claude-code-session-manager 0.58.0 → 0.60.0

package/src/main/scheduler.cjs

@@ -63,6 +63,7 @@ const prdParser = require('./scheduler/prdParser.cjs');
 const sessionsStore = require('./sessionsStore.cjs');
 const { enqueueExternalPrompt } = require('./chatRunner.cjs');
 const { appendResponseEventIfKnown } = require('./promptSessionEvents.cjs');
+const { maybeEnqueueValidationPrompt } = require('./lib/epicValidationHook.cjs');
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
 const { verifyRun } = require('./runVerify.cjs');
 const { latestTerminalOutcomeForSlug, COMPLETED_EQUIVALENT_VERDICTS } = require('./lib/terminalRunOutcome.cjs');
@@ -87,7 +88,7 @@ const queueOps = require('./queueOps.cjs');
 // home-dir layout.
 const { resolvePrdsDirs, resolveArchivedPrdsDirs, resolvePrdWriteDir, listEpicPrdDirs, listArchivedPrdDirs } = require('./lib/prdLocations.cjs');
 const { ensureEpic, appendPrdCreatedEvent, readActiveIndex } = require('./lib/epicMint.cjs');
-const { buildContextDigest } = require('./lib/epicContextDigest.cjs');
+const { buildContextDigest, composeExecutorPrompt } = require('./lib/epicContextDigest.cjs');
 
 // ---------- origin session resolution (PRD 832) ----------
 // An Epic IS a tagged claude session — job rows carry the originating
@@ -359,15 +360,6 @@ const HEARTBEAT_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'sc
 const HEARTBEAT_MAX_BYTES = 1024 * 1024;
 // DEFAULT_PROJECT_CWD imported from lib/schedulerBatch.cjs (single source of truth).
 
-// Read lazily (not captured at module-load time) so tests can stub the env
-// per-case without vi.resetModules(); production behavior is unaffected
-// since the env var never changes mid-process.
-function getEnvCap() {
-  return process.env.SM_SCHEDULER_MAX_CONCURRENCY
-    ? Math.max(1, Math.min(20, parseInt(process.env.SM_SCHEDULER_MAX_CONCURRENCY, 10) || 3))
-    : null;
-}
-
 // Each headless claude -p job can shell out to tsc/vite/pytest and grow well
 // past 1 GB at peak; reserve 2.5 GB per running+pending slot. Raised from 1.5 GB
 // after the 2026-06-16 OOM: 3 concurrent cross-project jobs + their build
@@ -392,7 +384,6 @@ const OOM_SCORE_ADJ_JOB = 500;
 
 const DEFAULT_CONFIG = {
   offsetMinutes: 15,
-  concurrencyCap: getEnvCap() ?? 3,
   defaultCwd: DEFAULT_PROJECT_CWD,
   // 'when-available' = poll usage and fire whenever utilization < threshold.
   // 'on-reset'        = fire offsetMinutes after the next 5h reset (legacy).
@@ -757,6 +748,16 @@ async function runPrdMigration() {
           meta: { cwd, reason: f.reason },
         });
       }
+      // Deliberately left behind because a live job still points at them
+      // (PRD 992). Logged so a permanently-stuck flat PRD is visible rather
+      // than looking like a clean consolidation.
+      for (const s of c.skipped ?? []) {
+        logs.writeLine({
+          level: 'info', scope: 'scheduler',
+          message: `flat-PRD consolidation: left ${s.file} in place`,
+          meta: { cwd, reason: s.reason },
+        });
+      }
     } catch (e) {
       logs.writeLine({ level: 'warn', scope: 'scheduler', message: 'flat-PRD consolidation failed', meta: { cwd, error: e?.message } });
     }
@@ -1450,6 +1451,18 @@ let cancelToken = { cancelled: false };
 // Last memory-gate observation; included in snapshot for renderer visibility.
 let lastMemGate = null;
 
+// Last tickQueue outcome, kept for the UI. tickQueue already computes a precise
+// reason for every way a batch can come back empty (dependency holds, slot
+// exhaustion, the memory gate, pause, manual policy) and used to throw all of
+// it into console.log — so the Home slot count read "5" while the queue was
+// actually pinned at 1 with nothing on screen explaining why. This is that
+// explanation, recorded once per tick and broadcast with the rest of the state.
+let lastTick = null;
+function recordTick(outcome, extra = {}) {
+  lastTick = { ...outcome, ...extra, at: new Date().toISOString() };
+  return outcome;
+}
+
 /**
  * Pure: applies clearPause()'s effect on the tick cancel-token.
  *
@@ -1505,10 +1518,19 @@ function buildScheduleStatePayload(state, { withPaths = false } = {}) {
       lastFailureKind,
     },
     memGate: lastMemGate,
-    effectiveConcurrency: {
-      cap: getEnvCap() ?? state.config.concurrencyCap,
-      source: getEnvCap() != null ? 'env' : 'config',
-    },
+    lastTick,
+    // The machine-wide slot pool IS the concurrency limit — there is no
+    // separate scheduler cap any more. `source` distinguishes the
+    // SM_SESSION_SLOTS env override from the persisted Home-tab value so the
+    // UI can disable its own control when the env has taken over.
+    effectiveConcurrency: (() => {
+      const snap = sessionSlots.snapshot();
+      return {
+        cap: snap.total,
+        free: Math.max(0, snap.total - snap.inUse),
+        source: snap.envOverride ? 'env' : 'pool',
+      };
+    })(),
   };
   if (withPaths) {
     payload.paths = { root: ROOT, prds: PRDS_DIR, runs: RUNS_DIR, queue: queueStore.MACHINE_STATE_PATH };
@@ -1797,6 +1819,43 @@ function extractResultTextFromLog(logPath) {
   }
 }
 
+/**
+ * resolveNotifyPrd(job, parsePrdRaw) → Promise<parsed PRD | null>
+ *
+ * Locate and parse a finishing job's PRD for the notification path, trying
+ * the live Epic-scoped dir first (findPrdDir scans candidatePrdsDirs) and
+ * then the archived twin (archivedPrdPathForJob scans listArchivedPrdDirs).
+ *
+ * Both lookups are required, and `prdPathForJob` is deliberately NOT used
+ * here (PRD 985). It resolves to `resolvePrdWriteDir(cwd)` — the RETIRED
+ * flat `<cwd>/session-manager-operations/scheduler/prds/` dir, which today
+ * holds only zero-byte `.reserved-NNN` number stubs and no PRD at all, so it
+ * ENOENT'd for every Epic-scoped PRD. On top of that, archiveCompletedPrd
+ * renames the file into `prds-archived/` immediately BEFORE the notify call
+ * (see tickQueue's newlyCompletedPrds loop), so even a correct live-dir
+ * lookup finds nothing by the time we run. The net effect was that `prd`
+ * was always null on the completed path: sourcePromptId never resolved, no
+ * transcript turn was written, no response event was appended, and the
+ * completed PRD silently never reported back to the Epic that authored it.
+ * Verified live: PRDs 961/962/963/964/967 all completed 2026-08-03 and not
+ * one response event landed on either authoring Epic's chain.
+ *
+ * Never throws — an unreadable/absent PRD returns null and each caller
+ * falls back to the job's own `epicId`.
+ */
+async function resolveNotifyPrd(job, parsePrdRaw) {
+  if (!job || !job.slug) return null;
+  const liveDir = await findPrdDir(job.slug).catch(() => null);
+  const livePath = liveDir ? safeSlugPathIn(liveDir, job.slug) : null;
+  if (livePath) {
+    const parsed = await parsePrdRaw(livePath).catch(() => null);
+    if (parsed) return parsed;
+  }
+  const archivedPath = archivedPrdPathForJob(job);
+  if (!archivedPath) return null;
+  return await parsePrdRaw(archivedPath).catch(() => null);
+}
+
 /**
  * notifyOriginatingTab(job) → void
  *
@@ -1835,18 +1894,38 @@ async function notifyOriginatingTab(job, {
   appendResponseEvent = appendResponseEventIfKnown,
   appendTranscriptTurn = promptSessionTranscript.appendTurn,
   readResultFromLog = extractResultTextFromLog,
+  enqueueValidation = maybeEnqueueValidationPrompt,
 } = {}) {
   try {
-    const prdPath = prdPathForJob(job);
-    const prd = await parsePrdRaw(prdPath).catch(() => null);
+    const prd = await resolveNotifyPrd(job, parsePrdRaw);
     const message = `PRD ${job.slug} finished: ${job.status}. Check Scheduler for details.`;
 
+    // The EPIC this check-in belongs to. Deliberately does NOT consider
+    // `sourceTabId` — that is a Terminal tab id, not an Epic id, and
+    // appending an Epic event chain onto one would be a category error (a
+    // pre-813 PRD carrying only sourceTabId must still take the
+    // chat:external-send path below; covered by the 'no sourcePromptId at
+    // all (pre-813 PRD)' test).
+    //
+    // `job.epicId` is the last resort and is what makes the notification
+    // survive an entirely unreadable PRD: the queue row carries the Epic FK
+    // independently of the .md on disk (20 of 21 history rows had it when
+    // PRD 985 was written), so a parse failure degrades to "notified without
+    // frontmatter detail" instead of "silently dropped". Mirrors
+    // notifyNeedsReview, which has had this fallback since PRD 854 — which
+    // is precisely why needs_review routing kept working while
+    // completed/failed routing did not.
+    const epicId = prd?.sourcePromptId || job.epicId || null;
+
     // Persist the job's real result text (not just the short status chip
     // above) to the durable per-Epic transcript, keyed off whichever id
-    // notifyOriginatingTab would otherwise notify. Best-effort: a missing
-    // cwd/epic id, an unreadable run log, or an IPC error here must never
-    // block the notification below.
-    const epicIdForTranscript = prd?.sourcePromptId || prd?.sourceTabId || null;
+    // notifyOriginatingTab would otherwise notify. Unlike the event append
+    // above, this one DOES accept sourceTabId — the durable transcript is
+    // keyed by whatever id the run is associated with, not strictly by Epic
+    // (pre-existing behaviour, unchanged by PRD 985 apart from the epicId
+    // fallback). Best-effort: a missing cwd/epic id, an unreadable run log,
+    // or an IPC error here must never block the notification below.
+    const epicIdForTranscript = prd?.sourcePromptId || prd?.sourceTabId || job.epicId || null;
     if (epicIdForTranscript && job.cwd) {
       try {
         const logPath = job.runId ? path.join(RUNS_DIR, job.runId, `${job.slug}.log`) : null;
@@ -1860,12 +1939,46 @@ async function notifyOriginatingTab(job, {
       }
     }
 
-    if (prd?.sourcePromptId) {
-      const routed = await appendResponseEvent(job.cwd || null, prd.sourcePromptId, message).catch((e) => {
+    if (epicId) {
+      // PRD 986: the check-in event is born validation:'unvalidated' — never
+      // 'verified' — regardless of the job's self-reported outcome. The
+      // check-in is a request to validate, not an assertion of done.
+      const routed = await appendResponseEvent(job.cwd || null, epicId, message, {
+        prdSlug: job.slug,
+        outcome: job.status,
+        validation: 'unvalidated',
+      }).catch((e) => {
         console.error('[scheduler] notifyOriginatingTab appendResponseEvent error', job?.slug, e);
         return false;
       });
-      if (routed) return;
+      if (routed) {
+        // PRD 986: a successful check-in append triggers ONE validation
+        // prompt into the authoring Epic's own session, asking it to verify
+        // every acceptance criterion against the real working tree and reply
+        // VERIFIED or REFUTED. Fire-and-forget, same convention as this
+        // function's own call site in tickQueue: a failure to enqueue is
+        // logged inside the hook, never thrown, and never blocks the job's
+        // status transition or the response-event append (which already
+        // happened above). All gating (kill-switch SM_EPIC_VALIDATION_DISABLE,
+        // active-Epic check, once-per-(epicId, prdSlug), loop guard, slot-pool
+        // routing) lives in lib/epicValidationHook.cjs.
+        try {
+          enqueueValidation(
+            {
+              cwd: job.cwd || null,
+              epicId,
+              prdSlug: job.slug,
+              prdPath: prd?.path || archivedPrdPathForJob(job) || null,
+              outcome: job.status,
+              eventValidation: 'unvalidated',
+            },
+            { sendPrompt },
+          );
+        } catch (e) {
+          console.error('[scheduler] notifyOriginatingTab enqueueValidation error', job?.slug, e);
+        }
+        return;
+      }
     }
 
     // appendResponseEvent already refused above (unknown id, completed
@@ -1874,7 +1987,7 @@ async function notifyOriginatingTab(job, {
     // re-checks against its own live PromptSession store. Deliberate
     // defense-in-depth (main's disk-backed check vs. the renderer's
     // in-memory one can disagree/race), not a redundant duplicate to prune.
-    let targetTabId = prd?.sourceTabId || prd?.sourcePromptId || null;
+    let targetTabId = prd?.sourceTabId || prd?.sourcePromptId || job.epicId || null;
     if (!targetTabId) {
       const jobCwd = job.cwd || null;
       if (jobCwd) {
@@ -1916,14 +2029,23 @@ async function notifyNeedsReview(job, report, {
 } = {}) {
   try {
     if (!job || !report || !report.filed) return false;
-    const prd = await parsePrdRaw(prdPathForJob(job)).catch(() => null);
+    const prd = await resolveNotifyPrd(job, parsePrdRaw);
     const epicId = prd?.sourcePromptId || job.epicId || null;
     if (!epicId || !job.cwd) {
       console.log(`[scheduler] notifyNeedsReview: no authoring Epic for ${job.slug}, report only`);
       return false;
     }
     const message = `${report.summary}. Root-cause report: ${report.path}`;
-    return await appendResponseEvent(job.cwd, epicId, message);
+    // PRD 986: like every scheduler check-in, born 'unvalidated' — the RCA
+    // report is itself a question, not a verified outcome. No validation
+    // prompt is enqueued here: that fires only for the terminal
+    // completed/failed path (notifyOriginatingTab); needs_review already
+    // routes its own question via this very report.
+    return await appendResponseEvent(job.cwd, epicId, message, {
+      prdSlug: job.slug,
+      outcome: 'needs_review',
+      validation: 'unvalidated',
+    });
   } catch (e) {
     console.error('[scheduler] notifyNeedsReview error', job?.slug, e);
     return false;
@@ -2157,7 +2279,7 @@ async function executeJob(job, runDir, defaultCwd, onPid) {
     try {
       const digestText = await buildContextDigest({ cwd, epicId: digestEpicId });
       if (digestText) {
-        prompt = digestText + '\n\n' + prompt;
+        prompt = composeExecutorPrompt({ prdBody: prompt, digestText });
         contextDigestApplied = true;
       }
     } catch (e) {
@@ -3184,20 +3306,34 @@ function tickQueue() {
     }
     if (state.paused) {
       console.log('[scheduler] tickQueue skipped: paused');
-      return { fired: false, reason: 'paused' };
+      return recordTick({ fired: false, reason: 'paused' }, { detail: 'scheduler paused' });
     }
     if (cancelToken.cancelled) return { fired: false, reason: 'cancelled' };
 
     await reconcile(state);
-    const cap = getEnvCap() ?? state.config.concurrencyCap;
-    const { batch, reason: holdReason } = pickNextBatch(state.jobs, runningSet, cap);
+    // Session-Manager's machine-wide slot pool is the ONLY concurrency limit
+    // the picker answers to (plus the memory gate below). The scheduler used
+    // to also carry a private `concurrencyCap` of 3 — the exact per-consumer
+    // cap that sessionSlots.cjs was written to replace — which silently
+    // ceilinged the queue at 3 while the pool the user configured said 5.
+    const freeSlots = sessionSlots.available();
+    const { batch, reason: holdReason, holds } = pickNextBatch(state.jobs, runningSet, freeSlots);
+    if (batch.length === 0 && freeSlots === 0) {
+      const snap = sessionSlots.snapshot();
+      const pendingCount = state.jobs.filter((j) => j.status === 'pending').length;
+      console.log(`[scheduler] slot gate: 0 of ${snap.total} session slots free (${snap.holders.map((h) => h.owner).join(', ')}) — deferring ${pendingCount} pending job(s)`);
+      return recordTick(
+        { fired: false, reason: 'slots-exhausted', deferredCount: pendingCount, holders: snap.holders },
+        { detail: `${snap.total} of ${snap.total} session slots busy (${snap.holders.map((h) => h.owner).join(', ')})`, holds },
+      );
+    }
     if (batch.length === 0) {
       // Queue drained — run the definition-of-done gate fire-and-forget.
       // Non-blocking: does not hold the mutate lock; errors are logged, not thrown.
       runDefinitionOfDoneOnDrain(state, { cancelToken }).catch((err) => {
         console.log(`[scheduler] dod-drain: ${err?.message ?? String(err)}`);
       });
-      if (holdReason) return { fired: false, reason: 'held', detail: holdReason };
+      if (holdReason) return recordTick({ fired: false, reason: 'held', detail: holdReason }, { holds });
       // Distinguish "genuinely nothing to do" from "the batch was already
       // fired by a concurrent tickQueue() call" (e.g. the periodic
       // when-available poll winning a race against a manual force-tick —
@@ -3210,9 +3346,9 @@ function tickQueue() {
         state.jobs.filter((j) => j.status === 'running').length,
       );
       if (runningCount > 0) {
-        return { fired: false, reason: 'already-running', runningCount };
+        return recordTick({ fired: false, reason: 'already-running', runningCount }, { holds });
       }
-      return { fired: false, reason: 'drained' };
+      return recordTick({ fired: false, reason: 'drained' }, { holds });
     }
 
     const availableMb = getAvailableMemMb();
@@ -3220,23 +3356,19 @@ function tickQueue() {
     // job is never started into the host's own headroom (that path OOM-kills
     // Electron and SIGHUPs every pty — 2026-06-16 incident).
     const jobBudgetMb = availableForJobs(availableMb, RESERVED_HOST_MB);
-    // Session-Manager's machine-wide slot pool is the outer bound: chat runs
-    // and scheduler jobs share it, so a busy chat lane shrinks this batch.
-    const slotAllowed = sessionSlots.available();
-    if (slotAllowed === 0) {
-      const snap = sessionSlots.snapshot();
-      console.log(`[scheduler] slot gate: 0 of ${snap.total} session slots free (${snap.holders.map((h) => h.owner).join(', ')}) — deferring ${batch.length} job(s)`);
-      return { fired: false, reason: 'slots-exhausted', deferredCount: batch.length, holders: snap.holders };
-    }
-    const allowed = Math.min(
-      slotAllowed,
-      memoryLimitedBatchSize(jobBudgetMb, MIN_FREE_MB_PER_JOB, runningSet.size, batch.length),
+    // The slot pool already bounded `batch` (it was passed as freeSlots to
+    // pickNextBatch above), so only the memory gate can narrow it further.
+    const allowed = memoryLimitedBatchSize(
+      jobBudgetMb, MIN_FREE_MB_PER_JOB, runningSet.size, batch.length,
     );
     if (allowed === 0) {
       const threshold = RESERVED_HOST_MB + MIN_FREE_MB_PER_JOB * (runningSet.size + 1);
       console.log(`[scheduler] memory gate: available=${availableMb} MB < threshold=${threshold} MB (host reserve ${RESERVED_HOST_MB} + ${MIN_FREE_MB_PER_JOB}/job × ${runningSet.size + 1}) — deferring ${batch.length} job(s)`);
       lastMemGate = { availableMb, threshold, deferred: true, at: new Date().toISOString() };
-      return { fired: false, reason: 'memory-deferred', deferredCount: batch.length, availableMb, threshold };
+      return recordTick(
+        { fired: false, reason: 'memory-deferred', deferredCount: batch.length, availableMb, threshold },
+        { detail: `memory gate: ${availableMb} MB free, need ${threshold} MB`, holds },
+      );
     }
     const gatedBatch = batch.slice(0, allowed);
     if (gatedBatch.length < batch.length) {
@@ -3257,7 +3389,7 @@ function tickQueue() {
       // spawnJob is fire-and-forget; it calls tickQueue() on completion.
       spawnJob(job, runId, runDir, state.config.defaultCwd).catch(() => {});
     }
-    return { fired: true, count: gatedBatch.length, group: gatedBatch[0]?.parallelGroup };
+    return recordTick({ fired: true, count: gatedBatch.length, group: gatedBatch[0]?.parallelGroup }, { holds });
   });
   tickTail = next.catch(() => {});
   return next;
@@ -3628,6 +3760,50 @@ function isUnresolvableNeedsReview(job, { hasRunDir }) {
  * commit-guard) — verifyRun can't see git, so re-scanning it would falsely
  * heal an unfinished job. Exported for tests.
  */
+/**
+ * healRefusalReason(job, verdict, committedDuringRun) → string | null
+ *
+ * Guards reverifyNeedsReview's needs_review → completed self-heal. Returns a
+ * refusal reason when the heal must NOT happen, or null to allow it.
+ *
+ * THE INCIDENT (PRD 983, 2026-08-03). Job 972 ran 34 s, edited zero files and
+ * exited 0. verifyRun correctly raised `no_verdict_sentinel` (no commit AND no
+ * SCHEDULER_VERDICT sentinel) with downgradeTo 'needs_review', and the job was
+ * parked. One minute later this self-heal pass promoted it to `completed`, and
+ * that false green shipped to the user.
+ *
+ * The mechanism is subtle and worth spelling out, because the individual parts
+ * all look correct: `no_verdict_sentinel` is in RESCANNABLE_VERDICTS, so the
+ * job was re-verified. The rescan recomputes `committedDuringRun` via
+ * `committedInWindow`, which runs `git log --all --since=<startedAt>
+ * --until=<finishedAt+60s>` with NO author, message, or slug filter — it
+ * answers "did ANY commit land in this repo during that window", not "did THIS
+ * job commit". With up to 3 concurrent scheduler jobs plus interactive
+ * sessions sharing one repo, a sibling job's commit lands inside the window
+ * routinely. `committedDuringRun` therefore flipped to true on the rescan,
+ * runVerify's `if (sentinel === null && !committedDuringRun)` no longer fired,
+ * `no_verdict_sentinel` was never re-raised, the issue list came back empty,
+ * and the verdict concluded `clean` — a COMPLETED_EQUIVALENT verdict, so the
+ * job healed. Another job's commit was silently credited to this one.
+ *
+ * The rule: a run that emitted no sentinel and landed no commit ATTRIBUTABLE
+ * TO ITSELF has produced no evidence it did anything, and repo-wide
+ * time-window evidence is not attribution. `landedCommit` is per-job and
+ * survives a resetJob (resetJobFields), so it is the honest signal here.
+ * Bias to needs_review: a false yellow costs a human glance, a false green
+ * costs a silently-unfixed bug — which is exactly what happened.
+ */
+function healRefusalReason(job, verdict, committedDuringRun) {
+  if (!job || !verdict) return null;
+  if (!COMPLETED_EQUIVALENT_VERDICTS.has(verdict.verdict)) return null;
+  if (job.verifierVerdict !== 'no_verdict_sentinel') return null;
+  // A commit this job actually recorded as its own is real evidence; the
+  // repo-wide window scan is not.
+  if (job.landedCommit) return null;
+  return 'no_verdict_sentinel with no job-attributable commit — refusing to heal'
+    + ` (committedInWindow=${committedDuringRun === true} is repo-wide, not proof this job delivered)`;
+}
+
 function isRescanCandidate(job) {
   return !!job
     && job.status === 'needs_review'
@@ -3729,7 +3905,10 @@ async function reverifyNeedsReview() {
         priorLandedCommit,
       });
     } catch { leftForReview.push({ slug: job.slug, reason: 'verifyRun threw' }); continue; }
-    if (v && COMPLETED_EQUIVALENT_VERDICTS.has(v.verdict)) {
+    const refusal = healRefusalReason(job, v, committedDuringRun);
+    if (refusal) {
+      leftForReview.push({ slug: job.slug, reason: refusal });
+    } else if (v && COMPLETED_EQUIVALENT_VERDICTS.has(v.verdict)) {
       healed.push(job.slug);
     } else {
       leftForReview.push({ slug: job.slug, reason: v ? `${v.verdict}: ${v.reason}` : 'null verdict' });
@@ -4595,4 +4774,4 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
   });
 }
 
-module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, runPrdMigration, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult };
+module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, healRefusalReason, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, runPrdMigration, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult };

package/src/main/templates/project-pages-default-home.html

@@ -0,0 +1,123 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Project Home</title>
+<meta name="description" content="Project Home — a hosted document generated from this project's own repo, not yet generated for this project." />
+<style>
+  /* Design tokens copied from src/renderer/lib/projectPages/library/kit.tsx's
+     PK palette/fonts — no font files are embedded here (unlike the
+     generated lenses), so the font-family stacks fall back to their system
+     alternatives (Georgia / system-ui / ui-monospace). This keeps the
+     document a zero-network, zero-JS static file while still reading as
+     the same visual system: same colors, same type scale, same shapes. */
+  :root {
+    --pk-paper: #f6efe1;
+    --pk-panel: #efe6d3;
+    --pk-card: #fbf6ec;
+    --pk-deep: #2a221a;
+    --pk-edge: #e0d3b8;
+    --pk-rule: #d9c9a8;
+    --pk-ink: #2a221a;
+    --pk-ink-soft: #5b4a36;
+    --pk-ink-mute: #8a7a60;
+    --pk-accent: #b85c34;
+    --pk-accent-deep: #9c4a26;
+    --pk-sage: #6f7d52;
+    --pk-butter: #e4b85a;
+    --pk-serif: 'Newsreader', Georgia, serif;
+    --pk-sans: 'Geist', system-ui, sans-serif;
+    --pk-mono: 'IBM Plex Mono', ui-monospace, monospace;
+  }
+  * { box-sizing: border-box; }
+  html, body { margin: 0; padding: 0; background: var(--pk-paper); color: var(--pk-ink); }
+  body { font-family: var(--pk-sans); }
+  .eyebrow {
+    font-family: var(--pk-mono); font-size: 11px; letter-spacing: 0.14em; text-transform: uppercase;
+    color: var(--pk-accent); font-weight: 500;
+  }
+  .pill {
+    display: inline-flex; align-items: center; gap: 6px; font-family: var(--pk-mono); font-size: 11px;
+    color: var(--pk-ink-soft); background: transparent; border: 1px solid var(--pk-rule); border-radius: 999px;
+    padding: 3px 9px; white-space: nowrap;
+  }
+  h1 {
+    margin: 0; font-family: var(--pk-serif); font-weight: 500; font-size: clamp(30px, 5vw, 44px);
+    line-height: 1.1; letter-spacing: -0.015em; color: var(--pk-ink);
+  }
+  h2 {
+    margin: 0; font-family: var(--pk-serif); font-weight: 500; font-size: 24px; line-height: 1.15;
+    letter-spacing: -0.01em; color: var(--pk-ink);
+  }
+  p { margin: 0; font-family: var(--pk-sans); font-size: 16px; line-height: 1.62; color: var(--pk-ink-soft); }
+  section { padding: clamp(28px, 6vw, 72px); }
+  .hero { border-bottom: 1px solid var(--pk-rule); background: var(--pk-panel); }
+  .hero-inner { max-width: 760px; margin: 0 auto; display: flex; flex-direction: column; gap: 16px; }
+  .cta {
+    display: inline-flex; width: fit-content; align-items: center; gap: 8px; font-family: var(--pk-sans);
+    font-size: 14px; font-weight: 600; padding: 11px 20px; border-radius: 9px; border: 1px solid transparent;
+    background: var(--pk-accent); color: #fff;
+  }
+  .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 20px; max-width: 960px; margin: 0 auto; }
+  .card {
+    background: var(--pk-card); border: 1px solid var(--pk-edge); border-radius: 12px; padding: 20px;
+    display: flex; flex-direction: column; gap: 8px;
+  }
+  .card .k { font-family: var(--pk-mono); font-size: 10px; letter-spacing: 0.1em; text-transform: uppercase; color: var(--pk-ink-mute); }
+  .card .t { font-family: var(--pk-serif); font-size: 18px; color: var(--pk-ink); }
+  .card .d { font-size: 13.5px; line-height: 1.55; color: var(--pk-ink-soft); }
+  .footnote { max-width: 760px; margin: 0 auto; display: flex; flex-direction: column; gap: 6px; }
+  .footnote .label { font-family: var(--pk-mono); font-size: 11px; color: var(--pk-ink-mute); }
+</style>
+</head>
+<body>
+  <section class="hero">
+    <div class="hero-inner">
+      <span class="pill">Shipped default — not yet generated for this project</span>
+      <div class="eyebrow">Project Home</div>
+      <h1>This is Project Home's shipped default page.</h1>
+      <p>
+        Project Home is a hosted document — a self-contained page describing this specific
+        project: what it is, its main areas, and what it's for. Session-manager ships this
+        default so the page is never empty, but it does not describe your project yet.
+        Nothing shown on this page is specific to any real project.
+      </p>
+      <a class="cta" href="#" onclick="return false;">Generate My Project Home</a>
+      <p style="font-size: 13px; color: var(--pk-ink-mute);">
+        Press "Generate My Project Home" in the app (this link is inert inside this static
+        preview) to replace this page with one generated from your project's own repo.
+      </p>
+    </div>
+  </section>
+  <section>
+    <div class="grid">
+      <div class="card">
+        <div class="k">What it reads</div>
+        <div class="t">Your repo, live</div>
+        <div class="d">Generation reads this project's own files, git history, and CLAUDE.md conventions — never invented content.</div>
+      </div>
+      <div class="card">
+        <div class="k">What it produces</div>
+        <div class="t">A static document</div>
+        <div class="d">A self-contained HTML page — inline styling, no network calls, no live app state — that replaces this default at a fixed path.</div>
+      </div>
+      <div class="card">
+        <div class="k">How it stays fresh</div>
+        <div class="t">On demand</div>
+        <div class="d">Regenerate any time from Project Home; this default only ever shows before the first generation.</div>
+      </div>
+    </div>
+  </section>
+  <section>
+    <div class="footnote">
+      <div class="label">About this page</div>
+      <p style="font-size: 13.5px;">
+        Shipped with Session Manager as a build-time asset — the same design system as a
+        generated Project Home page, but honest, generic copy instead of project-specific
+        content. See "About these templates" for how a generated page is built.
+      </p>
+    </div>
+  </section>
+</body>
+</html>