claude-code-session-manager 0.40.3 → 0.41.1

package/src/main/lib/opsOwnership.cjs

@@ -0,0 +1,169 @@
+'use strict';
+
+/**
+ * opsOwnership.cjs — THE SINGLE-WRITER LAW for a project's operations root.
+ *
+ * Every per-project operational namespace under
+ * `<projectCwd>/session-manager-operations/<namespace>/` has exactly ONE
+ * owning surface that may write to it. Everyone else reads. Reads are never
+ * restricted — consistency here is about who may *mutate* state, not who may
+ * see it.
+ *
+ * Why: these folders ARE the app's source of truth (Epics, PRDs, queue state,
+ * the Brief). When two surfaces write the same folder, they race through
+ * separate read-modify-write cycles and the later rename silently wins — the
+ * same class of bug that already produced live queue.json rows whose
+ * sourcePromptId and sourceTabId disagree. One writer per namespace removes
+ * the race by construction instead of by convention.
+ *
+ * The law is FAIL-CLOSED: a write into the ops root by an undeclared writer,
+ * or into a namespace with no declared owner, is refused. Adding a new
+ * namespace or a new writer is therefore a deliberate edit to this file — the
+ * ownership map is reviewable in one place rather than implied by whichever
+ * modules happen to call fs.writeFile.
+ *
+ * Enforcement points (every write path into the ops root calls assertOpsWrite):
+ *   - config.cjs writeTextAtomic / writeBinaryAtomic / writeJson / writeJsonSync
+ *   - lib/epicMint.cjs      (raw fs tmp+rename)
+ *   - lib/queueStore.cjs    (raw fs tmp+rename)
+ *   - lib/opsErrorLog.cjs   (raw fs append, JSONL error log)
+ * Renderer callers declare their writer id through the IPC payload.
+ */
+
+const path = require('node:path');
+
+const OPS_ROOT_DIR = 'session-manager-operations';
+
+/**
+ * namespace → the one writer id allowed to mutate it.
+ *
+ * Writer ids name a SURFACE (the tab/feature that owns the data), not a
+ * module — several modules may implement one surface, but they all write as
+ * that surface, and a surface owns its folder outright.
+ */
+const OWNERS = Object.freeze({
+  // Epics own the PromptSession store: active-index.json + per-Epic archives.
+  'prompt-sessions': 'epics',
+  // The Scheduler owns PRD sources, per-Epic PRD dirs, and queue/history shards.
+  'scheduler': 'scheduler',
+  // Project Home owns the synthesized Brief (generate + hand-edit).
+  'project-brief': 'project-home',
+  // The feedback intake folder — written by the RCA hook and feedback filing.
+  'feedback': 'feedback',
+  // Browser tab scratch saves (DOM captures, screenshots, recorded flows).
+  'browser': 'browser',
+  // Structured per-tab error log lines (JSONL), tagged for tracing/analysis.
+  'logs': 'logs',
+});
+
+/**
+ * Narrow, explicit exceptions to single-writer. Each entry names a second
+ * writer, the exact file it may touch, and why the owner can't do it itself.
+ * Anything not listed here is refused — a delegation must be argued for in
+ * code review, not discovered later in a race.
+ */
+const DELEGATIONS = Object.freeze({
+  'prompt-sessions': Object.freeze([
+    Object.freeze({
+      writer: 'scheduler',
+      // Only this one file, and only its top level.
+      file: 'active-index.json',
+      reason:
+        'The scheduler appends prd_created/response events to the Epic that '
+        + 'spawned a job (promptSessionEvents.cjs, PRD 814) and mints/joins an '
+        + 'Epic when a PRD is created (epicMint.cjs). Both happen in the main '
+        + 'process with no renderer attached, so the Epics surface cannot '
+        + 'perform them. Serialized per-path by each module\'s own write lock.',
+    }),
+  ]),
+});
+
+/**
+ * Split an absolute path into { inOps, namespace, relative }.
+ * `namespace` is the segment directly under session-manager-operations/;
+ * `relative` is the remainder (posix-joined), '' when the path IS the
+ * namespace dir. Returns inOps:false for any path outside an ops root.
+ *
+ * Complexity: O(n) in path segments.
+ */
+function parseOpsPath(absPath) {
+  if (!absPath || typeof absPath !== 'string') return { inOps: false, namespace: null, relative: null };
+  const segs = absPath.split(path.sep).filter(Boolean);
+  const idx = segs.lastIndexOf(OPS_ROOT_DIR);
+  if (idx === -1) return { inOps: false, namespace: null, relative: null };
+  const rest = segs.slice(idx + 1);
+  // A write to the ops root itself carries no namespace — nobody owns it.
+  if (rest.length === 0) return { inOps: true, namespace: null, relative: '' };
+  return { inOps: true, namespace: rest[0], relative: rest.slice(1).join('/') };
+}
+
+/** True when `writer` may write `relative` inside `namespace` by delegation. */
+function isDelegated(namespace, relative, writer) {
+  const entries = DELEGATIONS[namespace];
+  if (!entries) return false;
+  return entries.some((d) => d.writer === writer && d.file === relative);
+}
+
+/**
+ * Decide whether `writer` may write `absPath`. Pure — returns a verdict
+ * rather than throwing, so it can be unit-tested and so callers choose their
+ * own failure mode.
+ *
+ * Paths outside any ops root are allowed here unconditionally: they are
+ * governed by config.cjs's validateWrite boundary, which is a separate
+ * question (may this process write here at all) from ownership (which surface
+ * owns this state).
+ */
+function checkOpsWrite(absPath, writer) {
+  const { inOps, namespace, relative } = parseOpsPath(absPath);
+  if (!inOps) return { ok: true, error: null };
+
+  if (!namespace) {
+    return { ok: false, error: `${OPS_ROOT_DIR}/ itself has no owner — write inside a namespace folder` };
+  }
+
+  const owner = OWNERS[namespace];
+  if (!owner) {
+    return {
+      ok: false,
+      error:
+        `no declared owner for ${OPS_ROOT_DIR}/${namespace}/ — `
+        + `add it to OWNERS in lib/opsOwnership.cjs before writing there`,
+    };
+  }
+
+  if (!writer) {
+    return {
+      ok: false,
+      error:
+        `write to ${OPS_ROOT_DIR}/${namespace}/ did not declare a writer `
+        + `(owner is '${owner}')`,
+    };
+  }
+
+  if (writer === owner) return { ok: true, error: null };
+  if (isDelegated(namespace, relative, writer)) return { ok: true, error: null };
+
+  return {
+    ok: false,
+    error:
+      `'${writer}' may not write ${OPS_ROOT_DIR}/${namespace}/${relative} — `
+      + `that namespace is owned by '${owner}' (single-writer law, `
+      + `lib/opsOwnership.cjs). Read it freely; route writes through the owner.`,
+  };
+}
+
+/** Throwing wrapper used at each enforcement point. */
+function assertOpsWrite(absPath, writer) {
+  const verdict = checkOpsWrite(absPath, writer);
+  if (!verdict.ok) throw new Error(verdict.error);
+}
+
+module.exports = {
+  OPS_ROOT_DIR,
+  OWNERS,
+  DELEGATIONS,
+  parseOpsPath,
+  checkOpsWrite,
+  assertOpsWrite,
+};

package/src/main/lib/prdCreate.cjs

@@ -23,6 +23,7 @@ const { kebabCase } = require('./kebabCase.cjs');
 const config = require('../config.cjs');
 const { expandHome } = require('./expandHome.cjs');
 const { readBody, sendJson } = require('./localAdminHttp.cjs');
+const { readActiveIndex } = require('./epicMint.cjs');
 
 const STANDARDS_PATH = path.join(
   __dirname, '..', '..', '..',
@@ -90,6 +91,29 @@ function buildPrdBody(input) {
   return `${fmLines.join('\n')}${bodyLines.join('\n')}`;
 }
 
+/**
+ * Best-effort fallback for a PRD queued via the scheduler_create_prd MCP tool
+ * from inside an Epic's own headless chat session, when the model's tool
+ * call omitted `sourcePromptId` — the exact gap that let PRDs 866/867 mint
+ * two unrelated sibling Epics instead of joining the Epic that was actually
+ * driving the conversation (2026-08-01). `claudeSessionId` is this process's
+ * `originClaudeSessionId` input (chatRunner.cjs's SM_CHAT_SESSION_ID env var,
+ * inherited down to the MCP server child); looked up against `cwd`'s
+ * active-index.json for the Epic whose own claudeSessionId matches (domain
+ * model: Epic:claude-session is 1:1). Returns null for a non-Epic tab (plain
+ * SessionTab chat) or when the id is stale/unknown — never throws, since this
+ * is strictly a convenience default and a miss must fall back to minting a
+ * normal Epic exactly like today.
+ */
+function resolveSourcePromptIdFromClaudeSession(cwd, claudeSessionId) {
+  if (!claudeSessionId) return null;
+  const { sessions } = readActiveIndex(cwd);
+  for (const session of Object.values(sessions)) {
+    if (session && session.claudeSessionId === claudeSessionId) return session.id;
+  }
+  return null;
+}
+
 /**
  * Core create-PRD orchestration: cwd validation, slug derivation, NN
  * allocation, existing-file collision check, body build, write. Shared by
@@ -115,13 +139,26 @@ async function createPrd(input, remote) {
   // joins that treat it as a literal path segment, so an unexpanded `~/...`
   // fails downstream as a bare "invalid slug" instead of a clear cwd error.
   const cwd = expandHome(input.cwd);
+  let realCwd;
   try {
-    config.validatePath(cwd);
+    realCwd = config.validatePath(cwd);
   } catch (e) {
     return { ok: false, status: 400, error: `cwd rejected: ${e?.message ?? 'outside allowed roots'}` };
   }
+  // Register this project's cwd as a write-allowed root (config.cjs's
+  // validateWrite gate). Chat-only Epics (headless claude -p, no Terminal
+  // PTY ever spawned for this cwd) reach this code path without pty.cjs's
+  // addAllowedRoot call ever having run — without this, every PRD write for
+  // such a project fails with "Write outside allowed write boundaries" even
+  // though validatePath (the read boundary) just passed above.
+  config.addAllowedRoot(realCwd);
   input = { ...input, cwd };
 
+  if (!input.sourcePromptId && input.originClaudeSessionId) {
+    const resolved = resolveSourcePromptIdFromClaudeSession(cwd, input.originClaudeSessionId);
+    if (resolved) input = { ...input, sourcePromptId: resolved };
+  }
+
   const slug = input.slug || deriveSlugFromTitle(input.title);
   if (!slug || !PRD_CREATE_SLUG_RE.test(slug)) {
     return { ok: false, status: 400, error: 'could not derive a valid kebab-case slug from title; supply "slug" explicitly' };
@@ -201,6 +238,7 @@ module.exports = {
   readStandards,
   deriveSlugFromTitle,
   buildPrdBody,
+  resolveSourcePromptIdFromClaudeSession,
   createPrd,
   registerAdminRoute,
 };

package/src/main/lib/prdLocations.cjs

@@ -62,6 +62,26 @@ function listEpicPrdDirs(cwd) {
   return dirs;
 }
 
+/**
+ * Every `prds-archived/` dir for one project cwd: the retired flat layout's
+ * sibling archive plus each Epic's own sibling archive. Consumed by the
+ * scheduler's archived-twin stale-queue-row guard, so a PRD archived under
+ * its Epic (the layout every new PRD uses) is still found.
+ */
+function listArchivedPrdDirs(cwd) {
+  const dirs = [path.join(cwd, ...PRD_SUBPATH, '..', 'prds-archived')];
+  let root;
+  try { root = resolveEpicsRoot(cwd); } catch { return dirs; }
+  let entries;
+  try { entries = fs.readdirSync(root, { withFileTypes: true }); } catch { return dirs; }
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    const archiveDir = path.join(root, ent.name, 'prds-archived');
+    if (fs.existsSync(archiveDir)) dirs.push(archiveDir);
+  }
+  return dirs;
+}
+
 /**
  * resolvePrdWriteDir(cwd) → `<cwd>/session-manager-operations/scheduler/prds`
  * Pure path join, no I/O. Throws on a missing/non-string cwd so a caller
@@ -158,6 +178,7 @@ module.exports = {
   resolveEpicsRoot,
   resolveEpicPrdWriteDir,
   listEpicPrdDirs,
+  listArchivedPrdDirs,
   deriveEpicIdFromPrdPath,
   PRD_SUBPATH,
   EPICS_SUBPATH,

package/src/main/lib/projectBriefCore.cjs

@@ -8,12 +8,21 @@
  * with plain-object inputs.
  *
  * brief.json shape (see design-mocks/home/DESIGN_SPEC.md "Persistence"):
- *   { version, synthesizedAt, model, purpose, what[], areas[], scope[],
- *     conventions[], pins{what,conventions}, pinned{what,conventions} }
+ *   { version, synthesizedAt, editedAt, model, purpose, what[], areas[],
+ *     scope[], conventions[], pins{what,conventions}, pinned{what,conventions} }
+ *
+ * The file is not write-once: `computeUpdate` is the hand-edit path (the
+ * "maintain" half of generate-and-maintain), so the brief can be corrected
+ * without paying for a full re-synthesis.
  */
 
 const BRIEF_VERSION = 1;
 const PINNABLE_BLOCKS = ['what', 'conventions'];
+/** Fields a caller may hand-edit through `computeUpdate`. Editing a PINNABLE
+ *  block also auto-pins it, so the next refresh cannot silently undo the edit;
+ *  the derived blocks (areas/scope) are re-synthesized on every refresh by
+ *  design, so edits to them are a stopgap, not a source of truth. */
+const EDITABLE_FIELDS = ['purpose', 'what', 'areas', 'scope', 'conventions'];
 
 /** true when a source's mtime is strictly newer than the brief's synthesizedAt. */
 function computeDrift(mtimeMs, synthesizedAtMs) {
@@ -131,12 +140,15 @@ function applyPinEnforcement(rawBrief, priorPins, priorPinned) {
 }
 
 /** Full persisted-shape builder: stamps version/synthesizedAt/model on top of
- *  the pin-enforced content. `nowIso` is passed in — never computed here. */
-function buildPersistedBrief({ rawBrief, priorPins, priorPinned, model, nowIso }) {
+ *  the pin-enforced content. `nowIso` is passed in — never computed here.
+ *  `priorEditedAt` carries forward so a refresh doesn't erase the record that
+ *  the (pinned, therefore preserved) blocks were hand-edited. */
+function buildPersistedBrief({ rawBrief, priorPins, priorPinned, model, nowIso, priorEditedAt = null }) {
   const enforced = applyPinEnforcement(rawBrief, priorPins, priorPinned);
   return {
     version: BRIEF_VERSION,
     synthesizedAt: nowIso,
+    editedAt: priorEditedAt || null,
     model,
     purpose: enforced.purpose,
     what: enforced.what,
@@ -163,9 +175,61 @@ function computeSetPin(currentBrief, block, pinned) {
   return { ok: true, brief: { ...currentBrief, pins: nextPins, pinned: nextPinned } };
 }
 
+/** Per-field shape guard for a hand-edit patch. Mirrors validateBriefShape's
+ *  strictness so an edit can never write a brief the renderer can't render. */
+function validateUpdateField(field, value) {
+  if (field === 'purpose') {
+    if (typeof value !== 'string' || !value.trim()) return 'purpose must be a non-empty string';
+    return null;
+  }
+  if (!Array.isArray(value)) return `${field} must be an array`;
+  if (field === 'what' || field === 'conventions') {
+    if (value.some((v) => typeof v !== 'string')) return `${field} must be an array of strings`;
+    return null;
+  }
+  if (value.some((v) => !v || typeof v !== 'object' || Array.isArray(v))) return `${field} must be an array of objects`;
+  return null;
+}
+
+/**
+ * Pure hand-edit transform. Given the current brief (or null), a patch of
+ * editable fields, and `nowIso`, returns the next brief with the patch applied
+ * and `editedAt` stamped. Any edited PINNABLE block is auto-pinned and its
+ * frozen copy set to the new content, so the next refresh preserves the edit
+ * instead of overwriting it. Returns {ok:false, error} on a missing brief,
+ * an unknown/empty patch, or a field whose shape would break the renderer.
+ *
+ * Complexity: O(n) in the patched arrays' lengths.
+ */
+function computeUpdate(currentBrief, patch, nowIso) {
+  if (!currentBrief) return { ok: false, error: 'no brief to edit yet — generate one first' };
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)) return { ok: false, error: 'patch must be an object' };
+
+  const fields = Object.keys(patch);
+  if (fields.length === 0) return { ok: false, error: 'patch is empty' };
+  const unknown = fields.filter((f) => !EDITABLE_FIELDS.includes(f));
+  if (unknown.length) return { ok: false, error: `not editable: ${unknown.join(', ')}` };
+  for (const f of fields) {
+    const err = validateUpdateField(f, patch[f]);
+    if (err) return { ok: false, error: err };
+  }
+
+  const next = { ...currentBrief, ...patch, editedAt: nowIso };
+  next.pins = { what: false, conventions: false, ...(currentBrief.pins || {}) };
+  next.pinned = { what: null, conventions: null, ...(currentBrief.pinned || {}) };
+  for (const block of PINNABLE_BLOCKS) {
+    if (fields.includes(block)) {
+      next.pins[block] = true;
+      next.pinned[block] = patch[block];
+    }
+  }
+  return { ok: true, brief: next };
+}
+
 module.exports = {
   BRIEF_VERSION,
   PINNABLE_BLOCKS,
+  EDITABLE_FIELDS,
   computeDrift,
   buildSources,
   buildSynthesisPrompt,
@@ -173,4 +237,6 @@ module.exports = {
   applyPinEnforcement,
   buildPersistedBrief,
   computeSetPin,
+  validateUpdateField,
+  computeUpdate,
 };

package/src/main/lib/queueStore.cjs

@@ -33,6 +33,7 @@ const fsp = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
 const { allProjectCwds, activeProjectCwds } = require('../../../scripts/lib/activeSessions.cjs');
+const { assertOpsWrite } = require('./opsOwnership.cjs');
 
 const MACHINE_STATE_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'scheduler-machine.json');
 const LEGACY_QUEUE_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'scheduled-plans', 'queue.json');
@@ -52,6 +53,7 @@ function projectHistoryPath(cwd) {
 }
 
 function writeJsonAtomicSync(file, value) {
+  assertOpsWrite(file, 'scheduler');
   fs.mkdirSync(path.dirname(file), { recursive: true });
   const tmp = `${file}.tmp-${process.pid}`;
   fs.writeFileSync(tmp, JSON.stringify(value, null, 2));
@@ -59,6 +61,7 @@ function writeJsonAtomicSync(file, value) {
 }
 
 async function writeJsonAtomic(file, value) {
+  assertOpsWrite(file, 'scheduler');
   await fsp.mkdir(path.dirname(file), { recursive: true });
   const tmp = `${file}.tmp-${process.pid}`;
   await fsp.writeFile(tmp, JSON.stringify(value, null, 2));

package/src/main/lib/rcaFeedbackHook.cjs

@@ -28,6 +28,7 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const config = require('../config.cjs');
+const { ensureEpic } = require('./epicMint.cjs');
 const { splitFrontmatter } = require('./prdFrontmatter.cjs');
 const { readTail } = require('./fileTail.cjs');
 const { resolvePrdWriteDir } = require('./prdLocations.cjs');
@@ -35,7 +36,6 @@ const { resolvePrdWriteDir } = require('./prdLocations.cjs');
 // The one project this hook always knows how to reach, used as the fallback
 // destination when a job's own cwd has no feedback inbox.
 const SM_REPO_ROOT = path.join(os.homedir(), 'Projects', 'session-manager');
-const SM_REPO_FEEDBACK_DIR = path.join(SM_REPO_ROOT, 'session-manager-operations', 'feedback');
 
 // NEVER write here: ~/.claude/session-manager/feedback/ is the scheduler's
 // auto-PRD intake (src/main/scheduler.cjs's periodic feedback sweep) — it
@@ -200,27 +200,31 @@ function extractAcceptanceCriteria(prdBody) {
 // ─── Destination resolution ──────────────────────────────────────────────────
 
 /**
- * Resolve where an RCA for `job` should be filed.
- *   1. <job.cwd>/session-manager-operations/feedback/ if it exists.
- *   2. Else session-manager's own repo inbox, naming the target project.
+ * Resolve which PROJECT the proposal is filed into.
+ *   1. the job's own cwd — Epics live in every project, so this is almost
+ *      always the answer.
+ *   2. else session-manager's own repo, naming the target project in the body.
+ *
+ * The old version probed for a `session-manager-operations/feedback/`
+ * directory and fell back when it was missing; with proposals there is
+ * nothing to probe for — the Epic store is created on demand.
  */
 function resolveDestination(job) {
   const jobCwd = job?.cwd;
   if (jobCwd) {
-    const candidate = path.join(jobCwd, 'session-manager-operations', 'feedback');
-    try {
-      if (fs.statSync(candidate).isDirectory()) {
-        return { dir: candidate, allowlistRoot: jobCwd, targetProjectNote: null };
-      }
-    } catch {
-      // missing/inaccessible — fall through to the session-manager fallback
-    }
+    return { cwd: jobCwd, allowlistRoot: jobCwd, targetProjectNote: null };
   }
-  const targetProjectNote = jobCwd
-    ? `Filed into session-manager's own feedback inbox because \`${jobCwd}\` has no ` +
-      `\`session-manager-operations/feedback/\` directory. Target project: \`${jobCwd}\`.`
-    : 'Filed into session-manager\'s own feedback inbox (job had no cwd on record).';
-  return { dir: SM_REPO_FEEDBACK_DIR, allowlistRoot: SM_REPO_ROOT, targetProjectNote };
+  return {
+    cwd: SM_REPO_ROOT,
+    allowlistRoot: SM_REPO_ROOT,
+    targetProjectNote: "Filed into session-manager's own project (job had no cwd on record).",
+  };
+}
+
+/** One-line title for the proposal — goalText is what the Epics list shows,
+ *  so it must stay short; the full RCA markdown rides in openingPrompt. */
+function rcaProposalTitle(job, verdict) {
+  return `PRD ${job?.slug ?? 'unknown'} needs review: ${humanVerdict(verdict)}`;
 }
 
 function shortRunId(runId) {
@@ -228,10 +232,6 @@ function shortRunId(runId) {
   return cleaned.slice(0, 12) || 'norun';
 }
 
-function rcaFileName(dateStr, slug, runId) {
-  return `${dateStr}-rca-${slug}-${shortRunId(runId)}.md`;
-}
-
 function lastNLines(text, n) {
   const lines = (text || '').split('\n');
   return lines.slice(-n).join('\n');
@@ -328,35 +328,6 @@ async function fileRcaFeedback({ job, runDir, verdict, annotations, investigatio
     }
 
     const dest = resolveDestination(job);
-    const dateStr = (now instanceof Date ? now : new Date()).toISOString().slice(0, 10);
-    const fileName = rcaFileName(dateStr, job.slug, job.runId);
-    const destPath = path.resolve(path.join(dest.dir, fileName));
-    if (!destPath.startsWith(path.resolve(dest.dir) + path.sep)) {
-      console.log(`[rca] skip: destPath escaped dest dir (${destPath})`);
-      return { filed: false, reason: 'unsafe-path' };
-    }
-    // /process-feedback archives dispositioned items to <dest.dir>/processed/
-    // immediately at disposition time (its own README convention) — long
-    // before this hook's own run-verify/self-heal passes might touch the same
-    // (slug, runId) again. Once archived, the live-dir check alone goes false
-    // and a re-trigger would refile a duplicate straight into the live inbox.
-    const processedPath = path.resolve(path.join(dest.dir, 'processed', fileName));
-    if (!processedPath.startsWith(path.resolve(path.join(dest.dir, 'processed')) + path.sep)) {
-      console.log(`[rca] skip: processedPath escaped processed dir (${processedPath})`);
-      return { filed: false, reason: 'unsafe-path' };
-    }
-
-    const liveExists = fs.existsSync(destPath);
-    const processedExists = !liveExists && fs.existsSync(processedPath);
-    const alreadyFiled = liveExists || processedExists;
-    if (alreadyFiled && !investigationText) {
-      const existingPath = liveExists ? destPath : processedPath;
-      console.log(`[rca] skip: already filed for ${job.slug}@${job.runId}`);
-      return { filed: false, reason: 'duplicate', path: existingPath };
-    }
-    // An investigationText update must target wherever the file actually
-    // lives (live dir or processed/), not assume the live dir.
-    const targetPath = liveExists || !processedExists ? destPath : processedPath;
 
     const meta = readRunMeta(runDir, job.slug);
     const logPath = runDir ? path.join(runDir, `${job.slug}.log`) : null;
@@ -369,11 +340,27 @@ async function fileRcaFeedback({ job, runDir, verdict, annotations, investigatio
       targetProjectNote: dest.targetProjectNote, annotations,
     });
 
+    // File it as a PROPOSED Epic rather than a markdown file in a feedback
+    // inbox. The proposal lands directly in the Epics workspace behind an
+    // Approve & start gate: nothing runs and nothing is spent until a human
+    // approves it. This replaced the feedback-folder intake (and the
+    // process-feedback triage pass that existed only to read it back out) —
+    // the proposal IS the work item, already carrying its own session and
+    // PRD directory. reuseByGoal makes a re-trigger for the same failure
+    // join the existing proposal instead of duplicating it, which is what
+    // the old live/processed existence checks were for.
     config.addAllowedRoot(dest.allowlistRoot);
-    await config.writeTextAtomic(targetPath, markdown);
+    const title = rcaProposalTitle(job, verdict);
+    const { epicId, created } = await ensureEpic(dest.cwd, {
+      goalText: title,
+      tag: 'bug',
+      status: 'proposed',
+      reuseByGoal: true,
+      openingPrompt: markdown,
+    });
 
-    console.log(`[rca] ${alreadyFiled ? 'updated (investigation)' : 'filed'} ${targetPath}`);
-    return { filed: true, path: targetPath, updated: alreadyFiled };
+    console.log(`[rca] ${created ? 'proposed' : 'joined'} epic ${epicId} for ${job.slug}`);
+    return { filed: true, epicId, created, updated: !created };
   } catch (e) {
     console.error('[rca] error filing RCA feedback', e?.message ?? String(e));
     return { filed: false, reason: 'error', error: e?.message ?? String(e) };
@@ -382,15 +369,14 @@ async function fileRcaFeedback({ job, runDir, verdict, annotations, investigatio
 
 module.exports = {
   fileRcaFeedback,
+  rcaProposalTitle,
   // Pure helpers, exported for unit tests.
   humanVerdict,
   classifyFailure,
   extractAcceptanceCriteria,
   extractRcaBlock,
   resolveDestination,
-  rcaFileName,
   buildRcaMarkdown,
   FAILURE_CLASSES,
   VERDICT_LABELS,
-  SM_REPO_FEEDBACK_DIR,
 };

package/src/main/logs.cjs

@@ -1,6 +1,7 @@
 const { app, ipcMain } = require('electron');
 const fs = require('node:fs');
 const path = require('node:path');
+const opsErrorLog = require('./lib/opsErrorLog.cjs');
 
 // Rolling daily files under <userData>/logs/. Anything mtime'd older than
 // RETENTION_MS is pruned at boot; we never compact mid-session, since the
@@ -75,7 +76,24 @@ function writeLine(payload) {
 }
 
 function registerLogHandlers() {
-  ipcMain.on('log:write', (_e, payload) => writeLine(payload));
+  ipcMain.on('log:write', (_e, payload) => {
+    writeLine(payload);
+    // Renderer errors that name which project/tab they belong to also land
+    // in that project's own session-manager-operations/logs/ — the
+    // machine-global file above mixes every project together and isn't
+    // taggable, so it's not a substitute for the per-project trace.
+    if (payload && payload.level === 'error' && payload.cwd) {
+      opsErrorLog.appendError({
+        cwd: payload.cwd,
+        scope: payload.scope,
+        tabId: payload.tabId,
+        epicId: payload.epicId,
+        tags: Array.isArray(payload.tags) ? payload.tags : [],
+        message: payload.message,
+        meta: payload.meta,
+      });
+    }
+  });
   ipcMain.handle('log:dir', () => logDir());
 }