claude-code-session-manager 0.86.0 → 0.88.0

package/src/main/__tests__/scheduler-job-budget.test.cjs

@@ -0,0 +1,172 @@
+/**
+ * scheduler-job-budget.test.cjs — per-job wall-clock budget derived from the
+ * PRD's own `estimateMinutes`, and the classifier that parks an over-budget
+ * job `needs_review` (never 'failed', never silently 'completed').
+ *
+ * Closes the gap `findOverrunningJobs` deliberately leaves open (escalation
+ * only, never kills — see its own header): p50/p90/max across 606 run-meta
+ * records since 2026-08-25 was 13m/60m/240m against a concurrencyCap of 4,
+ * so a chatty-but-runaway executor that keeps emitting output (never
+ * tripping IDLE_OUTPUT_KILL_MS) could hold a dispatch slot for hours with
+ * nothing to notice or act on it.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-job-budget.test.cjs
+ */
+
+'use strict';
+
+// vitest, NOT node:test — this repo's suite is vitest-only (CLAUDE.md).
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const {
+  computeJobBudgetMs,
+  classifyBudgetKill,
+  isJobBudgetExempt,
+  shouldKillForBudget,
+  resolveBudgetKillOutcome,
+  selectAutoFixTargets,
+  JOB_BUDGET_FACTOR,
+  JOB_BUDGET_FLOOR_MS,
+  JOB_BUDGET_CEILING_MS,
+} = require('../scheduler.cjs');
+
+// ---------- computeJobBudgetMs: both clamps ----------
+
+test('computeJobBudgetMs: a mid-size estimate is factor*estimate, no clamp hit', () => {
+  // 30m * 3 = 90m — comfortably between the 45m floor and the 180m ceiling.
+  const budgetMs = computeJobBudgetMs(30);
+  assert.strictEqual(budgetMs, 90 * 60_000);
+});
+
+test('computeJobBudgetMs: the floor clamp — a tiny/missing/zero estimate never goes below 45m', () => {
+  // 5m * 3 = 15m, well under the 45m floor.
+  assert.strictEqual(computeJobBudgetMs(5), JOB_BUDGET_FLOOR_MS);
+  // Missing/zero estimate is treated as 0 — the floor dominates, no special-casing.
+  assert.strictEqual(computeJobBudgetMs(0), JOB_BUDGET_FLOOR_MS);
+  assert.strictEqual(computeJobBudgetMs(null), JOB_BUDGET_FLOOR_MS);
+  assert.strictEqual(computeJobBudgetMs(undefined), JOB_BUDGET_FLOOR_MS);
+});
+
+test('computeJobBudgetMs: the ceiling clamp — a huge estimate never exceeds 180m', () => {
+  // 200m * 3 = 600m, way past the 180m ceiling.
+  assert.strictEqual(computeJobBudgetMs(200), JOB_BUDGET_CEILING_MS);
+});
+
+test('computeJobBudgetMs: honors caller overrides when neither clamp is hit', () => {
+  const budgetMs = computeJobBudgetMs(5, { factor: 2, floorMs: 1000, ceilingMs: 3_600_000 });
+  assert.strictEqual(budgetMs, 10 * 60_000);
+});
+
+test('JOB_BUDGET_FACTOR/FLOOR/CEILING are the named constants the AC requires (3x, 45m, 180m)', () => {
+  assert.strictEqual(JOB_BUDGET_FACTOR, 3);
+  assert.strictEqual(JOB_BUDGET_FLOOR_MS, 45 * 60_000);
+  assert.strictEqual(JOB_BUDGET_CEILING_MS, 180 * 60_000);
+});
+
+// ---------- shouldKillForBudget: under vs over budget ----------
+
+test('shouldKillForBudget: a job under budget is untouched', () => {
+  assert.strictEqual(shouldKillForBudget(44 * 60_000, 45 * 60_000), false);
+});
+
+test('shouldKillForBudget: a job at or past its budget fires', () => {
+  assert.strictEqual(shouldKillForBudget(45 * 60_000, 45 * 60_000), true);
+  assert.strictEqual(shouldKillForBudget(241 * 60_000, 90 * 60_000), true);
+});
+
+// ---------- classifyBudgetKill: the needs_review park + evidence threading ----------
+
+test('classifyBudgetKill: a job not killed by the budget watchdog is untouched (returns null)', () => {
+  assert.strictEqual(classifyBudgetKill({ killedByWatchdog: 'idle-tail', exitCode: 143 }, null), null);
+  assert.strictEqual(classifyBudgetKill({ killedByWatchdog: null, exitCode: 0 }, null), null);
+  assert.strictEqual(classifyBudgetKill(null, null), null);
+});
+
+test('classifyBudgetKill: an over-budget job parks needs_review with the exact reason string, no evidence', () => {
+  const res = {
+    killedByWatchdog: 'budget',
+    exitCode: 143,
+    budgetKillReason: 'wall-clock budget exceeded: ran 241m against a 90m budget (estimateMinutes=30)',
+  };
+  const decision = classifyBudgetKill(res, null);
+  assert.strictEqual(decision.status, 'needs_review');
+  assert.strictEqual(decision.reason, 'wall-clock budget exceeded: ran 241m against a 90m budget (estimateMinutes=30)');
+  assert.strictEqual(decision.landedCommit, null);
+});
+
+test('classifyBudgetKill: an over-budget job with a verified landed commit is still adjudicated on git evidence, not discarded', () => {
+  const res = {
+    killedByWatchdog: 'budget',
+    exitCode: 143,
+    budgetKillReason: 'wall-clock budget exceeded: ran 91m against a 90m budget (estimateMinutes=30)',
+  };
+  const decision = classifyBudgetKill(res, 'deadbeef1234567890');
+  // Never 'failed' or 'completed' just because a commit landed — still parked
+  // for review, but the evidence is threaded onto the row rather than dropped.
+  assert.strictEqual(decision.status, 'needs_review');
+  assert.strictEqual(decision.landedCommit, 'deadbeef1234567890');
+});
+
+// ---------- isJobBudgetExempt: quietMachine + explicit opt-out ----------
+
+test('isJobBudgetExempt: a quietMachine job is exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({ quietMachine: true }), true);
+});
+
+test('isJobBudgetExempt: a PRD with an explicit budgetExempt opt-out is exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({ budgetExempt: true }), true);
+});
+
+test('isJobBudgetExempt: an ordinary job is not exempt', () => {
+  assert.strictEqual(isJobBudgetExempt({}), false);
+  assert.strictEqual(isJobBudgetExempt({ quietMachine: false, budgetExempt: false }), false);
+});
+
+// ---------- resolveBudgetKillOutcome: the watchdog-tick vs natural-exit race ----------
+
+test('resolveBudgetKillOutcome: a genuine signal kill (exit 143) is trusted', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: true, durationMs: 91 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, 'budget');
+  assert.strictEqual(outcome.budgetKillReason, 'wall-clock budget exceeded: ran 91m against a 90m budget (estimateMinutes=30)');
+});
+
+test('resolveBudgetKillOutcome: a race where the child exits cleanly (exit 0) in the same tick is NOT trusted as a budget kill', () => {
+  // The watchdog's action() fired (stamping ctx.killedByWatchdog='budget')
+  // but the agent had already exited on its own with exit 0 — killTree()
+  // was a no-op against an already-dead pid. Must never misclassify a
+  // genuinely successful run as needs_review.
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: false, durationMs: 90 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, null);
+  assert.strictEqual(outcome.budgetKillReason, null);
+});
+
+test('resolveBudgetKillOutcome: a race where the child fails on its own (exit 1, unrelated) is NOT trusted as a budget kill', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'budget', killedBySignal: false, durationMs: 90 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, null);
+});
+
+test('resolveBudgetKillOutcome: no watchdog fired at all — untouched', () => {
+  const outcome = resolveBudgetKillOutcome({
+    killedByWatchdog: 'idle-tail', killedBySignal: true, durationMs: 25 * 60_000, jobBudgetMs: 90 * 60_000, estimateMinutes: 30,
+  });
+  assert.strictEqual(outcome.killedByWatchdog, 'idle-tail');
+  assert.strictEqual(outcome.budgetKillReason, null);
+});
+
+// ---------- selectAutoFixTargets: a budget-killed job never gets auto-retried ----------
+
+test('selectAutoFixTargets: a budget_exceeded needs_review job is excluded — it parks for a human/ladder decision, never a fix-plan', () => {
+  const jobs = [
+    { slug: '10-budget-victim', status: 'needs_review', verifierVerdict: 'budget_exceeded', runId: 'r1' },
+    { slug: '11-ordinary', status: 'needs_review', verifierVerdict: 'transcript_errors', runId: 'r2' },
+  ];
+  const targets = selectAutoFixTargets(jobs, { fixSlugExists: () => false });
+  assert.ok(!targets.some((t) => t.slug === '10-budget-victim'));
+  assert.ok(targets.some((t) => t.slug === '11-ordinary'));
+});

package/src/main/__tests__/scheduler-launch-failure.test.cjs

@@ -20,6 +20,7 @@ import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
 
 let tmpHome;
 let originalHome;
@@ -50,8 +51,7 @@ afterEach(() => {
 const THINKING_400 = 'API Error: 400 {"detail":{"error":"{\\"message\\":\\"\\\\\\"thinking.type.enabled\\\\\\" is not supported for this model. Use \\\\\\"thinking.type.adaptive\\\\\\" and \\\\\\"output_config.effort\\\\\\" to control thinking behavior.\\"}"}}';
 
 function writeStub({ mode }) {
-  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-launch-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
-  const body = `
+  return claudeStub.writeClaudeStub({ body: `
     const fs = require('fs');
     const path = require('path');
     fs.writeFileSync(path.join(process.cwd(), 'env.marker'), JSON.stringify({
@@ -67,9 +67,7 @@ function writeStub({ mode }) {
     }
     process.stdout.write(JSON.stringify({ type: 'result', subtype: 'error', is_error: true, num_turns: 9, usage: { input_tokens: 100, output_tokens: 250 }, result: 'Error: tests failed' }) + '\\n');
     process.exit(1);
-  `;
-  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\n`, { mode: 0o755 });
-  return stubPath;
+  ` });
 }
 
 function mkProject() {

package/src/main/__tests__/scheduler-looks-done.test.cjs

@@ -33,8 +33,8 @@ const { execFileSync } = require('node:child_process');
 const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'looks-done-test-'));
 process.env.HOME = tmpHome;
 
-const { reverifyNeedsReview, computeLooksDone, findSatisfyingCommitOnMain } = require('../scheduler.cjs');
-const { resolvePrdWriteDir } = require('../lib/prdLocations.cjs');
+const { reverifyNeedsReview, computeLooksDone, applyNeedsReviewAutoResolve, findSatisfyingCommitOnMain } = require('../scheduler.cjs');
+const { resolveEpicPrdWriteDir } = require('../lib/prdLocations.cjs');
 const { bustCwdCache } = require('../lib/queueStore.cjs');
 
 function git(args, cwd) {
@@ -92,13 +92,32 @@ function writeRunLog(runId, slug, lines) {
   fs.writeFileSync(path.join(runDir, `${slug}.log`), lines.join('\n') + '\n');
 }
 
+// Epic-scoped, not the legacy flat prds/ dir: the flat dir is retired and
+// swept into prds-archived/ by consolidateFlatPrds the moment a job is no
+// longer live (pending/running/needs_review/investigating), which would
+// strand a row that starts 'failed' before reverifyNeedsReview ever gets a
+// chance to decide anything about it.
 function writePrd(cwd, slug, body) {
-  const dir = resolvePrdWriteDir(cwd);
+  const dir = resolveEpicPrdWriteDir(cwd, 'test-fixture-epic');
   fs.mkdirSync(dir, { recursive: true });
   const text = `---\ntitle: Test PRD\ncwd: ${cwd}\nestimateMinutes: 30\n---\n${body}\n`;
   fs.writeFileSync(path.join(dir, `${slug}.md`), text);
 }
 
+// A job reverifyNeedsReview() heals to 'completed' has its PRD archived
+// immediately (archiveCompletedPrd) and its row backfilled to history.jsonl
+// + dropped from queue.json on the very same reconcile pass — see
+// scheduler-reconcile-history-backfill.test.cjs. Look in both places.
+function readTerminalRow(queuePath, projectCwd, slug) {
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  if (row) return row;
+  const historyPath = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'state', 'history.jsonl');
+  if (!fs.existsSync(historyPath)) return undefined;
+  const lines = fs.readFileSync(historyPath, 'utf8').trim().split('\n').filter(Boolean);
+  return lines.map((l) => JSON.parse(l)).reverse().find((j) => j.slug === slug);
+}
+
 async function wait(ms) {
   await new Promise((r) => setTimeout(r, ms));
 }
@@ -127,7 +146,10 @@ test('failed + no result event (unverified-shaped) + later commit touching decla
   writeRunLog('run-171', '171-example', ['[scheduler] starting 171-example']); // no result event
 
   await wait(1100); // git --since has 1s resolution
-  commitFile(projectCwd, 'src/foo.js', 'hello', 'fix 171');
+  // Must name this job's own slug to be attributable (see
+  // attributeLandedCommits's 'slug trailer' rule) — path overlap alone is no
+  // longer evidence.
+  commitFile(projectCwd, 'src/foo.js', 'hello', 'fix 171-example');
 
   await reverifyNeedsReview();
 
@@ -136,8 +158,9 @@ test('failed + no result event (unverified-shaped) + later commit touching decla
   assert.equal(jobs[0].status, 'needs_review', 'looksDone never auto-completes — only surfaces for a human');
   assert.ok(jobs[0].looksDone, 'expected a looksDone annotation');
   assert.equal(jobs[0].looksDone.commits.length, 1);
+  assert.equal(jobs[0].looksDone.rule, 'slug trailer');
   assert.deepEqual(jobs[0].looksDone.paths, ['src/foo.js']);
-  assert.match(jobs[0].error, /looks done — 1 commit/);
+  assert.match(jobs[0].error, /looks done \(slug trailer\) — 1 commit/);
 });
 
 test('failed + a real result event (genuine gate failure) → not a candidate, stays failed untouched', async () => {
@@ -216,11 +239,11 @@ test('needs_review with an in-window commit heals exactly as today (regression
 
   await reverifyNeedsReview();
 
-  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
-  assert.equal(jobs.length, 1);
-  assert.equal(jobs[0].status, 'completed', 'a clean re-verify on a RESCANNABLE verdict must still heal');
-  assert.equal(jobs[0].verifierVerdict, undefined);
-  assert.equal(jobs[0].error, null);
+  const row = readTerminalRow(queuePath, projectCwd, '20-clean-feature');
+  assert.ok(row, 'healed job must be found in queue.json or (once archived+backfilled) history.jsonl');
+  assert.equal(row.status, 'completed', 'a clean re-verify on a RESCANNABLE verdict must still heal');
+  assert.equal(row.verifierVerdict, undefined);
+  assert.equal(row.error, null);
 });
 
 test('computeLooksDone: no declared paths on the PRD → null, never fabricates evidence', async () => {
@@ -379,3 +402,89 @@ test('computeLooksDone: non-git cwd → null without throwing (git-unavailable)'
   const looksDone = await computeLooksDone(job);
   assert.equal(looksDone, null);
 });
+
+// --- Attribution regression (PRD 1204/1205 incident, 2026-09-13) ---
+//
+// Two PRDs in the SAME Epic declaring the same hot file: sibling job B lands
+// a commit on that path while job A is parked in needs_review. Path overlap
+// alone must never read as job A's own evidence — that's exactly how 1204's
+// row cited 1205's commit 5dadf3c as "looks done" while 1204's real
+// implementing commit (164184e) sat unnoticed.
+
+test('sibling PRD commit on the same declared path is not attributable — computeLooksDone returns null, applyNeedsReviewAutoResolve never promotes to completed', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-1204-sibling-incident');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-1204-sibling-incident-slug');
+  writePrd(projectCwd, '1204-job-a', [
+    '# Implementation notes',
+    'Edit `src/main/scheduler.cjs`.',
+  ].join('\n'));
+
+  const startedAt = new Date().toISOString();
+  await wait(1100);
+  // Sibling job B's commit: touches job A's declared path, but names neither
+  // job A's slug nor any `sm-job/1204-job-a` branch, and job A's row carries
+  // no landedCommit of its own.
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'sibling change', 'feat(scheduler): restructure the backlog into Epic groups (1205-job-b)');
+
+  const jobA = {
+    slug: '1204-job-a',
+    cwd: projectCwd,
+    status: 'needs_review',
+    startedAt,
+    autoFixAttempted: true,
+    autoFixOutcome: 'no-plan',
+    autoFixRetries: 1,
+    exhaustedResolveAttempts: 0,
+    statusHistory: [{ to: 'needs_review', at: new Date(Date.now() - 45 * 60_000).toISOString() }],
+  };
+
+  const looksDone = await computeLooksDone(jobA);
+  assert.equal(looksDone, null, 'a sibling\'s path-overlapping commit must never be credited as job A\'s own evidence');
+
+  const outcome = applyNeedsReviewAutoResolve(jobA);
+  assert.equal(outcome, 'requeued', 'with no attributable evidence, the row must fall through to the existing requeue path, never complete');
+  assert.equal(jobA.status, 'pending');
+});
+
+test('this job\'s OWN attributable commit (landedCommit) still produces looksDone and still promotes to completed', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-1204-own-commit');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-1204-own-commit-slug');
+  writePrd(projectCwd, '1204-job-a2', [
+    '# Implementation notes',
+    'Edit `src/main/scheduler.cjs`.',
+  ].join('\n'));
+
+  const startedAt = new Date().toISOString();
+  await wait(1100);
+  // A sibling commit lands on the same path first...
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'sibling change', 'feat(scheduler): unrelated sibling work');
+  // ...then this job's OWN commit lands, exactly as spawnJob's finalize step
+  // would have recorded it on job.landedCommit.
+  commitFile(projectCwd, 'src/main/scheduler.cjs', 'this job\'s own change', 'fix(scheduler): attribution fix');
+  const ownSha = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const jobA = {
+    slug: '1204-job-a2',
+    cwd: projectCwd,
+    status: 'needs_review',
+    startedAt,
+    landedCommit: ownSha,
+    autoFixAttempted: true,
+    autoFixOutcome: 'no-plan',
+    autoFixRetries: 1,
+    exhaustedResolveAttempts: 0,
+    statusHistory: [{ to: 'needs_review', at: new Date(Date.now() - 45 * 60_000).toISOString() }],
+  };
+
+  const looksDone = await computeLooksDone(jobA);
+  assert.ok(looksDone, 'this job\'s own landedCommit must be recognized as attributable evidence');
+  assert.equal(looksDone.rule, 'landedCommit');
+  assert.deepEqual(looksDone.commits, [ownSha], 'only this job\'s own commit is evidence — never the sibling\'s');
+
+  jobA.looksDone = looksDone;
+  const outcome = applyNeedsReviewAutoResolve(jobA);
+  assert.equal(outcome, 'completed', 'strong, attributable evidence must still promote the row');
+  assert.equal(jobA.status, 'completed');
+});

package/src/main/__tests__/scheduler-manual-pause.test.cjs

@@ -0,0 +1,118 @@
+/**
+ * scheduler-manual-pause.test.cjs — user-initiated pause (schedule:pause /
+ * POST /admin/scheduler/pause). A 'manual' pause stops NEW dispatch, never
+ * kills running jobs, survives restart, and is cleared only by an explicit
+ * Resume / Run now — never by the rate-limit reset timer or network recovery.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-manual-pause.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+let tmpHome;
+let originalHome;
+let scheduler;
+let queueStore;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-manual-pause-'));
+  process.env.HOME = tmpHome;
+  process.env.SM_JOB_WORKTREE_DISABLE = '1';
+  scheduler = require('../scheduler.cjs');
+  queueStore = require('../lib/queueStore.cjs');
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  delete process.env.SM_JOB_WORKTREE_DISABLE;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+beforeEach(async () => {
+  await scheduler.clearPause('manual');
+});
+
+test('pause engages reason "manual" with no resumeAt, even inside the manual-override cooldown', async () => {
+  await scheduler.clearPause('manual'); // starts the 5-minute cooldown
+  await scheduler.setPaused('manual', null);
+  const state = await queueStore.readMerged();
+  expect(state.paused).toBeTruthy();
+  expect(state.paused.reason).toBe('manual');
+  expect(state.paused.resumeAt).toBeNull();
+});
+
+test('a manual pause never arms a resume time, even if a resumeAt is supplied', async () => {
+  await scheduler.setPaused('manual', new Date(Date.now() + 3_600_000).toISOString());
+  const state = await queueStore.readMerged();
+  expect(state.paused.resumeAt).toBeNull();
+});
+
+test('pause blocks tickQueue dispatch', async () => {
+  await scheduler.setPaused('manual', null);
+  const result = await scheduler.tickQueue();
+  expect(result.fired).toBe(false);
+  expect(result.reason).toBe('paused');
+});
+
+test('an auto rate_limit / network / auth pause cannot displace a manual pause', async () => {
+  await scheduler.setPaused('manual', null);
+  await scheduler.setPaused('rate_limit', new Date(Date.now() + 3_600_000).toISOString());
+  await scheduler.setPaused('network', null);
+  await scheduler.setPaused('auth', null);
+  const state = await queueStore.readMerged();
+  expect(state.paused.reason).toBe('manual');
+  expect(state.paused.resumeAt).toBeNull();
+});
+
+test('poll recovery and the resume-time computation never clear/arm a manual pause', () => {
+  expect(scheduler.pollRecoveryClearSource('manual', true)).toBeNull();
+  expect(scheduler.pollRecoveryClearSource('manual', false)).toBeNull();
+  expect(scheduler.computeEffectiveResumeAt('manual', null)).toBeNull();
+});
+
+test('a running job survives a pause untouched', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(tmpHome, 'pause-survivor-'));
+  const slugDir = path.join(tmpHome, '.claude', 'projects', 'pause-survivor-slug');
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd: projectCwd }) + '\n');
+  queueStore.bustCwdCache();
+  const stateDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'state');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({
+    jobs: [{ slug: 'pause-survivor', status: 'running', cwd: projectCwd, pid: process.pid, runId: 'r1', startedAt: new Date().toISOString() }],
+  }));
+  await scheduler.setPaused('manual', null);
+  const state = await queueStore.readMerged();
+  const row = state.jobs.find((j) => j.slug === 'pause-survivor');
+  expect(row.status).toBe('running');
+  expect(row.runId).toBe('r1');
+});
+
+test('a manual pause survives restart (re-read from disk; boot never clears it)', async () => {
+  await scheduler.setPaused('manual', null);
+  const onDisk = await queueStore.readMerged(); // what a fresh process reads at boot
+  expect(onDisk.paused.reason).toBe('manual');
+  // Boot only clears a pause whose resumeAt has elapsed / re-arms one with a
+  // resumeAt; a manual pause has none, so neither branch applies.
+  expect(onDisk.paused.resumeAt).toBeNull();
+});
+
+test('resume clears a manual pause', async () => {
+  await scheduler.setPaused('manual', null);
+  await scheduler.clearPause('manual');
+  const state = await queueStore.readMerged();
+  expect(state.paused).toBeNull();
+});
+
+test('remote.pause / remote.resume are the admin-route twins of the IPC handlers', async () => {
+  expect(await scheduler.remote.pause()).toEqual({ ok: true });
+  expect((await queueStore.readMerged()).paused.reason).toBe('manual');
+  expect(await scheduler.remote.resume()).toEqual({ ok: true });
+  expect((await queueStore.readMerged()).paused).toBeNull();
+});

package/src/main/__tests__/scheduler-meta-code-sha.test.cjs

@@ -5,19 +5,42 @@
  * scheduler process is otherwise invisible in the run record, which cost a
  * full investigation to diagnose a false pass_no_commit.
  *
+ * SCHEDULER_CODE_SHA now resolves through src/main/lib/buildIdentity.cjs
+ * (build-identity-stamp PRD): a production npx install ships no .git, so a
+ * runtime `git rev-parse` was structurally always null there — this file
+ * used to accept that null unconditionally, which made the dead stamp green
+ * forever. With src/main/build-info.json present (ensured below — the exact
+ * artifact scripts/write-build-info.cjs bakes at publish time), the sha must
+ * be real.
+ *
  * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-meta-code-sha.test.cjs
  */
 
 'use strict';
 
-import { test, expect } from 'vitest';
+import { test, expect, afterAll } from 'vitest';
+const fs = require('node:fs');
+const path = require('node:path');
+
+const BUILD_INFO_PATH = path.join(__dirname, '..', 'build-info.json');
+const preexistingBuildInfo = fs.existsSync(BUILD_INFO_PATH) ? fs.readFileSync(BUILD_INFO_PATH, 'utf8') : null;
+if (preexistingBuildInfo === null) {
+  // eslint-disable-next-line global-require
+  require('../../../scripts/write-build-info.cjs').writeBuildInfo();
+}
+
 const { SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA } = require('../scheduler.cjs');
 
+afterAll(() => {
+  if (preexistingBuildInfo === null) fs.rmSync(BUILD_INFO_PATH, { force: true });
+  else fs.writeFileSync(BUILD_INFO_PATH, preexistingBuildInfo);
+});
+
 test('SCHEDULER_BOOTED_AT is a valid ISO date string', () => {
   expect(typeof SCHEDULER_BOOTED_AT).toBe('string');
   expect(Number.isNaN(new Date(SCHEDULER_BOOTED_AT).getTime())).toBe(false);
 });
 
-test('SCHEDULER_CODE_SHA is null or a short git hex SHA', () => {
-  expect(SCHEDULER_CODE_SHA === null || /^[0-9a-f]{7,40}$/.test(SCHEDULER_CODE_SHA)).toBe(true);
+test('SCHEDULER_CODE_SHA is a real short git hex SHA when build-info.json is present — never null', () => {
+  expect(SCHEDULER_CODE_SHA).toMatch(/^[0-9a-f]{7,40}$/);
 });