claude-code-session-manager 0.85.0 → 0.87.0

package/src/main/__tests__/scheduler-reap-dead-running-jobs.test.cjs

@@ -148,6 +148,48 @@ test('reapDeadRunningJobs reaps a pidless row older than PIDLESS_SPAWN_GRACE_MS
   assert.ok(pidlessEvent, 'reaping a pidless row must leave an audit trace');
 });
 
+test('reapDeadRunningJobs: a pidless row past grace with a landedCommit already recorded is routed to needs_review, not failed, naming the commit sha (PRD 1173)', async () => {
+  const projectCwd = path.join(tmpHome, 'c3-project-pidless-with-landed-commit');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const staleStartedAt = new Date(Date.now() - PIDLESS_SPAWN_GRACE_MS - 60_000).toISOString();
+  const landedSha = 'f3e35a7f9e49f13a9eb8c338b0d086160e32a87f';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'shipped-but-pidless',
+      status: 'running',
+      cwd: projectCwd,
+      runId: 'run-shipped-but-pidless',
+      startedAt: staleStartedAt,
+      landedCommit: landedSha,
+      // no runtime key at all — the spawn never got far enough to record one
+    },
+  ]);
+  // Empty run dir, same shape as the sibling 'failed' test below — the
+  // landedCommit evidence must be what changes the outcome, not the log.
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', 'run-shipped-but-pidless'), { recursive: true });
+
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'shipped-but-pidless');
+  assert.equal(row.status, 'needs_review', 'a row with proof of landed work must never be transitioned to failed by the pidless branch');
+  assert.equal(row.landedCommit, landedSha, 'the pre-existing landedCommit must be preserved on the row');
+  assert.match(row.error, new RegExp(landedSha), 'the reason must name the recorded commit sha');
+  assert.equal(row.verifierVerdict, 'pidless_reap_with_landed_commit');
+
+  // Scan the whole audit log for THIS slug's event rather than slicing by a
+  // byte offset from statSync — a prior test's audit entries can contain
+  // multi-byte characters (e.g. an em dash in a reaper reason string), and
+  // slicing a utf8-decoded JS string (UTF-16 code units) at a byte offset
+  // then silently corrupts the boundary. The slug is unique to this test.
+  const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  const pidlessEvent = auditLines.find((e) => e.kind === 'job_reaped_pidless' && e.slug === 'shipped-but-pidless');
+  assert.ok(pidlessEvent, 'reaping this row must still leave an audit trace');
+  assert.equal(pidlessEvent.landedCommit, landedSha, 'the audit event must carry the landed-commit evidence so the decision is reconstructable from the audit log alone');
+});
+
 test('reapDeadRunningJobs clears runId on a pidless reap whose run dir holds only a sibling slug\'s files', async () => {
   const projectCwd = path.join(tmpHome, 'c2-project-batch-sibling');
   fs.mkdirSync(projectCwd, { recursive: true });
@@ -573,3 +615,121 @@ test('reapDeadRunningJobs: a non-git cwd skips the integration check entirely, p
   assert.equal(row.status, 'completed', 'a non-git cwd must keep today\'s behaviour — the check is meaningless there');
   assert.equal(row.verifierVerdict, undefined);
 });
+
+// ---------- Reaper landed-commit evidence gate (job 1192 incident) ----------
+//
+// job 1192 shipped a real 3-file commit (7bf5fa3f...) and was still
+// stamped 'failed' by reapDeadRunningJobs because a `landedCommit` field
+// being present was never actually verified against the repo. These cover
+// the dead-pid branch specifically (runtime.pid recorded, process
+// confirmed dead) rather than the pidless branch: a pidless row with a
+// non-empty landedCommit is already fully owned by PRD 1173's
+// resolvePidlessFailureOverride (routes to needs_review, tested above) —
+// this PRD's gate exists for the shape 1173 doesn't cover, where the
+// reaper would otherwise fall straight through to 'failed' with no
+// evidence check of any kind.
+
+test('reapDeadRunningJobs: a dead-pid reap with a git-resolvable landedCommit transitions to completed, naming the reap cause and the evidence, source reapDeadRunningJobs:landed', async () => {
+  const projectCwd = path.join(tmpHome, 'n-project-landed-commit-evidence');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  fs.writeFileSync(path.join(projectCwd, 'shipped.txt'), 'done\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'ship the PRD work'], projectCwd);
+  const landedSha = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const runId = 'run-landed-commit-evidence';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'landed-but-reaped',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 }, // guaranteed-dead pid
+      landedCommit: landedSha,
+    },
+  ]);
+  // Empty run dir → classifyRunOutcome finds no result event → 'no_result'
+  // → without this PRD's gate this would stamp 'failed' despite the real
+  // commit already sitting on HEAD.
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'landed-but-reaped');
+  assert.equal(row.status, 'completed', 'a resolvable landedCommit must promote the reap to completed, not failed');
+  assert.equal(row.landedCommit, landedSha);
+  assert.equal(row.exitCode, 0);
+  assert.equal(row.error, null);
+  const lastTransition = row.statusHistory[row.statusHistory.length - 1];
+  assert.equal(lastTransition.source, 'reapDeadRunningJobs:landed');
+  assert.match(lastTransition.reason, /process gone/, 'the reap cause must still be named');
+  assert.match(lastTransition.reason, new RegExp(landedSha), 'the evidence sha must be named');
+  assert.match(lastTransition.reason, /resolves/);
+});
+
+test('reapDeadRunningJobs: a dead-pid reap with an unresolvable (stale) landedCommit keeps today\'s behaviour exactly — failed, same reason shape, same source', async () => {
+  const projectCwd = path.join(tmpHome, 'o-project-stale-landed-commit');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const staleSha = '0123456789abcdef0123456789abcdef01234567'; // well-formed sha, never committed anywhere
+  const runId = 'run-stale-landed-commit';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'stale-landed-commit',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      landedCommit: staleSha,
+    },
+  ]);
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'stale-landed-commit');
+  assert.equal(row.status, 'failed', 'a landedCommit that does not resolve in the repo must never be trusted as evidence');
+  assert.equal(row.landedCommit, staleSha, 'the stale field is left on the row untouched, never cleared');
+  assert.match(row.error, /reaped: process gone \(outcome=no_result\)/);
+  assert.doesNotMatch(row.error, /resolves/);
+  const lastTransition = row.statusHistory[row.statusHistory.length - 1];
+  assert.equal(lastTransition.source, 'reapDeadRunningJobs', 'no evidence found — source must stay the plain reaper source, not :landed');
+});
+
+test('reapDeadRunningJobs: a landedCommit that cannot be git-resolved because the row cwd is not a usable git repo falls back to failed without throwing out of the reaper', async () => {
+  const projectCwd = path.join(tmpHome, 'p-project-unresolvable-cwd');
+  // Deliberately NOT initRepo(projectCwd) — no `.git` at all, the same
+  // "cwd git resolution cannot possibly succeed" shape a deleted/torn-down
+  // worktree checkout would produce (git itself errors identically for
+  // "not a git repository" and "no such directory" — both must be caught
+  // and treated as no-evidence, never thrown out of the reaper).
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const runId = 'run-unresolvable-cwd';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'unresolvable-cwd-job',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      landedCommit: '89abcdef89abcdef89abcdef89abcdef89abcdef',
+    },
+  ]);
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await assert.doesNotReject(() => reapDeadRunningJobs(), 'a bounded git spawn failure/timeout must never escape the reaper as an unhandled rejection');
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'unresolvable-cwd-job');
+  assert.equal(row.status, 'failed', 'an unresolvable cwd must fall back to failed, exactly like no evidence at all');
+});

package/src/main/__tests__/scheduler-reaper-helpers-basics.test.cjs

@@ -0,0 +1,87 @@
+'use strict';
+
+// Ported from the retired top-level test-root directory (a node:test suite,
+// never runnable by this repo's vitest-only setup — see CLAUDE.md's Commands
+// section). The existing src/main/lib/__tests__/reaperHelpers.test.cjs
+// exercises classifyRunOutcome extensively via selectReapableJobs and the
+// rate-limit paths, but never asserts claudePidAlive directly (only ever
+// injects a stand-in `pidAlive` function), and never pins the bare
+// no-result/empty-file/malformed-event edge cases below. These fill that
+// gap.
+//
+// Run: timeout 120 npx vitest run src/main/__tests__/scheduler-reaper-helpers-basics.test.cjs
+
+const assert = require('node:assert/strict');
+const os = require('node:os');
+const path = require('node:path');
+const fs = require('node:fs');
+const { claudePidAlive, classifyRunOutcome } = require('../lib/reaperHelpers.cjs');
+
+// ─────────────────────────────────────────── claudePidAlive
+
+test('claudePidAlive: nonexistent pid (999999) returns false', () => {
+  assert.equal(claudePidAlive(999999), false);
+});
+
+test('claudePidAlive: pid 0 returns false', () => {
+  assert.equal(claudePidAlive(0), false);
+});
+
+test('claudePidAlive: pid 1 returns false', () => {
+  assert.equal(claudePidAlive(1), false);
+});
+
+test('claudePidAlive: null returns false', () => {
+  assert.equal(claudePidAlive(null), false);
+});
+
+test('claudePidAlive: undefined returns false', () => {
+  assert.equal(claudePidAlive(undefined), false);
+});
+
+// ─────────────────────────────────────────── classifyRunOutcome
+
+function writeTempLog(content) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'reaper-basics-test-'));
+  const filePath = path.join(dir, 'test.log');
+  fs.writeFileSync(filePath, content, 'utf8');
+  return filePath;
+}
+
+test('classifyRunOutcome: success without an is_error field → success', () => {
+  const p = writeTempLog('{"type":"result","subtype":"success","result":"ok"}\n');
+  assert.equal(classifyRunOutcome(p), 'success');
+});
+
+test('classifyRunOutcome: subtype success but is_error:true → failed (error wins)', () => {
+  const p = writeTempLog('{"type":"result","subtype":"success","is_error":true}\n');
+  assert.equal(classifyRunOutcome(p), 'failed');
+});
+
+test('classifyRunOutcome: no result event in the tail → no_result', () => {
+  const log = [
+    '{"type":"assistant","message":"working"}',
+    '{"type":"tool_use","name":"bash"}',
+    'some plain text log line',
+  ].join('\n');
+  const p = writeTempLog(log);
+  assert.equal(classifyRunOutcome(p), 'no_result');
+});
+
+test('classifyRunOutcome: empty file → no_result', () => {
+  const p = writeTempLog('');
+  assert.equal(classifyRunOutcome(p), 'no_result');
+});
+
+test('classifyRunOutcome: last result event wins when multiple exist', () => {
+  const log = [
+    '{"type":"result","subtype":"success"}',
+    '{"type":"result","subtype":"error","is_error":true}',
+  ].join('\n');
+  const p = writeTempLog(log);
+  assert.equal(classifyRunOutcome(p), 'failed');
+});
+
+test('classifyRunOutcome: nonexistent file → no_result (readTail swallows I/O errors)', () => {
+  assert.equal(classifyRunOutcome('/nonexistent/path/that/cannot/exist.log'), 'no_result');
+});

package/src/main/__tests__/scheduler-shared-tree-guard.test.cjs

@@ -16,6 +16,7 @@
 'use strict';
 
 import { test, expect, vi, afterEach } from 'vitest';
+const fs = require('node:fs');
 const scheduler = require('../scheduler.cjs');
 const { evaluateSharedTreeGuard, checkSharedTreeGuard } = scheduler;
 
@@ -210,3 +211,90 @@ test('checkSharedTreeGuard never throws when the underlying git calls reject', a
   });
   expect(result).toBeNull();
 });
+
+// --- 2026-09-12 false-positive: an untracked path that merely became
+// IGNORED during the run (a .gitignore edit) is not a revert. See the
+// evaluateSharedTreeGuard doc comment for the full incident writeup. Each
+// test below is written to FAIL against the pre-fix implementation (which
+// computed `reverted = dirtyBefore - dirtyAfter - committed` with no
+// existence/tracked-status distinction at all) and PASS after it.
+
+test('evaluateSharedTreeGuard: an untracked path that disappears from git status but STILL EXISTS on disk is nowIgnored, not reverted', () => {
+  // Pre-fix behavior: this path would land in `reverted` (dirtyBefore minus
+  // dirtyAfter minus committed, no existence check at all) — FAILS pre-fix.
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore: [{ code: '??', path: 'session-manager-operations/logs/errors-2026-09-12.jsonl' }],
+    dirtyAfter: [],
+    pathsCommittedDuringRun: ['.gitignore'],
+    existsAfter: ['session-manager-operations/logs/errors-2026-09-12.jsonl'],
+  });
+  expect(result.reverted).toEqual([]);
+  expect(result.nowIgnored).toEqual(['session-manager-operations/logs/errors-2026-09-12.jsonl']);
+});
+
+test('evaluateSharedTreeGuard: an untracked path that disappears from git status AND no longer exists on disk is still reverted', () => {
+  // Proves the fix is not a blanket "stop reporting reverted": a genuinely
+  // deleted untracked file (the guard's real purpose — catching a job that
+  // discarded uncommitted work) must still surface. If the fix had simply
+  // stopped reporting any untracked-and-missing path as reverted, this test
+  // would fail (reverted would come back empty instead of containing the
+  // path).
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore: [{ code: '??', path: 'data/scratch.txt' }],
+    dirtyAfter: [],
+    pathsCommittedDuringRun: [],
+    existsAfter: [], // file no longer exists on disk
+  });
+  expect(result.reverted).toEqual(['data/scratch.txt']);
+  expect(result.nowIgnored).toEqual([]);
+});
+
+test('evaluateSharedTreeGuard: a TRACKED path clean after the run is still reverted even though it exists on disk', () => {
+  // A tracked file leaving the dirty set means its content was restored to
+  // HEAD — exactly the discard this guard exists to catch — regardless of
+  // whether the file is still present. Pre-fix this already worked by
+  // accident (no existence check existed at all); this test pins the
+  // behavior now that existence checks exist for the untracked branch, so a
+  // future change can't accidentally start trusting `existsAfter` for
+  // tracked paths too.
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore: [{ code: ' M', path: 'src/config.js' }],
+    dirtyAfter: [],
+    pathsCommittedDuringRun: [],
+    existsAfter: ['src/config.js'], // file exists, but content was reset to HEAD
+  });
+  expect(result.reverted).toEqual(['src/config.js']);
+  expect(result.nowIgnored).toEqual([]);
+});
+
+test('checkSharedTreeGuard end-to-end: the real 2026-09-12 incident shape — untracked logs path ignored by a committed .gitignore change, file still on disk — must NOT verdict shared_tree_reverted', async () => {
+  // PRD 1181's exact shape: a bare `logs/` pattern lands in .gitignore during
+  // the run (committed), eleven untracked log paths vanish from `git status`,
+  // and the files are untouched on disk. Pre-fix, checkSharedTreeGuard's
+  // `reverted` would contain this path (no existsAfter computation existed),
+  // driving the caller's `verdict: 'shared_tree_reverted'` downgrade — FAILS
+  // pre-fix.
+  const logPath = 'session-manager-operations/logs/errors-2026-09-12.jsonl';
+  vi.spyOn(scheduler, 'stashList').mockResolvedValue([]);
+  vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha-after');
+  vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue(['.gitignore']);
+  vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue([]); // the log path no longer shows up at all
+  vi.spyOn(fs, 'existsSync').mockImplementation((p) => String(p).includes('errors-2026-09-12.jsonl'));
+
+  const result = await checkSharedTreeGuard({
+    cwd: '/repo',
+    stashBaseline: [],
+    dirtyBaseline: [{ code: '??', path: logPath }],
+    headBefore: 'sha-before',
+    slug: 'job-1181',
+  });
+
+  expect(result.reverted).toBeUndefined();
+  expect(result.nowIgnored).toEqual([logPath]);
+});

package/src/main/__tests__/scheduler-starve-escalation.test.cjs

@@ -0,0 +1,154 @@
+/**
+ * scheduler-starve-escalation.test.cjs — the `project_starved` audit event
+ * (scheduler.cjs ~line 8888) used to be emit-only: it fired every sweep
+ * forever with zero consequence. The 2026-09-12 audit log showed
+ * /home/bilko/Projects/Bilko emitting it ~115 times over a 19h starve with
+ * nothing acting on it. runStarveEscalationSweep is the bounded, automated
+ * consequence: a starve outliving STARVE_ESCALATION_MS gets a DISTINCT
+ * 'project_starve_escalated' audit event (once per starve stretch, latched
+ * per cwd) plus a toast-channel error via the existing 'schedule:stall'
+ * push (already wired to toast.error on the renderer side).
+ *
+ * Exercises selectStarveEscalations() (pure) directly, and
+ * runStarveEscalationSweep() (the side-effecting wrapper) against a real,
+ * scratch audit-log.jsonl and a fake attached window — matching
+ * pollLoop-dispatch-on-failure.test.cjs's pattern of setting HOME before
+ * require() (beforeAll runs AFTER module evaluation) since every state path
+ * is baked from os.homedir() at load, and restoring it in afterAll.
+ *
+ * Run: timeout 180 npx vitest run src/main/__tests__/scheduler-starve-escalation.test.cjs
+ */
+
+'use strict';
+
+import { test, beforeEach, afterAll } from 'vitest';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const originalHome = process.env.HOME;
+const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'starve-escalation-test-'));
+process.env.HOME = tmpHome;
+fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager'), { recursive: true });
+fs.mkdirSync(path.join(tmpHome, '.claude', 'projects'), { recursive: true });
+
+const {
+  selectStarveEscalations,
+  runStarveEscalationSweep,
+  STARVE_ESCALATION_MS,
+  attachWindow,
+} = require('../scheduler.cjs');
+const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+const CWD_A = '/home/bilko/Projects/Bilko';
+const CWD_B = '/home/bilko/Projects/session-manager';
+
+function readAuditKind(kind) {
+  let lines;
+  try {
+    lines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').split('\n').filter(Boolean);
+  } catch {
+    return [];
+  }
+  return lines.map((l) => JSON.parse(l)).filter((r) => r.kind === kind);
+}
+
+function fakeWindow() {
+  const sent = [];
+  return {
+    sent,
+    isDestroyed: () => false,
+    webContents: {
+      isDestroyed: () => false,
+      isCrashed: () => false,
+      send: (channel, payload) => sent.push({ channel, payload }),
+    },
+  };
+}
+
+beforeEach(() => {
+  // Fresh scratch audit log per test so escalation counts never bleed across
+  // tests in this file.
+  fs.mkdirSync(path.dirname(AUDIT_LOG_PATH), { recursive: true });
+  fs.writeFileSync(AUDIT_LOG_PATH, '');
+  attachWindow(null);
+});
+
+test('selectStarveEscalations: escalates a row past threshold not already latched', () => {
+  const starved = [{ cwd: CWD_A, pendingCount: 3, oldestPendingSlug: 'x', ageMs: STARVE_ESCALATION_MS + 1 }];
+  const { toEscalate, toClear } = selectStarveEscalations(starved, new Set(), STARVE_ESCALATION_MS);
+  assert.equal(toEscalate.length, 1);
+  assert.equal(toEscalate[0].cwd, CWD_A);
+  assert.deepEqual(toClear, []);
+});
+
+test('selectStarveEscalations: never re-escalates a cwd already latched', () => {
+  const starved = [{ cwd: CWD_A, pendingCount: 3, oldestPendingSlug: 'x', ageMs: STARVE_ESCALATION_MS + 60_000 }];
+  const { toEscalate } = selectStarveEscalations(starved, new Set([CWD_A]), STARVE_ESCALATION_MS);
+  assert.deepEqual(toEscalate, []);
+});
+
+test('selectStarveEscalations: a latched cwd no longer starved is returned for latch-clear', () => {
+  const { toEscalate, toClear } = selectStarveEscalations([], new Set([CWD_A]), STARVE_ESCALATION_MS);
+  assert.deepEqual(toEscalate, []);
+  assert.deepEqual(toClear, [CWD_A]);
+});
+
+test('selectStarveEscalations: below-threshold starve is neither escalated nor cleared', () => {
+  const starved = [{ cwd: CWD_A, pendingCount: 1, oldestPendingSlug: 'x', ageMs: STARVE_ESCALATION_MS - 1 }];
+  const { toEscalate, toClear } = selectStarveEscalations(starved, new Set(), STARVE_ESCALATION_MS);
+  assert.deepEqual(toEscalate, []);
+  assert.deepEqual(toClear, []);
+});
+
+test('runStarveEscalationSweep: emits project_starve_escalated exactly once per starve stretch, plus a toast', () => {
+  const win = fakeWindow();
+  attachWindow(win);
+  const sp = { cwd: CWD_A, pendingCount: 4, oldestPendingSlug: 'oldest-a', ageMs: STARVE_ESCALATION_MS + 60_000 };
+
+  runStarveEscalationSweep([sp]);
+  assert.equal(readAuditKind('project_starve_escalated').length, 1);
+  assert.equal(win.sent.length, 1);
+  assert.equal(win.sent[0].channel, 'schedule:stall');
+  assert.match(win.sent[0].payload.message, /Bilko/);
+
+  const record = readAuditKind('project_starve_escalated')[0];
+  assert.equal(record.cwd, CWD_A);
+  assert.equal(record.pendingCount, 4);
+  assert.equal(record.oldestPendingSlug, 'oldest-a');
+  assert.equal(record.ageMs, sp.ageMs);
+  assert.ok(
+    ['slots-exhausted', 'memory-deferred', 'load-deferred', 'held', 'unknown'].includes(record.holdReason),
+    `unexpected holdReason: ${record.holdReason}`,
+  );
+
+  // Same still-starved stretch on the NEXT sweep must not escalate again.
+  runStarveEscalationSweep([sp]);
+  assert.equal(readAuditKind('project_starve_escalated').length, 1);
+  assert.equal(win.sent.length, 1);
+});
+
+test('runStarveEscalationSweep: the latch resets once the starve clears, so a later stretch escalates again', () => {
+  const win = fakeWindow();
+  attachWindow(win);
+  const sp = { cwd: CWD_B, pendingCount: 2, oldestPendingSlug: 'oldest-b', ageMs: STARVE_ESCALATION_MS + 1 };
+
+  runStarveEscalationSweep([sp]);
+  assert.equal(readAuditKind('project_starve_escalated').length, 1);
+
+  // Starve clears: this cwd is no longer reported by findStarvedProjects at all.
+  runStarveEscalationSweep([]);
+  assert.equal(readAuditKind('project_starve_escalated').length, 1); // no new escalation on a clear pass
+
+  // A NEW starve stretch on the same cwd must escalate again — the latch
+  // must not have been permanently burned by the first stretch.
+  runStarveEscalationSweep([sp]);
+  assert.equal(readAuditKind('project_starve_escalated').length, 2);
+  assert.equal(win.sent.length, 2);
+});

package/src/main/__tests__/scheduler-worktree-cap-defer.test.cjs

@@ -187,6 +187,20 @@ test('a non-git cwd still falls back to running in place (unchanged behaviour
     expect(row.worktreeFallbackReason).toMatch(/not a git repository/);
     // Ran IN PLACE — the marker landed directly in projectCwd, not a worktree.
     expect(fs.existsSync(path.join(projectCwd, 'ran-here.marker'))).toBe(true);
+
+    // A job losing worktree isolation must never be a silent downgrade
+    // discoverable only by reading queue.json afterwards — it must also land
+    // as a warn line in the durable ops error log, naming the slug, cwd, and
+    // reason.
+    const { todayFile } = require('../lib/opsErrorLog.cjs');
+    const errorLogPath = todayFile(projectCwd);
+    expect(fs.existsSync(errorLogPath)).toBe(true);
+    const logLines = fs.readFileSync(errorLogPath, 'utf8').trim().split('\n').map((l) => JSON.parse(l));
+    const fallbackLine = logLines.find((l) => l.scope === 'scheduler' && l.level === 'warn' && l.message.includes(slug));
+    expect(fallbackLine).toBeTruthy();
+    expect(fallbackLine.message).toMatch(/SHARED working tree/);
+    expect(fallbackLine.message).toMatch(/not a git repository/);
+    expect(fallbackLine.meta).toMatchObject({ slug, cwd: projectCwd, reason: expect.stringMatching(/not a git repository/) });
   } finally {
     fs.rmSync(projectCwd, { recursive: true, force: true });
     fs.rmSync(runDir, { recursive: true, force: true });

package/src/main/__tests__/telemetryClient.test.cjs

@@ -150,6 +150,26 @@ test('ingress functions never throw on hostile inputs', async () => {
   client.shutdown();
 });
 
+// ─── reportInstall failure visibility ──────────────────────────────────
+
+test('reportInstall logs a warn line naming the thrown error instead of swallowing it silently', async () => {
+  const home = await mkHome();
+  const client = freshClient(home);
+  client._setMachineProfileBuilder(() => { throw new Error('boom-profile'); });
+  const warnLines = [];
+  client._setLogger((payload) => warnLines.push(payload));
+
+  const result = await client.reportInstall(fakeProfile());
+
+  expect(result).toEqual({ accepted: false, reason: 'error' });
+  expect(warnLines).toHaveLength(1);
+  expect(warnLines[0].scope).toBe('telemetry');
+  expect(warnLines[0].level).toBe('warn');
+  expect(warnLines[0].message).toBe('reportInstall failed');
+  expect(warnLines[0].meta.error).toContain('boom-profile');
+  client.shutdown();
+});
+
 // ─── disabled at ingress ───────────────────────────────────────────────
 
 test('when telemetry is disabled, ingress drops at the point of entry', async () => {
@@ -269,6 +289,55 @@ test('attribution fields are exempt from redaction/clamping and arrive byte-iden
   client.shutdown();
 });
 
+// ─── env discriminator (wire-level, all four channels) ─────────────────
+
+test('every channel carries env:"dev" when SM_DEV drives installChannel, and it survives the queue round-trip through flush', async () => {
+  const home = await mkHome();
+  const client = freshClient(home, { installChannel: 'dev' });
+  const fetchFn = fetchStub(async () => okResponse());
+  client._setFetchImpl(fetchFn);
+
+  await client.track('evt', { a: 1 });
+  await client.logLine({ level: 'info', msg: 'hi' });
+  await client.reportError({ name: 'E', msg: 'boom', stack: 'at x' });
+  await client.reportInstall(fakeProfile({ installChannel: 'dev' }));
+
+  // Present the instant it's appended to telemetry-queue.jsonl, before any flush.
+  const queued = await readQueueLines(client);
+  expect(queued).toHaveLength(4);
+  for (const rec of queued) expect(rec.wire.env).toBe('dev');
+
+  // Still present in the exact body flush() POSTs.
+  await client.flush('manual');
+  expect(fetchFn.calls.length).toBeGreaterThan(0);
+  for (const call of fetchFn.calls) {
+    const bodies = Array.isArray(call.body.batch) ? call.body.batch : [call.body];
+    for (const wire of bodies) expect(wire.env).toBe('dev');
+  }
+  client.shutdown();
+});
+
+test('every channel carries env:"prod" for a non-dev installChannel', async () => {
+  const home = await mkHome();
+  const client = freshClient(home, { installChannel: 'npx' });
+
+  await client.track('evt', { a: 1 });
+  await client.logLine({ level: 'info', msg: 'hi' });
+  await client.reportError({ name: 'E', msg: 'boom', stack: 'at x' });
+  await client.reportInstall(fakeProfile({ installChannel: 'npx' }));
+
+  const queued = await readQueueLines(client);
+  expect(queued).toHaveLength(4);
+  for (const rec of queued) expect(rec.wire.env).toBe('prod');
+  client.shutdown();
+});
+
+test('env resolves to "test" under a real test-runner environment, independent of installChannel', () => {
+  const machineProfile = require('../lib/machineProfile.cjs');
+  expect(machineProfile.resolveEnv({ isTestRunner: true, installChannel: 'dev' })).toBe('test');
+  expect(machineProfile.resolveEnv({ isTestRunner: true, installChannel: 'npx' })).toBe('test');
+});
+
 // ─── queue is the accumulator, survives restart ────────────────────────
 
 test('a record survives a simulated process restart and is still pending', async () => {
@@ -532,11 +601,11 @@ test('wire field names match server/routes/telemetry.ts exactly', async () => {
   const errorCall = fetchFn.calls.find((c) => c.url.endsWith('/error'));
   const installCall = fetchFn.calls.find((c) => c.url.endsWith('/install'));
 
-  expect(Object.keys(eventCall.body.batch[0]).sort()).toEqual(['app', 'name', 'props', 'session_id', 'visitor_id'].sort());
-  expect(Object.keys(logCall.body.batch[0]).sort()).toEqual(['app', 'version', 'level', 'msg', 'visitor_id', 'session_id', 'fields', 'ts'].sort());
-  expect(Object.keys(errorCall.body.batch[0]).sort()).toEqual(['app', 'version', 'name', 'msg', 'stack', 'url', 'ua', 'visitor_id', 'session_id', 'context', 'ts'].sort());
+  expect(Object.keys(eventCall.body.batch[0]).sort()).toEqual(['app', 'env', 'name', 'props', 'session_id', 'visitor_id'].sort());
+  expect(Object.keys(logCall.body.batch[0]).sort()).toEqual(['app', 'env', 'version', 'level', 'msg', 'visitor_id', 'session_id', 'fields', 'ts'].sort());
+  expect(Object.keys(errorCall.body.batch[0]).sort()).toEqual(['app', 'env', 'version', 'name', 'msg', 'stack', 'url', 'ua', 'visitor_id', 'session_id', 'context', 'ts'].sort());
   expect(Object.keys(installCall.body).sort()).toEqual([
-    'app', 'app_version', 'arch', 'cpu_count', 'electron_version',
+    'app', 'app_version', 'arch', 'cpu_count', 'electron_version', 'env',
     'install_channel', 'install_id', 'locale', 'node_version',
     'os_release', 'platform', 'timezone', 'total_mem_mb',
   ].sort());
@@ -854,7 +923,7 @@ test('reportInstall() maps buildMachineProfile()\'s camelCase onto the exact sna
 
   expect(rec.channel).toBe('install');
   expect(Object.keys(rec.wire).sort()).toEqual([
-    'app', 'app_version', 'arch', 'cpu_count', 'electron_version',
+    'app', 'app_version', 'arch', 'cpu_count', 'electron_version', 'env',
     'install_channel', 'install_id', 'locale', 'node_version',
     'os_release', 'platform', 'timezone', 'total_mem_mb',
   ].sort());
@@ -962,6 +1031,7 @@ test('a stub server bound to 127.0.0.1 receives exactly one well-formed install
       install_channel: profile.installChannel,
       locale: profile.locale,
       timezone: String(profile.timezoneOffsetMinutes),
+      env: 'dev',
     });
     client.shutdown();
   } finally {