
-}
-
 /**
  * Pure: picks the reset to pause against for a rate-limited run (PRD 1118).
  * Prefers the BINDING window read off the run's own log — refreshNextReset()
@@ -2223,7 +2234,6 @@ const consecutiveRapidRateLimitsBySlug = new Map();
 // ---------- timer ----------
 
 let mainWindow = null;
-let fireTimer = null;
 let resumeTimer = null;
 let pollLoopTimer = null;
 let rescheduleInterval = null;
@@ -2344,14 +2354,13 @@ function buildScheduleStatePayload(state) {
   const payload = {
     config: state.config,
     jobs: state.jobs,
-    scheduledFor: state.scheduledFor,
     lastRunAt: state.lastRunAt,
     // Distinct from lastRunAt (only stamped when a batch actually launches):
     // stamped every time tickQueue reaches the picker at all. See
     // classifyQueueHealth/classifyQueueStarvation's header comments for why
     // the two must never merge.
     lastDispatchAttemptAt: state.lastDispatchAttemptAt ?? null,
-    nextReset: getNextResetCached(),
+    nextReset: cachedNextReset,
     paused: state.paused,
     drain: state.drain ?? null,
     // Launch circuit breaker (issue #11): which personas cannot launch right
@@ -2428,24 +2437,6 @@ async function broadcast(opts = {}) {
   }
 }
 
-function clearFireTimer() {
-  if (fireTimer) {
-    clearTimeout(fireTimer);
-    fireTimer = null;
-  }
-}
-
-function computeFireAt(state, nextResetIso) {
-  // Only the legacy 'on-reset' policy uses scheduled fire times. Other
-  // policies fire either immediately on demand ('manual') or via the
-  // when-available poll loop.
-  if (state.config.firePolicy !== 'on-reset') return null;
-  if (!nextResetIso) return null;
-  const reset = new Date(nextResetIso).getTime();
-  if (Number.isNaN(reset)) return null;
-  return reset + (state.config.offsetMinutes * 60_000);
-}
-
 // PRD 1446: refreshNextReset() awaits billing.fetchUsage(), which can hang
 // or back off for minutes while the usage meter is rate-limited. Left
 // unbounded, that stalled THIS function's own mutate(reconcile) call for as
@@ -2459,12 +2450,9 @@ function computeFireAt(state, nextResetIso) {
 const RESCHEDULE_TIMER_BILLING_RACE_MS = 10_000;
 
 async function rescheduleTimer() {
-  clearFireTimer();
-  // Wrap in try/catch — on failure use the cached value so the on-reset
-  // timer can still be armed from the last known reset.
-  let nextResetIso;
+  // Wrap in try/catch — on failure the cached value is kept.
   try {
-    nextResetIso = await Promise.race([
+    await Promise.race([
       refreshNextReset(),
       new Promise((resolve) => {
         const t = setTimeout(() => resolve(cachedNextReset), RESCHEDULE_TIMER_BILLING_RACE_MS);
@@ -2472,20 +2460,12 @@ async function rescheduleTimer() {
       }),
     ]);
   } catch {
-    nextResetIso = cachedNextReset;
+    // cachedNextReset stays as-is; reconcile below does not need the value.
   }
-  const fireAt = await mutate(async (state) => {
+  await mutate(async (state) => {
     await reconcile(state);
-    const fa = computeFireAt(state, nextResetIso);
-    state.scheduledFor = fa ? new Date(fa).toISOString() : null;
-    return fa;
   });
   await broadcast();
-  if (!fireAt) return;
-
-  const delay = Math.max(1000, fireAt - Date.now());
-  fireTimer = setTimeout(() => { runDueJobs().catch(() => {}); }, delay);
-  console.log(`[scheduler] next fire in ${Math.round(delay / 1000)}s @ ${new Date(fireAt).toISOString()}`);
 }
 
 // ---------- pause / resume ----------
@@ -2709,6 +2689,9 @@ function resetJobFields(job, errorMsg, opts = {}) {
   job.error = errorMsg ?? null;
   delete job.runtime;
   delete job.verifierVerdict;
+  // A reset starts the consecutive-downgrade count over (the refire path in
+  // spawnJob re-sets it right after this call).
+  delete job.verifyRefireCount;
   delete job.humanQuestion;
   delete job.uncommittedPaths;
   delete job.resumeRecoveryAttempted;
@@ -2868,7 +2851,9 @@ function isBootRowAlive(j, {
  * applyOrphanOutcome(job, outcome, killNote?, confirmedLandedCommit?) → void
  *
  * Mutates `job` in place to finalize a boot-orphaned 'running' job given its
- * classified run outcome: success/failed finalize terminally; no_result/unknown
+ * classified run outcome: success finalizes only with landed-commit evidence
+ * (or for artifact-only PRDs), otherwise it takes the re-queue path below;
+ * failed finalizes terminally; no_result/unknown
  * re-queues to pending bounded by ORPHAN_REQUEUE_CAP. The status-mutation
  * semantics (and the cap-exhaustion boundary) match the now-deleted
  * reconcileQueueOffline (src/main/lib/scheduler/watchdogHelpers.cjs) verbatim; killNote
@@ -2882,12 +2867,21 @@ function isBootRowAlive(j, {
  * orphaned job that actually landed a real commit is reachable via boot
  * reconciliation even though the live reap path is now guarded. Callers
  * must resolve this (a git spawn) BEFORE calling mutate(), never inside it —
- * pass null to skip the gate (e.g. when the outcome isn't 'failed').
+ * pass null when there is none (a 'success' then re-queues, unless artifact-only).
  */
 function applyOrphanOutcome(job, outcome, killNote = '', confirmedLandedCommit = null) {
   const now = new Date().toISOString();
-  if (outcome === 'success') {
-    transitionJob(job, 'completed', { reason: 'boot orphan reconciliation: run succeeded', source: 'applyOrphanOutcome' });
+  // A reported 'success' completes only on landed-commit evidence, or for a
+  // DECLARED artifact-only PRD (`deliverable: artifact` + artifactPaths — same
+  // check as runVerify's artifact exemption) where no commit is legitimate.
+  const artifactOnly = job.deliverable === 'artifact' && Array.isArray(job.artifactPaths) && job.artifactPaths.length > 0;
+  if (outcome === 'success' && (confirmedLandedCommit || artifactOnly)) {
+    if (confirmedLandedCommit) {
+      transitionJob(job, 'completed', { reason: `boot orphan reconciliation: run succeeded, landedCommit ${confirmedLandedCommit} resolves`, source: 'applyOrphanOutcome:landed' });
+      job.landedCommit = confirmedLandedCommit;
+    } else {
+      transitionJob(job, 'completed', { reason: 'boot orphan reconciliation: run succeeded (artifact-only PRD, no commit expected)', source: 'applyOrphanOutcome' });
+    }
     job.exitCode = 0;
     job.error = null;
     job.finishedAt = now;
@@ -2907,8 +2901,9 @@ function applyOrphanOutcome(job, outcome, killNote = '', confirmedLandedCommit =
     delete job.runtime;
   } else {
     const tries = job.orphanRetries ?? 0;
+    const noLanded = outcome === 'success' ? ' — run reported success but no landed commit was found' : '';
     if (tries < ORPHAN_REQUEUE_CAP) {
-      resetJobFields(job, `orphaned: app restarted mid-run, re-queued (attempt ${tries + 1}/${ORPHAN_REQUEUE_CAP})${killNote}`, { source: 'applyOrphanOutcome' });
+      resetJobFields(job, `orphaned: app restarted mid-run, re-queued (attempt ${tries + 1}/${ORPHAN_REQUEUE_CAP})${killNote}${noLanded}`, { source: 'applyOrphanOutcome' });
       job.orphanRetries = tries + 1;
     } else if (confirmedLandedCommit) {
       transitionJob(job, 'completed', { reason: `orphaned: app restarted while running, exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts${killNote}, but landedCommit ${confirmedLandedCommit} resolves — completed on evidence`, source: 'applyOrphanOutcome:landed' });
@@ -2918,9 +2913,9 @@ function applyOrphanOutcome(job, outcome, killNote = '', confirmedLandedCommit =
       job.finishedAt = now;
       delete job.runtime;
     } else {
-      transitionJob(job, 'failed', { reason: `orphaned: app restarted while running, exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts${killNote}`, source: 'applyOrphanOutcome' });
+      transitionJob(job, 'failed', { reason: `orphaned: app restarted while running, exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts${killNote}${noLanded}`, source: 'applyOrphanOutcome' });
       job.exitCode = job.exitCode ?? 1;
-      job.error = `orphaned: app restarted while running, exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts${killNote}`;
+      job.error = `orphaned: app restarted while running, exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts${killNote}${noLanded}`;
       job.finishedAt = now;
       delete job.runtime;
     }
@@ -3148,10 +3143,10 @@ async function notifyOriginatingTab(job, {
     // survive an entirely unreadable PRD: the queue row carries the Epic FK
     // independently of the .md on disk (20 of 21 history rows had it when
     // PRD 985 was written), so a parse failure degrades to "notified without
-    // frontmatter detail" instead of "silently dropped". Mirrors
-    // notifyNeedsReview, which has had this fallback since PRD 854 — which
-    // is precisely why needs_review routing kept working while
-    // completed/failed routing did not.
+    // frontmatter detail" instead of "silently dropped". The
+    // needs_review notice path carries the same fallback (PRD 854), which
+    // is why needs_review routing kept working while completed/failed
+    // routing did not.
     const epicId = prd?.sourcePromptId || job.epicId || null;
 
     // Persist the job's real result text (not just the short status chip
@@ -3283,61 +3278,6 @@ async function notifyOriginatingTab(job, {
   }
 }
 
-/**
- * notifyNeedsReview(job, report) → Promise<boolean>
- *
- * A job parked in `needs_review` is a question, not a result: something about
- * the PRD was unclear, unverifiable, or ran past its acceptance criteria.
- * That question belongs in the conversation that WROTE the PRD, so this
- * appends a 'response' event to the authoring Epic's own chain (the same
- * channel notifyOriginatingTab uses for completed/failed, which deliberately
- * excludes needs_review — isNotifiableTerminalStatus). It resolves the Epic
- * from the PRD's `sourcePromptId`, falling back to the job's own `epicId`.
- *
- * Join-only by construction: appendResponseEventIfKnown refuses an unknown or
- * non-active session and returns false. Nothing here can create an Epic — if
- * no open authoring Epic exists, the root-cause report in the run directory
- * is the whole record and the Scheduler tab is where it surfaces.
- *
- * Quiet by default (this PRD): the park path no longer calls this at park
- * time. It records a `reviewNotice` on the job row instead and lets
- * flushDueReviewNotices send one grouped message once the self-heal ladder
- * gives up or the hold time passes. This function now only runs under the
- * SM_REVIEW_NOTICE_IMMEDIATE=1 kill switch (same park-time call site, for
- * local debugging) — it is otherwise dead code outside its own tests. That
- * call site stamps `reviewNotice.sentAt` itself afterward, and only when
- * this returns true AND the row's live notice still matches the one it just
- * built — never on the strength of this function's return value alone.
- */
-async function notifyNeedsReview(job, report, {
-  parsePrdRaw = prdParser.parsePrdRaw,
-  appendResponseEvent = appendResponseEventIfKnown,
-} = {}) {
-  try {
-    if (!job || !report || !report.filed) return false;
-    const prd = await resolveNotifyPrd(job, parsePrdRaw);
-    const epicId = prd?.sourcePromptId || job.epicId || null;
-    if (!epicId || !job.cwd) {
-      console.log(`[scheduler] notifyNeedsReview: no authoring Epic for ${job.slug}, report only`);
-      return false;
-    }
-    const message = `${report.summary}. Root-cause report: ${report.path}`;
-    // PRD 986: like every scheduler check-in, born 'unvalidated' — the RCA
-    // report is itself a question, not a verified outcome. No validation
-    // prompt is enqueued here: that fires only for the terminal
-    // completed/failed path (notifyOriginatingTab); needs_review already
-    // routes its own question via this very report.
-    return await appendResponseEvent(job.cwd, epicId, message, {
-      prdSlug: job.slug,
-      outcome: 'needs_review',
-      validation: 'unvalidated',
-    });
-  } catch (e) {
-    console.error('[scheduler] notifyNeedsReview error', job?.slug, e);
-    return false;
-  }
-}
-
 // Single-flight guard for flushDueReviewNotices — same shape as
 // gateShadowPending above: a module-level flag rather than a class, so two
 // triggers landing close together (an auto-resolve skip right next to the
@@ -3348,8 +3288,7 @@ let reviewNoticeFlushPending = null;
 /**
  * flushDueReviewNotices() → Promise<void>
  *
- * The only path that still sends a needs_review notice (outside the
- * SM_REVIEW_NOTICE_IMMEDIATE=1 kill switch above notifyNeedsReview). Reads
+ * The only path that still sends a needs_review notice. Reads
  * the live queue, asks reviewNotice.cjs's selectDueReviewNotices which (cwd,
  * Epic, cause) groups have gone quiet — the ladder gave up
  * (needsReviewAutoResolvedSkip) or the hold time passed (holdMsFromEnv) —
@@ -4234,10 +4173,9 @@ function pickRunDir() {
 // process. It never throws and never blocks or fails a spawn: a failed
 // install just logs one line and leaves the PATH addition pointing at a shim
 // dir that may have nothing in it yet, no worse than today's
-// no-shim-at-all. SM_TIMEOUT_SHIM_DISABLE=1 skips it outright.
+// no-shim-at-all.
 let timeoutShimEnsured = null;
 function ensureTimeoutShimOnce() {
-  if (process.env.SM_TIMEOUT_SHIM_DISABLE === '1') return Promise.resolve();
   if (!timeoutShimEnsured) {
     timeoutShimEnsured = ensureTimeoutShim().then(
       (result) => {
@@ -4541,11 +4479,8 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
     // `launchEnv` is the launch circuit breaker's degraded-mode env (e.g.
     // MAX_THINKING_TOKENS=0 while an outdated CLI's thinking parameter is
     // being rejected — lib/scheduler/launchFailure.cjs); applied last so it wins.
-    // SM_TIMEOUT_SHIM_DISABLE=1 is the kill switch for the PATH addition
-    // below — paired with the install skip inside ensureTimeoutShimOnce().
-    const timeoutShimEnabled = process.env.SM_TIMEOUT_SHIM_DISABLE !== '1';
     const childEnv = cleanChildEnv({
-      PATH: timeoutShimEnabled ? withTimeoutShimOnPath(pathWithUserBins()) : pathWithUserBins(),
+      PATH: withTimeoutShimOnPath(pathWithUserBins()),
       SM_PROJECT_ROOT: cwd,
       SM_SCHEDULER_JOB_SLUG: job.slug,
       SM_SCHEDULER_JOB_MAY_QUEUE: job.agentType === 'architect' ? '1' : '0',
@@ -5272,11 +5207,8 @@ async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {})
   await ensureCliCapsProbed();
   await ensureTimeoutShimOnce();
   const claudeBin = resolveClaudeBin();
-  // SM_TIMEOUT_SHIM_DISABLE=1 is the kill switch for the PATH addition below —
-  // paired with the install skip inside ensureTimeoutShimOnce().
-  const timeoutShimEnabled = process.env.SM_TIMEOUT_SHIM_DISABLE !== '1';
   const childEnv = cleanChildEnv({
-    PATH: timeoutShimEnabled ? withTimeoutShimOnPath(pathWithUserBins()) : pathWithUserBins(), // Homebrew/user bins for macOS
+    PATH: withTimeoutShimOnPath(pathWithUserBins()), // Homebrew/user bins for macOS
     BASH_DEFAULT_TIMEOUT_MS: String(BASH_DEFAULT_TIMEOUT_MS),
     BASH_MAX_TIMEOUT_MS: String(BASH_MAX_TIMEOUT_MS),
   });
@@ -6620,6 +6552,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
           // Determine effective status, applying the verifier verdict for exit=0 runs.
           let effectiveStatus;
           let sigtermOverrideReason = null;
+          let capParkVerdict = null; // set only when the re-fire cap parks the job
           // Wall-clock budget kill — checked FIRST and unconditionally wins:
           // never 'failed', never silently 'completed', and (via
           // sigtermLandedCommitEvidence/plainExitLandedCommitEvidence, whichever
@@ -6707,9 +6640,18 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
           ) {
             effectiveStatus = 'completed';
           } else if (verifyResult.downgradeTo === 'pending') {
-            // HALT or deps_unmet: reset to pending so the job re-fires.
-            resetJobFields(s.jobs[i2], verifyResult.reason, { source: 'spawnJob:verify-downgrade' });
-            return; // job already mutated by resetJobFields; skip the rest
+            // HALT or deps_unmet: re-fire, bounded by decideVerifyDowngrade.
+            const downgrade = decideVerifyDowngrade(s.jobs[i2], verifyResult);
+            if (downgrade.action === 'refire') {
+              if (resetJobFields(s.jobs[i2], verifyResult.reason, { source: 'spawnJob:verify-downgrade' })) {
+                s.jobs[i2].verifyRefireCount = downgrade.nextCount;
+              }
+              return; // job already mutated by resetJobFields; skip the rest
+            }
+            // Cap hit: park through the existing needs_review stamping path.
+            effectiveStatus = 'needs_review';
+            capParkVerdict = downgrade.verdict;
+            sigtermOverrideReason = downgrade.reason;
           } else {
             // transcript_errors or verify_unavailable: escalate to needs_review.
             effectiveStatus = 'needs_review';
@@ -6728,7 +6670,9 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
           // needs_review ledger stale/leftover values from before this run,
           // defeating its whole `byReason` rollup for the two escalation
           // paths that land here.
-          s.jobs[i2].error = (effectiveStatus === 'needs_review' || s.jobs[i2].blockedByForeignWip === true)
+          s.jobs[i2].error = capParkVerdict
+            ? sigtermOverrideReason
+            : (effectiveStatus === 'needs_review' || s.jobs[i2].blockedByForeignWip === true)
             ? (verifyResult?.reason ?? sigtermOverrideReason ?? null)
             // A failed job (non-zero exit) never consults verifyResult above,
             // but a worktree integration failure is still worth surfacing on
@@ -6748,11 +6692,16 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
           // 'blocked_by_foreign_wip_streak'/'budget_exceeded' are set above
           // from the sigterm/exit-code path, never from verifyResult (which
           // stays null on a non-zero exit) — never clobber either here.
-          if (verifyResult?.verdict && verifyResult.verdict !== 'clean') {
+          if (capParkVerdict) {
+            s.jobs[i2].verifierVerdict = capParkVerdict;
+          } else if (verifyResult?.verdict && verifyResult.verdict !== 'clean') {
             s.jobs[i2].verifierVerdict = verifyResult.verdict;
           } else if (!['blocked_by_foreign_wip_streak', 'budget_exceeded'].includes(s.jobs[i2].verifierVerdict)) {
             delete s.jobs[i2].verifierVerdict;
           }
+          // Only a downgrade-to-pending (which returned above) keeps the count;
+          // every other finalize outcome, including the cap park, clears it.
+          delete s.jobs[i2].verifyRefireCount;
           if (verifyResult?.verdict === 'needs_human') {
             s.jobs[i2].humanQuestion = verifyResult.humanQuestion || '';
           } else {
@@ -6996,7 +6945,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
         annotations: needsReviewRcaSnapshot.verifierAnnotations,
       })
         .then(async (report) => {
-          // Resolve the authoring Epic the same way notifyNeedsReview does —
+          // Resolve the authoring Epic (sourcePromptId, else the job epicId) —
           // the review notice needs the same epicId so flushDueReviewNotices
           // can route the eventual grouped message to the right place.
           let epicId = null;
@@ -7011,7 +6960,6 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
           // classification (e.g. selectAutoFixTargets excluding 'archive')
           // and flushDueReviewNotices routes on the notice, neither re-parsing
           // the RCA markdown nor losing the notice to a lost race.
-          let builtNotice = null;
           await mutate((s) => {
             const j = s.jobs.find((x) => x.slug === needsReviewRcaSnapshot.slug);
             applyRcaClassification(j, report);
@@ -7021,31 +6969,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
             // lands, must not get a stale notice grafted back onto it.
             if (j && j.status === 'needs_review') {
               j.reviewNotice = buildReviewNotice({ job: j, report, epicId, now: new Date().toISOString(), prior: j.reviewNotice });
-              builtNotice = j.reviewNotice;
             }
           }).catch((e) => {
             console.error('[scheduler] writeRcaReport reviewNotice mutate error', needsReviewRcaSnapshot.slug, e);
           });
-          // Quiet by default (this PRD): the notice recorded above waits for
+          // Quiet by default: the notice recorded above waits for
           // flushDueReviewNotices to send it, grouped, once the ladder gives
-          // up or the hold time passes. SM_REVIEW_NOTICE_IMMEDIATE=1 restores
-          // the old immediate-notify behavior, for local debugging.
-          if (process.env.SM_REVIEW_NOTICE_IMMEDIATE === '1') {
-            const sent = await notifyNeedsReview(needsReviewRcaSnapshot, report);
-            if (sent && builtNotice) {
-              await mutate((s) => {
-                const j = s.jobs.find((x) => x.slug === needsReviewRcaSnapshot.slug);
-                // Stamp only if the live notice is still the exact one just
-                // sent — a re-park between the send and this mutate must not
-                // be marked sent for a notice that never went out.
-                if (j && j.reviewNotice && j.reviewNotice.firstParkedAt === builtNotice.firstParkedAt && j.reviewNotice.cause === builtNotice.cause) {
-                  j.reviewNotice.sentAt = new Date().toISOString();
-                }
-              }).catch((e) => {
-                console.error('[scheduler] writeRcaReport immediate-stamp mutate error', needsReviewRcaSnapshot.slug, e);
-              });
-            }
-          }
+          // up or the hold time passes.
         })
         .catch((e) => {
           console.error('[scheduler] writeRcaReport error', job.slug, e);
@@ -7586,8 +7516,6 @@ async function runDueJobs({ bypassLoadGate = false } = {}) {
   }
   cancelToken = { cancelled: false };
   const result = await tickQueue({ bypassLoadGate });
-  // Clear the one-shot scheduledFor without waiting for jobs to settle.
-  await mutate((s) => { s.scheduledFor = null; });
   await broadcast();
   return result;
 }
@@ -8997,7 +8925,7 @@ async function runGateShadow(job) {
     if (fs.existsSync(path.dirname(verdictsPath))) {
       let existing = {};
       try { existing = JSON.parse(fs.readFileSync(verdictsPath, 'utf8')) || {}; } catch { /* absent/unparseable → fresh */ }
-      try { atomicWriteJsonSync(verdictsPath, { ...existing, gateShadow }); } catch { /* best-effort */ }
+      try { config.writeJsonSync(verdictsPath, { ...existing, gateShadow }); } catch { /* best-effort */ }
     }
   }
 
@@ -9213,7 +9141,7 @@ async function reverifyNeedsReview() {
   // pass starting before this one's pick resolves could choose a target of
   // its own too, breaking the single-flight rule.
   let pick = null;
-  if (!gateShadowPending && process.env.SM_GATE_SHADOW_DISABLE !== '1') {
+  if (!gateShadowPending) {
     pick = (async () => {
       const needsReview = snap.jobs.filter((j) => j.status === 'needs_review');
       const headByCwd = new Map();
@@ -9931,12 +9859,12 @@ function rescheduleIntervalTick() {
   // auto-clears WITHOUT waiting for the next app restart. Cheap-guarded by
   // shouldRunPeriodicReverify, which reuses isRescanCandidate so the guard
   // and the candidate filter can never drift apart again (they did once —
-  // see that function's comment). Kill-switch:
-  // SM_REVERIFY_PERIODIC_DISABLE=1 (boot reverify above stays always-on).
+  // see that function's comment). Test seam:
+  // _setPeriodicReverifyEnabledForTests(false) (boot reverify above stays always-on).
   // reverifyNeedsReview's auto-fix loop is capped downstream by
   // MAX_CONCURRENT_INVESTIGATIONS (spawnInvestigation queues/early-returns
   // past it), so this interval firing cannot fan out investigations.
-  if (process.env.SM_REVERIFY_PERIODIC_DISABLE !== '1') {
+  if (periodicReverifyEnabled) {
     if (reviewLadder.shouldRunPeriodicReverify(s.jobs)) {
       reverifyNeedsReview().catch(() => {});
     }
@@ -10149,6 +10077,13 @@ function rescheduleIntervalTick() {
   }
 }
 
+// Test-only seam: the periodic reverify pass is on in production; tests turn it
+// off to isolate themselves from the unrelated reverify/broadcast side effects.
+let periodicReverifyEnabled = true;
+function _setPeriodicReverifyEnabledForTests(enabled) {
+  periodicReverifyEnabled = enabled !== false;
+}
+
 async function init() {
   ensureDirs();
   // Boot phase — reconciliation, migrations, self-heal, first reset probe.
@@ -10167,16 +10102,6 @@ async function init() {
     // Boot-time expiry pass (process-local state is empty after a restart, so
     // this is a cheap belt-and-braces run against the freshly read queue).
     try { runReservationExpiryPass((await readQueue()).jobs); } catch { /* best-effort */ }
-    // Retire the global queue.json: split its rows into per-project shards
-    // BEFORE the first read below, so boot reconciliation sees the shards.
-    try {
-      const m = await queueStore.migrateLegacyGlobalQueue(DEFAULT_PROJECT_CWD);
-      if (m.migrated) {
-        console.log(`[scheduler] legacy global queue retired: ${m.moved} row(s) split across ${m.projects} project shard(s)`);
-      }
-    } catch (e) {
-      console.error('[scheduler] legacy queue split failed', e?.message);
-    }
     await prdPaths.runPrdMigration();
     prdPaths.sweepQueueBackups().catch((e) => console.warn('[scheduler] backup sweep failed', e?.message));
 
@@ -10273,7 +10198,7 @@ async function init() {
     const bootLandedCommitEvidence = new Map();
     await Promise.all(bootSnap.jobs.map(async (j) => {
       if (!immediateSlugs.includes(j.slug) || j.status !== 'running') return;
-      if (bootOutcomes.get(j.slug) === 'success' || !j.landedCommit) return;
+      if (!j.landedCommit) return;
       const resolved = await resolveLandedCommitEvidence(j.cwd || DEFAULT_PROJECT_CWD, j.landedCommit, j.startedAt);
       if (resolved) bootLandedCommitEvidence.set(j.slug, j.landedCommit);
     }));
@@ -10433,7 +10358,7 @@ function toCompactPrdEntry(entry) {
  * `schedule:list-prds` IPC handler and the admin HTTP `GET
  * /admin/scheduler/prds` route (PRD 1024) — neither re-implements this scan.
  */
-async function listPrdsInternal() {
+async function listPrdsInternal({ cwd } = {}) {
   ensureDirs();
   const out = [];
   const seenSlugs = new Set();
@@ -10485,12 +10410,21 @@ async function listPrdsInternal() {
   // Live PRDs first, so an archived duplicate (shouldn't exist, but a
   // stale rename copy is possible) never shadows the still-runnable live
   // entry.
-  for (const dir of prdPaths.candidatePrdsDirs()) {
+  // A non-empty cwd scopes the scan to that one project's dirs (cost = that
+  // project's files, not every project's); no cwd = the machine-wide scan.
+  const scoped = typeof cwd === 'string' && cwd.length > 0;
+  const liveDirs = scoped
+    ? [...new Set([schedulerPaths.prdsRoot(), prdPaths.prdDirForCwd(cwd), ...listEpicPrdDirs(cwd)])]
+    : prdPaths.candidatePrdsDirs();
+  const archivedDirs = scoped
+    ? [...new Set(listArchivedPrdDirs(cwd))]
+    : prdPaths.candidateArchivedPrdsDirs();
+  for (const dir of liveDirs) {
     await readDirInto(dir, { archived: false });
   }
 
   const archivedStart = out.length;
-  for (const dir of prdPaths.candidateArchivedPrdsDirs()) {
+  for (const dir of archivedDirs) {
     await readDirInto(dir, { archived: true });
   }
 
@@ -10733,7 +10667,7 @@ const remote = {
   // paging by offset can't skip or duplicate an entry between requests as
   // long as the underlying PRD set doesn't change mid-page.
   async listPrds(filter = {}) {
-    const all = await listPrdsInternal();
+    const all = await listPrdsInternal({ cwd: filter.cwd });
     const filtered = all.filter((entry) => {
       if (filter.cwd && entry.cwd !== filter.cwd) return false;
       if (filter.epicId && entry.epicId !== filter.epicId) return false;
@@ -11100,6 +11034,7 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
 }
 
 module.exports = {
+  normalizeConfig,
   reportSchedulerError,
   finalizeJobWorktree,
   worktreeIntegrationVerdict,
@@ -11117,6 +11052,7 @@ module.exports = {
   getSchedulerStateSnapshot,
   computeDegradedBudget,
   writeQueue,
+  _setPeriodicReverifyEnabledForTests,
   _mutateForTests: mutate, // mutate() has no other exported call site; test-only seam.
   reconcile,
   broadcast,
@@ -11175,7 +11111,6 @@ module.exports = {
   applyOrphanOutcome,
   registerAdminRoutes,
   notifyOriginatingTab,
-  notifyNeedsReview,
   flushDueReviewNotices,
   isNotifiableTerminalStatus,
   extractResultTextFromLog,