claude-code-session-manager 0.41.1 → 0.42.0

package/dist/index.html

@@ -7,10 +7,10 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-CV9TNjxX.js"></script>
+    <script type="module" crossorigin src="./assets/index-D4ga1iZ5.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
-    <link rel="stylesheet" crossorigin href="./assets/index-CKY3mHgV.css">
+    <link rel="stylesheet" crossorigin href="./assets/index-CxGY-V5G.css">
   </head>
   <body class="bg-bg text-fg font-sans antialiased">
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.41.1",
+  "version": "0.42.0",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/scripts/lib/watchdogHelpers.cjs

@@ -313,9 +313,16 @@ async function emitFeedbackPRD(cwd, {
     // Every PRD belongs to an Epic (CLAUDE.md domain model). The sweep joins
     // one standing "Inbound feedback" Epic per project (reuseByGoal) so
     // recurring ticks chain into a single Epic rather than minting one each.
+    // This is an unattended automated sweep, not a human action — status
+    // MUST be 'proposed' (same as lib/rcaFeedbackHook.cjs) so the Epic lands
+    // behind the Approve & start human gate instead of running immediately;
+    // an 'active' default here would let an unattended process mint and
+    // execute PRDs with zero human approval, exactly the hole the 'proposed'
+    // gate exists to close.
     const epic = await ensureEpic(cwd, {
       goalText: 'Inbound feedback processing',
       tag: 'discussion',
+      status: 'proposed',
       reuseByGoal: true,
     });
     epicId = epic.epicId;

package/src/main/lib/__tests__/localAdminHttp.test.cjs

@@ -11,12 +11,24 @@
 
 'use strict';
 
-import { test, expect } from 'vitest';
+import { test, expect, afterAll } from 'vitest';
 const http = require('node:http');
 const fs = require('node:fs');
 const path = require('node:path');
+const os = require('node:os');
 const { createAdminHttp, TOKEN_PATH, resolveTokenPath } = require('../localAdminHttp.cjs');
 
+// Redirect every start() in this file away from the PRODUCTION admin-api.json.
+// Without this, these tests overwrote the running app's port+token with a
+// throwaway server's, orphaning scheduler-mcp-server.cjs until an app restart
+// (confirmed live 2026-08-01). Tests that specifically exercise path
+// resolution unset this override themselves.
+// Must live under the home dir: config.writeJson enforces allowedRoots.
+const TEST_TOKEN_PATH = path.join(path.dirname(TOKEN_PATH), `admin-api.test-${process.pid}.json`);
+process.env.SM_ADMIN_TOKEN_PATH = TEST_TOKEN_PATH;
+
+afterAll(() => { fs.rmSync(TEST_TOKEN_PATH, { force: true }); });
+
 function request(port, { method = 'GET', path: reqPath, token, body }) {
   return new Promise((resolve, reject) => {
     const headers = {};
@@ -109,11 +121,11 @@ test('start() persists token file with port + token, mode 0600', async () => {
   const admin = createAdminHttp();
   const { port, token } = await admin.start();
   try {
-    const raw = fs.readFileSync(TOKEN_PATH, 'utf8');
+    const raw = fs.readFileSync(TEST_TOKEN_PATH, 'utf8');
     const parsed = JSON.parse(raw);
     expect(parsed.port).toBe(port);
     expect(parsed.token).toBe(token);
-    const mode = fs.statSync(TOKEN_PATH).mode & 0o777;
+    const mode = fs.statSync(TEST_TOKEN_PATH).mode & 0o777;
     expect(mode).toBe(0o600);
   } finally {
     await admin.stop();
@@ -124,6 +136,8 @@ test('SM_DEV=1 writes to a dev-suffixed path, never the production admin-api.jso
   const devPath = path.join(path.dirname(TOKEN_PATH), 'admin-api.dev.json');
   const prevMtime = fs.existsSync(TOKEN_PATH) ? fs.statSync(TOKEN_PATH).mtimeMs : null;
   const prevEnv = process.env.SM_DEV;
+  const prevOverride = process.env.SM_ADMIN_TOKEN_PATH;
+  delete process.env.SM_ADMIN_TOKEN_PATH;
   process.env.SM_DEV = '1';
   const admin = createAdminHttp();
   try {
@@ -141,32 +155,36 @@ test('SM_DEV=1 writes to a dev-suffixed path, never the production admin-api.jso
   } finally {
     await admin.stop();
     if (prevEnv === undefined) delete process.env.SM_DEV; else process.env.SM_DEV = prevEnv;
+    if (prevOverride !== undefined) process.env.SM_ADMIN_TOKEN_PATH = prevOverride;
     fs.rmSync(devPath, { force: true });
   }
 });
 
-test('with neither SM_DEV nor SM_E2E set, writes to the original admin-api.json path', async () => {
+test('with neither SM_DEV nor SM_E2E set, resolves to the original admin-api.json path', () => {
+  // Path RESOLUTION only — deliberately does not start() a server here. This
+  // test used to boot one with no override set, which wrote a throwaway
+  // port+token straight into the live app's admin-api.json and cut
+  // scheduler-mcp-server.cjs off from the running app. Persistence itself is
+  // covered by the 0600 test above, against the redirected test path.
   const prevDev = process.env.SM_DEV;
   const prevE2e = process.env.SM_E2E;
+  const prevOverride = process.env.SM_ADMIN_TOKEN_PATH;
   delete process.env.SM_DEV;
   delete process.env.SM_E2E;
-  let admin;
+  delete process.env.SM_ADMIN_TOKEN_PATH;
   try {
     expect(resolveTokenPath()).toBe(TOKEN_PATH);
-    admin = createAdminHttp();
-    const { port, token } = await admin.start();
-    const parsed = JSON.parse(fs.readFileSync(TOKEN_PATH, 'utf8'));
-    expect(parsed.port).toBe(port);
-    expect(parsed.token).toBe(token);
   } finally {
-    if (admin) await admin.stop();
     if (prevDev === undefined) delete process.env.SM_DEV; else process.env.SM_DEV = prevDev;
     if (prevE2e === undefined) delete process.env.SM_E2E; else process.env.SM_E2E = prevE2e;
+    if (prevOverride !== undefined) process.env.SM_ADMIN_TOKEN_PATH = prevOverride;
   }
 });
 
 test('dev and production token paths never collide', () => {
   const prevEnv = process.env.SM_DEV;
+  const prevOverride = process.env.SM_ADMIN_TOKEN_PATH;
+  delete process.env.SM_ADMIN_TOKEN_PATH;
   try {
     process.env.SM_DEV = '1';
     const devPath = resolveTokenPath();
@@ -175,6 +193,7 @@ test('dev and production token paths never collide', () => {
     expect(devPath).not.toBe(prodPath);
   } finally {
     if (prevEnv === undefined) delete process.env.SM_DEV; else process.env.SM_DEV = prevEnv;
+    if (prevOverride !== undefined) process.env.SM_ADMIN_TOKEN_PATH = prevOverride;
   }
 });
 

package/src/main/lib/__tests__/schedulerBatchDepends.test.cjs

@@ -0,0 +1,94 @@
+'use strict';
+
+// Run: timeout 120 npx vitest run src/main/lib/__tests__/schedulerBatchDepends.test.cjs
+//
+// Regression coverage for dependsOn eligibility in pickForProject. The
+// bare-slug cases below are the ones that shipped broken: a PRD's filename
+// carries the auto-allocated `NN-` prefix, but `dependsOn:` is authored with
+// the bare name (the author can't know the number the allocator will issue),
+// so every such dep silently resolved to "no row -> already done" and the
+// gate never held anything.
+
+// vitest globals (test) — same convention as the other .cjs tests.
+const assert = require('node:assert/strict');
+const { pickForProject, DEFAULT_PROJECT_CWD } = require('../schedulerBatch.cjs');
+
+const CWD = DEFAULT_PROJECT_CWD;
+
+function job(slug, status, extra = {}) {
+return {
+  slug,
+  status,
+  cwd: CWD,
+  parallelGroup: Number(String(slug).match(/^(\d+)-/)?.[1] ?? 99),
+  dependsOn: [],
+  ...extra,
+};
+}
+
+function pick(jobs, running = new Set(), slots = 3) {
+return pickForProject(jobs, running, slots);
+}
+
+test('holds a dependent whose bare-named dep is still running (NN- prefix stripped)', () => {
+  const jobs = [
+    job('873-leftnav-two-face-framework', 'running'),
+    job('874-nav-face-project-home', 'pending', { dependsOn: ['leftnav-two-face-framework'] }),
+  ];
+  const { batch } = pick(jobs, new Set(['873-leftnav-two-face-framework']));
+  assert.deepEqual(batch.map((j) => j.slug), []);
+});
+
+test('holds a dependent whose bare-named dep is still pending', () => {
+  const jobs = [
+    job('873-leftnav-two-face-framework', 'pending'),
+    job('895-home-global-behavior-settings', 'pending', {
+      dependsOn: ['leftnav-two-face-framework', 'nav-face-session-manager-config'],
+    }),
+    job('890-nav-face-session-manager-config', 'pending', {
+      dependsOn: ['leftnav-two-face-framework'],
+    }),
+  ];
+  const { batch } = pick(jobs);
+  // Only the framework PRD (no deps) is eligible; both dependents are held.
+  assert.deepEqual(batch.map((j) => j.slug), ['873-leftnav-two-face-framework']);
+});
+
+test('releases a dependent once its bare-named dep is completed', () => {
+  const jobs = [
+    job('873-leftnav-two-face-framework', 'completed'),
+    job('874-nav-face-project-home', 'pending', { dependsOn: ['leftnav-two-face-framework'] }),
+  ];
+  const { batch } = pick(jobs);
+  assert.deepEqual(batch.map((j) => j.slug), ['874-nav-face-project-home']);
+});
+
+test('still resolves an exact-slug dep (dep written WITH the NN- prefix)', () => {
+  const jobs = [
+    job('873-leftnav-two-face-framework', 'pending'),
+    job('874-nav-face-project-home', 'pending', {
+      dependsOn: ['873-leftnav-two-face-framework'],
+    }),
+  ];
+  const { batch } = pick(jobs);
+  assert.deepEqual(batch.map((j) => j.slug), ['873-leftnav-two-face-framework']);
+});
+
+test('a dep with no row at all is treated as already done (archived/retired)', () => {
+  const jobs = [
+    job('874-nav-face-project-home', 'pending', { dependsOn: ['some-long-archived-prd'] }),
+  ];
+  const { batch } = pick(jobs);
+  assert.deepEqual(batch.map((j) => j.slug), ['874-nav-face-project-home']);
+});
+
+test('a FAILED bare-named dep holds the dependent and reports an explicit reason', () => {
+  const jobs = [
+    job('873-leftnav-two-face-framework', 'failed'),
+    job('874-nav-face-project-home', 'pending', { dependsOn: ['leftnav-two-face-framework'] }),
+  ];
+  const { batch, reason } = pick(jobs);
+  assert.deepEqual(batch, []);
+  assert.match(reason, /depends-gate/);
+  assert.match(reason, /874-nav-face-project-home <- leftnav-two-face-framework/);
+});

package/src/main/lib/auditLog.cjs

@@ -0,0 +1,60 @@
+/**
+ * auditLog.cjs — append-only trace of every Epic/PRD creation, so a rogue or
+ * unexpected Epic/PRD can always be traced back to its origin.
+ *
+ * Deliberately machine-level (~/.claude/session-manager/), not under any
+ * project's session-manager-operations/ — this is a security trace, not app
+ * state a project's single-writer law needs to arbitrate, and it must
+ * survive even if the project's ops root doesn't exist yet.
+ *
+ * Best-effort only: a logging failure must never block the mint/create it is
+ * observing (same posture as rcaFeedbackHook.cjs / dodDrainHook.cjs).
+ *
+ * Plain Node module (no Electron deps) so scripts/mint-epic.cjs and
+ * scripts/propose-epic.cjs (which run outside Electron) can require it too.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const AUDIT_LOG_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'audit-log.jsonl');
+
+/**
+ * Best-effort identity of the process making this call — there is no
+ * cryptographic caller identity available across the admin HTTP API (bearer
+ * token proves "runs as this OS user", not "which agent/session"), so this
+ * captures every breadcrumb that IS available: this process's pid/ppid, and
+ * (when set) the claude session id chatRunner.cjs stamps on headless
+ * `claude -p` children and passes down to MCP server children.
+ */
+function callerContext() {
+  return {
+    pid: process.pid,
+    ppid: process.ppid,
+    claudeSessionId: process.env.SM_CHAT_SESSION_ID || null,
+  };
+}
+
+/**
+ * appendAuditEvent(kind, fields) — append one JSONL record. `kind` is a short
+ * label ('epic_mint' | 'prd_create' | ...); `fields` is event-specific detail
+ * (cwd, epicId, status, title, slug, etc). Never throws.
+ */
+function appendAuditEvent(kind, fields = {}) {
+  try {
+    const record = {
+      at: new Date().toISOString(),
+      kind,
+      ...fields,
+      caller: callerContext(),
+    };
+    fs.mkdirSync(path.dirname(AUDIT_LOG_PATH), { recursive: true });
+    fs.appendFileSync(AUDIT_LOG_PATH, `${JSON.stringify(record)}\n`);
+  } catch (e) {
+    console.error('[auditLog] failed to append audit event', e?.message ?? String(e));
+  }
+}
+
+module.exports = { appendAuditEvent, AUDIT_LOG_PATH };

package/src/main/lib/epicMint.cjs

@@ -22,6 +22,7 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const { resolveEpicPrdWriteDir } = require('./prdLocations.cjs');
 const { assertOpsWrite } = require('./opsOwnership.cjs');
+const { appendAuditEvent } = require('./auditLog.cjs');
 
 function activeIndexPath(cwd) {
   return path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json');
@@ -164,6 +165,11 @@ function ensureEpic(cwd, { goalText, tag, reuseByGoal = false, epicId: explicitE
     index.events[epicId] = [firstEvent];
     writeActiveIndex(cwd, index);
 
+    // Every mint is logged, whether the Epic starts 'proposed' (human gate
+    // ahead) or 'active' (started immediately) — this is the trace-back point
+    // for "who/what created this Epic" (see auditLog.cjs).
+    appendAuditEvent('epic_mint', { cwd, epicId, status, tag: tag ?? null, goalText: session.goalText });
+
     const prdDir = resolveEpicPrdWriteDir(cwd, epicId);
     fs.mkdirSync(prdDir, { recursive: true });
     return { epicId, prdDir, created: true };

package/src/main/lib/localAdminHttp.cjs

@@ -49,6 +49,15 @@ const TOKEN_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'admin-
  * harmless tie-break, since real launches only ever set one or the other.
  */
 function resolveTokenPath() {
+  // Explicit override, highest priority. Exists because the unit tests call
+  // createAdminHttp().start() directly with neither SM_DEV nor SM_E2E set,
+  // which resolved to the PRODUCTION admin-api.json and overwrote the
+  // running app's port+token with a throwaway test server's — silently
+  // orphaning scheduler-mcp-server.cjs's access to the live app until the
+  // next app restart (confirmed live 2026-08-01: `npm run test:unit` made
+  // every scheduler_* MCP tool report "app is not running"). Tests point
+  // this at a tmp file; production never sets it.
+  if (process.env.SM_ADMIN_TOKEN_PATH) return process.env.SM_ADMIN_TOKEN_PATH;
   if (process.env.SM_DEV === '1') {
     return path.join(os.homedir(), '.claude', 'session-manager', 'admin-api.dev.json');
   }

package/src/main/lib/prdCreate.cjs

@@ -24,6 +24,7 @@ const config = require('../config.cjs');
 const { expandHome } = require('./expandHome.cjs');
 const { readBody, sendJson } = require('./localAdminHttp.cjs');
 const { readActiveIndex } = require('./epicMint.cjs');
+const { appendAuditEvent } = require('./auditLog.cjs');
 
 const STANDARDS_PATH = path.join(
   __dirname, '..', '..', '..',
@@ -192,6 +193,17 @@ async function createPrd(input, remote) {
     return { ok: false, status: 500, error: writeResult?.error ?? 'write failed' };
   }
 
+  // Trace-back point for "who/what created this PRD" (auditLog.cjs) — every
+  // PRD write, whether from the admin/MCP route or the renderer's chat:create-prd
+  // IPC handler, lands one record here regardless of outcome path above.
+  appendAuditEvent('prd_create', {
+    cwd: input.cwd,
+    slug: filenameSlug,
+    title: input.title,
+    sourcePromptId: input.sourcePromptId ?? null,
+    sourceTabId: input.sourceTabId ?? null,
+  });
+
   return { ok: true, nn, filename: `${filenameSlug}.md` };
 }
 

package/src/main/lib/schedulerBatch.cjs

@@ -49,10 +49,32 @@ function pickForProject(projectJobs, runningSlugsInProject, slots) {
   // unchanged (lowest-number-first waves), so an in-flight mixed queue keeps
   // its order without migration.
   const rowBySlug = new Map(projectJobs.map((j) => [j.slug, j]));
-  const blockingDep = (j) => (j.dependsOn ?? []).find((slug) => {
-    const dep = rowBySlug.get(slug);
-    return dep && dep.status !== 'completed';
-  });
+  // A PRD's filename slug carries the auto-allocated `NN-` prefix
+  // (prdCreate.cjs builds `${nn}-${slug}`), but a human/agent authoring
+  // `dependsOn:` writes the BARE name it chose — it cannot know the number
+  // the allocator will hand out. Without this, every such dep resolved to
+  // undefined and was silently treated as "already done", turning the whole
+  // dependency gate into a no-op (observed live 2026-08-01: 22 PRDs listing
+  // `leftnav-two-face-framework` while the real row was
+  // `873-leftnav-two-face-framework`, all of them eligible immediately even
+  // though the framework PRD they build on had not landed). Resolve a dep by
+  // exact slug first, then fall back to matching rows whose slug is that dep
+  // with a leading `NN-` stripped.
+  const rowsByBareSlug = new Map();
+  for (const j of projectJobs) {
+    const bare = String(j.slug ?? '').replace(/^\d+-/, '');
+    if (!rowsByBareSlug.has(bare)) rowsByBareSlug.set(bare, []);
+    rowsByBareSlug.get(bare).push(j);
+  }
+  /** Every queue row a dep string refers to (exact match, else bare-name match). */
+  const rowsForDep = (slug) => {
+    const exact = rowBySlug.get(slug);
+    if (exact) return [exact];
+    return rowsByBareSlug.get(String(slug ?? '').replace(/^\d+-/, '')) ?? [];
+  };
+  const blockingDep = (j) => (j.dependsOn ?? []).find((slug) => (
+    rowsForDep(slug).some((dep) => dep.status !== 'completed')
+  ));
 
   const allPending = projectJobs.filter(
     (j) => j.status === 'pending' && !runningSlugsInProject.has(j.slug),
@@ -64,7 +86,7 @@ function pickForProject(projectJobs, runningSlugsInProject, slots) {
   for (const j of allPending) {
     const dep = blockingDep(j);
     if (!dep) { pending.push(j); continue; }
-    if (rowBySlug.get(dep)?.status === 'failed') heldByFailedDep.push({ job: j, dep });
+    if (rowsForDep(dep).some((d) => d.status === 'failed')) heldByFailedDep.push({ job: j, dep });
     // running/pending/needs_review dep — simply not eligible this tick.
   }
   if (pending.length === 0) {

package/src/main/pty.cjs

@@ -147,6 +147,14 @@ class PtyManager {
       FORCE_COLOR: '1',
       // Tag the session so hook server / transcript tail can correlate.
       SESSION_MANAGER_TAB_ID: tabId,
+      // Tab ID = claudeSessionId by design (see CLAUDE.md domain model), and
+      // for an Epic, Terminal/Chat are two views over the SAME session — so
+      // this is exactly the id chatRunner.cjs sets for headless chat runs.
+      // Without it, a PRD queued via scheduler_create_prd from an
+      // interactive Epic terminal (not headless chat) had no way to resolve
+      // back to its originating Epic and minted an unrelated sibling one
+      // instead (prdCreate.cjs's resolveSourcePromptIdFromClaudeSession).
+      SM_CHAT_SESSION_ID: tabId,
     });
 
     const shell = process.env.SHELL || '/bin/bash';

package/src/main/scheduler.cjs

@@ -1071,6 +1071,11 @@ function reconcileSourcePromptId(job, parsedSourcePromptId) {
  * Status is preserved: pending stays pending, completed stays completed.
  * Newly-discovered PRDs land as `pending`.
  */
+// Epic ids already warned about (PRD-bearing but absent from
+// active-index.json). Module-scoped so the warning is one line per Epic per
+// process rather than one per 60s reconcile tick.
+const warnedUnregisteredEpics = new Set();
+
 async function reconcile(state) {
   // Defence in depth — tickQueue already gates on this, but reconcile is the
   // function that would do the damage (every unmatched PRD .md becomes a
@@ -1163,8 +1168,54 @@ async function reconcile(state) {
   // for them (that row already exists, durably, in history.jsonl).
   const historyArchiveCandidates = [];
 
+  // Cache active-index.json reads per cwd across this reconcile pass — many
+  // unmatched PRDs typically share a project, and readActiveIndex is a
+  // synchronous fs.readFileSync.
+  const epicStatusCache = new Map(); // cwd -> { sessions }
+  function epicStatus(cwd, epicId) {
+    if (!cwd || !epicId) return null;
+    let idx = epicStatusCache.get(cwd);
+    if (!idx) {
+      idx = readActiveIndex(cwd);
+      epicStatusCache.set(cwd, idx);
+    }
+    return idx.sessions[epicId]?.status ?? null;
+  }
+
   for (const [slug, p] of onDisk) {
     if (seen.has(slug)) continue;
+    // Security gate: a PRD's file location IS its Epic membership
+    // (prdLocations.deriveEpicIdFromPrdPath / p.epicId). Before this check,
+    // the scheduler queued ANY .md file it found under an Epic's prds/ dir
+    // regardless of that Epic's status or even whether it was ever properly
+    // minted — so a PRD filed under a 'proposed' Epic (agent-proposed,
+    // awaiting human Approve & start via EpicApprovalBar), or one dropped
+    // straight onto disk under a directory that was never registered via
+    // ensureEpic()/active-index.json at all (bypassing the app entirely),
+    // would still execute as a claude -p job with --dangerously-skip-permissions.
+    // Block ONLY an explicit 'proposed' — the actual human gate. The human's
+    // Approve action flips status to 'active' (state/promptSessions.ts) and
+    // the very next reconcile pass picks the PRD up with no other change.
+    //
+    // This deliberately does NOT require a positive 'active' registration.
+    // That stricter form shipped briefly and caused a 6-hour silent outage
+    // (2026-08-01): 23 real PRDs whose Epic dir existed on disk but had no
+    // active-index.json entry were skipped forever with no log line, so the
+    // scheduler looked simply dead. Absence of an entry is not evidence of a
+    // rogue writer — an Epic archived on completion also leaves active-index,
+    // and other paths can create the dir without registering it. Fail-closed
+    // is right for the approval gate; it is wrong as a blanket requirement,
+    // because the failure mode is invisible and unrecoverable by the user.
+    const ownerStatus = epicStatus(p.cwd, p.epicId);
+    if (p.epicId && ownerStatus === 'proposed') {
+      continue;
+    }
+    // Unregistered Epic dir: allowed, but never silently — this is the only
+    // signal that a PRD's Epic is missing from the index it should be in.
+    if (p.epicId && ownerStatus === null && !warnedUnregisteredEpics.has(p.epicId)) {
+      warnedUnregisteredEpics.add(p.epicId);
+      console.warn(`[scheduler] epic ${p.epicId} (${p.cwd}) has PRDs on disk but no active-index.json entry — queuing anyway; register or archive it to silence this`);
+    }
     const hist = historyBySlug.get(slug);
     if (hist) {
       if (hist.status === 'completed') {