claude-code-session-manager 0.40.1 → 0.40.3

package/dist/index.html

@@ -7,7 +7,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-BbI9slj8.js"></script>
+    <script type="module" crossorigin src="./assets/index-QRU8uTeq.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
     <link rel="stylesheet" crossorigin href="./assets/index-BxVBtmjA.css">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.40.1",
+  "version": "0.40.3",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/src/main/chatRunner.cjs

@@ -341,12 +341,30 @@ function getConcurrencyCap() {
 // await full teardown instead of firing SIGTERM and returning immediately.
 const inFlight = new Map();
 const waiting = []; // [{ tabId, sessionId, prompt, cwd, resume, silent, onSilentResult }]
+// tabIds picked by pump() but not yet registered in `inFlight` by executeRun.
+// Closes the microtask-wide window in which per-tab exclusivity would
+// otherwise not hold. See pump().
+const dispatching = new Set();
 let activeCount = 0;
 
 // Indirection so tests can stub the spawn without launching claude.
 let executor = executeRun;
 function __setExecutor(fn) { executor = fn || executeRun; }
 
+/**
+ * Test hook: drop all lane state. The module is a singleton shared across
+ * every test in a file, and a spec whose fake child never emits 'exit' leaves
+ * its run permanently in flight — holding a session slot and a lane seat that
+ * silently starve every later test. Also releases the shared slot pool.
+ */
+function __resetQueueForTests() {
+  inFlight.clear();
+  dispatching.clear();
+  waiting.length = 0;
+  activeCount = 0;
+  sessionSlots.__resetForTests();
+}
+
 // ─── Window reference (set by attachWindow) ────────────────────────────────
 
 let mainWindow = null;
@@ -375,27 +393,56 @@ function broadcast(channel, payload) {
  * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean, silent?: boolean, onSilentResult?: (text: string) => void, promptId?: string }} opts
  */
 function run(opts) {
-  // Per-tab exclusivity guard — unrelated to the cross-tab cap; must hold for
-  // BOTH manual and silent runs so a manual send can't race a /context probe
-  // for the same tab against the same --resume sessionId.
-  if (inFlight.has(opts.tabId) || waiting.some((w) => w.tabId === opts.tabId)) return;
+  // Per-tab exclusivity still holds — two `claude -p --resume` against ONE
+  // sessionId must never overlap — but it is now enforced in pump() (which
+  // refuses to start a run for a tab that already has one live) rather than by
+  // discarding the submission here.
+  //
+  // Dropping was silent and unrecoverable: `chat:run` still resolved
+  // { ok: true }, so the renderer sat at running: true forever with no toast
+  // and no terminal event. A `silent` /context probe holding the tabId was
+  // enough to swallow a user's message. User-initiated sends are now QUEUED
+  // behind whatever holds the tab and dispatched in FIFO order.
+  // `dispatching` counts as busy too: between pump() picking a run and
+  // executeRun registering it in `inFlight`, the tab is committed but not yet
+  // visible in `inFlight` — the same window pump() guards against.
+  const tabBusy = inFlight.has(opts.tabId)
+    || dispatching.has(opts.tabId)
+    || waiting.some((w) => w.tabId === opts.tabId);
+  if (tabBusy && opts.silent) {
+    // Silent probes stay best-effort and invisible: a probe that collides is
+    // still dropped, since queueing one would delay real work to no benefit.
+    return { accepted: false, reason: 'tab-busy-silent' };
+  }
 
   waiting.push(opts);
   pump();
+  return { accepted: true, queued: tabBusy };
 }
 
 // Fill open lanes FIFO up to CONCURRENCY_CAP, then announce queue positions for
 // the remainder. O(n) over the waiting list (bounded by open tabs).
 function pump() {
   while (activeCount < getConcurrencyCap() && waiting.length > 0) {
+    // Per-tab exclusivity: skip past any waiting run whose tab already has one
+    // live, rather than head-blocking the whole lane on it. `dispatching`
+    // covers the gap between picking a job here and executeRun() registering
+    // it in `inFlight` (which happens a microtask later) — without it, one
+    // synchronous sweep of this loop could start two runs for the same tab and
+    // race two --resume processes against a single sessionId.
+    const idx = waiting.findIndex((w) => !inFlight.has(w.tabId) && !dispatching.has(w.tabId));
+    // Everything queued is blocked behind its own tab's live run; the settle()
+    // of that run re-pumps.
+    if (idx === -1) break;
     // The chat lane cap is a POLICY bound; actual capacity comes from the
     // Session-Manager-wide slot pool shared with the scheduler
     // (lib/sessionSlots.cjs). No slot → everyone keeps waiting; the next
     // settle() in either subsystem re-pumps.
-    const slotToken = sessionSlots.acquire(`chat:${waiting[0].tabId}`);
+    const slotToken = sessionSlots.acquire(`chat:${waiting[idx].tabId}`);
     if (!slotToken) break;
-    const job = waiting.shift();
+    const [job] = waiting.splice(idx, 1);
     activeCount += 1;
+    dispatching.add(job.tabId);
     Promise.resolve()
       .then(() => {
         const donePromise = executor(job);
@@ -404,7 +451,12 @@ function pump() {
         return donePromise;
       })
       .catch(() => { /* executeRun never rejects; defensive */ })
-      .finally(() => { sessionSlots.release(slotToken); activeCount -= 1; pump(); });
+      .finally(() => {
+        dispatching.delete(job.tabId);
+        sessionSlots.release(slotToken);
+        activeCount -= 1;
+        pump();
+      });
   }
   // Anyone still waiting gets a 1-based position update. Silent (automated
   // probe) runs must stay invisible to the renderer, same as every other
@@ -815,8 +867,12 @@ function registerChatHandlers() {
   const { schemas, validated } = require('./ipcSchemas.cjs');
 
   ipcMain.handle('chat:run', validated(schemas.chatRun, async ({ tabId, sessionId, prompt, cwd, resume, promptId }) => {
-    run({ tabId, sessionId, prompt, cwd, resume: !!resume, promptId });
-    return { ok: true };
+    // Report what actually happened instead of an unconditional { ok: true }.
+    // A user send is always accepted now (queued behind the tab's live run if
+    // one holds it), but the renderer gets the truth either way rather than a
+    // success it can't verify.
+    const outcome = run({ tabId, sessionId, prompt, cwd, resume: !!resume, promptId });
+    return { ok: outcome.accepted !== false, queued: !!outcome.queued, reason: outcome.reason };
   }));
 
   // Classification for a queued PromptTicket reaching the front of its
@@ -841,6 +897,7 @@ function registerChatHandlers() {
 module.exports = {
   run,
   cancel,
+  __resetQueueForTests,
   attachWindow,
   registerChatHandlers,
   parseStopSignal,

package/src/main/health.cjs

@@ -84,6 +84,11 @@ function evaluateTickLiveness(queueState, heartbeat, now, runningCount) {
   if (queueState.paused) return { stalled: false, reason: 'paused' };
   if (config.enabled === false) return { stalled: false, reason: 'disabled' };
   if (running >= concurrencyCap) return { stalled: false, reason: 'at-capacity' };
+  // 'manual' means the operator fires batches by hand — the scheduler is not
+  // supposed to pick these up on its own, so pending work sitting with free
+  // capacity is the configured behaviour, not a stall. Without this, any queue
+  // under a manual policy reported RED forever and drowned out real stalls.
+  if (config.firePolicy === 'manual') return { stalled: false, reason: 'manual-fire-policy' };
 
   const lastRunAt = queueState.lastRunAt ? Date.parse(queueState.lastRunAt) : null;
   // No lastRunAt at all (fresh install, never ticked) — nothing to measure

package/src/main/pty.cjs

@@ -25,6 +25,11 @@ const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 // the remediation message so the user can cd there and rebuild.
 const PKG_DIR = path.join(__dirname, '..', '..');
 
+// Per-session replay buffer ceiling. Big enough that switching away from an
+// Epic and back shows a meaningful working history, small enough that a dozen
+// chatty sessions can't balloon main-process memory.
+const REPLAY_BUFFER_MAX = 256 * 1024;
+
 /**
  * ANSI-formatted terminal text explaining a native-module / immediate-exit
  * failure and exactly how to fix it. Written straight into the tab's output so
@@ -60,6 +65,13 @@ class PtyManager {
   constructor() {
     this.sessions = new Map(); // tabId -> { proc, cwd, created }
     this.killed = new Set();   // tabIds explicitly killed — suppress their exit events
+    // tabId -> recent output, replayed verbatim on reattach. An Epic's
+    // Terminal pane unmounts whenever the user views a DIFFERENT Epic while
+    // its claude keeps running (Epic ⇄ claude-session is 1:1 and must survive
+    // browsing), so "pre-reattach output is lost" — tolerable for a dev
+    // reload — would read as the session having been wiped. Bounded ring so a
+    // long-lived session can't grow this without limit.
+    this.buffers = new Map();
     this.window = null;
   }
 
@@ -104,6 +116,15 @@ class PtyManager {
       } catch {
         /* pty may have exited between the check and the resize */
       }
+      // Replay recent output so a reattached viewport isn't blank. The caller
+      // registers its pty:data listener BEFORE invoking spawn (see
+      // EpicTerminalPane / Terminal), and this fires on the next tick, so the
+      // listener is always in place by the time the replay lands. Sent as one
+      // chunk ahead of any live data, preserving ordering.
+      const replay = this.buffers.get(tabId);
+      if (replay) {
+        setImmediate(() => sendIfAlive(this.window, `pty:data:${tabId}`, replay));
+      }
       // If the process has already exited but its session wasn't cleaned up,
       // fire a synthetic exit after the renderer re-registers its onExit handler.
       if (existing.proc.exitCode != null) {
@@ -154,6 +175,7 @@ class PtyManager {
 
     proc.onData((data) => {
       gotData = true;
+      this.#appendReplay(tabId, data);
       sendIfAlive(this.window, `pty:data:${tabId}`, data);
     });
 
@@ -164,6 +186,7 @@ class PtyManager {
       if (this.killed.delete(tabId)) {
         console.log('[pty] suppressed exit broadcast for killed tabId=', tabId);
         this.sessions.delete(tabId);
+        this.buffers.delete(tabId);
         return;
       }
       // Fast-exit detector: a shell that dies in <1.2s with a non-zero status
@@ -176,12 +199,22 @@ class PtyManager {
       }
       sendIfAlive(this.window, `pty:exit:${tabId}`, { exitCode, signal });
       this.sessions.delete(tabId);
+      this.buffers.delete(tabId);
     });
 
     this.sessions.set(tabId, { proc, cwd, created: spawnedAt });
     return { pid: proc.pid, cwd, reattached: false };
   }
 
+  /** Append to a session's bounded replay buffer, trimming oldest output. */
+  #appendReplay(tabId, data) {
+    const next = (this.buffers.get(tabId) ?? '') + data;
+    this.buffers.set(
+      tabId,
+      next.length > REPLAY_BUFFER_MAX ? next.slice(next.length - REPLAY_BUFFER_MAX) : next,
+    );
+  }
+
   write({ tabId, data }) {
     const s = this.sessions.get(tabId);
     if (!s) {
@@ -225,6 +258,7 @@ class PtyManager {
         /* already dead */
       }
       this.sessions.delete(tabId);
+      this.buffers.delete(tabId);
     }
   }
 

package/src/main/scheduler.cjs

@@ -3822,116 +3822,137 @@ function registerScheduleHandlers() {
 
 async function init() {
   ensureDirs();
-  // A slot freed anywhere (e.g. a chat run settled) may unblock a deferred
-  // batch — advance the queue without waiting for the next 60s poll.
-  sessionSlots.subscribe(() => { tickQueue().catch(() => {}); });
-  // Retire the global queue.json: split its rows into per-project shards
-  // BEFORE the first read below, so boot reconciliation sees the shards.
+  // Boot phase — reconciliation, migrations, self-heal, first reset probe.
+  // Guarded as a unit: everything below installs the timers that ARE the
+  // running scheduler (poll loop, heartbeat, supervisor). A throw in here
+  // used to reject init() and silently skip all of them, leaving an app
+  // that looks up and holds the ownership lock but never ticks and never
+  // writes a heartbeat — indistinguishable from a hung queue. Most of this
+  // work is best-effort recovery; none of it is worth trading the scheduler
+  // itself for. rescheduleTimer() in particular reaches the billing API,
+  // which fails whenever the OAuth token is stale.
   try {
-    const m = await queueStore.migrateLegacyGlobalQueue(DEFAULT_PROJECT_CWD);
-    if (m.migrated) {
-      console.log(`[scheduler] legacy global queue retired: ${m.moved} row(s) split across ${m.projects} project shard(s)`);
+    // A slot freed anywhere (e.g. a chat run settled) may unblock a deferred
+    // batch — advance the queue without waiting for the next 60s poll.
+    sessionSlots.subscribe(() => { tickQueue().catch(() => {}); });
+    // Retire the global queue.json: split its rows into per-project shards
+    // BEFORE the first read below, so boot reconciliation sees the shards.
+    try {
+      const m = await queueStore.migrateLegacyGlobalQueue(DEFAULT_PROJECT_CWD);
+      if (m.migrated) {
+        console.log(`[scheduler] legacy global queue retired: ${m.moved} row(s) split across ${m.projects} project shard(s)`);
+      }
+    } catch (e) {
+      console.error('[scheduler] legacy queue split failed', e?.message);
     }
-  } catch (e) {
-    console.error('[scheduler] legacy queue split failed', e?.message);
-  }
-  await runPrdMigration();
-  sweepQueueBackups().catch((e) => console.warn('[scheduler] backup sweep failed', e?.message));
-
-  // Hydrate cached state from the sidecar before any scheduling decisions.
-  loadSchedulerState();
-  bootedAt = Date.now();
-
-  // Boot reconciliation: finalize any job that was 'running' when the app died.
-  // Check the run log first — a job that emitted result/success before the crash
-  // should be marked 'completed', not 'failed', so it doesn't wedge the queue
-  // via the failure-gate. Also kill any still-live orphan claude child to prevent
-  // it from continuing to write to the project unsupervised (2026-05-21 incident).
-  //
-  // classifyRunOutcome calls readTail → fs.readFileSync (up to 64 KB per job).
-  // Pre-compute all outcomes BEFORE entering the mutate lock so the blocking I/O
-  // does not stall the event loop or hold the mutateTail chain during startup.
-  //
-  // Jobs whose recorded pid is still alive are deferred (not classified here) —
-  // see partitionBootOrphans. Everything else (dead pid or no pid) is safe to
-  // classify immediately below.
-  const bootSnap = readQueueSync();
-  const { immediate: immediateSlugs, deferred: deferredSlugs } = partitionBootOrphans(bootSnap.jobs);
-  const bootOutcomes = new Map();
-  for (const j of bootSnap.jobs) {
-    if (!immediateSlugs.includes(j.slug)) continue;
-    const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
-    bootOutcomes.set(j.slug, logPath ? classifyRunOutcome(logPath) : 'unknown');
-  }
-  const bootReconciledCompletions = [];
-  await mutate((state) => {
-    for (const j of state.jobs) {
-      if (j.status !== 'running' || !immediateSlugs.includes(j.slug)) continue;
-      const outcome = bootOutcomes.get(j.slug) ?? 'unknown';
-      const pid = j.runtime?.pid;
-      const killNote = pid ? ` (orphan pid=${pid}: dead)` : '';
-      applyOrphanOutcome(j, outcome, killNote);
-      if (j.status === 'completed') bootReconciledCompletions.push({ slug: j.slug, cwd: j.cwd });
-      console.log(`[scheduler] boot reconcile: slug=${j.slug} outcome=${outcome} → status=${j.status}`);
+    await runPrdMigration();
+    sweepQueueBackups().catch((e) => console.warn('[scheduler] backup sweep failed', e?.message));
+
+    // Hydrate cached state from the sidecar before any scheduling decisions.
+    loadSchedulerState();
+    bootedAt = Date.now();
+
+    // Boot reconciliation: finalize any job that was 'running' when the app died.
+    // Check the run log first — a job that emitted result/success before the crash
+    // should be marked 'completed', not 'failed', so it doesn't wedge the queue
+    // via the failure-gate. Also kill any still-live orphan claude child to prevent
+    // it from continuing to write to the project unsupervised (2026-05-21 incident).
+    //
+    // classifyRunOutcome calls readTail → fs.readFileSync (up to 64 KB per job).
+    // Pre-compute all outcomes BEFORE entering the mutate lock so the blocking I/O
+    // does not stall the event loop or hold the mutateTail chain during startup.
+    //
+    // Jobs whose recorded pid is still alive are deferred (not classified here) —
+    // see partitionBootOrphans. Everything else (dead pid or no pid) is safe to
+    // classify immediately below.
+    const bootSnap = readQueueSync();
+    const { immediate: immediateSlugs, deferred: deferredSlugs } = partitionBootOrphans(bootSnap.jobs);
+    const bootOutcomes = new Map();
+    for (const j of bootSnap.jobs) {
+      if (!immediateSlugs.includes(j.slug)) continue;
+      const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
+      bootOutcomes.set(j.slug, logPath ? classifyRunOutcome(logPath) : 'unknown');
+    }
+    const bootReconciledCompletions = [];
+    await mutate((state) => {
+      for (const j of state.jobs) {
+        if (j.status !== 'running' || !immediateSlugs.includes(j.slug)) continue;
+        const outcome = bootOutcomes.get(j.slug) ?? 'unknown';
+        const pid = j.runtime?.pid;
+        const killNote = pid ? ` (orphan pid=${pid}: dead)` : '';
+        applyOrphanOutcome(j, outcome, killNote);
+        if (j.status === 'completed') bootReconciledCompletions.push({ slug: j.slug, cwd: j.cwd });
+        console.log(`[scheduler] boot reconcile: slug=${j.slug} outcome=${outcome} → status=${j.status}`);
+      }
+    });
+    for (const { slug, cwd } of bootReconciledCompletions) {
+      await archiveCompletedPrd(slug, cwd);
     }
-  });
-  for (const { slug, cwd } of bootReconciledCompletions) {
-    await archiveCompletedPrd(slug, cwd);
-  }
 
-  // Still-alive orphans: SIGTERM (+ killOrphanClaudePid's own deferred SIGKILL
-  // follow-up) now, but classification waits until BOOT_ORPHAN_KILL_GRACE_MS
-  // later — reading the log while the orphan might still be writing to it
-  // could misclassify an about-to-succeed run as no_result and double-run the
-  // same PRD (2026-05-21 incident this guard exists for).
-  for (const slug of deferredSlugs) {
-    const j = bootSnap.jobs.find((x) => x.slug === slug);
-    const pid = j?.runtime?.pid;
-    const bootRunId = j?.runId ?? null; // captured now — guards against reconciling a DIFFERENT later run of the same slug
-    if (!pid) continue;
-    const result = killOrphanClaudePid(pid);
-    const killNote = ` (orphan pid=${pid}: ${result})`;
-    if (result === 'killed') {
-      console.log(`[scheduler] boot: SIGTERM'd orphan claude pid=${pid} for ${slug} — deferring finalize ${BOOT_ORPHAN_KILL_GRACE_MS}ms`);
+    // Still-alive orphans: SIGTERM (+ killOrphanClaudePid's own deferred SIGKILL
+    // follow-up) now, but classification waits until BOOT_ORPHAN_KILL_GRACE_MS
+    // later — reading the log while the orphan might still be writing to it
+    // could misclassify an about-to-succeed run as no_result and double-run the
+    // same PRD (2026-05-21 incident this guard exists for).
+    for (const slug of deferredSlugs) {
+      const j = bootSnap.jobs.find((x) => x.slug === slug);
+      const pid = j?.runtime?.pid;
+      const bootRunId = j?.runId ?? null; // captured now — guards against reconciling a DIFFERENT later run of the same slug
+      if (!pid) continue;
+      const result = killOrphanClaudePid(pid);
+      const killNote = ` (orphan pid=${pid}: ${result})`;
+      if (result === 'killed') {
+        console.log(`[scheduler] boot: SIGTERM'd orphan claude pid=${pid} for ${slug} — deferring finalize ${BOOT_ORPHAN_KILL_GRACE_MS}ms`);
+      }
+      setTimeout(() => {
+        const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
+        const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
+        let deferredCompletedCwd;
+        mutate((state) => {
+          const cur = state.jobs.find((x) => x.slug === slug);
+          // Race guard: bail if the job already resolved, OR if it's already been
+          // re-picked into a NEW run (different runId) within the grace window —
+          // that new run is not the boot orphan we SIGTERM'd and must not be
+          // touched by this stale classification.
+          if (!cur || cur.status !== 'running' || cur.runId !== bootRunId) return;
+          applyOrphanOutcome(cur, outcome, killNote);
+          console.log(`[scheduler] boot reconcile (deferred): slug=${slug} outcome=${outcome} → status=${cur.status}`);
+          deferredCompletedCwd = cur.status === 'completed' ? cur.cwd : undefined;
+        }).then(() => {
+          if (deferredCompletedCwd !== undefined) return archiveCompletedPrd(slug, deferredCompletedCwd);
+        }).catch((e) => console.error(`[scheduler] deferred boot reconcile failed for ${slug}:`, e?.message));
+      }, BOOT_ORPHAN_KILL_GRACE_MS).unref?.();
     }
-    setTimeout(() => {
-      const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
-      const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
-      let deferredCompletedCwd;
-      mutate((state) => {
-        const cur = state.jobs.find((x) => x.slug === slug);
-        // Race guard: bail if the job already resolved, OR if it's already been
-        // re-picked into a NEW run (different runId) within the grace window —
-        // that new run is not the boot orphan we SIGTERM'd and must not be
-        // touched by this stale classification.
-        if (!cur || cur.status !== 'running' || cur.runId !== bootRunId) return;
-        applyOrphanOutcome(cur, outcome, killNote);
-        console.log(`[scheduler] boot reconcile (deferred): slug=${slug} outcome=${outcome} → status=${cur.status}`);
-        deferredCompletedCwd = cur.status === 'completed' ? cur.cwd : undefined;
-      }).then(() => {
-        if (deferredCompletedCwd !== undefined) return archiveCompletedPrd(slug, deferredCompletedCwd);
-      }).catch((e) => console.error(`[scheduler] deferred boot reconcile failed for ${slug}:`, e?.message));
-    }, BOOT_ORPHAN_KILL_GRACE_MS).unref?.();
-  }
 
-  // If we boot up while paused with a resumeAt in the past, clear it. This
-  // happens when the app was closed across the reset window.
-  const boot = await readQueue();
-  if (boot.paused && boot.paused.resumeAt && new Date(boot.paused.resumeAt).getTime() <= Date.now()) {
-    await clearPause('boot-elapsed');
-  } else if (boot.paused && boot.paused.resumeAt) {
-    // Re-arm the resume timer (lost across restart).
-    await setPaused(boot.paused.reason, boot.paused.resumeAt);
-  }
+    // If we boot up while paused with a resumeAt in the past, clear it. This
+    // happens when the app was closed across the reset window.
+    const boot = await readQueue();
+    if (boot.paused && boot.paused.resumeAt && new Date(boot.paused.resumeAt).getTime() <= Date.now()) {
+      await clearPause('boot-elapsed');
+    } else if (boot.paused && boot.paused.resumeAt) {
+      // Re-arm the resume timer (lost across restart).
+      await setPaused(boot.paused.reason, boot.paused.resumeAt);
+    }
 
-  // Self-heal stale needs_review flags using the current verifier (see
-  // reverifyNeedsReview). Runs once on boot so a shipped verifier fix clears
-  // its own historical false positives without manual retagging.
-  await reverifyNeedsReview().catch((e) => {
-    console.error(`[scheduler] boot reverify failed: ${e?.message ?? e}`);
-  });
+    // Self-heal stale needs_review flags using the current verifier (see
+    // reverifyNeedsReview). Runs once on boot so a shipped verifier fix clears
+    // its own historical false positives without manual retagging.
+    await reverifyNeedsReview().catch((e) => {
+      console.error(`[scheduler] boot reverify failed: ${e?.message ?? e}`);
+    });
 
-  await rescheduleTimer();
+    await rescheduleTimer();
+  } catch (e) {
+    console.error('[scheduler] boot phase failed — starting timers anyway:', e?.message);
+    try {
+      require('./logs.cjs').writeLine({
+        scope: 'scheduler',
+        level: 'error',
+        message: 'boot phase failed; timers started anyway',
+        meta: { error: e?.message },
+      });
+    } catch { /* logging must never be the thing that stops the scheduler */ }
+  }
   // Refresh next-reset every 10 minutes — billing window can shift if usage
   // resets early or the auth token rotates. Tracked so re-init doesn't leak.
   if (rescheduleInterval) clearInterval(rescheduleInterval);