claude-code-session-manager 0.75.3 → 0.77.0

package/src/main/__tests__/scheduler-reap-dead-running-jobs.test.cjs

@@ -32,11 +32,34 @@ const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { execFileSync } = require('node:child_process');
 
 const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'reap-dead-running-jobs-test-'));
 process.env.HOME = tmpHome;
 
-const { reapDeadRunningJobs } = require('../scheduler.cjs');
+const { reapDeadRunningJobs, PIDLESS_SPAWN_GRACE_MS } = require('../scheduler.cjs');
+const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+// queueStore's cwd discovery is cached for 30s (queueStore.cjs's CACHE_MS) —
+// a project registered by THIS test after an earlier test already populated
+// that cache (and didn't itself bust it, e.g. because it found nothing
+// reapable and returned before ever calling writeQueue) would otherwise be
+// invisible to readQueue() for the rest of that window. Bust explicitly
+// after registering a new project so each test sees its own fixture.
+const { bustCwdCache } = require('../lib/queueStore.cjs');
+
+function git(args, cwd) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8' });
+}
+
+function initRepo(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  git(['init', '-q'], dir);
+  git(['config', 'user.email', 'test@example.com'], dir);
+  git(['config', 'user.name', 'Test'], dir);
+  fs.writeFileSync(path.join(dir, 'README.md'), 'hello\n', 'utf8');
+  git(['add', '-A'], dir);
+  git(['commit', '-q', '-m', 'initial'], dir);
+}
 
 function registerActiveProject(cwd) {
   const projectsDir = path.join(tmpHome, '.claude', 'projects');
@@ -85,6 +108,66 @@ test('reapDeadRunningJobs reconciles a queue.json row stuck at status:running wi
   assert.equal(jobs[0].status, 'completed', 'job must be reconciled from disk state, not skipped via the runningSet gate');
   assert.equal(jobs[0].exitCode, 0);
   assert.equal(jobs[0].runtime, undefined);
+  assert.equal(jobs[0].gateOutcome, 'passed', 'a success result event maps to gateOutcome:passed');
+});
+
+test('reapDeadRunningJobs reaps a pidless row older than PIDLESS_SPAWN_GRACE_MS with an empty run dir as failed, not completed, and audits it', async () => {
+  const projectCwd = path.join(tmpHome, 'c-project');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const staleStartedAt = new Date(Date.now() - PIDLESS_SPAWN_GRACE_MS - 60_000).toISOString();
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'pidless-zombie',
+      status: 'running',
+      cwd: projectCwd,
+      runId: 'run-pidless-zombie',
+      startedAt: staleStartedAt,
+      estimateMinutes: 24,
+      // no runtime key at all — the spawn never got far enough to record one
+    },
+  ]);
+  // Empty run dir: created, but never written to (the exact 2026-09-01 repro).
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', 'run-pidless-zombie'), { recursive: true });
+
+  const auditSizeBefore = fs.existsSync(AUDIT_LOG_PATH) ? fs.statSync(AUDIT_LOG_PATH).size : 0;
+
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  assert.equal(jobs.length, 1);
+  assert.equal(jobs[0].status, 'failed', 'an empty run dir must never be reaped as completed');
+  assert.match(jobs[0].error, /no runtime\.pid recorded/);
+  assert.equal(jobs[0].runtime, undefined);
+  assert.equal(jobs[0].gateOutcome, 'never_ran', 'a pidless reap means the gate never had a chance to run');
+
+  const auditText = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').slice(auditSizeBefore);
+  const auditLines = auditText.trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  const pidlessEvent = auditLines.find((e) => e.kind === 'job_reaped_pidless' && e.slug === 'pidless-zombie');
+  assert.ok(pidlessEvent, 'reaping a pidless row must leave an audit trace');
+});
+
+test('reapDeadRunningJobs leaves a pidless row alone while it is still within the grace window', async () => {
+  const projectCwd = path.join(tmpHome, 'd-project');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const freshStartedAt = new Date(Date.now() - 60_000).toISOString(); // 1 minute ago
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'mid-flight-spawn',
+      status: 'running',
+      cwd: projectCwd,
+      runId: 'run-mid-flight',
+      startedAt: freshStartedAt,
+    },
+  ]);
+
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  assert.equal(jobs[0].status, 'running', 'a genuinely mid-flight spawn must not be reaped');
 });
 
 test('reapDeadRunningJobs is a no-op when no job is actually running in queue.json', async () => {
@@ -101,3 +184,126 @@ test('reapDeadRunningJobs is a no-op when no job is actually running in queue.js
   assert.equal(jobs.length, 1);
   assert.equal(jobs[0].status, 'completed');
 });
+
+test('reapDeadRunningJobs salvages a delta-scoped in-place patch (PRD 1098) when the row carries a persisted guardBaseline', async () => {
+  const projectCwd = path.join(tmpHome, 'e-project');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  // Pre-existing WIP present at the recorded pre-run baseline — must never
+  // appear in the salvaged patch.
+  fs.writeFileSync(path.join(projectCwd, 'human-wip.txt'), 'human wip\n', 'utf8');
+
+  const runId = 'run-vanished-inplace';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'vanished-inplace',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 }, // guaranteed-dead pid
+      // Includes the untracked session-manager-operations/ dir itself (git
+      // status --porcelain reports an untracked DIRECTORY, not the file
+      // inside it) — writeProjectQueue below writes queue.json INSIDE this
+      // same git repo, so it's part of the true pre-run baseline exactly
+      // like human-wip.txt.
+      guardBaseline: ['human-wip.txt', 'session-manager-operations/'],
+    },
+  ]);
+  const runDir = path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId);
+  fs.mkdirSync(runDir, { recursive: true });
+  fs.writeFileSync(path.join(runDir, 'vanished-inplace.log'), '{"type":"result","subtype":"success","result":"done","is_error":false}\n');
+
+  // The job's own delta, dirtied before its process vanished.
+  fs.writeFileSync(path.join(projectCwd, 'README.md'), 'hello\nedited by job\n', 'utf8');
+  fs.writeFileSync(path.join(projectCwd, 'job-output.txt'), 'job work\n', 'utf8');
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'vanished-inplace');
+  assert.equal(row.status, 'completed');
+  assert.ok(row.salvagePatch, 'a salvage patch must be recorded on the row');
+  assert.ok(fs.existsSync(row.salvagePatch));
+  const patch = fs.readFileSync(row.salvagePatch, 'utf8');
+  assert.match(patch, /README\.md/);
+  assert.match(patch, /edited by job/);
+  assert.match(patch, /job-output\.txt/);
+  assert.doesNotMatch(patch, /human wip/, 'baseline WIP must never leak into the salvaged patch');
+  assert.equal(row.leftoverCount, 2, 'the reaper must attribute the job\'s own delta (README.md + job-output.txt), never the baseline WIP');
+  assert.deepEqual(new Set(row.leftoverPaths), new Set(['README.md', 'job-output.txt']));
+});
+
+test('reapDeadRunningJobs: a failed reap with a persisted guardBaseline names the leftover count in its transition reason and error', async () => {
+  const projectCwd = path.join(tmpHome, 'g-project');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const runId = 'run-vanished-failed';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'vanished-failed',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      // Includes the untracked session-manager-operations/ dir itself — see
+      // the comment on the salvage test above for why.
+      guardBaseline: ['session-manager-operations/'],
+    },
+  ]);
+  // Empty run dir → classifyRunOutcome finds no result event → 'no_result' → failed.
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  fs.writeFileSync(path.join(projectCwd, 'partial-work.txt'), 'unfinished\n', 'utf8');
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'vanished-failed');
+  assert.equal(row.status, 'failed');
+  assert.equal(row.leftoverCount, 1);
+  assert.deepEqual(row.leftoverPaths, ['partial-work.txt']);
+  assert.match(row.error, /left 1 files uncommitted/, 'the leftover count must be visible in the error string, not just a separate field');
+  const lastTransition = row.statusHistory[row.statusHistory.length - 1];
+  assert.match(lastTransition.reason, /left 1 files uncommitted/);
+});
+
+test('reapDeadRunningJobs skips in-place salvage (no whole-tree dump) when the row has no persisted guardBaseline', async () => {
+  const projectCwd = path.join(tmpHome, 'f-project');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  fs.writeFileSync(path.join(projectCwd, 'human-wip.txt'), 'human wip\n', 'utf8');
+  fs.writeFileSync(path.join(projectCwd, 'README.md'), 'hello\nedited by job\n', 'utf8');
+
+  const runId = 'run-vanished-no-baseline';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'vanished-no-baseline',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      // No guardBaseline field — simulates a row whose owning process
+      // vanished before spawnJob's dispatch-time persist-mutate ever ran, so
+      // there's no safe way to distinguish this job's own dirt from the
+      // human's pre-existing WIP above.
+    },
+  ]);
+  const runDir = path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId);
+  fs.mkdirSync(runDir, { recursive: true });
+  fs.writeFileSync(path.join(runDir, 'vanished-no-baseline.log'), '{"type":"result","subtype":"success","result":"done","is_error":false}\n');
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'vanished-no-baseline');
+  assert.equal(row.status, 'completed');
+  assert.equal(row.salvagePatch, undefined, 'must skip salvage entirely rather than ever dumping the whole tree');
+  assert.equal(row.leftoverPaths, undefined, 'no baseline means no safe attribution — must not guess');
+  assert.equal(row.leftoverCount, undefined);
+});

package/src/main/__tests__/scheduler-shared-tree-guard.test.cjs

@@ -0,0 +1,212 @@
+/**
+ * scheduler-shared-tree-guard.test.cjs — the shared-tree stash guard added
+ * for the 2026-09-01 social-signals-trader incident: a headless PRD executor
+ * ran a blanket `git stash` in a working tree shared with a live trading
+ * service, silently reverting an uncommitted operator config edit with no
+ * error anywhere.
+ *
+ * evaluateSharedTreeGuard is the pure diff (no I/O); checkSharedTreeGuard is
+ * the orchestrator that also restores a single unambiguous stash, using the
+ * same module.exports spy pattern computeCommittedDuringRun/committedInWindow
+ * use so the underlying git calls never actually run.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-shared-tree-guard.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, vi, afterEach } from 'vitest';
+const scheduler = require('../scheduler.cjs');
+const { evaluateSharedTreeGuard, checkSharedTreeGuard } = scheduler;
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+test('evaluateSharedTreeGuard: no-op when nothing changed', () => {
+  const result = evaluateSharedTreeGuard({
+    stashBefore: ['aaa stash@{0} WIP on main: aaa old'],
+    stashAfter: ['aaa stash@{0} WIP on main: aaa old'],
+    dirtyBefore: ['data/spread_config.json'],
+    dirtyAfter: ['data/spread_config.json'],
+    pathsCommittedDuringRun: [],
+  });
+  expect(result.newStashes).toEqual([]);
+  expect(result.reverted).toEqual([]);
+});
+
+test('evaluateSharedTreeGuard: flags one new stash entry not present in the baseline', () => {
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: ['bbb stash@{0} WIP on fix/x: bbb f5ae98f'],
+    dirtyBefore: [],
+    dirtyAfter: [],
+    pathsCommittedDuringRun: [],
+  });
+  expect(result.newStashes).toEqual([{ hash: 'bbb', ref: 'stash@{0}', subject: 'WIP on fix/x: bbb f5ae98f' }]);
+});
+
+test('evaluateSharedTreeGuard: two new stash entries both surface (caller decides ambiguity, not this function)', () => {
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [
+      'bbb stash@{0} WIP on fix/x: bbb newest',
+      'ccc stash@{1} WIP on fix/x: ccc older',
+    ],
+    dirtyBefore: [],
+    dirtyAfter: [],
+    pathsCommittedDuringRun: [],
+  });
+  expect(result.newStashes).toHaveLength(2);
+  expect(result.newStashes.map((e) => e.ref)).toEqual(['stash@{0}', 'stash@{1}']);
+});
+
+test('evaluateSharedTreeGuard: baseline-dirty path clean after the run with no commit to explain it is flagged reverted', () => {
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore: ['data/spread_config.json'],
+    dirtyAfter: [],
+    pathsCommittedDuringRun: [],
+  });
+  expect(result.reverted).toEqual(['data/spread_config.json']);
+});
+
+test('evaluateSharedTreeGuard: baseline-dirty path clean after the run but touched by a commit made during the run is NOT flagged', () => {
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore: ['src/foo.js'],
+    dirtyAfter: [],
+    pathsCommittedDuringRun: ['src/foo.js'],
+  });
+  expect(result.reverted).toEqual([]);
+});
+
+test('checkSharedTreeGuard: no-op when nothing changed returns null', async () => {
+  vi.spyOn(scheduler, 'stashList').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha1');
+  vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue([]);
+  const restoreSpy = vi.spyOn(scheduler, 'restoreSpecificStash');
+
+  const result = await checkSharedTreeGuard({
+    cwd: '/repo',
+    stashBaseline: [],
+    dirtyBaseline: [],
+    headBefore: 'sha1',
+    slug: 'job-1',
+  });
+  expect(result).toBeNull();
+  expect(restoreSpy).not.toHaveBeenCalled();
+});
+
+test('checkSharedTreeGuard: a single new stash is restored via apply+drop of that specific ref', async () => {
+  vi.spyOn(scheduler, 'stashList').mockResolvedValue(['newhash stash@{0} WIP on main: f5ae98f']);
+  vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha1');
+  vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue([]);
+  const restoreSpy = vi.spyOn(scheduler, 'restoreSpecificStash').mockResolvedValue({ ok: true });
+
+  const result = await checkSharedTreeGuard({
+    cwd: '/repo',
+    stashBaseline: [],
+    dirtyBaseline: [],
+    headBefore: 'sha1',
+    slug: 'job-1',
+  });
+  expect(restoreSpy).toHaveBeenCalledWith('/repo', 'stash@{0}');
+  expect(result).toEqual({ restoredStash: 'stash@{0}' });
+});
+
+test('checkSharedTreeGuard: a baseline-dirty path stashed by the job and successfully restored is not ALSO flagged reverted', async () => {
+  vi.spyOn(scheduler, 'stashList').mockResolvedValue(['newhash stash@{0} WIP on main: f5ae98f']);
+  vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha1');
+  vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'restoreSpecificStash').mockResolvedValue({ ok: true });
+  // uncommittedChanges is queried AFTER the restore attempt in the fixed
+  // implementation — simulate the stashed file reappearing dirty once the
+  // apply+drop succeeds (this is the exact 2026-09-01 incident shape: an
+  // operator's pre-existing dirty file gets swept into the job's stash).
+  vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue(['data/spread_config.json']);
+
+  const result = await checkSharedTreeGuard({
+    cwd: '/repo',
+    stashBaseline: [],
+    dirtyBaseline: ['data/spread_config.json'],
+    headBefore: 'sha1',
+    slug: 'job-1',
+  });
+  expect(result).toEqual({ restoredStash: 'stash@{0}' });
+});
+
+test('checkSharedTreeGuard: two new stashes are reported, not restored (ambiguous)', async () => {
+  vi.spyOn(scheduler, 'stashList').mockResolvedValue([
+    'aaa stash@{0} WIP on main: newest',
+    'bbb stash@{1} WIP on main: older',
+  ]);
+  vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha1');
+  vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue([]);
+  const restoreSpy = vi.spyOn(scheduler, 'restoreSpecificStash');
+
+  const result = await checkSharedTreeGuard({
+    cwd: '/repo',
+    stashBaseline: [],
+    dirtyBaseline: [],
+    headBefore: 'sha1',
+    slug: 'job-1',
+  });
+  expect(restoreSpy).not.toHaveBeenCalled();
+  expect(result.ambiguousStashes).toEqual(['stash@{0}', 'stash@{1}']);
+  expect(result.restoredStash).toBeUndefined();
+});
+
+test('checkSharedTreeGuard: a baseline-dirty path reverted with no stash and no commit is flagged reverted', async () => {
+  vi.spyOn(scheduler, 'stashList').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha1');
+  vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue([]);
+
+  const result = await checkSharedTreeGuard({
+    cwd: '/repo',
+    stashBaseline: [],
+    dirtyBaseline: ['data/spread_config.json'],
+    headBefore: 'sha1',
+    slug: 'job-1',
+  });
+  expect(result).toEqual({ reverted: ['data/spread_config.json'] });
+});
+
+test('checkSharedTreeGuard: a failed restore is reported as restoreFailed, entry left in place', async () => {
+  vi.spyOn(scheduler, 'stashList').mockResolvedValue(['newhash stash@{0} WIP on main: f5ae98f']);
+  vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha1');
+  vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'restoreSpecificStash').mockResolvedValue({ ok: false, error: 'conflict applying stash' });
+
+  const result = await checkSharedTreeGuard({
+    cwd: '/repo',
+    stashBaseline: [],
+    dirtyBaseline: [],
+    headBefore: 'sha1',
+    slug: 'job-1',
+  });
+  expect(result.restoreFailed).toMatch(/stash@\{0\}.*conflict applying stash/);
+});
+
+test('checkSharedTreeGuard never throws when the underlying git calls reject', async () => {
+  vi.spyOn(scheduler, 'stashList').mockRejectedValue(new Error('boom'));
+  vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha1');
+  vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue([]);
+
+  const result = await checkSharedTreeGuard({
+    cwd: '/repo',
+    stashBaseline: [],
+    dirtyBaseline: [],
+    headBefore: 'sha1',
+    slug: 'job-1',
+  });
+  expect(result).toBeNull();
+});

package/src/main/__tests__/scheduler-stranded-investigation.test.cjs

@@ -0,0 +1,185 @@
+/**
+ * scheduler-stranded-investigation.test.cjs — findStrandedInvestigations: a
+ * job left 'investigating' with nothing to restore it once the process that
+ * spawned its probe is gone.
+ *
+ * spawnInvestigation's own restore (onExit / synchronous-throw catch) runs
+ * ONLY inside the live process that spawned the probe. An app restart (or
+ * crash) mid-probe leaves the row frozen at 'investigating' forever — the
+ * comment at spawnInvestigation's onExit already asserts "'investigating'
+ * must never be the job's resting state", but nothing enforced that across a
+ * restart. Live repro (burrow, 2026-09-01): 834-session-summary-... sat
+ * 'investigating' for 1653 minutes even though finishedAt+exitCode were
+ * already recorded 27h earlier.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-stranded-investigation.test.cjs
+ */
+
+'use strict';
+
+// vitest, NOT node:test — this repo's suite is vitest-only (CLAUDE.md).
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const { findStrandedInvestigations, INVESTIGATION_MAX_MS } = require('../scheduler.cjs');
+
+const NOW = Date.parse('2026-09-01T12:00:00.000Z');
+const agoMin = (m) => new Date(NOW - m * 60_000).toISOString();
+const neverAlive = () => false;
+const alwaysAlive = () => true;
+
+test('stranded past the window is selected, with the pre-probe status as restoreStatus', () => {
+  const jobs = [
+    {
+      slug: 'a',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [
+        { from: 'failed', to: 'investigating', at: agoMin(120), reason: 'spawning investigation probe' },
+      ],
+    },
+  ];
+  const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+  assert.strictEqual(out.length, 1);
+  assert.strictEqual(out[0].slug, 'a');
+  assert.strictEqual(out[0].restoreStatus, 'failed');
+  assert.ok(out[0].ageMs >= 119 * 60_000);
+});
+
+test('within the window is left alone — a live probe must not be yanked mid-flight', () => {
+  const jobs = [
+    {
+      slug: 'b',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [{ from: 'needs_review', to: 'investigating', at: agoMin(10) }],
+    },
+  ];
+  assert.deepStrictEqual(findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive), []);
+});
+
+test('a live probe process (pid alive) is never restored, even past the window', () => {
+  const jobs = [
+    {
+      slug: 'c',
+      cwd: '/p1',
+      status: 'investigating',
+      runtime: { pid: 4242 },
+      statusHistory: [{ from: 'failed', to: 'investigating', at: agoMin(120) }],
+    },
+  ];
+  assert.deepStrictEqual(findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, alwaysAlive), []);
+});
+
+test('a row with no runtime.pid past the window is still selected (dead-process default)', () => {
+  const jobs = [
+    {
+      slug: 'd',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [{ from: 'failed', to: 'investigating', at: agoMin(120) }],
+    },
+  ];
+  const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, alwaysAlive);
+  assert.strictEqual(out.length, 1);
+  assert.strictEqual(out[0].slug, 'd');
+});
+
+test('missing statusHistory transition is warn-logged and not restored — cannot prove age', () => {
+  const jobs = [{ slug: 'e', cwd: '/p1', status: 'investigating', statusHistory: [] }];
+  const warnSpy = [];
+  const origWarn = console.warn;
+  console.warn = (...args) => warnSpy.push(args.join(' '));
+  try {
+    const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+    assert.deepStrictEqual(out, []);
+    assert.ok(warnSpy.some((line) => line.includes('e') && line.includes('no statusHistory entry')), `expected a warn mentioning slug 'e', got: ${JSON.stringify(warnSpy)}`);
+  } finally {
+    console.warn = origWarn;
+  }
+});
+
+test('unparseable transition timestamp is warn-logged and not restored', () => {
+  const jobs = [
+    {
+      slug: 'f',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [{ from: 'failed', to: 'investigating', at: 'not-a-date' }],
+    },
+  ];
+  const warnSpy = [];
+  const origWarn = console.warn;
+  console.warn = (...args) => warnSpy.push(args.join(' '));
+  try {
+    const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+    assert.deepStrictEqual(out, []);
+    assert.ok(warnSpy.some((line) => line.includes('f') && line.includes('unparseable')), `expected a warn mentioning slug 'f', got: ${JSON.stringify(warnSpy)}`);
+  } finally {
+    console.warn = origWarn;
+  }
+});
+
+test('the burrow-834 shape: finishedAt + non-null exitCode already recorded is restored using that recorded outcome, not re-run', () => {
+  const jobs = [
+    {
+      slug: '834-session-summary-reports-planner-intent-as-outcome',
+      cwd: '/home/bilko/Projects/burrow',
+      status: 'investigating',
+      finishedAt: '2026-08-31T15:13:15.181Z',
+      exitCode: 0,
+      error: 'is_error=true in final 20% of transcript (event 91/101)',
+      estimateMinutes: 60,
+      statusHistory: [
+        { from: 'needs_review', to: 'investigating', at: '2026-08-31T15:20:00.000Z', reason: 'spawning investigation probe' },
+      ],
+    },
+  ];
+  const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+  assert.strictEqual(out.length, 1);
+  assert.strictEqual(out[0].restoreStatus, 'needs_review');
+  assert.ok(out[0].ageMs / 60_000 > 1200, `expected well past the 60m threshold, got ${out[0].ageMs / 60_000}m`);
+});
+
+test('only the most recent investigating transition is used when a job was investigated more than once', () => {
+  const jobs = [
+    {
+      slug: 'g',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [
+        { from: 'failed', to: 'investigating', at: agoMin(500) },
+        { from: 'investigating', to: 'failed', at: agoMin(400) },
+        { from: 'failed', to: 'investigating', at: agoMin(10) }, // recent retry — still within the window
+      ],
+    },
+  ];
+  assert.deepStrictEqual(findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive), []);
+});
+
+test('non-investigating rows are never considered', () => {
+  const base = { cwd: '/p1', statusHistory: [{ from: 'x', to: 'investigating', at: agoMin(500) }] };
+  const jobs = [
+    { ...base, slug: 'h', status: 'failed' },
+    { ...base, slug: 'i', status: 'running' },
+    { ...base, slug: 'j', status: 'needs_review' },
+  ];
+  assert.deepStrictEqual(findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive), []);
+});
+
+test('a corrupted/illegal statusHistory `from` value falls back to failed rather than being handed to transitionJob unvalidated', () => {
+  const jobs = [
+    {
+      slug: 'k',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [{ from: 'quarantined', to: 'investigating', at: agoMin(120) }],
+    },
+  ];
+  const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+  assert.strictEqual(out.length, 1);
+  assert.strictEqual(out[0].restoreStatus, 'failed');
+});
+
+test('the shipped default is the documented one (60 minutes)', () => {
+  assert.strictEqual(INVESTIGATION_MAX_MS, 60 * 60_000);
+});