claude-code-session-manager 0.86.0 → 0.88.0

package/src/main/__tests__/scheduler-reap-dead-running-jobs.test.cjs

@@ -38,7 +38,7 @@ const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'reap-dead-running-jobs-te
 process.env.HOME = tmpHome;
 
 const { reapDeadRunningJobs, PIDLESS_SPAWN_GRACE_MS } = require('../scheduler.cjs');
-const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+const { auditLogPath } = require('../lib/auditLog.cjs');
 // queueStore's cwd discovery is cached for 30s (queueStore.cjs's CACHE_MS) —
 // a project registered by THIS test after an earlier test already populated
 // that cache (and didn't itself bust it, e.g. because it found nothing
@@ -68,10 +68,29 @@ function registerActiveProject(cwd) {
   fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
 }
 
+// Every real scheduler row is born from a real PRD .md file — reconcile()'s
+// auto-archive-drop path (a terminal job whose slug has no on-disk PRD
+// anywhere is treated as "archived on purpose": dropped from queue.json and
+// backfilled to history.jsonl, see scheduler-reconcile-history-backfill.
+// test.cjs) fires the very next time broadcast({flush:true}) reconciles —
+// which reapDeadRunningJobs() itself does on every reap. Without a matching
+// PRD source, a row this test just reaped to a terminal status vanishes from
+// queue.json before the assertions below ever read it back. Epic-scoped (not
+// the legacy flat prds/ dir) so it's never swept by consolidateFlatPrds
+// either.
+function writeFixturePrd(cwd, slug) {
+  const prdsDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'epics', 'test-fixture-epic', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), 'Test fixture PRD.', 'utf8');
+}
+
 function writeProjectQueue(cwd, jobs) {
   const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
   fs.mkdirSync(stateDir, { recursive: true });
   fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({ jobs }, null, 2));
+  for (const job of jobs) {
+    if (job && job.slug) writeFixturePrd(job.cwd || cwd, job.slug);
+  }
   return path.join(stateDir, 'queue.json');
 }
 
@@ -131,7 +150,7 @@ test('reapDeadRunningJobs reaps a pidless row older than PIDLESS_SPAWN_GRACE_MS
   // Empty run dir: created, but never written to (the exact 2026-09-01 repro).
   fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', 'run-pidless-zombie'), { recursive: true });
 
-  const auditSizeBefore = fs.existsSync(AUDIT_LOG_PATH) ? fs.statSync(AUDIT_LOG_PATH).size : 0;
+  const auditSizeBefore = fs.existsSync(auditLogPath()) ? fs.statSync(auditLogPath()).size : 0;
 
   await reapDeadRunningJobs();
 
@@ -142,12 +161,54 @@ test('reapDeadRunningJobs reaps a pidless row older than PIDLESS_SPAWN_GRACE_MS
   assert.equal(jobs[0].runtime, undefined);
   assert.equal(jobs[0].gateOutcome, 'never_ran', 'a pidless reap means the gate never had a chance to run');
 
-  const auditText = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').slice(auditSizeBefore);
+  const auditText = fs.readFileSync(auditLogPath(), 'utf8').slice(auditSizeBefore);
   const auditLines = auditText.trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
   const pidlessEvent = auditLines.find((e) => e.kind === 'job_reaped_pidless' && e.slug === 'pidless-zombie');
   assert.ok(pidlessEvent, 'reaping a pidless row must leave an audit trace');
 });
 
+test('reapDeadRunningJobs: a pidless row past grace with a landedCommit already recorded is routed to needs_review, not failed, naming the commit sha (PRD 1173)', async () => {
+  const projectCwd = path.join(tmpHome, 'c3-project-pidless-with-landed-commit');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const staleStartedAt = new Date(Date.now() - PIDLESS_SPAWN_GRACE_MS - 60_000).toISOString();
+  const landedSha = 'f3e35a7f9e49f13a9eb8c338b0d086160e32a87f';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'shipped-but-pidless',
+      status: 'running',
+      cwd: projectCwd,
+      runId: 'run-shipped-but-pidless',
+      startedAt: staleStartedAt,
+      landedCommit: landedSha,
+      // no runtime key at all — the spawn never got far enough to record one
+    },
+  ]);
+  // Empty run dir, same shape as the sibling 'failed' test below — the
+  // landedCommit evidence must be what changes the outcome, not the log.
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', 'run-shipped-but-pidless'), { recursive: true });
+
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'shipped-but-pidless');
+  assert.equal(row.status, 'needs_review', 'a row with proof of landed work must never be transitioned to failed by the pidless branch');
+  assert.equal(row.landedCommit, landedSha, 'the pre-existing landedCommit must be preserved on the row');
+  assert.match(row.error, new RegExp(landedSha), 'the reason must name the recorded commit sha');
+  assert.equal(row.verifierVerdict, 'pidless_reap_with_landed_commit');
+
+  // Scan the whole audit log for THIS slug's event rather than slicing by a
+  // byte offset from statSync — a prior test's audit entries can contain
+  // multi-byte characters (e.g. an em dash in a reaper reason string), and
+  // slicing a utf8-decoded JS string (UTF-16 code units) at a byte offset
+  // then silently corrupts the boundary. The slug is unique to this test.
+  const auditLines = fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  const pidlessEvent = auditLines.find((e) => e.kind === 'job_reaped_pidless' && e.slug === 'shipped-but-pidless');
+  assert.ok(pidlessEvent, 'reaping this row must still leave an audit trace');
+  assert.equal(pidlessEvent.landedCommit, landedSha, 'the audit event must carry the landed-commit evidence so the decision is reconstructable from the audit log alone');
+});
+
 test('reapDeadRunningJobs clears runId on a pidless reap whose run dir holds only a sibling slug\'s files', async () => {
   const projectCwd = path.join(tmpHome, 'c2-project-batch-sibling');
   fs.mkdirSync(projectCwd, { recursive: true });
@@ -573,3 +634,121 @@ test('reapDeadRunningJobs: a non-git cwd skips the integration check entirely, p
   assert.equal(row.status, 'completed', 'a non-git cwd must keep today\'s behaviour — the check is meaningless there');
   assert.equal(row.verifierVerdict, undefined);
 });
+
+// ---------- Reaper landed-commit evidence gate (job 1192 incident) ----------
+//
+// job 1192 shipped a real 3-file commit (7bf5fa3f...) and was still
+// stamped 'failed' by reapDeadRunningJobs because a `landedCommit` field
+// being present was never actually verified against the repo. These cover
+// the dead-pid branch specifically (runtime.pid recorded, process
+// confirmed dead) rather than the pidless branch: a pidless row with a
+// non-empty landedCommit is already fully owned by PRD 1173's
+// resolvePidlessFailureOverride (routes to needs_review, tested above) —
+// this PRD's gate exists for the shape 1173 doesn't cover, where the
+// reaper would otherwise fall straight through to 'failed' with no
+// evidence check of any kind.
+
+test('reapDeadRunningJobs: a dead-pid reap with a git-resolvable landedCommit transitions to completed, naming the reap cause and the evidence, source reapDeadRunningJobs:landed', async () => {
+  const projectCwd = path.join(tmpHome, 'n-project-landed-commit-evidence');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  fs.writeFileSync(path.join(projectCwd, 'shipped.txt'), 'done\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'ship the PRD work'], projectCwd);
+  const landedSha = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const runId = 'run-landed-commit-evidence';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'landed-but-reaped',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 }, // guaranteed-dead pid
+      landedCommit: landedSha,
+    },
+  ]);
+  // Empty run dir → classifyRunOutcome finds no result event → 'no_result'
+  // → without this PRD's gate this would stamp 'failed' despite the real
+  // commit already sitting on HEAD.
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'landed-but-reaped');
+  assert.equal(row.status, 'completed', 'a resolvable landedCommit must promote the reap to completed, not failed');
+  assert.equal(row.landedCommit, landedSha);
+  assert.equal(row.exitCode, 0);
+  assert.equal(row.error, null);
+  const lastTransition = row.statusHistory[row.statusHistory.length - 1];
+  assert.equal(lastTransition.source, 'reapDeadRunningJobs:landed');
+  assert.match(lastTransition.reason, /process gone/, 'the reap cause must still be named');
+  assert.match(lastTransition.reason, new RegExp(landedSha), 'the evidence sha must be named');
+  assert.match(lastTransition.reason, /resolves/);
+});
+
+test('reapDeadRunningJobs: a dead-pid reap with an unresolvable (stale) landedCommit keeps today\'s behaviour exactly — failed, same reason shape, same source', async () => {
+  const projectCwd = path.join(tmpHome, 'o-project-stale-landed-commit');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const staleSha = '0123456789abcdef0123456789abcdef01234567'; // well-formed sha, never committed anywhere
+  const runId = 'run-stale-landed-commit';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'stale-landed-commit',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      landedCommit: staleSha,
+    },
+  ]);
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'stale-landed-commit');
+  assert.equal(row.status, 'failed', 'a landedCommit that does not resolve in the repo must never be trusted as evidence');
+  assert.equal(row.landedCommit, staleSha, 'the stale field is left on the row untouched, never cleared');
+  assert.match(row.error, /reaped: process gone \(outcome=no_result\)/);
+  assert.doesNotMatch(row.error, /resolves/);
+  const lastTransition = row.statusHistory[row.statusHistory.length - 1];
+  assert.equal(lastTransition.source, 'reapDeadRunningJobs', 'no evidence found — source must stay the plain reaper source, not :landed');
+});
+
+test('reapDeadRunningJobs: a landedCommit that cannot be git-resolved because the row cwd is not a usable git repo falls back to failed without throwing out of the reaper', async () => {
+  const projectCwd = path.join(tmpHome, 'p-project-unresolvable-cwd');
+  // Deliberately NOT initRepo(projectCwd) — no `.git` at all, the same
+  // "cwd git resolution cannot possibly succeed" shape a deleted/torn-down
+  // worktree checkout would produce (git itself errors identically for
+  // "not a git repository" and "no such directory" — both must be caught
+  // and treated as no-evidence, never thrown out of the reaper).
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const runId = 'run-unresolvable-cwd';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'unresolvable-cwd-job',
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      landedCommit: '89abcdef89abcdef89abcdef89abcdef89abcdef',
+    },
+  ]);
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId), { recursive: true });
+
+  bustCwdCache();
+  await assert.doesNotReject(() => reapDeadRunningJobs(), 'a bounded git spawn failure/timeout must never escape the reaper as an unhandled rejection');
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === 'unresolvable-cwd-job');
+  assert.equal(row.status, 'failed', 'an unresolvable cwd must fall back to failed, exactly like no evidence at all');
+});

package/src/main/__tests__/scheduler-reaper-helpers-basics.test.cjs

@@ -0,0 +1,87 @@
+'use strict';
+
+// Ported from the retired top-level test-root directory (a node:test suite,
+// never runnable by this repo's vitest-only setup — see CLAUDE.md's Commands
+// section). The existing src/main/lib/__tests__/reaperHelpers.test.cjs
+// exercises classifyRunOutcome extensively via selectReapableJobs and the
+// rate-limit paths, but never asserts claudePidAlive directly (only ever
+// injects a stand-in `pidAlive` function), and never pins the bare
+// no-result/empty-file/malformed-event edge cases below. These fill that
+// gap.
+//
+// Run: timeout 120 npx vitest run src/main/__tests__/scheduler-reaper-helpers-basics.test.cjs
+
+const assert = require('node:assert/strict');
+const os = require('node:os');
+const path = require('node:path');
+const fs = require('node:fs');
+const { claudePidAlive, classifyRunOutcome } = require('../lib/reaperHelpers.cjs');
+
+// ─────────────────────────────────────────── claudePidAlive
+
+test('claudePidAlive: nonexistent pid (999999) returns false', () => {
+  assert.equal(claudePidAlive(999999), false);
+});
+
+test('claudePidAlive: pid 0 returns false', () => {
+  assert.equal(claudePidAlive(0), false);
+});
+
+test('claudePidAlive: pid 1 returns false', () => {
+  assert.equal(claudePidAlive(1), false);
+});
+
+test('claudePidAlive: null returns false', () => {
+  assert.equal(claudePidAlive(null), false);
+});
+
+test('claudePidAlive: undefined returns false', () => {
+  assert.equal(claudePidAlive(undefined), false);
+});
+
+// ─────────────────────────────────────────── classifyRunOutcome
+
+function writeTempLog(content) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'reaper-basics-test-'));
+  const filePath = path.join(dir, 'test.log');
+  fs.writeFileSync(filePath, content, 'utf8');
+  return filePath;
+}
+
+test('classifyRunOutcome: success without an is_error field → success', () => {
+  const p = writeTempLog('{"type":"result","subtype":"success","result":"ok"}\n');
+  assert.equal(classifyRunOutcome(p), 'success');
+});
+
+test('classifyRunOutcome: subtype success but is_error:true → failed (error wins)', () => {
+  const p = writeTempLog('{"type":"result","subtype":"success","is_error":true}\n');
+  assert.equal(classifyRunOutcome(p), 'failed');
+});
+
+test('classifyRunOutcome: no result event in the tail → no_result', () => {
+  const log = [
+    '{"type":"assistant","message":"working"}',
+    '{"type":"tool_use","name":"bash"}',
+    'some plain text log line',
+  ].join('\n');
+  const p = writeTempLog(log);
+  assert.equal(classifyRunOutcome(p), 'no_result');
+});
+
+test('classifyRunOutcome: empty file → no_result', () => {
+  const p = writeTempLog('');
+  assert.equal(classifyRunOutcome(p), 'no_result');
+});
+
+test('classifyRunOutcome: last result event wins when multiple exist', () => {
+  const log = [
+    '{"type":"result","subtype":"success"}',
+    '{"type":"result","subtype":"error","is_error":true}',
+  ].join('\n');
+  const p = writeTempLog(log);
+  assert.equal(classifyRunOutcome(p), 'failed');
+});
+
+test('classifyRunOutcome: nonexistent file → no_result (readTail swallows I/O errors)', () => {
+  assert.equal(classifyRunOutcome('/nonexistent/path/that/cannot/exist.log'), 'no_result');
+});

package/src/main/__tests__/scheduler-reconcile-cwd-preserve.test.cjs

@@ -0,0 +1,100 @@
+/**
+ * scheduler-reconcile-cwd-preserve.test.cjs — regression test for the
+ * data-loss bug found while chasing PRD 1218's test:unit gate: reconcile()
+ * rebuilt a queue row's `cwd` unconditionally from its PRD's own
+ * frontmatter (`cwd: p.cwd`) at all three of its row-construction sites. A
+ * PRD file with no `cwd:` frontmatter key — every hand-written or legacy PRD,
+ * and every fixture in this test suite before this fix — parses to
+ * `p.cwd === undefined`, which nulled the row's real, already-correct `cwd`.
+ * queueStore.writeSplit's `job.cwd || defaultCwd` bucketing then relocated
+ * the row into schedulerBatch.cjs's DEFAULT_PROJECT_CWD shard
+ * (`~/Projects/session-manager`) — the WRONG project — while the row's own
+ * project's shard was rewritten without it. A PRD's frontmatter `cwd` must
+ * REFINE a row's existing `cwd`, never erase one.
+ *
+ * Covers the normal refresh path (an existing row matched to its PRD) and
+ * the fresh-discovery path (a PRD with no prior row, falling back to the
+ * project root it was actually found under via
+ * prdLocations.deriveProjectCwdFromPrdPath rather than nulling to
+ * DEFAULT_PROJECT_CWD).
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-reconcile-cwd-preserve.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+let tmpHome;
+let originalHome;
+let reconcile;
+let DEFAULT_PROJECT_CWD;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-reconcile-cwd-preserve-'));
+  process.env.HOME = tmpHome;
+  ({ reconcile } = require('../scheduler.cjs'));
+  ({ DEFAULT_PROJECT_CWD } = require('../lib/schedulerBatch.cjs'));
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+// allProjectCwds()/activeProjectCwds() (queueStore.cjs's stateCwds) discover
+// project cwds by scanning ~/.claude/projects/*/*.jsonl for a `cwd` field —
+// same pattern as scheduler-reap-dead-running-jobs.test.cjs and friends.
+function registerActiveProject(cwd) {
+  const projectsDir = path.join(tmpHome, '.claude', 'projects');
+  const slugDir = path.join(projectsDir, `fake-project-slug-${path.basename(cwd)}`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
+}
+
+test('reconcile() never nulls an existing row\'s cwd because its PRD has no cwd: frontmatter', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-reconcile-cwd-preserve-project-'));
+  registerActiveProject(projectCwd);
+
+  const slug = `1218-cwd-preserve-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'epics', 'test-fixture-epic', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  // Deliberately NO `cwd:` frontmatter key — the exact shape of every
+  // hand-written or legacy PRD that triggered the bug.
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), '# Goal\n\nNo cwd frontmatter here.\n', 'utf8');
+
+  const job = { slug, title: 'x', cwd: projectCwd, status: 'pending' };
+  const state = { jobs: [job] };
+
+  await reconcile(state);
+
+  const row = state.jobs.find((j) => j.slug === slug);
+  expect(row).toBeDefined();
+  expect(row.cwd).toBe(projectCwd);
+  expect(row.cwd).not.toBe(DEFAULT_PROJECT_CWD);
+});
+
+test('reconcile() gives a freshly-discovered, frontmatter-less PRD the project root it was actually found under, never DEFAULT_PROJECT_CWD', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-reconcile-cwd-preserve-fresh-'));
+  registerActiveProject(projectCwd);
+
+  const slug = `1218-cwd-preserve-fresh-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'epics', 'test-fixture-epic', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), '# Goal\n\nNo cwd frontmatter here either.\n', 'utf8');
+
+  // No prior row at all — this PRD is discovered fresh by reconcile()'s own
+  // onDisk scan, not handed in via `state.jobs`.
+  const state = { jobs: [] };
+
+  await reconcile(state);
+
+  const row = state.jobs.find((j) => j.slug === slug);
+  expect(row).toBeDefined();
+  expect(row.cwd).toBe(projectCwd);
+  expect(row.cwd).not.toBe(DEFAULT_PROJECT_CWD);
+});

package/src/main/__tests__/scheduler-reconcile-invalid-repair.test.cjs

@@ -127,8 +127,8 @@ test('reconcile() repairs a queue row with an invalid status back to pending, lo
     // require time, so spying on the module's export property after the
     // fact wouldn't intercept scheduler.cjs's already-bound reference —
     // assert against the real (tmpHome-isolated) audit log file instead.
-    const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
-    expect(AUDIT_LOG_PATH.startsWith(tmpHome)).toBe(true);
+    const { auditLogPath } = require('../lib/auditLog.cjs');
+    expect(auditLogPath().startsWith(tmpHome)).toBe(true);
 
     queueStore.bustCwdCache();
     await scheduler.reconcile(state);
@@ -142,7 +142,7 @@ test('reconcile() repairs a queue row with an invalid status back to pending, lo
     );
     expect(warnedRepair).toBe(true);
 
-    const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const auditLines = fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
     const auditedRepair = auditLines.some(
       (rec) => rec.kind === 'scheduler_row_repaired' && rec.slug === badRow.slug && rec.oldStatus === 'queued',
     );

package/src/main/__tests__/scheduler-reconcile-quarantine.test.cjs

@@ -80,7 +80,7 @@ test('reconcile() quarantines a newly-discovered PRD with no createdVia provenan
     fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({ jobs: [] }, null, 2), 'utf8');
 
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+    const { auditLogPath } = require('../lib/auditLog.cjs');
 
     queueStore.bustCwdCache();
     const state = { jobs: [], invalidJobs: [], paused: null };
@@ -95,7 +95,7 @@ test('reconcile() quarantines a newly-discovered PRD with no createdVia provenan
     );
     expect(warned).toBe(true);
 
-    const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const auditLines = fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
     expect(auditLines.some((rec) => rec.kind === 'prd_quarantined' && rec.slug === '9001-hand-written')).toBe(true);
   } finally {
     fs.rmSync(cwd, { recursive: true, force: true });
@@ -230,7 +230,7 @@ test('reconcile() adopts a quarantined row to pending once its PRD file is stamp
     fm.issuedAt = '2026-08-07T01:00:00.000Z';
     fs.writeFileSync(prdPath, serializePrdFile(fm, body), 'utf8');
 
-    const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+    const { auditLogPath } = require('../lib/auditLog.cjs');
     queueStore.bustCwdCache();
     const state = { jobs: [quarantinedRow], invalidJobs: [], paused: null };
     await scheduler.reconcile(state);
@@ -239,7 +239,7 @@ test('reconcile() adopts a quarantined row to pending once its PRD file is stamp
     expect(row).toBeDefined();
     expect(row.status).toBe('pending');
 
-    const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const auditLines = fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
     expect(auditLines.some((rec) => rec.kind === 'scheduler_prd_adopted' && rec.slug === '9004-adopt-me')).toBe(true);
   } finally {
     fs.rmSync(cwd, { recursive: true, force: true });

package/src/main/__tests__/scheduler-shard-quarantine.test.cjs

@@ -0,0 +1,110 @@
+/**
+ * scheduler-shard-quarantine.test.cjs — a torn per-project queue shard
+ * quarantines THAT project only. tickQueue keeps dispatching the healthy
+ * project, never scans/mints rows for the torn project's PRDs, never touches
+ * the torn file, and health names the quarantined cwd (non-GREEN).
+ *
+ * Everything runs under a temp HOME; the stub `claude` writes a marker into
+ * its own cwd so the test can prove where a spawn did (not) happen.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-shard-quarantine.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
+
+let tmpHome;
+let originalHome;
+let originalWt;
+let scheduler;
+
+function registerActiveProject(cwd) {
+  const slugDir = path.join(tmpHome, '.claude', 'projects', `fake-project-slug-${path.basename(cwd)}`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
+}
+
+function makeProject(name) {
+  const cwd = path.join(tmpHome, 'Projects', name);
+  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
+  const prdsDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'epics', 'fixture-epic', 'prds');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.mkdirSync(prdsDir, { recursive: true });
+  registerActiveProject(cwd);
+  return { cwd, prdsDir, queueFile: path.join(stateDir, 'queue.json') };
+}
+
+function writeClaudeStub() {
+  return claudeStub.writeClaudeStub({ body: `
+    require('fs').writeFileSync(require('path').join(process.cwd(), 'ran-here.marker'), 'yes');
+    process.stdout.write(JSON.stringify({ type: 'result', subtype: 'success', result: 'ok\\nSCHEDULER_VERDICT: PASS' }) + '\\n');
+    process.exit(0);
+  ` });
+}
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  originalWt = process.env.SM_JOB_WORKTREE_DISABLE;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-shard-quarantine-'));
+  process.env.HOME = tmpHome;
+  process.env.SM_JOB_WORKTREE_DISABLE = '1';
+  process.env.SM_AUTOFIX_DISABLE = '1';
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager'), { recursive: true });
+  scheduler = require('../scheduler.cjs');
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  if (originalWt === undefined) delete process.env.SM_JOB_WORKTREE_DISABLE;
+  else process.env.SM_JOB_WORKTREE_DISABLE = originalWt;
+  delete process.env.SM_AUTOFIX_DISABLE;
+  delete process.env.SM_CLAUDE_BIN;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+test('tickQueue dispatches the healthy project while the torn project is skipped; health names it', async () => {
+  const good = makeProject('good-proj');
+  const torn = makeProject('torn-proj');
+  const goodSlug = `9101-good-${process.pid}`;
+  const tornSlug = `9102-torn-${process.pid}`;
+  fs.writeFileSync(path.join(good.prdsDir, `${goodSlug}.md`), 'Healthy PRD.', 'utf8');
+  fs.writeFileSync(path.join(torn.prdsDir, `${tornSlug}.md`), 'PRD in the torn project.', 'utf8');
+  fs.writeFileSync(good.queueFile, JSON.stringify({
+    jobs: [{ slug: goodSlug, title: 'good', status: 'pending', cwd: good.cwd, dependsOn: [], createdAt: new Date().toISOString() }],
+  }));
+  // A running row was in flight when the shard tore — must never become pending.
+  const TORN = '{"jobs":[{"slug":"' + tornSlug + '","status":"running"}]}{"jobs":[{"slug":"';
+  fs.writeFileSync(torn.queueFile, TORN);
+  const before = fs.readFileSync(torn.queueFile);
+  process.env.SM_CLAUDE_BIN = writeClaudeStub();
+
+  const result = await scheduler.tickQueue({ bypassLoadGate: true });
+  expect(result.reason).not.toBe('unreadable');
+  expect(result.fired).toBe(true);
+  // flagUnreadable (via tickQueue's readQueue) snapshots the torn shard beside itself.
+  const snaps = fs.readdirSync(path.dirname(torn.queueFile)).filter((f) => f.startsWith('queue.json.corrupt-'));
+  expect(snaps).toHaveLength(1);
+
+  await new Promise((resolve, reject) => {
+    const t0 = Date.now();
+    const poll = () => {
+      if (fs.existsSync(path.join(good.cwd, 'ran-here.marker'))) return resolve();
+      if (Date.now() - t0 > 20_000) return reject(new Error('healthy project never dispatched'));
+      setTimeout(poll, 100);
+    };
+    poll();
+  });
+
+  expect(fs.existsSync(path.join(torn.cwd, 'ran-here.marker'))).toBe(false);
+  expect(fs.readFileSync(torn.queueFile).equals(before)).toBe(true);
+
+  const health = await require('../health.cjs').check();
+  expect(health.components.scheduler_queue.ok).toBe(false);
+  expect(health.components.scheduler_queue.quarantinedCwds).toEqual([torn.cwd]);
+  expect(health.issues.some((i) => i.includes(torn.cwd))).toBe(true);
+}, 120_000); // health.check() alone can take tens of seconds