claude-code-session-manager 0.86.0 → 0.88.0

package/src/main/__tests__/scheduler-porcelain-rename.test.cjs

@@ -0,0 +1,164 @@
+/**
+ * scheduler-porcelain-rename.test.cjs — PRD 1187/1186-follow-on: a staged
+ * rename ("R  old -> new") was parsed by `parsePorcelainEntries` as ONE fused
+ * path string `"old -> new"`. That string can never match a real path in
+ * `dirtyAfter`, `pathsCommittedDuringRun`, or an `fs.existsSync` check, so
+ * every staged rename in a shared-tree-guard baseline was structurally
+ * guaranteed to be reported reverted — even when it was cleanly committed
+ * during the run. On 2026-09-12 this flagged 45 paths and parked a clean,
+ * committed run (job `1187-autoresolve-guard-verdict-parks`):
+ *
+ *   "job discarded pre-existing state in the shared tree: 45 path(s)
+ *   reverted with no commit to explain it
+ *   (scripts/__tests__/manual-chapter-links.test.cjs ->
+ *   web/manual/__tests__/chapter-links.test.cjs, ...)" — exit 0, landedCommit
+ *   recorded, nothing actually lost.
+ *
+ * Every test below is written to FAIL against the pre-fix implementation
+ * (`path: l.slice(3)`, no rename/quote parsing at all).
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-porcelain-rename.test.cjs
+ */
+
+'use strict';
+
+import { test, expect } from 'vitest';
+const scheduler = require('../scheduler.cjs');
+const { parsePorcelainEntries, evaluateSharedTreeGuard } = scheduler;
+
+// --- parsePorcelainEntries: rename/copy lines split into real components ---
+
+test('parsePorcelainEntries: a plain staged rename splits into new path + oldPath, not one fused string', () => {
+  const entries = parsePorcelainEntries('R  old.txt -> new.txt\n');
+  expect(entries).toEqual([{ code: 'R ', path: 'new.txt', oldPath: 'old.txt' }]);
+});
+
+test('parsePorcelainEntries: a rename-with-worktree-modification (RM) line still splits correctly', () => {
+  const entries = parsePorcelainEntries('RM old.txt -> new.txt\n');
+  expect(entries).toEqual([{ code: 'RM', path: 'new.txt', oldPath: 'old.txt' }]);
+});
+
+test('parsePorcelainEntries: a copy line (C) splits the same way as a rename', () => {
+  const entries = parsePorcelainEntries('C  old.txt -> copy.txt\n');
+  expect(entries).toEqual([{ code: 'C ', path: 'copy.txt', oldPath: 'old.txt' }]);
+});
+
+test('parsePorcelainEntries: a NEW path containing a space is quoted by git and must be unquoted', () => {
+  // Real `git status --porcelain` output for `git mv new.txt "renamed with space.txt"`.
+  const entries = parsePorcelainEntries('R  new.txt -> "renamed with space.txt"\n');
+  expect(entries).toEqual([{ code: 'R ', path: 'renamed with space.txt', oldPath: 'new.txt' }]);
+});
+
+test('parsePorcelainEntries: an OLD path containing a space is quoted independently of the new path', () => {
+  const entries = parsePorcelainEntries('R  "old with space.txt" -> new.txt\n');
+  expect(entries).toEqual([{ code: 'R ', path: 'new.txt', oldPath: 'old with space.txt' }]);
+});
+
+test('parsePorcelainEntries: a non-ASCII path is quoted with per-byte octal escapes and must decode back to UTF-8', () => {
+  // Real recorded `git status --porcelain` output for a rename onto
+  // "résumé file.txt" — git's default core.quotepath escapes each raw UTF-8
+  // byte >= 0x80 as \NNN octal: 'é' is UTF-8 bytes 0xC3 0xA9 -> \303\251.
+  const line = 'R  new.txt -> "r\\303\\251sum\\303\\251 file.txt"\n';
+  const entries = parsePorcelainEntries(line);
+  expect(entries).toEqual([{ code: 'R ', path: 'résumé file.txt', oldPath: 'new.txt' }]);
+});
+
+test('parsePorcelainEntries: non-rename entries are unaffected (no oldPath, path as before)', () => {
+  const entries = parsePorcelainEntries(' M src/foo.js\n?? untracked.txt\n');
+  expect(entries).toEqual([
+    { code: ' M', path: 'src/foo.js' },
+    { code: '??', path: 'untracked.txt' },
+  ]);
+});
+
+test('parsePorcelainEntries: a quoted plain (non-rename) path is also unquoted, not left with literal quotes', () => {
+  const entries = parsePorcelainEntries('?? "plain space.txt"\n');
+  expect(entries).toEqual([{ code: '??', path: 'plain space.txt' }]);
+});
+
+// --- The exact 1187 shape: committed rename must not be flagged reverted ---
+
+test('evaluateSharedTreeGuard: a staged rename that is committed during the run is NOT reported reverted (real 1187 case)', () => {
+  const oldPath = 'scripts/__tests__/manual-chapter-links.test.cjs';
+  const newPath = 'web/manual/__tests__/chapter-links.test.cjs';
+  const dirtyBefore = parsePorcelainEntries(`R  ${oldPath} -> ${newPath}\n`);
+  // git diff --name-only <headBefore>..<headAfter> reports only the NEW path
+  // for a committed rename (verified against real git 2.43 behavior).
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [], // fully committed, nothing left dirty
+    pathsCommittedDuringRun: [newPath],
+  });
+  expect(result.reverted).toEqual([]);
+});
+
+test('evaluateSharedTreeGuard: a batch of committed renames (the real 45-path shape) are all cleared, none reverted', () => {
+  const pairs = [
+    ['scripts/__tests__/manual-chapter-links.test.cjs', 'web/manual/__tests__/chapter-links.test.cjs'],
+    ['scripts/foo-old.js', 'src/foo-new.js'],
+    ['docs/old-name.md', 'docs/new-name.md'],
+  ];
+  const porcelain = pairs.map(([o, n]) => `R  ${o} -> ${n}`).join('\n') + '\n';
+  const dirtyBefore = parsePorcelainEntries(porcelain);
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [],
+    pathsCommittedDuringRun: pairs.map(([, n]) => n),
+  });
+  expect(result.reverted).toEqual([]);
+});
+
+// --- The guard's real purpose survives: an UNDONE rename still parks ---
+
+test('evaluateSharedTreeGuard: a staged rename that is UNDONE (old path restored, new path gone, nothing committed) IS still reported reverted', () => {
+  // This test must FAIL if the fix is implemented as "blanket skip rename
+  // entries" (dropping every rename-coded entry from consideration would
+  // make `reverted` come back empty here, exactly like the committed case
+  // above — but here nothing was committed to explain the disappearance).
+  const dirtyBefore = parsePorcelainEntries('R  old.txt -> new.txt\n');
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [], // clean again — reverted to HEAD, old.txt restored, new.txt gone
+    pathsCommittedDuringRun: [], // nothing committed
+  });
+  expect(result.reverted).toEqual(['new.txt']);
+});
+
+// --- The two already-fixed false-positive classes stay fixed (pinned here
+// too, using parsePorcelainEntries as the real entry point rather than
+// hand-built fixtures, so a future change to the parser can't silently
+// regress them without failing a test right next to the rename fix). ---
+
+test('evaluateSharedTreeGuard: nowIgnored still works for a real parsePorcelainEntries untracked baseline entry', () => {
+  const dirtyBefore = parsePorcelainEntries('?? session-manager-operations/logs/errors-2026-09-12.jsonl\n');
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [],
+    pathsCommittedDuringRun: ['.gitignore'],
+    existsAfter: ['session-manager-operations/logs/errors-2026-09-12.jsonl'],
+  });
+  expect(result.reverted).toEqual([]);
+  expect(result.nowIgnored).toEqual(['session-manager-operations/logs/errors-2026-09-12.jsonl']);
+});
+
+test('evaluateSharedTreeGuard: a genuine deletion of an untracked path (from a real parsePorcelainEntries entry) is still reverted', () => {
+  const dirtyBefore = parsePorcelainEntries('?? data/scratch.txt\n');
+  const result = evaluateSharedTreeGuard({
+    stashBefore: [],
+    stashAfter: [],
+    dirtyBefore,
+    dirtyAfter: [],
+    pathsCommittedDuringRun: [],
+    existsAfter: [],
+  });
+  expect(result.reverted).toEqual(['data/scratch.txt']);
+  expect(result.nowIgnored).toEqual([]);
+});

package/src/main/__tests__/scheduler-prd-missing-skip.test.cjs

@@ -103,6 +103,22 @@ function writeProjectQueue(cwd, jobs) {
   return path.join(stateDir, 'queue.json');
 }
 
+// This test's whole premise is a PRD source missing EVERYWHERE — so the row
+// this produces is exactly what reconcile()'s auto-archive-drop path treats
+// as "archived on purpose": backfilled to history.jsonl and dropped from
+// queue.json in the very same reconcile pass that spawnJob's own
+// broadcast({flush:true}) triggers on completion (see
+// scheduler-reconcile-history-backfill.test.cjs). Look in both places.
+function readTerminalRow(queuePath, projectCwd, slug) {
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  if (row) return row;
+  const historyPath = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'state', 'history.jsonl');
+  if (!fs.existsSync(historyPath)) return undefined;
+  const lines = fs.readFileSync(historyPath, 'utf8').trim().split('\n').filter(Boolean);
+  return lines.map((l) => JSON.parse(l)).reverse().find((j) => j.slug === slug);
+}
+
 // This is the actual regression case: PRD 812's fix only covered executeJob's
 // own return value. The bug lived one layer up, in spawnJob's post-run
 // handler, which only short-circuited on skipped === 'prd-archived' and let
@@ -123,8 +139,7 @@ test("spawnJob's post-run handler retires a prd-missing skip as a plain completi
     const job = { slug, cwd: projectCwd };
     await spawnJob(job, 'run-spawnjob-missing', runDir, projectCwd);
 
-    const state = JSON.parse(fs.readFileSync(queuePath, 'utf8'));
-    const row = state.jobs.find((j) => j.slug === slug);
+    const row = readTerminalRow(queuePath, projectCwd, slug);
     expect(row).toBeDefined();
     // A 'prd-missing' skip means no executor ever ran — it must land on the
     // distinct 'skipped' status, never 'completed' (the status a genuine

package/src/main/__tests__/scheduler-prd-persona-spawn.test.cjs

@@ -17,6 +17,7 @@ import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
 
 let tmpHome;
 let originalHome;
@@ -66,16 +67,13 @@ test('buildClaudeSpawnArgs: model is never omitted even without a systemPrompt',
 // stream-json success result and exits 0 — same technique as
 // scheduler-bash-timeout-env.test.cjs's env-var proof, applied to argv.
 function writeClaudeStub() {
-  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-argv-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
-  const body = `
+  return claudeStub.writeClaudeStub({ body: `
     const fs = require('fs');
     const path = require('path');
     fs.writeFileSync(path.join(process.cwd(), 'argv.marker'), JSON.stringify(process.argv.slice(2)), 'utf8');
     process.stdout.write(JSON.stringify({ type: 'result', subtype: 'success', result: 'ok' }) + '\\n');
     process.exit(0);
-  `;
-  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\n`, { mode: 0o755 });
-  return stubPath;
+  ` });
 }
 
 function writePersona(dir, name, frontmatterLines, bodyText) {

package/src/main/__tests__/scheduler-quiet-machine-lease.test.cjs

@@ -19,6 +19,7 @@ import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
 const { execFileSync } = require('node:child_process');
 
 let tmpHome;
@@ -52,10 +53,41 @@ function registerActiveProject(cwd) {
   fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
 }
 
+// Every real scheduler row is born from a real PRD .md file — reconcile()'s
+// auto-archive-drop path (a terminal job whose slug has no on-disk PRD
+// anywhere is treated as "archived on purpose": dropped from queue.json and
+// backfilled to history.jsonl, see scheduler-reconcile-history-backfill.
+// test.cjs) fires the moment a completion path reconciles with
+// broadcast({flush:true}). Without a matching PRD source, a row this test
+// drives to a terminal status vanishes from queue.json before the assertions
+// below ever read it back. Epic-scoped (not the legacy flat prds/ dir) so
+// it's never swept by consolidateFlatPrds either.
+// Some tests author their own real PRD (e.g. with `quietMachine: true`
+// frontmatter) before calling writeProjectQueue — never shadow that with a
+// blank fixture, which would silently overwrite its parsed frontmatter on
+// the next reconcile() refresh (onDisk.set(slug, ...) keeps whichever file a
+// later scan pass parses).
+function prdAlreadyExists(cwd, slug) {
+  const flatPath = path.join(cwd, 'session-manager-operations', 'scheduler', 'prds', `${slug}.md`);
+  if (fs.existsSync(flatPath)) return true;
+  const epicsRoot = path.join(cwd, 'session-manager-operations', 'scheduler', 'epics');
+  if (!fs.existsSync(epicsRoot)) return false;
+  return fs.readdirSync(epicsRoot).some((epicId) => fs.existsSync(path.join(epicsRoot, epicId, 'prds', `${slug}.md`)));
+}
+
+function writeFixturePrd(cwd, slug) {
+  const prdsDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'epics', 'test-fixture-epic', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), 'Test fixture PRD.', 'utf8');
+}
+
 function writeProjectQueue(cwd, jobs) {
   const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
   fs.mkdirSync(stateDir, { recursive: true });
   fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({ jobs }, null, 2));
+  for (const job of jobs) {
+    if (job && job.slug && !prdAlreadyExists(job.cwd || cwd, job.slug)) writeFixturePrd(job.cwd || cwd, job.slug);
+  }
   return path.join(stateDir, 'queue.json');
 }
 
@@ -66,15 +98,12 @@ function writeProjectQueue(cwd, jobs) {
 // as a genuine kill-with-partial-work, not an auto-retryable transient blip
 // with no evidence of real execution.
 function writeKilledClaudeStub() {
-  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-quiet-killed-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
-  const body = `
+  return claudeStub.writeClaudeStub({ body: `
     const fs = require('fs');
     const path = require('path');
     fs.writeFileSync(path.join(process.cwd(), 'job-output.txt'), 'work in progress when killed\\n', 'utf8');
     process.exit(137);
-  `;
-  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\n`, { mode: 0o755 });
-  return stubPath;
+  ` });
 }
 
 let reapDeadRunningJobs;
@@ -109,7 +138,13 @@ test('a killed quietMachine job releases the exclusive lease, and an ordinary jo
 
   const quietSlug = `1107-test-quiet-killed-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
   const ordinarySlug = `1107-test-ordinary-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
-  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'prds');
+  // Epic-scoped, not the legacy flat prds/ dir: the flat dir is retired and
+  // swept into prds-archived/ by consolidateFlatPrds the moment a job is no
+  // longer pending/running, which would silently strip this PRD's
+  // `quietMachine: true` frontmatter from the row on the very next
+  // reconcile() refresh (or drop the row entirely once terminal — see
+  // scheduler-reconcile-history-backfill.test.cjs).
+  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'epics', 'test-fixture-epic', 'prds');
   fs.mkdirSync(prdsDir, { recursive: true });
   fs.writeFileSync(path.join(prdsDir, `${quietSlug}.md`), '---\nquietMachine: true\n---\nMeasure timing without contention, then get killed.', 'utf8');
   fs.writeFileSync(path.join(prdsDir, `${ordinarySlug}.md`), 'An ordinary PRD queued behind the quiet job.', 'utf8');

package/src/main/__tests__/scheduler-rate-limit-pause.test.cjs

@@ -5,6 +5,13 @@
  * resume timer when both the log and the billing endpoint come up empty
  * (the live failure mode: the usage endpoint itself 429s).
  *
+ * Also (usage-meter circuit PRD): neither function may arm a PAST reset —
+ * resolveRateLimitPauseReset/computeEffectiveResumeAt now reject a stale ISO
+ * via usageCircuit.isResetFresh and fall back to the bounded 30-MINUTE pause
+ * instead. A stale reset used to survive straight into computeResumeDelay's
+ * `Math.max(30_000, <negative>)`, arming a 30-SECOND nap that spun the queue
+ * right back into the same still-active rate limit.
+ *
  * These test the PURE decision functions scheduler.cjs's setPaused() and the
  * spawnJob() rateLimited branch delegate to — never the real setPaused/mutate
  * path, which writes the machine's live scheduler queue.json at a fixed
@@ -21,9 +28,11 @@ const assert = require('node:assert/strict');
 const path = require('node:path');
 const {
   resolveRateLimitPauseReset,
+  billingResetForPause,
   computeEffectiveResumeAt,
   computeResumeDelay,
 } = require('../scheduler.cjs');
+const billing = require('../usage.cjs');
 
 // Repo-tracked, byte-for-byte copy of the real 2026-09-05 starry-night-ships
 // incident log (see src/main/lib/__tests__/rateLimitWindow.test.cjs for the
@@ -32,37 +41,84 @@ const {
 const FIXTURE = path.join(__dirname, '..', 'lib', '__tests__', 'fixtures', '204-mercury-steam-horse.log.txt');
 const FIVE_HOUR_ISO = new Date(1788643800 * 1000).toISOString(); // what refreshNextReset() would have returned
 const SEVEN_DAY_ISO = new Date(1789059600 * 1000).toISOString(); // the actually-binding window
+// Fixed "now" contemporaneous with the fixture's own timestamps (BEFORE both
+// resets above), so freshness checks read the fixture the way it looked at
+// incident time — not relative to whenever this suite happens to run.
+const FIXTURE_NOW = Date.parse('2026-09-05T16:32:00.000Z');
 
 test('resolveRateLimitPauseReset: prefers the log-derived seven-day reset over the billing five_hour reset', () => {
-  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO);
+  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO, FIXTURE_NOW);
   assert.strictEqual(resetIso, SEVEN_DAY_ISO);
   assert.notStrictEqual(resetIso, FIVE_HOUR_ISO);
 });
 
 test('resolveRateLimitPauseReset: falls back to the billing reset when the log yields none', () => {
-  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO);
+  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO, FIXTURE_NOW);
   assert.strictEqual(resetIso, FIVE_HOUR_ISO);
 });
 
 test('resolveRateLimitPauseReset: null when BOTH the log and the billing endpoint are unavailable', () => {
-  assert.strictEqual(resolveRateLimitPauseReset('/nonexistent/path/job.log', null), null);
+  assert.strictEqual(resolveRateLimitPauseReset('/nonexistent/path/job.log', null, FIXTURE_NOW), null);
+});
+
+test('resolveRateLimitPauseReset: a PAST log-derived reset is rejected, not returned stale', () => {
+  // "now" is AFTER both fixture resets have already elapsed.
+  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
+  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO, longAfter);
+  assert.strictEqual(resetIso, null);
+});
+
+test('resolveRateLimitPauseReset: log yields nothing and the billing reset has already passed -> null, not the stale value', () => {
+  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
+  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO, longAfter);
+  assert.strictEqual(resetIso, null);
 });
 
 test('computeEffectiveResumeAt: rate_limit with no resumeAt gets the same bounded 30-minute fallback as network', () => {
-  const now = Date.parse('2026-09-05T16:32:00.000Z');
+  const now = FIXTURE_NOW;
   const resumeAt = computeEffectiveResumeAt('rate_limit', null, now);
   assert.strictEqual(resumeAt, new Date(now + 30 * 60_000).toISOString());
 });
 
-test('computeEffectiveResumeAt: an explicit resumeAt (the log-derived reset) is never overridden', () => {
-  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, Date.now());
+test('computeEffectiveResumeAt: a FRESH explicit resumeAt (the log-derived reset) is never overridden', () => {
+  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, FIXTURE_NOW);
   assert.strictEqual(resumeAt, SEVEN_DAY_ISO);
 });
 
+test('computeEffectiveResumeAt: a PAST resumeAt gets the 30-minute fallback, not a ~30-second nap', () => {
+  // now is well AFTER SEVEN_DAY_ISO has already elapsed — the exact shape of
+  // the bug: Math.max(30_000, <negative>) used to arm a 30-second resume.
+  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
+  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, longAfter);
+  assert.strictEqual(resumeAt, new Date(longAfter + 30 * 60_000).toISOString());
+  assert.notStrictEqual(resumeAt, SEVEN_DAY_ISO);
+  const { delayMs } = computeResumeDelay(resumeAt, longAfter);
+  assert.ok(delayMs >= 30 * 60_000, `expected >= 30 minutes, got ${delayMs}ms`);
+});
+
 test('computeEffectiveResumeAt: other reasons (e.g. auth) get no fallback — stays indefinite', () => {
   assert.strictEqual(computeEffectiveResumeAt('auth', null, Date.now()), null);
 });
 
+test('billingResetForPause: skips refreshNextReset() (no billing.fetchUsage call) while the shared circuit is OPEN', async () => {
+  const originalFetchUsage = billing.fetchUsage;
+  let fetchCalls = 0;
+  billing.fetchUsage = async () => { fetchCalls++; return { kind: 'ok', data: { usage: {} } }; };
+  try {
+    // Force the shared circuit open (3 consecutive failures), same threshold usageCircuit.cjs uses.
+    billing.usageCircuit.recordFailure('a');
+    billing.usageCircuit.recordFailure('a');
+    billing.usageCircuit.recordFailure('a');
+    assert.strictEqual(billing.usageCircuit.state(), 'open');
+
+    await billingResetForPause();
+    assert.strictEqual(fetchCalls, 0, 'refreshNextReset() must not call billing.fetchUsage() while the circuit is open');
+  } finally {
+    billing.usageCircuit.recordSuccess({}); // close the shared circuit back up for later tests/files
+    billing.fetchUsage = originalFetchUsage;
+  }
+});
+
 test('computeResumeDelay: a seven-day-out reset (~5 days from now) is armed, not treated as too-far', () => {
   const now = Date.parse('2026-09-05T16:32:00.000Z');
   // ~5 days out — comfortably under the 0x7fffffff (~24.8 day) setTimeout cap.

package/src/main/__tests__/scheduler-rate-limit-spin-guard.test.cjs

@@ -27,6 +27,7 @@ import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
 const { execFileSync } = require('node:child_process');
 
 let tmpHome;
@@ -92,15 +93,12 @@ function writeProjectQueue(cwd, jobs) {
 // non-zero almost instantly, and bumps a counter file each invocation so the
 // test can assert exactly how many times it was actually spawned.
 function writeAlways429ClaudeStub(counterPath) {
-  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-429-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
-  const body = `
+  return claudeStub.writeClaudeStub({ body: `
     const fs = require('fs');
     fs.appendFileSync(${JSON.stringify(counterPath)}, 'x');
     process.stdout.write(JSON.stringify({ type: 'result', subtype: 'error', is_error: true, api_error_status: 429 }) + '\\n');
     process.exit(1);
-  `;
-  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\n`, { mode: 0o755 });
-  return stubPath;
+  ` });
 }
 
 test('a manual Resume immediately followed by a permanently-429ing job never produces a runaway dispatch loop', async () => {