claude-code-session-manager 0.83.0 → 0.85.0

package/src/main/lib/__tests__/gitWorktree.test.cjs

@@ -15,7 +15,7 @@ import { test, expect, beforeEach, afterEach, vi } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { execFileSync } = require('node:child_process');
+const { execFileSync, spawn } = require('node:child_process');
 const gitWorktree = require('../gitWorktree.cjs');
 
 let tmpRoot;
@@ -53,6 +53,7 @@ beforeEach(() => {
   delete process.env.SM_EPIC_WORKTREE_MAX;
   gitWorktree._resetActiveWorktreeCountForTests('job', 0);
   gitWorktree._resetActiveWorktreeCountForTests('epic', 0);
+  gitWorktree._resetObservedWorktreeCountCacheForTests();
 });
 
 afterEach(async () => {
@@ -315,6 +316,189 @@ test('[job] falls back once the concurrency cap is reached, and recovers after c
   await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: third.dir, branch: third.branch });
 });
 
+test('[job] a leaked cap count (checkout removed from disk without cleanupWorktree) self-heals on the next createWorktree', async () => {
+  process.env.SM_JOB_WORKTREE_MAX = '1';
+  const first = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'leak-1' });
+  expect(first.ok).toBe(true);
+
+  // Simulate the crash/reap path: the checkout is torn off disk directly
+  // (not via cleanupJobWorktree), exactly like a job that got SIGTERM'd or
+  // reaped before its own teardown ran — activeWorktreeCount never gets
+  // decremented, so the in-memory counter is now permanently stuck at the
+  // cap even though nothing real is holding it.
+  await execFileSync('git', ['worktree', 'remove', '--force', first.dir], { cwd: repoCwd, encoding: 'utf8' });
+  fs.rmSync(first.dir, { recursive: true, force: true });
+  expect(gitWorktree._getActiveWorktreeCountForTests('job')).toBe(1);
+
+  // Against unpatched main this next call stays wedged forever: the counter
+  // never reflects that nothing is actually checked out anymore.
+  const second = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'leak-2' });
+  expect(second.ok).toBe(true);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: second.dir, branch: second.branch });
+});
+
+test('[job] reclaimTerminalJobOrphans removes a completed row\'s clean-of-real-work orphan checkout', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'orphan-clean' });
+  expect(worktree.ok).toBe(true);
+  // Zero commits ahead of main and nothing dirty at all in the checkout —
+  // the simplest "safe to reclaim" shape.
+  const reclaimed = await gitWorktree.reclaimTerminalJobOrphans({
+    cwd: repoCwd,
+    terminalSlugs: new Set(['orphan-clean']),
+  });
+  expect(reclaimed).toEqual(['orphan-clean']);
+  expect(fs.existsSync(worktree.dir)).toBe(false);
+});
+
+test('[job] reclaimTerminalJobOrphans reclaims a checkout carrying only ops-folder dirty noise', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'orphan-ops-noise' });
+  expect(worktree.ok).toBe(true);
+  fs.mkdirSync(path.join(worktree.dir, 'session-manager-operations'), { recursive: true });
+  fs.writeFileSync(path.join(worktree.dir, 'session-manager-operations', 'queue.json'), '{}\n', 'utf8');
+
+  const reclaimed = await gitWorktree.reclaimTerminalJobOrphans({
+    cwd: repoCwd,
+    terminalSlugs: new Set(['orphan-ops-noise']),
+  });
+  expect(reclaimed).toEqual(['orphan-ops-noise']);
+  expect(fs.existsSync(worktree.dir)).toBe(false);
+});
+
+test('[job] reclaimTerminalJobOrphans leaves a checkout with real (non-ops) dirty content alone', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'orphan-real-work' });
+  expect(worktree.ok).toBe(true);
+  fs.writeFileSync(path.join(worktree.dir, 'real-output.txt'), 'not ops noise\n', 'utf8');
+
+  const reclaimed = await gitWorktree.reclaimTerminalJobOrphans({
+    cwd: repoCwd,
+    terminalSlugs: new Set(['orphan-real-work']),
+  });
+  expect(reclaimed).toEqual([]);
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[job] reclaimTerminalJobOrphans leaves a checkout with unmerged commits alone', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'orphan-unmerged' });
+  expect(worktree.ok).toBe(true);
+  fs.writeFileSync(path.join(worktree.dir, 'new-file.txt'), 'real committed work\n', 'utf8');
+  git(['add', '-A'], worktree.dir);
+  git(['commit', '-q', '-m', 'unmerged job commit'], worktree.dir);
+
+  const reclaimed = await gitWorktree.reclaimTerminalJobOrphans({
+    cwd: repoCwd,
+    terminalSlugs: new Set(['orphan-unmerged']),
+  });
+  expect(reclaimed).toEqual([]);
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[job] reclaimTerminalJobOrphans ignores a worktree whose slug is not in terminalSlugs', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'not-terminal' });
+  expect(worktree.ok).toBe(true);
+
+  const reclaimed = await gitWorktree.reclaimTerminalJobOrphans({
+    cwd: repoCwd,
+    terminalSlugs: new Set(['some-other-slug']),
+  });
+  expect(reclaimed).toEqual([]);
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+// ──────────────────────────────────────────── PRD 1163: liveness gate in front of reclaimTerminalJobOrphans
+
+test('[job] reclaimTerminalJobOrphans does NOT remove a checkout when an injected isLive predicate reports it live', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'terminal-but-live' });
+  expect(worktree.ok).toBe(true);
+  // Clean-of-real-work shape (zero commits ahead, nothing dirty) — would be
+  // reclaimed by the existing two proofs alone. The liveness gate must be
+  // checked BEFORE those proofs and override them.
+  const isLive = vi.fn(async () => true);
+
+  const reclaimed = await gitWorktree.reclaimTerminalJobOrphans({
+    cwd: repoCwd,
+    terminalSlugs: new Set(['terminal-but-live']),
+    isLive,
+  });
+
+  expect(reclaimed).toEqual([]);
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  expect(isLive).toHaveBeenCalledWith('terminal-but-live', expect.objectContaining({ worktree: worktree.dir }));
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[job] reclaimTerminalJobOrphans still removes a terminal, dead, merged, ops-only-dirty checkout when isLive reports it not live', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'terminal-and-dead' });
+  expect(worktree.ok).toBe(true);
+  const isLive = vi.fn(async () => false);
+
+  const reclaimed = await gitWorktree.reclaimTerminalJobOrphans({
+    cwd: repoCwd,
+    terminalSlugs: new Set(['terminal-and-dead']),
+    isLive,
+  });
+
+  expect(reclaimed).toEqual(['terminal-and-dead']);
+  expect(fs.existsSync(worktree.dir)).toBe(false);
+  expect(isLive).toHaveBeenCalled();
+});
+
+test('[job] reclaimTerminalJobOrphans treats an isLive that throws as fail-safe (assume live, do not delete)', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'isLive-throws' });
+  expect(worktree.ok).toBe(true);
+  const isLive = vi.fn(async () => { throw new Error('boom'); });
+
+  const reclaimed = await gitWorktree.reclaimTerminalJobOrphans({
+    cwd: repoCwd,
+    terminalSlugs: new Set(['isLive-throws']),
+    isLive,
+  });
+
+  expect(reclaimed).toEqual([]);
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[job] jobWorktreeTerminalOrphanLive.buildTerminalOrphanIsLive skips on a live cwd holder BEFORE checking pid, and reports the reason via onLive', async () => {
+  const { buildTerminalOrphanIsLive } = require('../jobWorktreeTerminalOrphanLive.cjs');
+  const claudePidAlive = vi.fn(() => false); // pid check must never even matter here
+  const hasLiveHolder = vi.fn(() => true);
+  const onLive = vi.fn();
+  const isLive = buildTerminalOrphanIsLive({
+    terminalJobs: [{ slug: 'held-slug', runtime: { pid: 4242 } }],
+    claudePidAlive,
+    hasLiveHolder,
+    cwdHolders: new Set(['/tmp/fake']),
+    onLive,
+  });
+
+  const result = await isLive('held-slug', { worktree: '/tmp/fake/checkout' });
+
+  expect(result).toBe(true);
+  expect(hasLiveHolder).toHaveBeenCalledWith('/tmp/fake/checkout', expect.any(Set));
+  expect(onLive).toHaveBeenCalledWith('held-slug', expect.stringContaining('live cwd holder'));
+});
+
+test('[job] jobWorktreeTerminalOrphanLive.buildTerminalOrphanIsLive falls back to the recorded pid when there is no live holder', async () => {
+  const { buildTerminalOrphanIsLive } = require('../jobWorktreeTerminalOrphanLive.cjs');
+  const claudePidAlive = vi.fn((pid) => pid === 4242);
+  const hasLiveHolder = vi.fn(() => false);
+  const onLive = vi.fn();
+  const isLive = buildTerminalOrphanIsLive({
+    terminalJobs: [{ slug: 'pid-slug', runtime: { pid: 4242 } }],
+    claudePidAlive,
+    hasLiveHolder,
+    onLive,
+  });
+
+  expect(await isLive('pid-slug', { worktree: '/tmp/whatever' })).toBe(true);
+  expect(onLive).toHaveBeenCalledWith('pid-slug', expect.stringContaining('pid=4242'));
+
+  expect(await isLive('unknown-slug', { worktree: '/tmp/whatever' })).toBe(false);
+});
+
 test('[job] getMaxConcurrentWorktrees floors the job cap at the sessionSlots pool size (PRD 1112)', () => {
   const originalSlots = process.env.SM_SESSION_SLOTS;
   try {
@@ -390,6 +574,104 @@ test('[job] reconcileWorktreesOnBoot never touches a worktree outside WORKTREE_R
   git(['worktree', 'remove', '--force', humanWorktreeDir], repoCwd);
 });
 
+// ──────────────────────────────────────────── PRD 1162: job-kind isLive gate
+// (a job survives an app restart via detached:true, so a worktree found at
+// boot is not by itself proof its run already died — see scheduler.cjs's
+// boot sweep + jobWorktreeBootLive.cjs, exercised here at the
+// reconcileWorktreesOnBoot layer with a fully injected isLive predicate).
+
+test('[job] reconcileWorktreesOnBoot removes a job worktree with no live holder and no running row', async () => {
+  const slug = 'test-slug-dead';
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  gitWorktree._resetActiveWorktreeCountForTests('job', 0);
+
+  const isLive = vi.fn(() => false);
+  await gitWorktree.reconcileWorktreesOnBoot([repoCwd], { kind: 'job', isLive });
+
+  expect(fs.existsSync(worktree.dir)).toBe(false);
+  expect(isLive).toHaveBeenCalledWith(slug, expect.objectContaining({ worktree: worktree.dir }));
+});
+
+test('[job] reconcileWorktreesOnBoot SKIPS a worktree whose row is running with a live pid', async () => {
+  const slug = 'test-slug-running-live';
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  gitWorktree._resetActiveWorktreeCountForTests('job', 0);
+
+  const isLive = (key) => key === slug;
+  const result = await gitWorktree.reconcileWorktreesOnBoot([repoCwd], { kind: 'job', isLive });
+
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  expect(result.checkoutsRemoved).toBe(0);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[job] reconcileWorktreesOnBoot SKIPS a worktree whose row is absent/terminal but a live cwd holder is reported', async () => {
+  const slug = 'test-slug-terminal-holder';
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  gitWorktree._resetActiveWorktreeCountForTests('job', 0);
+
+  // Row is absent from the caller's bookkeeping entirely (as if the queue row
+  // already went terminal) — only the injected cwd-holder signal says live.
+  const isLive = (key, entry) => entry.worktree === worktree.dir;
+  const result = await gitWorktree.reconcileWorktreesOnBoot([repoCwd], { kind: 'job', isLive });
+
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  expect(result.checkoutsRemoved).toBe(0);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+// ──────────────────────────────────────────── PRD 1162: hasLiveHolder / listCwdHolders
+
+test('hasLiveHolder returns true for the current process own cwd', () => {
+  if (process.platform !== 'linux') return; // darwin has no /proc — covered by the pid-based gate instead
+  expect(gitWorktree.hasLiveHolder(process.cwd())).toBe(true);
+});
+
+test('hasLiveHolder returns false for a freshly-created empty temp dir nothing holds as cwd', () => {
+  const emptyDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-hasLiveHolder-empty-'));
+  try {
+    expect(gitWorktree.hasLiveHolder(emptyDir)).toBe(false);
+  } finally {
+    fs.rmSync(emptyDir, { recursive: true, force: true });
+  }
+});
+
+test('hasLiveHolder never throws for a non-existent path', () => {
+  expect(() => gitWorktree.hasLiveHolder('/definitely/does/not/exist/anywhere')).not.toThrow();
+  expect(gitWorktree.hasLiveHolder('/definitely/does/not/exist/anywhere')).toBe(false);
+});
+
+test('hasLiveHolder still matches a checkout dir whose /proc readlink shows the "(deleted)" suffix (unlinked while a process still held it as cwd)', async () => {
+  if (process.platform !== 'linux') return;
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-hasLiveHolder-deleted-'));
+  const child = spawn('sleep', ['5'], { cwd: dir, stdio: 'ignore' });
+  try {
+    // Give the child a moment to actually chdir before the dir is unlinked.
+    await new Promise((resolve) => setTimeout(resolve, 150));
+    fs.rmSync(dir, { recursive: true, force: true });
+    expect(gitWorktree.hasLiveHolder(dir)).toBe(true);
+  } finally {
+    child.kill();
+  }
+});
+
+test('hasLiveHolder accepts a precomputed holders Set from listCwdHolders() and matches a path nested under a holder', () => {
+  if (process.platform !== 'linux') return; // darwin: hasLiveHolder always false, per its own contract
+  const holders = new Set(['/tmp/some-worktree-checkout']);
+  expect(gitWorktree.hasLiveHolder('/tmp/some-worktree-checkout/nested/deep', holders)).toBe(false);
+  expect(gitWorktree.hasLiveHolder('/tmp/some-worktree-checkout', holders)).toBe(true);
+});
+
+test('listCwdHolders returns a Set and includes the current process own cwd on linux', () => {
+  const holders = gitWorktree.listCwdHolders();
+  expect(holders).toBeInstanceOf(Set);
+  if (process.platform === 'linux') {
+    expect(holders.has(path.resolve(process.cwd()))).toBe(true);
+  } else {
+    expect(holders.size).toBe(0);
+  }
+});
+
 // ──────────────────────────────────────────── epic kind (new)
 
 test('[epic] createEpicWorktree names the branch sm-epic/<id>, distinct from the job root', async () => {
@@ -657,6 +939,29 @@ test('[job] sweepStaleWorktreeCheckouts treats staleAgeMs: 0 as "reclaim immedia
   expect(fs.existsSync(worktree.dir)).toBe(false);
 });
 
+test('[job] sweepStaleWorktreeCheckouts does NOT remove an old-mtime checkout with a live holder, regardless of age', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'stale-but-live' });
+  expect(worktree.ok).toBe(true);
+  const holders = new Set([path.resolve(worktree.dir)]);
+
+  const result = await gitWorktree.sweepStaleWorktreeCheckouts('job', { staleAgeMs: 0, holders });
+
+  expect(result.checkoutsRemoved).toBe(0);
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[job] sweepStaleWorktreeCheckouts removes an old-mtime checkout when there is no live holder', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'stale-and-dead' });
+  expect(worktree.ok).toBe(true);
+  const holders = new Set(); // nothing holds it
+
+  const result = await gitWorktree.sweepStaleWorktreeCheckouts('job', { staleAgeMs: 0, holders });
+
+  expect(result.checkoutsRemoved).toBe(1);
+  expect(fs.existsSync(worktree.dir)).toBe(false);
+});
+
 test('[job] sweepStaleWorktreeCheckouts never deletes anything outside its own kind root, even via a symlink shaped like a traversal', async () => {
   const outsideDir = path.join(tmpRoot, 'outside-root');
   fs.mkdirSync(outsideDir, { recursive: true });
@@ -802,3 +1107,110 @@ test('[job] integrateBranch aborts cleanly when the single retry also fails on a
 
   await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch, keepBranch: true });
 });
+
+// ──────────────────────────────────────────── default-branch integration guard (PRD: starry-night-ships wrong-base merges)
+
+test('[guard] integrateBranch proceeds normally when HEAD is on the repo default branch', async () => {
+  const slug = 'test-slug-guard-default-ok';
+  const defaultBranch = git(['symbolic-ref', '--short', 'HEAD'], repoCwd).trim();
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  expect(worktree.ok).toBe(true);
+
+  fs.writeFileSync(path.join(worktree.dir, 'guard-ok.txt'), 'job output\n', 'utf8');
+  git(['add', '-A'], worktree.dir);
+  git(['commit', '-q', '-m', 'job commit'], worktree.dir);
+
+  expect(await gitWorktree.getCurrentBranch(repoCwd)).toBe(defaultBranch);
+  const outcome = await gitWorktree.integrateJobBranch({ cwd: repoCwd, branch: worktree.branch, slug });
+  expect(outcome.ok).toBe(true);
+  expect(outcome.integrated).toBe(true);
+
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[guard] integrateBranch refuses when HEAD is on a stray sm-job/* branch, naming both branches in the reason, and mutates nothing', async () => {
+  const defaultBranch = git(['symbolic-ref', '--short', 'HEAD'], repoCwd).trim();
+  const slugB = 'test-slug-guard-stray-b';
+  const strayBranch = 'sm-job/leftover-from-a-prior-run';
+  const worktreeB = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: slugB });
+  fs.writeFileSync(path.join(worktreeB.dir, 'guard-stray.txt'), 'branch b output\n', 'utf8');
+  git(['add', '-A'], worktreeB.dir);
+  git(['commit', '-q', '-m', 'job commit b'], worktreeB.dir);
+
+  // Simulate the live incident: the SHARED tree's own HEAD got checked out
+  // onto a leftover job branch instead of staying on the default branch.
+  git(['checkout', '-b', strayBranch], repoCwd);
+  const headBefore = git(['rev-parse', 'HEAD'], repoCwd).trim();
+  const statusBefore = git(['status', '--porcelain'], repoCwd);
+
+  const outcome = await gitWorktree.integrateJobBranch({ cwd: repoCwd, branch: worktreeB.branch, slug: slugB });
+  expect(outcome.ok).toBe(false);
+  expect(outcome.reason).toContain(defaultBranch);
+  expect(outcome.reason).toContain(strayBranch);
+
+  // Refusing must not touch git state: no checkout/reset/switch performed.
+  expect(git(['rev-parse', 'HEAD'], repoCwd).trim()).toBe(headBefore);
+  expect(git(['status', '--porcelain'], repoCwd)).toBe(statusBefore);
+
+  git(['checkout', defaultBranch], repoCwd);
+  git(['branch', '-D', strayBranch], repoCwd);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktreeB.dir, branch: worktreeB.branch, keepBranch: true });
+  try { git(['branch', '-D', worktreeB.branch], repoCwd); } catch { /* best-effort */ }
+});
+
+test('[guard] integrateBranch refuses on a detached HEAD, reporting "detached HEAD" rather than treating it as a branch', async () => {
+  const defaultBranch = git(['symbolic-ref', '--short', 'HEAD'], repoCwd).trim();
+  const slug = 'test-slug-guard-detached';
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  fs.writeFileSync(path.join(worktree.dir, 'guard-detached.txt'), 'output\n', 'utf8');
+  git(['add', '-A'], worktree.dir);
+  git(['commit', '-q', '-m', 'job commit'], worktree.dir);
+
+  const headSha = git(['rev-parse', 'HEAD'], repoCwd).trim();
+  git(['checkout', '--detach', headSha], repoCwd);
+  expect(await gitWorktree.getCurrentBranch(repoCwd)).toBeNull();
+
+  const outcome = await gitWorktree.integrateJobBranch({ cwd: repoCwd, branch: worktree.branch, slug });
+  expect(outcome.ok).toBe(false);
+  expect(outcome.reason).toContain('detached HEAD');
+  expect(outcome.reason).toContain(defaultBranch);
+
+  git(['checkout', defaultBranch], repoCwd);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch, keepBranch: true });
+  try { git(['branch', '-D', worktree.branch], repoCwd); } catch { /* best-effort */ }
+});
+
+test('[guard] resolveDefaultBranch resolves a sensible default (the sole local branch) for a repo with no remote, and integration still proceeds', async () => {
+  const remoteOut = execFileSync('git', ['remote'], { cwd: repoCwd, encoding: 'utf8' }).trim();
+  expect(remoteOut).toBe('');
+  const defaultBranch = git(['symbolic-ref', '--short', 'HEAD'], repoCwd).trim();
+  expect(await gitWorktree.resolveDefaultBranch(repoCwd)).toBe(defaultBranch);
+
+  const slug = 'test-slug-guard-no-remote';
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  fs.writeFileSync(path.join(worktree.dir, 'guard-no-remote.txt'), 'output\n', 'utf8');
+  git(['add', '-A'], worktree.dir);
+  git(['commit', '-q', '-m', 'job commit'], worktree.dir);
+
+  const outcome = await gitWorktree.integrateJobBranch({ cwd: repoCwd, branch: worktree.branch, slug });
+  expect(outcome.ok).toBe(true);
+  expect(outcome.integrated).toBe(true);
+
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[guard][epic] integrateEpicBranch inherits the same guard and still merges cleanly when HEAD is on the default branch', async () => {
+  const epicId = 'test-epic-guard-ok';
+  const worktree = await gitWorktree.createEpicWorktree({ cwd: repoCwd, epicId });
+  expect(worktree.ok).toBe(true);
+
+  fs.writeFileSync(path.join(worktree.dir, 'epic-guard.txt'), 'epic output\n', 'utf8');
+  git(['add', '-A'], worktree.dir);
+  git(['commit', '-q', '-m', 'epic commit'], worktree.dir);
+
+  const outcome = await gitWorktree.integrateEpicBranch({ cwd: repoCwd, branch: worktree.branch, epicId });
+  expect(outcome.ok).toBe(true);
+  expect(outcome.integrated).toBe(true);
+
+  await gitWorktree.cleanupEpicWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});

package/src/main/lib/__tests__/jobWorktreeBootLive.test.cjs

@@ -0,0 +1,71 @@
+/**
+ * jobWorktreeBootLive.test.cjs — PRD 1162: pure unit tests for the `isLive`
+ * predicate the scheduler's boot worktree sweep hands to
+ * jobWorktree.reconcileWorktreesOnBoot. Liveness is fully injected/stubbed —
+ * no /proc, no git, no electron.
+ *
+ * Run: timeout 60 npx vitest run src/main/lib/__tests__/jobWorktreeBootLive.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, vi } from 'vitest';
+const { buildJobWorktreeIsLive } = require('../jobWorktreeBootLive.cjs');
+
+test('isLive returns true when the row is running with a live pid', () => {
+  const claudePidAlive = vi.fn(() => true);
+  const hasLiveHolder = vi.fn(() => false);
+  const isLive = buildJobWorktreeIsLive({
+    bootJobs: [{ slug: 'job-a', status: 'running', runtime: { pid: 4242 } }],
+    claudePidAlive,
+    hasLiveHolder,
+  });
+  expect(isLive('job-a', { worktree: '/tmp/whatever' })).toBe(true);
+  expect(claudePidAlive).toHaveBeenCalledWith(4242);
+  expect(hasLiveHolder).not.toHaveBeenCalled();
+});
+
+test('isLive returns false when the row is running but the pid is dead and no cwd holder exists', () => {
+  const isLive = buildJobWorktreeIsLive({
+    bootJobs: [{ slug: 'job-a', status: 'running', runtime: { pid: 4242 } }],
+    claudePidAlive: () => false,
+    hasLiveHolder: () => false,
+  });
+  expect(isLive('job-a', { worktree: '/tmp/whatever' })).toBe(false);
+});
+
+test('isLive returns true via hasLiveHolder when the row is absent/terminal but a process still holds the checkout as cwd', () => {
+  const claudePidAlive = vi.fn(() => true);
+  const hasLiveHolder = vi.fn(() => true);
+  const isLive = buildJobWorktreeIsLive({
+    bootJobs: [{ slug: 'job-b', status: 'completed', runtime: { pid: 999 } }],
+    claudePidAlive,
+    hasLiveHolder,
+  });
+  expect(isLive('job-b', { worktree: '/tmp/checkout-b' })).toBe(true);
+  // Terminal row never even consults claudePidAlive — only a 'running' row does.
+  expect(claudePidAlive).not.toHaveBeenCalled();
+  expect(hasLiveHolder).toHaveBeenCalledWith('/tmp/checkout-b', undefined);
+});
+
+test('isLive returns false when there is no matching row and no cwd holder', () => {
+  const isLive = buildJobWorktreeIsLive({
+    bootJobs: [],
+    claudePidAlive: () => true,
+    hasLiveHolder: () => false,
+  });
+  expect(isLive('job-c', { worktree: '/tmp/checkout-c' })).toBe(false);
+});
+
+test('a precomputed cwdHolders set is forwarded through to hasLiveHolder unchanged', () => {
+  const holders = new Set(['/tmp/precomputed']);
+  const hasLiveHolder = vi.fn(() => false);
+  const isLive = buildJobWorktreeIsLive({
+    bootJobs: [],
+    claudePidAlive: () => false,
+    hasLiveHolder,
+    cwdHolders: holders,
+  });
+  isLive('job-d', { worktree: '/tmp/checkout-d' });
+  expect(hasLiveHolder).toHaveBeenCalledWith('/tmp/checkout-d', holders);
+});

package/src/main/lib/__tests__/queueStoreAtomicWrite.test.cjs

@@ -0,0 +1,88 @@
+/**
+ * queueStoreAtomicWrite.test.cjs — regression test for the tmp-path collision
+ * that tore `scheduler-machine.json` four times (`.corrupt-*` Sep 7/10/11,
+ * plus a `.bak-*`). The old `writeJsonAtomic`/`writeJsonAtomicSync` used
+ * `${file}.tmp-${process.pid}` — keyed on PID ONLY, so two overlapping writes
+ * inside the SAME process shared one tmp path. A long write mid-flight gets
+ * clobbered by a short write's O_TRUNC open on the same tmp file, and the
+ * short write's remaining buffered bytes land past the short write's own
+ * EOF; `rename()` is atomic, but the shared tmp file underneath it never was
+ * — the publish carries the interleaved bytes.
+ *
+ * This drives two REAL concurrent async writes (one large enough that
+ * Node's fs writeFile chunks it — see WRITE_CHUNK_BYTES below — so the two
+ * calls' internal awaits actually interleave on the event loop) against the
+ * same target path, and asserts the result is one clean payload with no
+ * trailing bytes. Confirmed by hand against the pre-fix pid-only tmp name
+ * (reverting just the tmp-path line): this test fails there — the read
+ * either doesn't parse or parses to neither payload — and passes against the
+ * unique-per-call tmp name shipped in this commit.
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/queueStoreAtomicWrite.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, afterEach } from 'vitest';
+const fs = require('node:fs');
+const fsp = require('node:fs/promises');
+const os = require('node:os');
+const path = require('node:path');
+const { writeJsonAtomic } = require('../queueStore.cjs');
+
+// Node's fs.promises writeFile-style chunking writes large buffers in ~512KB
+// pieces, awaiting each one — large enough here to guarantee the short
+// write's open+truncate+write+rename lands in the middle of the long write's
+// remaining chunks when raced with Promise.all.
+const LONG_PAYLOAD = { kind: 'long', blob: 'A'.repeat(4 * 1024 * 1024) };
+const SHORT_PAYLOAD = { kind: 'short' };
+
+const tmpDirs = [];
+
+afterEach(async () => {
+  while (tmpDirs.length) {
+    await fsp.rm(tmpDirs.pop(), { recursive: true, force: true }).catch(() => {});
+  }
+});
+
+test('two concurrent writeJsonAtomic calls against the same path never interleave', async () => {
+  const dir = await fsp.mkdtemp(path.join(os.tmpdir(), 'queueStore-atomic-'));
+  tmpDirs.push(dir);
+  const target = path.join(dir, 'race-target.json');
+
+  // Repeat a handful of times — the race is timing-dependent, and this
+  // guards against a lucky single run masking a reintroduced bug.
+  for (let attempt = 0; attempt < 5; attempt++) {
+    await Promise.all([
+      writeJsonAtomic(target, LONG_PAYLOAD),
+      writeJsonAtomic(target, SHORT_PAYLOAD),
+    ]);
+
+    const raw = fs.readFileSync(target, 'utf8');
+    const parsed = JSON.parse(raw); // throws if the file is torn — that alone is a failure
+    const matchesLong = JSON.stringify(parsed) === JSON.stringify(LONG_PAYLOAD);
+    const matchesShort = JSON.stringify(parsed) === JSON.stringify(SHORT_PAYLOAD);
+    expect(matchesLong || matchesShort).toBe(true);
+
+    // No trailing bytes beyond the serialized payload (the exact shape of
+    // the real corruption: a complete object followed by an orphaned tail).
+    const expected = JSON.stringify(parsed, null, 2);
+    expect(raw).toBe(expected);
+  }
+});
+
+test('a failed write never leaves a stray .tmp-* file behind', async () => {
+  const dir = await fsp.mkdtemp(path.join(os.tmpdir(), 'queueStore-atomic-fail-'));
+  tmpDirs.push(dir);
+  const target = path.join(dir, 'target.json');
+  // Target is a directory, not a file — mkdir + open + write all succeed,
+  // but the final rename() onto an existing directory fails with EISDIR,
+  // exercising the unlink-the-tmp-on-error path specifically (not just a
+  // trivial pre-write failure).
+  fs.mkdirSync(target);
+
+  await expect(writeJsonAtomic(target, { a: 1 })).rejects.toThrow();
+
+  const leftovers = fs.readdirSync(dir).filter((f) => f.includes('.tmp-'));
+  expect(leftovers).toEqual([]);
+});