claude-code-session-manager 0.86.0 → 0.88.0

package/src/main/lib/__tests__/instanceLock.test.cjs

@@ -1,17 +1,49 @@
 // PRD 834 — machine-wide scheduler-ownership lock. Secondary instances must
 // go scheduler-passive instead of running boot reconciliation / admin server
 // against the owner's queue state (live incident 2026-07-31).
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+//
+// HOME is stubbed to a mkdtemp dir BEFORE requiring instanceLock.cjs (mirrors
+// scheduler-reconcile-invalid-repair.test.cjs): instanceLock.cjs pulls in
+// auditLog.cjs, whose audit log path resolves from
+// os.homedir() — so real ~/.claude/session-manager state must never be
+// touched by this suite.
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from 'vitest';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-const {
-  acquireSchedulerOwnership,
-  releaseSchedulerOwnership,
-  pidAlive,
-  lockPath,
-} = require('../instanceLock.cjs');
+let originalHome;
+let tmpHome;
+let instanceLock;
+let auditLogPath;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-instance-lock-home-'));
+  process.env.HOME = tmpHome;
+  instanceLock = require('../instanceLock.cjs');
+  ({ auditLogPath } = require('../auditLog.cjs'));
+  if (!auditLogPath().startsWith(tmpHome)) {
+    throw new Error(`refusing to run: auditLogPath() (${auditLogPath()}) is not under the temp HOME (${tmpHome})`);
+  }
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+// Thin pass-throughs so every test body below can keep calling these as
+// bare names, resolved lazily against the module loaded in beforeAll.
+const acquireSchedulerOwnership = (...args) => instanceLock.acquireSchedulerOwnership(...args);
+const releaseSchedulerOwnership = (...args) => instanceLock.releaseSchedulerOwnership(...args);
+const pidAlive = (...args) => instanceLock.pidAlive(...args);
+const lockPath = (...args) => instanceLock.lockPath(...args);
+
+function readAuditEvents() {
+  if (!fs.existsSync(auditLogPath())) return [];
+  return fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+}
 
 let dir;
 
@@ -22,7 +54,9 @@ beforeEach(() => {
 
 afterEach(() => {
   delete process.env.SM_SCHEDULER_LOCK_PATH;
+  delete process.env.SM_PROC_ROOT;
   fs.rmSync(dir, { recursive: true, force: true });
+  if (fs.existsSync(auditLogPath())) fs.rmSync(auditLogPath(), { force: true });
 });
 
 describe('instanceLock (PRD 834)', () => {
@@ -84,4 +118,56 @@ describe('instanceLock (PRD 834)', () => {
     expect(pidAlive(-5)).toBe(false);
     expect(pidAlive(0)).toBe(false);
   });
+
+  it('a legacy lock ({pid, startedAt} only, no identity) is respected while its pid is alive', () => {
+    // Mirrors the on-disk shape of every lock written before this PRD.
+    fs.mkdirSync(path.dirname(lockPath()), { recursive: true });
+    fs.writeFileSync(lockPath(), JSON.stringify({ pid: 1, startedAt: 'x' }));
+    const res = acquireSchedulerOwnership();
+    expect(res.owner).toBe(false);
+    expect(res.holderPid).toBe(1);
+    expect(JSON.parse(fs.readFileSync(lockPath(), 'utf8')).pid).toBe(1);
+    // No identity information to compare, so no stale-lock-broken audit event.
+    expect(readAuditEvents().some((e) => e.kind === 'stale_lock_broken')).toBe(false);
+  });
+
+  it('a recorded identity that no longer matches the live process at that (recycled) pid is broken, and audited', () => {
+    // process.ppid is guaranteed alive for the lifetime of this test (the
+    // vitest worker's own parent) — stand-in for "a hard crash left a lock
+    // whose pid was later reused by an unrelated live process".
+    const recycledPid = process.ppid;
+    const procRoot = path.join(dir, 'proc');
+    fs.mkdirSync(path.join(procRoot, String(recycledPid)), { recursive: true });
+    fs.writeFileSync(
+      path.join(procRoot, String(recycledPid), 'stat'),
+      `${recycledPid} (bash) S 1 ${recycledPid} ${recycledPid} 0 -1 4194304 0 0 0 0 0 0 0 0 20 0 1 0 222222 0 0 0 0 0 0 0 0 0 0 0 0 0 17 0 0 0 0 0 0 0 0 0 0 0 0\n`,
+    );
+    fs.writeFileSync(path.join(procRoot, String(recycledPid), 'cmdline'), 'bash\0');
+    process.env.SM_PROC_ROOT = procRoot;
+
+    fs.mkdirSync(path.dirname(lockPath()), { recursive: true });
+    fs.writeFileSync(lockPath(), JSON.stringify({
+      pid: recycledPid,
+      startedAt: 'x',
+      // The identity the crashed scheduler instance actually recorded — a
+      // different cmdline/startTicks than the process now holding this pid.
+      identity: { pid: recycledPid, startTicks: 111111, cmdline: 'claude --session-id old', complete: true },
+    }));
+
+    const res = acquireSchedulerOwnership();
+    expect(res.owner).toBe(true);
+    expect(JSON.parse(fs.readFileSync(lockPath(), 'utf8')).pid).toBe(process.pid);
+
+    const auditEvents = readAuditEvents().filter((e) => e.kind === 'stale_lock_broken');
+    expect(auditEvents.length).toBe(1);
+    expect(auditEvents[0].recordedPid).toBe(recycledPid);
+  });
+
+  it('writeLockExclusive (via acquire) records a complete identity for this process', () => {
+    acquireSchedulerOwnership();
+    const onDisk = JSON.parse(fs.readFileSync(lockPath(), 'utf8'));
+    expect(onDisk.identity).toBeTruthy();
+    expect(onDisk.identity.pid).toBe(process.pid);
+    expect(onDisk.identity.complete).toBe(true);
+  });
 });

package/src/main/lib/__tests__/jobSupervisorRecord.test.cjs

@@ -0,0 +1,78 @@
+/**
+ * jobSupervisorRecord.test.cjs — record round-trip, live listing, retention
+ * claim, and the pure classifyAdoption matrix.
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/jobSupervisorRecord.test.cjs
+ */
+'use strict';
+
+import { test, expect, beforeEach, afterEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const rec = require('../jobSupervisorRecord.cjs');
+
+let root;
+beforeEach(() => { root = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-supervisor-')); });
+afterEach(() => { fs.rmSync(root, { recursive: true, force: true }); });
+
+const base = (over = {}) => ({
+  runDir: path.join(root, 'run-1'), slug: 'p1', cwd: '/x', runId: 'run-1', pid: 42, pgid: 42,
+  identity: { pid: 42, startTicks: 7, cmdline: 'claude -p', complete: true },
+  execCwd: '/wt', worktreeDir: '/wt', worktreeBranch: 'sm-job/p1', sessionId: 's',
+  startedAt: 1_000, budgetMs: 10_000, maxDurationMs: null, idleKillMs: 5_000, schedulerPid: 1, codeSha: 'abc', ...over,
+});
+
+test('write → read round-trips every field at <runDir>/<slug>.supervisor.json', () => {
+  const input = base();
+  rec.writeSupervisorRecord(input);
+  expect(fs.existsSync(path.join(input.runDir, 'p1.supervisor.json'))).toBe(true);
+  const back = rec.readSupervisorRecord(input.runDir, 'p1');
+  const { runDir, ...persisted } = input;
+  expect(back).toMatchObject({ ...persisted, kind: 'job' });
+  expect(back.runDir).toBeUndefined();
+});
+
+test('readSupervisorRecord returns null for absent or torn files', () => {
+  expect(rec.readSupervisorRecord(path.join(root, 'nope'), 'p1')).toBeNull();
+  fs.mkdirSync(path.join(root, 'r'));
+  fs.writeFileSync(path.join(root, 'r', 'p1.supervisor.json'), '{"pid":');
+  expect(rec.readSupervisorRecord(path.join(root, 'r'), 'p1')).toBeNull();
+});
+
+test('listLiveSupervisorRecords skips exited (meta.json) and stale records', () => {
+  rec.writeSupervisorRecord(base({ slug: 'live' }));
+  rec.writeSupervisorRecord(base({ slug: 'done' }));
+  fs.writeFileSync(path.join(root, 'run-1', 'done.meta.json'), '{}');
+  const live = rec.listLiveSupervisorRecords(root, { maxAgeMs: 60_000 });
+  expect(live.map((r) => r.slug)).toEqual(['live']);
+  expect(live[0].runDir).toBe(path.join(root, 'run-1'));
+  expect(rec.listLiveSupervisorRecords(root, { maxAgeMs: 1, now: Date.now() + 10_000 })).toEqual([]);
+  expect(rec.listLiveSupervisorRecords(path.join(root, 'missing'), { maxAgeMs: 1 })).toEqual([]);
+});
+
+test('investigation records use the .investigation.log exit line as their marker', () => {
+  const runDir = path.join(root, 'run-1');
+  rec.writeSupervisorRecord(base({ slug: 'p1.investigation', kind: 'investigation' }));
+  fs.writeFileSync(path.join(runDir, 'p1.investigation.log'), 'working\n');
+  expect(rec.listLiveSupervisorRecords(root, { maxAgeMs: 60_000 })).toHaveLength(1);
+  fs.appendFileSync(path.join(runDir, 'p1.investigation.log'), '\n[scheduler] investigation exit code=0\n');
+  expect(rec.listLiveSupervisorRecords(root, { maxAgeMs: 60_000 })).toEqual([]);
+});
+
+test('classifyAdoption matrix', () => {
+  const r = base();
+  const same = { pid: 42, startTicks: 7, cmdline: 'claude -p', complete: true };
+  const other = { pid: 42, startTicks: 99, cmdline: 'claude -p', complete: true };
+  const now = 2_000;
+  const c = (o) => rec.classifyAdoption(r, { identity: same, pidAlive: true, logMtimeMs: now, exitMarker: false, now, ...o });
+  expect(c({})).toBe('adopt');
+  expect(c({ pidAlive: false })).toBe('dead');
+  expect(c({ pidAlive: false, exitMarker: true })).toBe('exited');
+  expect(c({ identity: other })).toBe('foreign-pid');
+  expect(c({ identity: { pid: 42, startTicks: null, cmdline: null, complete: false } })).toBe('adopt'); // fail-closed
+  expect(c({ now: 1_000 + 10_001, logMtimeMs: 1_000 + 10_000 })).toBe('over-budget');
+  expect(c({ now: 1_000 + 5_001, logMtimeMs: 1_000 })).toBe('over-budget'); // log stalled past idleKillMs
+  expect(rec.classifyAdoption(base({ budgetMs: null, maxDurationMs: 100 }), { identity: same, pidAlive: true, logMtimeMs: 1_050, now: 1_200 })).toBe('over-budget');
+  expect(rec.classifyAdoption(base({ budgetMs: null, idleKillMs: null }), { identity: same, pidAlive: true, now: 9e9 })).toBe('adopt');
+});

package/src/main/lib/__tests__/jobWorktreeBootLive.test.cjs

@@ -69,3 +69,14 @@ test('a precomputed cwdHolders set is forwarded through to hasLiveHolder unchang
   isLive('job-d', { worktree: '/tmp/checkout-d' });
   expect(hasLiveHolder).toHaveBeenCalledWith('/tmp/checkout-d', holders);
 });
+
+test('rowPid (the record/log ladder) is consulted instead of runtime.pid alone', () => {
+  const claudePidAlive = vi.fn((pid) => pid === 777);
+  const isLive = buildJobWorktreeIsLive({
+    bootJobs: [{ slug: 'job-e', status: 'running' }],
+    claudePidAlive,
+    hasLiveHolder: () => false,
+    rowPid: () => 777,
+  });
+  expect(isLive('job-e', { worktree: '/tmp/checkout-e' })).toBe(true);
+});

package/src/main/lib/__tests__/localAdminHttp.test.cjs

@@ -173,7 +173,7 @@ test('with neither SM_DEV nor SM_E2E set, resolves to the original admin-api.jso
   delete process.env.SM_E2E;
   delete process.env.SM_ADMIN_TOKEN_PATH;
   try {
-    expect(resolveTokenPath()).toBe(TOKEN_PATH);
+    expect(resolveTokenPath()).toBe(path.join(require('../schedulerPaths.cjs').schedulerHome(), 'admin-api.json'));
   } finally {
     if (prevDev === undefined) delete process.env.SM_DEV; else process.env.SM_DEV = prevDev;
     if (prevE2e === undefined) delete process.env.SM_E2E; else process.env.SM_E2E = prevE2e;

package/src/main/lib/__tests__/mcpToolCatalog.test.cjs

@@ -78,12 +78,17 @@ test.each(MCP_TOOL_CATALOG)('$name composeDescription joins purpose/whenToUse/wh
   expect(composeDescription(entry).length).toBeGreaterThan(0);
 });
 
+test('project-home group is exactly the single project_home_write tool', () => {
+  expect(MCP_TOOL_CATALOG.filter((e) => e.group === 'project-home').map((e) => e.name)).toEqual(['project_home_write']);
+});
+
 test('MCP_RECIPES covers queue-work, unstick-needs-review, and hand-off-to-another-project', () => {
   const ids = MCP_RECIPES.map((r) => r.id);
   expect(ids).toContain('queue-work-via-develop');
   expect(ids).toContain('unstick-needs-review-job');
   expect(ids).toContain('hand-finding-to-another-project');
-  expect(ids).toContain('generate-project-home');
+  // the single-tool project_home_write needs no recipe; the old 4-step one is gone
+  expect(ids).not.toContain('generate-project-home');
   for (const recipe of MCP_RECIPES) {
     expect(recipe.title).toBeTruthy();
     expect(Array.isArray(recipe.steps)).toBe(true);

package/src/main/lib/__tests__/opsRootAbsoluteCwd.test.cjs

@@ -29,7 +29,7 @@ const fsp = require('node:fs/promises');
 const os = require('node:os');
 const path = require('node:path');
 const queueStore = require('../queueStore.cjs');
-const { activeProjectCwds } = require('../../../../scripts/lib/activeSessions.cjs');
+const { activeProjectCwds } = require('../activeSessions.cjs');
 
 const tmpDirs = [];
 
@@ -149,7 +149,7 @@ test('a transcript cwd inside an ops root is normalized to the project root, not
 });
 
 test('normalization keeps the active-project signal rather than dropping the row', () => {
-  const { projectRootOf } = require('../../../../scripts/lib/activeSessions.cjs');
+  const { projectRootOf } = require('../activeSessions.cjs');
   expect(projectRootOf('/p/session-manager-operations/prompt-sessions')).toBe('/p');
   expect(projectRootOf('/p/session-manager-operations')).toBe('/p');
   expect(projectRootOf('/p/session-manager-operations/scheduler/state')).toBe('/p');
@@ -185,7 +185,7 @@ test('projectStateDir fails closed on an ops-internal cwd, naming the offending
 // list at all. `worktreeMainRootOf` reverses a linked worktree's `.git` FILE
 // (`gitdir: <main>/.git/worktrees/<name>`) back to `<main>`.
 
-const { worktreeMainRootOf } = require('../../../../scripts/lib/activeSessions.cjs');
+const { worktreeMainRootOf } = require('../activeSessions.cjs');
 const { KIND_CONFIG: WORKTREE_KIND_CONFIG } = require('../gitWorktree.cjs');
 
 // A worktree's MAIN tree root must live outside os.tmpdir() for these fixtures
@@ -285,13 +285,13 @@ test('worktreeMainRootOf returns null for a plain non-git directory', async () =
 
 test('projectRootOf resolves a worktree cwd to the main tree root', async () => {
   const { main, worktree } = await makeWorktreeFixture();
-  const { projectRootOf } = require('../../../../scripts/lib/activeSessions.cjs');
+  const { projectRootOf } = require('../activeSessions.cjs');
   expect(projectRootOf(worktree)).toBe(main);
 });
 
 test('projectRootOf resolves a cwd nested inside a worktree\'s OWN ops tree to the main root', async () => {
   const { main, worktree } = await makeWorktreeFixture();
-  const { projectRootOf } = require('../../../../scripts/lib/activeSessions.cjs');
+  const { projectRootOf } = require('../activeSessions.cjs');
   const nestedOps = path.join(worktree, 'session-manager-operations', 'scheduler', 'state');
   fs.mkdirSync(nestedOps, { recursive: true });
   expect(projectRootOf(nestedOps)).toBe(main);

package/src/main/lib/__tests__/prdDisposition.test.cjs

@@ -0,0 +1,224 @@
+/**
+ * prdDisposition.test.cjs — pure logic behind the scheduler wave-disposition
+ * PRD: does a new PRD wave extend an Epic's existing dependsOn chain
+ * ('append', gaining a dependsOn on the chain's current terminal PRD(s)) or
+ * start an independent, parallel-eligible root ('new-head')? And, after the
+ * fact, can a human safely rewrite that choice from the Scheduler UI?
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/prdDisposition.test.cjs
+ */
+
+'use strict';
+
+import { test, expect } from 'vitest';
+
+const {
+  isIncomplete,
+  resolveChainTerminals,
+  wouldCreateCycle,
+  computeDispositionRewrite,
+} = require('../prdDisposition.cjs');
+
+function row(overrides) {
+  return { slug: 'x', status: 'pending', dependsOn: [], ...overrides };
+}
+
+// ─────────────────────────────────────────── isIncomplete
+
+test('isIncomplete: completed is the only complete status', () => {
+  expect(isIncomplete('completed')).toBe(false);
+  for (const status of [null, undefined, 'pending', 'running', 'needs_review', 'failed', 'quarantined']) {
+    expect(isIncomplete(status)).toBe(true);
+  }
+});
+
+// ─────────────────────────────────────────── resolveChainTerminals
+
+test('resolveChainTerminals: a lone root is its own terminal', () => {
+  const rows = [row({ slug: 'a' })];
+  expect(resolveChainTerminals(rows)).toEqual(['a']);
+});
+
+test('resolveChainTerminals: a linear chain terminates at its tail', () => {
+  const rows = [
+    row({ slug: 'a' }),
+    row({ slug: 'b', dependsOn: ['a'] }),
+    row({ slug: 'c', dependsOn: ['b'] }),
+  ];
+  expect(resolveChainTerminals(rows)).toEqual(['c']);
+});
+
+test('resolveChainTerminals: a fork yields both leaves', () => {
+  const rows = [
+    row({ slug: 'a' }),
+    row({ slug: 'b', dependsOn: ['a'] }),
+    row({ slug: 'c', dependsOn: ['a'] }),
+  ];
+  expect(resolveChainTerminals(rows).sort()).toEqual(['b', 'c']);
+});
+
+test('resolveChainTerminals: two independent roots are both terminals (existing multi-head Epic)', () => {
+  const rows = [row({ slug: 'a' }), row({ slug: 'z' })];
+  expect(resolveChainTerminals(rows).sort()).toEqual(['a', 'z']);
+});
+
+test('resolveChainTerminals: a dependsOn cycle contributes no terminal', () => {
+  const rows = [
+    row({ slug: 'a', dependsOn: ['b'] }),
+    row({ slug: 'b', dependsOn: ['a'] }),
+  ];
+  expect(resolveChainTerminals(rows)).toEqual([]);
+});
+
+test('resolveChainTerminals: empty input yields no terminals', () => {
+  expect(resolveChainTerminals([])).toEqual([]);
+});
+
+// ─────────────────────────────────────────── wouldCreateCycle
+
+test('wouldCreateCycle: false for a fresh, unrelated edge', () => {
+  const rows = [row({ slug: 'a' }), row({ slug: 'b' })];
+  expect(wouldCreateCycle(rows, 'b', ['a'])).toBe(false);
+});
+
+test('wouldCreateCycle: true when the target already (transitively) depends on the source', () => {
+  // a depends on b; proposing b depends on a closes the loop.
+  const rows = [
+    row({ slug: 'a', dependsOn: ['b'] }),
+    row({ slug: 'b' }),
+  ];
+  expect(wouldCreateCycle(rows, 'b', ['a'])).toBe(true);
+});
+
+test('wouldCreateCycle: true for a direct self-reference', () => {
+  const rows = [row({ slug: 'a' })];
+  expect(wouldCreateCycle(rows, 'a', ['a'])).toBe(true);
+});
+
+test('wouldCreateCycle: false through an unrelated third row', () => {
+  const rows = [
+    row({ slug: 'a' }),
+    row({ slug: 'b', dependsOn: ['a'] }),
+    row({ slug: 'c' }),
+  ];
+  expect(wouldCreateCycle(rows, 'c', ['b'])).toBe(false);
+});
+
+// ─────────────────────────────────────────── computeDispositionRewrite
+
+test('append sets the expected edges', () => {
+  const rows = [
+    row({ slug: 'wave1-tail' }),
+    row({ slug: 'wave2-root' }),
+  ];
+  const result = computeDispositionRewrite({
+    slug: 'wave2-root',
+    disposition: 'append',
+    dependsOn: ['wave1-tail'],
+    rows,
+  });
+  expect(result).toEqual({ ok: true, dependsOn: ['wave1-tail'] });
+});
+
+test('new-head sets none', () => {
+  const rows = [
+    row({ slug: 'wave1-tail' }),
+    row({ slug: 'wave2-root', dependsOn: ['wave1-tail'] }),
+  ];
+  const result = computeDispositionRewrite({
+    slug: 'wave2-root',
+    disposition: 'new-head',
+    dependsOn: [],
+    rows,
+  });
+  expect(result).toEqual({ ok: true, dependsOn: [] });
+});
+
+test('promoting a wave to a head removes exactly its root edges', () => {
+  const rows = [
+    row({ slug: 'wave1-tail' }),
+    row({ slug: 'other-head' }),
+    row({ slug: 'wave2-root', dependsOn: ['wave1-tail'] }),
+  ];
+  const result = computeDispositionRewrite({
+    slug: 'wave2-root',
+    disposition: 'new-head',
+    dependsOn: [],
+    rows,
+  });
+  expect(result.ok).toBe(true);
+  expect(result.dependsOn).toEqual([]);
+  // The unrelated head's own row is untouched — this function only ever
+  // returns the target row's new dependsOn, never mutates `rows`.
+  expect(rows.find((r) => r.slug === 'other-head').dependsOn).toEqual([]);
+});
+
+test('a change that would create a cycle is rejected', () => {
+  const rows = [
+    row({ slug: 'a', dependsOn: ['b'] }),
+    row({ slug: 'b' }),
+  ];
+  const result = computeDispositionRewrite({
+    slug: 'b',
+    disposition: 'append',
+    dependsOn: ['a'],
+    rows,
+  });
+  expect(result.ok).toBe(false);
+  expect(result.error).toMatch(/cycle/i);
+});
+
+test('running rows are untouched', () => {
+  const rows = [
+    row({ slug: 'wave1-tail' }),
+    row({ slug: 'wave2-root', status: 'running', dependsOn: ['wave1-tail'] }),
+  ];
+  const result = computeDispositionRewrite({
+    slug: 'wave2-root',
+    disposition: 'new-head',
+    dependsOn: [],
+    rows,
+  });
+  expect(result.ok).toBe(false);
+  expect(result.error).toMatch(/running/i);
+});
+
+test('completed rows are untouched', () => {
+  const rows = [
+    row({ slug: 'wave1-tail' }),
+    row({ slug: 'wave2-root', status: 'completed', dependsOn: ['wave1-tail'] }),
+  ];
+  const result = computeDispositionRewrite({
+    slug: 'wave2-root',
+    disposition: 'append',
+    dependsOn: ['wave1-tail'],
+    rows,
+  });
+  expect(result.ok).toBe(false);
+  expect(result.error).toMatch(/completed/i);
+});
+
+test('refuses to rewrite a row whose existing blocker has already completed', () => {
+  const rows = [
+    row({ slug: 'blocker', status: 'completed' }),
+    row({ slug: 'dependent', status: 'pending', dependsOn: ['blocker'] }),
+  ];
+  const result = computeDispositionRewrite({
+    slug: 'dependent',
+    disposition: 'new-head',
+    dependsOn: [],
+    rows,
+  });
+  expect(result.ok).toBe(false);
+  expect(result.error).toMatch(/already completed|satisfied/i);
+});
+
+test('unknown slug is refused, not silently ignored', () => {
+  const result = computeDispositionRewrite({
+    slug: 'ghost',
+    disposition: 'new-head',
+    dependsOn: [],
+    rows: [row({ slug: 'a' })],
+  });
+  expect(result.ok).toBe(false);
+});

package/src/main/lib/__tests__/procIdentity.test.cjs

@@ -0,0 +1,119 @@
+// PRD: fail-closed process identity so a recycled pid can never pin
+// instanceLock ownership or dodge killOrphanClaudePid's veto. Stat parsing is
+// exercised against fixture files under SM_PROC_ROOT (never real /proc) so a
+// synthetic `comm` containing parens/spaces can be asserted precisely.
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const { identity, isDifferentProcess } = require('../procIdentity.cjs');
+
+let dir;
+
+function writeProcEntry(root, pid, { stat, cmdline }) {
+  const entryDir = path.join(root, String(pid));
+  fs.mkdirSync(entryDir, { recursive: true });
+  if (stat !== undefined) fs.writeFileSync(path.join(entryDir, 'stat'), stat);
+  if (cmdline !== undefined) fs.writeFileSync(path.join(entryDir, 'cmdline'), cmdline);
+}
+
+// Real /proc/<pid>/stat line, comm replaced with one containing a space and
+// an embedded ')' — field 22 (starttime) is `124686`, at the position AFTER
+// the LAST ')', not the first.
+function statLine(comm, startTicks) {
+  return `12345 (${comm}) R 1 12345 12345 0 -1 4194304 118 0 0 0 0 0 0 0 32 12 1 0 ${startTicks} 18698240 440 0 0 0 0 0 0 0 0 0 0 0 17 7 0 0 0 0 0 0 0 0 0 0 0 0\n`;
+}
+
+beforeEach(() => {
+  dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-proc-identity-'));
+  process.env.SM_PROC_ROOT = dir;
+});
+
+afterEach(() => {
+  delete process.env.SM_PROC_ROOT;
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+describe('procIdentity.identity — /proc parsing', () => {
+  it('parses field 22 located after the LAST ")" when comm contains a paren and a space', () => {
+    writeProcEntry(dir, 4242, {
+      stat: statLine('claude (worker)', 999888),
+      cmdline: 'node\0claude\0--session-id\0abc\0',
+    });
+    const id = identity(4242);
+    expect(id.pid).toBe(4242);
+    expect(id.startTicks).toBe(999888);
+    expect(id.cmdline).toBe('node claude --session-id abc');
+    expect(id.complete).toBe(true);
+  });
+
+  it('reads the live node process itself from real /proc (sanity check against production code path)', () => {
+    delete process.env.SM_PROC_ROOT;
+    const id = identity(process.pid);
+    expect(id.pid).toBe(process.pid);
+    expect(typeof id.startTicks).toBe('number');
+    expect(id.startTicks).toBeGreaterThan(0);
+    expect(typeof id.cmdline).toBe('string');
+    expect(id.cmdline.length).toBeGreaterThan(0);
+    expect(id.complete).toBe(true);
+    process.env.SM_PROC_ROOT = dir; // restore for afterEach
+  });
+
+  it('tri-state: missing stat file → incomplete (startTicks null) even though cmdline is readable', () => {
+    writeProcEntry(dir, 5001, { cmdline: 'node\0claude\0' });
+    const id = identity(5001);
+    expect(id.startTicks).toBeNull();
+    expect(id.cmdline).toBe('node claude');
+    expect(id.complete).toBe(false);
+  });
+
+  it('tri-state: missing cmdline file → incomplete (cmdline null) even though stat is readable', () => {
+    writeProcEntry(dir, 5002, { stat: statLine('claude', 111) });
+    const id = identity(5002);
+    expect(id.startTicks).toBe(111);
+    expect(id.cmdline).toBeNull();
+    expect(id.complete).toBe(false);
+  });
+
+  it('tri-state: neither file exists (pid never existed / already reaped) → incomplete, never throws', () => {
+    const id = identity(999999);
+    expect(id.startTicks).toBeNull();
+    expect(id.cmdline).toBeNull();
+    expect(id.complete).toBe(false);
+  });
+
+  it('rejects a non-positive-integer pid without touching the filesystem', () => {
+    expect(identity(-1).complete).toBe(false);
+    expect(identity(0).complete).toBe(false);
+    expect(identity(NaN).complete).toBe(false);
+  });
+});
+
+describe('procIdentity.isDifferentProcess — fail-closed decision', () => {
+  const complete = (over = {}) => ({ pid: 100, startTicks: 555, cmdline: 'node claude', complete: true, ...over });
+
+  it('true only when both sides are complete AND a field differs', () => {
+    expect(isDifferentProcess(complete(), complete({ startTicks: 999 }))).toBe(true);
+    expect(isDifferentProcess(complete(), complete({ cmdline: 'node other' }))).toBe(true);
+    expect(isDifferentProcess(complete(), complete())).toBe(false);
+  });
+
+  it('an incomplete recorded or live side never reads as different (fail closed)', () => {
+    const incomplete = { pid: 100, startTicks: null, cmdline: null, complete: false };
+    expect(isDifferentProcess(incomplete, complete())).toBe(false);
+    expect(isDifferentProcess(complete(), incomplete)).toBe(false);
+    expect(isDifferentProcess(incomplete, incomplete)).toBe(false);
+  });
+
+  it('a null/undefined probe (unreadable /proc, process gone) never reads as different', () => {
+    expect(isDifferentProcess(complete(), null)).toBe(false);
+    expect(isDifferentProcess(null, complete())).toBe(false);
+    expect(isDifferentProcess(undefined, undefined)).toBe(false);
+  });
+
+  it('a legacy record with no identity fields at all never reads as different', () => {
+    const legacy = { pid: 100 }; // e.g. an old {pid, startedAt}-only lock body
+    expect(isDifferentProcess(legacy, complete())).toBe(false);
+  });
+});