claude-code-session-manager 0.86.0 → 0.88.0

package/src/main/lib/queueStore.cjs

@@ -31,14 +31,13 @@
 const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
-const os = require('node:os');
 const crypto = require('node:crypto');
-const { allProjectCwds, activeProjectCwds } = require('../../../scripts/lib/activeSessions.cjs');
+const { allProjectCwds, activeProjectCwds, bustProjectCwdCache } = require('./activeSessions.cjs');
+const { classifyCwd } = require('./cwdClassify.cjs');
 const { assertOpsWrite, resolveOpsRoot, OPS_ROOT_DIR } = require('./opsOwnership.cjs');
 const { ScheduleJobSchema } = require('./scheduleJobSchema.cjs');
+const schedulerPaths = require('./schedulerPaths.cjs');
 
-const MACHINE_STATE_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'scheduler-machine.json');
-const LEGACY_QUEUE_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'scheduled-plans', 'queue.json');
 const OPS_DIRNAME = OPS_ROOT_DIR;
 const STATE_SUBPATH = ['scheduler', 'state'];
 
@@ -118,7 +117,12 @@ function projectHistoryPath(cwd) {
  */
 function queuePathOrSkip(cwd, context) {
   try {
-    return projectQueuePath(cwd);
+    const file = projectQueuePath(cwd);
+    // Unprovable project identity: the row stays dispatchable and is never
+    // dropped or emptied — the write itself is refused by assertOpsWrite.
+    const { kind, reason } = classifyCwd(cwd);
+    if (kind === 'unknown') console.warn(`[queueStore] ${context}: project identity unprovable for "${cwd}" (${reason}) — reads allowed, writes refused`);
+    return file;
   } catch (e) {
     if (e?.ephemeral) {
       console.warn(`[queueStore] ${context}: refusing ephemeral cwd "${cwd}" — ${e.message}`);
@@ -190,8 +194,10 @@ async function writeJsonAtomic(file, value) {
 // list briefly. Correctness fallback: a brand-new project appears at worst
 // CACHE_MS late, and its first write goes through writeSplit which busts the
 // cache.
-const CACHE_MS = 30_000;
-let cwdCache = { at: 0, cwds: [] };
+// Above the 60 s dispatch-loop interval so one pass never re-scans cold; the
+// cached array is frozen (shared, never mutated).
+const CACHE_MS = 120_000;
+let cwdCache = { at: 0, cwds: Object.freeze([]) };
 
 function stateCwds(opts) {
   const now = Date.now();
@@ -205,12 +211,18 @@ function stateCwds(opts) {
   }
   // ...and active projects are included even before their first write.
   for (const cwd of activeProjectCwds(undefined, opts)) add(cwd);
+  Object.freeze(cwds);
   if (!opts) cwdCache = { at: now, cwds };
   return cwds;
 }
 
 function bustCwdCache() {
-  cwdCache = { at: 0, cwds: [] };
+  cwdCache = { at: 0, cwds: Object.freeze([]) };
+  // Without this chain, activeSessions' own scan cache hands stateCwds a
+  // stale list even after this bust — turning a caller's "I just wrote a
+  // brand-new project's first state file, make it visible now" into a
+  // no-op until activeSessions' independent TTL expires.
+  bustProjectCwdCache();
 }
 
 // ---------- merged read ----------
@@ -226,6 +238,10 @@ function shapeMachine(data) {
     // classifyQueueStarvation's header for why the two must never merge.
     lastDispatchAttemptAt: data.lastDispatchAttemptAt ?? null,
     paused: data.paused ?? null,
+    // Upgrade-drain state (lib/upgradeDrain.cjs): deliberately NOT part of
+    // `paused`, so a rate-limit pause can neither overwrite it nor have the
+    // manual-clear cooldown swallow it.
+    drain: data.drain && typeof data.drain === 'object' ? data.drain : null,
     // Launch circuit breaker (lib/launchFailure.cjs): per-persona blocks and
     // the degraded-mode env a persona is currently launching with. Machine
     // state, not per-project: the broken thing is the installed CLI.
@@ -286,7 +302,6 @@ function findLongestValidJsonPrefix(raw) {
 // project's own ops root is the natural home for a machine-level log entry,
 // mirroring scheduler.cjs's own `job.cwd || DEFAULT_PROJECT_CWD` fallback for
 // cwd-less machine errors (schedulerBatch.cjs's DEFAULT_PROJECT_CWD).
-const MACHINE_STATE_LOG_CWD = path.join(os.homedir(), 'Projects', 'session-manager');
 
 // The truncated tail in the real 2026-09-11 tear contained an orphaned
 // `resumeAt` fragment with no way to reconstruct the `paused` object it
@@ -301,7 +316,7 @@ const PAUSED_HINT_RE = /"paused"|resumeAt/;
 function logMachineStateRecovery({ level, message, meta }) {
   try {
     const { appendError } = require('./opsErrorLog.cjs');
-    appendError({ cwd: MACHINE_STATE_LOG_CWD, scope: 'scheduler', level, message, meta });
+    appendError({ cwd: schedulerPaths.machineStateLogCwd(), scope: 'scheduler', level, message, meta });
   } catch { /* durable logging must never block recovery */ }
   console.error(`[queueStore] ${message}`);
 }
@@ -326,7 +341,7 @@ function buildMachineStateRecovery(raw, parseError) {
           ? '; the discarded tail looks like it contained paused/resumeAt data that could not '
             + 'be reconstructed — verify pause status manually'
           : ''),
-      meta: { path: MACHINE_STATE_PATH, prefixLength: prefix.prefixLength, totalLength: raw.length, pausedHint },
+      meta: { path: schedulerPaths.machineStatePath(), prefixLength: prefix.prefixLength, totalLength: raw.length, pausedHint },
     };
   }
   // No valid JSON prefix at all: fall back to defaults (shapeMachine({}) —
@@ -339,7 +354,7 @@ function buildMachineStateRecovery(raw, parseError) {
     message:
       `scheduler-machine.json unrecoverable (${parseError?.message}) — falling back to defaults `
       + 'so dispatch does not silently halt',
-    meta: { path: MACHINE_STATE_PATH, totalLength: raw.length },
+    meta: { path: schedulerPaths.machineStatePath(), totalLength: raw.length },
   };
 }
 
@@ -347,7 +362,7 @@ function recoverTornMachineStateSync(raw, parseError) {
   const recovery = buildMachineStateRecovery(raw, parseError);
   logMachineStateRecovery(recovery);
   try {
-    writeJsonAtomicSync(MACHINE_STATE_PATH, recovery.value);
+    writeJsonAtomicSync(schedulerPaths.machineStatePath(), recovery.value);
   } catch (e) {
     console.error(`[queueStore] failed to persist recovered machine state: ${e?.message}`);
   }
@@ -358,7 +373,7 @@ async function recoverTornMachineState(raw, parseError) {
   const recovery = buildMachineStateRecovery(raw, parseError);
   logMachineStateRecovery(recovery);
   try {
-    await writeJsonAtomic(MACHINE_STATE_PATH, recovery.value);
+    await writeJsonAtomic(schedulerPaths.machineStatePath(), recovery.value);
   } catch (e) {
     console.error(`[queueStore] failed to persist recovered machine state: ${e?.message}`);
   }
@@ -373,10 +388,10 @@ async function recoverTornMachineState(raw, parseError) {
 function loadMachineStateSync() {
   let raw;
   try {
-    raw = fs.readFileSync(MACHINE_STATE_PATH, 'utf8');
+    raw = fs.readFileSync(schedulerPaths.machineStatePath(), 'utf8');
   } catch (e) {
     if (e?.code === 'ENOENT') return {};
-    return { unreadable: `machine state unreadable: ${e?.message}`, unreadablePath: MACHINE_STATE_PATH };
+    return { unreadable: `machine state unreadable: ${e?.message}`, unreadablePath: schedulerPaths.machineStatePath() };
   }
   try {
     return { shaped: shapeMachine(JSON.parse(raw)) };
@@ -389,10 +404,10 @@ function loadMachineStateSync() {
 async function loadMachineState() {
   let raw;
   try {
-    raw = await fsp.readFile(MACHINE_STATE_PATH, 'utf8');
+    raw = await fsp.readFile(schedulerPaths.machineStatePath(), 'utf8');
   } catch (e) {
     if (e?.code === 'ENOENT') return {};
-    return { unreadable: `machine state unreadable: ${e?.message}`, unreadablePath: MACHINE_STATE_PATH };
+    return { unreadable: `machine state unreadable: ${e?.message}`, unreadablePath: schedulerPaths.machineStatePath() };
   }
   try {
     return { shaped: shapeMachine(JSON.parse(raw)) };
@@ -437,15 +452,17 @@ function shapeJobs(raw, file) {
 
 /**
  * readMergedSync(opts?) → { config, jobs, scheduledFor, lastRunAt, paused,
- * unreadable?, unreadablePath?, sourceCwds }.
+ * unreadable?, unreadablePath?, unreadableCwds, sourceCwds }.
  *
- * `unreadable` mirrors the old single-file semantics: ANY source file that
- * exists but fails to parse halts scheduling (never treat a project's queue
- * as empty because it read corrupt). `sourceCwds` records every project file
- * consulted so writeSplit can persist "this project now has zero jobs".
+ * `unreadable` is reserved for the machine-runtime file alone (a machine-wide
+ * halt). A project shard that exists but fails to read/parse is quarantined
+ * per cwd in `unreadableCwds: [{cwd, file, error}]` — other projects keep
+ * dispatching, and the torn shard is never treated as empty, recovered, or
+ * written. `sourceCwds` records every healthy project file consulted so
+ * writeSplit can persist "this project now has zero jobs".
  */
 function readMergedSync(opts) {
-  const out = { config: {}, jobs: [], scheduledFor: null, lastRunAt: null, lastDispatchAttemptAt: null, paused: null, launchBlocks: {}, launchMitigations: {}, invalidJobs: [] };
+  const out = { config: {}, jobs: [], scheduledFor: null, lastRunAt: null, lastDispatchAttemptAt: null, paused: null, drain: null, launchBlocks: {}, launchMitigations: {}, invalidJobs: [], unreadableCwds: [] };
   const sourceCwds = [];
   const machine = loadMachineStateSync();
   if (machine.shaped) {
@@ -468,8 +485,9 @@ function readMergedSync(opts) {
       sourceCwds.push(cwd);
     } catch (e) {
       if (e?.code === 'ENOENT') { sourceCwds.push(cwd); continue; }
-      out.unreadable = out.unreadable || `project queue unreadable (${file}): ${e?.message}`;
-      out.unreadablePath = out.unreadablePath || file;
+      // Quarantine this ONE shard; never recover or rewrite it (a job shard is a
+      // ledger — a prefix could time-travel a running row back to pending).
+      out.unreadableCwds.push({ cwd, file, error: e?.message ?? String(e) });
     }
   }
   defineSources(out, sourceCwds);
@@ -478,7 +496,7 @@ function readMergedSync(opts) {
 
 /** Async twin of readMergedSync for IPC hot paths. */
 async function readMerged(opts) {
-  const out = { config: {}, jobs: [], scheduledFor: null, lastRunAt: null, lastDispatchAttemptAt: null, paused: null, launchBlocks: {}, launchMitigations: {}, invalidJobs: [] };
+  const out = { config: {}, jobs: [], scheduledFor: null, lastRunAt: null, lastDispatchAttemptAt: null, paused: null, drain: null, launchBlocks: {}, launchMitigations: {}, invalidJobs: [], unreadableCwds: [] };
   const sourceCwds = [];
   const machine = await loadMachineState();
   if (machine.shaped) {
@@ -501,8 +519,9 @@ async function readMerged(opts) {
       sourceCwds.push(cwd);
     } catch (e) {
       if (e?.code === 'ENOENT') { sourceCwds.push(cwd); continue; }
-      out.unreadable = out.unreadable || `project queue unreadable (${file}): ${e?.message}`;
-      out.unreadablePath = out.unreadablePath || file;
+      // Quarantine this ONE shard; never recover or rewrite it (a job shard is a
+      // ledger — a prefix could time-travel a running row back to pending).
+      out.unreadableCwds.push({ cwd, file, error: e?.message ?? String(e) });
     }
   }
   defineSources(out, sourceCwds);
@@ -526,21 +545,25 @@ function defineSources(state, sourceCwds) {
  * deletions stick.
  */
 async function writeSplit(state, defaultCwd) {
-  await writeJsonAtomic(MACHINE_STATE_PATH, {
+  await writeJsonAtomic(schedulerPaths.machineStatePath(), {
     config: state.config,
     scheduledFor: state.scheduledFor ?? null,
     lastRunAt: state.lastRunAt ?? null,
     lastDispatchAttemptAt: state.lastDispatchAttemptAt ?? null,
     paused: state.paused ?? null,
+    drain: state.drain ?? null,
     launchBlocks: state.launchBlocks ?? {},
     launchMitigations: state.launchMitigations ?? {},
   });
 
+  // A quarantined shard is left byte-identical: never re-created or clobbered,
+  // even if merged rows carry that cwd.
+  const quarantined = new Set((state.unreadableCwds ?? []).map((u) => u.cwd));
   const byCwd = new Map();
-  for (const cwd of state.sourceCwds ?? []) byCwd.set(cwd, []);
+  for (const cwd of state.sourceCwds ?? []) if (!quarantined.has(cwd)) byCwd.set(cwd, []);
   for (const job of state.jobs ?? []) {
     const cwd = job.cwd || defaultCwd;
-    if (!cwd) continue; // nowhere to put it; job is dropped from persistence rather than crashing
+    if (!cwd || quarantined.has(cwd)) continue; // nowhere to put it; job is dropped from persistence rather than crashing
     if (!byCwd.has(cwd)) byCwd.set(cwd, []);
     byCwd.get(cwd).push(job);
   }
@@ -571,7 +594,7 @@ async function writeSplit(state, defaultCwd) {
 async function migrateLegacyGlobalQueue(defaultCwd) {
   let raw;
   try {
-    raw = await fsp.readFile(LEGACY_QUEUE_PATH, 'utf8');
+    raw = await fsp.readFile(schedulerPaths.legacyQueuePath(), 'utf8');
   } catch {
     return { migrated: false };
   }
@@ -583,8 +606,8 @@ async function migrateLegacyGlobalQueue(defaultCwd) {
     return { migrated: false, error: e?.message };
   }
 
-  if (!fs.existsSync(MACHINE_STATE_PATH)) {
-    await writeJsonAtomic(MACHINE_STATE_PATH, {
+  if (!fs.existsSync(schedulerPaths.machineStatePath())) {
+    await writeJsonAtomic(schedulerPaths.machineStatePath(), {
       config: legacy.config || {},
       scheduledFor: legacy.scheduledFor ?? null,
       lastRunAt: legacy.lastRunAt ?? null,
@@ -617,14 +640,12 @@ async function migrateLegacyGlobalQueue(defaultCwd) {
     }
   }
 
-  await fsp.rename(LEGACY_QUEUE_PATH, `${LEGACY_QUEUE_PATH}.retired-${Date.now()}`);
+  await fsp.rename(schedulerPaths.legacyQueuePath(), `${schedulerPaths.legacyQueuePath()}.retired-${Date.now()}`);
   bustCwdCache();
   return { migrated: true, moved, projects: byCwd.size };
 }
 
 module.exports = {
-  MACHINE_STATE_PATH,
-  LEGACY_QUEUE_PATH,
   STATE_SUBPATH,
   projectStateDir,
   projectQueuePath,
@@ -640,3 +661,7 @@ module.exports = {
   writeJsonAtomicSync,
   findLongestValidJsonPrefix,
 };
+
+// Lazy path getters (SM_SCHEDULER_HOME resolved at read, never at require).
+Object.defineProperty(module.exports, 'MACHINE_STATE_PATH', { get: schedulerPaths.machineStatePath, enumerable: true });
+Object.defineProperty(module.exports, 'LEGACY_QUEUE_PATH', { get: schedulerPaths.legacyQueuePath, enumerable: true });

package/src/main/lib/quietMachineLease.cjs

@@ -12,17 +12,22 @@
  */
 'use strict';
 
+const { appendAuditEvent } = require('./auditLog.cjs');
+const { isProvablyDead, DEFAULT_GRACE_MS } = require('./reservationExpiry.cjs');
+
 // slug of the job currently holding the lease, or null.
 let heldBySlug = null;
+let heldClaimedAt = 0;
 
 function isHeld() {
   return heldBySlug !== null;
 }
 
 /** acquire(slug) → true if the lease was free and is now held by `slug`. */
-function acquire(slug) {
+function acquire(slug, { claimedAt = Date.now() } = {}) {
   if (heldBySlug !== null) return false;
   heldBySlug = String(slug);
+  heldClaimedAt = claimedAt;
   return true;
 }
 
@@ -36,6 +41,17 @@ function release(slug) {
   return true;
 }
 
+/** expireDead — free a lease whose holder has no running row and is past the grace window
+ * (the lease never carries a pid; the row-liveness + grace proof is the whole test). */
+function expireDead({ liveSlugs, now = Date.now(), graceMs = DEFAULT_GRACE_MS } = {}) {
+  if (heldBySlug === null) return false;
+  const live = liveSlugs instanceof Set ? liveSlugs : new Set(liveSlugs || []);
+  if (!isProvablyDead({ claimedAt: heldClaimedAt, pid: null }, { live: live.has(heldBySlug), now, graceMs })) return false;
+  appendAuditEvent('quiet_lease_expired', { slug: heldBySlug });
+  heldBySlug = null;
+  return true;
+}
+
 function holder() {
   return heldBySlug;
 }
@@ -43,6 +59,7 @@ function holder() {
 /** Test hook: force the lease back to free. */
 function __resetForTests() {
   heldBySlug = null;
+  heldClaimedAt = 0;
 }
 
-module.exports = { isHeld, acquire, release, holder, __resetForTests };
+module.exports = { isHeld, acquire, release, expireDead, holder, __resetForTests };

package/src/main/lib/reaperHelpers.cjs

@@ -36,26 +36,37 @@ function claudePidAlive(pid) {
 }
 
 /**
- * findLiveProcessForJob(job, { worktreeDir }) → pid | null
+ * findLiveProcessForJob(job, { worktreeDir, runCwd }) → pid | null
  *
  * Positive liveness scan for a 'running' row whose `runtime.pid` is missing —
  * the case a missing pid must NOT be read as "the process is gone" (2026-09-06
  * incident: 234-uranus-eight-tails-ox marked failed/never_ran while PID
  * 2174739 was a live `claude -p` still writing to that job's own worktree).
  *
- * Linux-`/proc` only. Scans every numeric `/proc/<pid>` entry and matches
- * either: `/proc/<pid>/cwd` resolves to `worktreeDir` (or a path nested under
- * it), or `/proc/<pid>/cmdline` contains both `claude` and the job's slug
- * (fallback for a worktree-disabled/in-place run, where there is no dedicated
- * worktreeDir to match against). Returns the first matching pid, or null if
- * none is found.
+ * Linux-`/proc` only. Scans every numeric `/proc/<pid>` entry and matches any
+ * of, in order:
+ *  - `/proc/<pid>/cwd` resolves to `worktreeDir` (or a path nested under it)
+ *    — sufficient alone, no cmdline check needed.
+ *  - `/proc/<pid>/cmdline` contains both `claude` and the job's slug —
+ *    fallback for a worktree-disabled/in-place run with no dedicated
+ *    worktreeDir to match against.
+ *  - `/proc/<pid>/cwd` resolves to `runCwd` (or nested under it) AND
+ *    `/proc/<pid>/cmdline` contains `claude` (2026-09-13 incident:
+ *    runId 2026-09-13T16-15-56-818Z ran in-place in the shared tree — no
+ *    worktree, and dispatch never puts the slug into argv — so neither of
+ *    the above could ever match a live pid 3138458). `runCwd` is deliberately
+ *    NEVER matched alone: several concurrent jobs commonly share one tree's
+ *    cwd, so a bare cwd match without the process-identity check would
+ *    cross-match the wrong job's process.
+ *
+ * Returns the first matching pid, or null if none is found.
  *
  * Safe fallback by construction: on any platform without `/proc` (macOS,
  * Windows) `fs.readdirSync('/proc')` throws and this returns null immediately
  * — i.e. exactly today's behaviour (fail toward terminalizing), never a hang
  * or a thrown error propagating to the caller.
  */
-function findLiveProcessForJob(job, { worktreeDir } = {}) {
+function findLiveProcessForJob(job, { worktreeDir, runCwd } = {}) {
   const slug = job?.slug;
   let entries;
   try {
@@ -67,27 +78,107 @@ function findLiveProcessForJob(job, { worktreeDir } = {}) {
     if (!/^\d+$/.test(name)) continue;
     const pid = Number(name);
     if (!pid || pid <= 1) continue;
-    if (worktreeDir) {
+
+    let cwdLink = null;
+    if (worktreeDir || runCwd) {
       try {
-        const cwdLink = fs.readlinkSync(`/proc/${pid}/cwd`);
-        if (cwdLink === worktreeDir || cwdLink.startsWith(worktreeDir + path.sep)) return pid;
+        cwdLink = fs.readlinkSync(`/proc/${pid}/cwd`);
       } catch {
         // Process exited mid-scan, or permission denied — try the argv
         // fallback below before giving up on this pid.
       }
     }
-    if (slug) {
+
+    if (worktreeDir && cwdLink && (cwdLink === worktreeDir || cwdLink.startsWith(worktreeDir + path.sep))) {
+      return pid;
+    }
+
+    let cmd = null;
+    if (slug || (runCwd && cwdLink)) {
       try {
-        const cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
-        if (/\bclaude\b/.test(cmd) && cmd.includes(slug)) return pid;
+        cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
       } catch {
         // Same as above — process gone or unreadable, keep scanning.
       }
     }
+
+    if (slug && cmd && /\bclaude\b/.test(cmd) && cmd.includes(slug)) return pid;
+
+    if (runCwd && cwdLink && cmd && /\bclaude\b/.test(cmd) &&
+        (cwdLink === runCwd || cwdLink.startsWith(runCwd + path.sep))) {
+      return pid;
+    }
   }
   return null;
 }
 
+/**
+ * readSpawnedPidFromLog(logPath) → pid | null
+ *
+ * Recovers the pid a pidless row's spawn actually produced by reading the
+ * run's own log — proof of life that pre-dates and is independent of the
+ * `runtime.pid` persistence this reap path exists to route around (2026-09-13
+ * incident: the mutate that stamps runtime.pid failed silently while the
+ * spawn itself, and this exact log line, succeeded). Reads only the first
+ * ~8KB — scheduler.cjs's spawnJob writes `[scheduler] spawned pid=<n> ...`
+ * synchronously right after fork, always near the top of the log — so this
+ * stays cheap against a multi-MB log. Pure IO, never throws: a missing file,
+ * an empty file, or a log with no such line all return null.
+ */
+function readSpawnedPidFromLog(logPath) {
+  if (!logPath) return null;
+  let fd;
+  try {
+    fd = fs.openSync(logPath, 'r');
+    const buf = Buffer.alloc(8192);
+    const bytesRead = fs.readSync(fd, buf, 0, buf.length, 0);
+    const text = buf.toString('utf8', 0, bytesRead);
+    const match = text.match(/\[scheduler\] spawned pid=(\d+)/);
+    if (!match) return null;
+    const pid = Number(match[1]);
+    return Number.isFinite(pid) && pid > 1 ? pid : null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* already closed / never opened */ }
+    }
+  }
+}
+
+/**
+ * readLogMtimeMs(logPath) → number | null
+ *
+ * Same never-throws IO contract as logHasOutput — returns the run log's
+ * last-modified time, or null when it can't be statted (missing file,
+ * permission denied).
+ */
+function readLogMtimeMs(logPath) {
+  if (!logPath) return null;
+  try {
+    return fs.statSync(logPath).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * isLogFresh(logMtimeMs, now, windowMs) → boolean
+ *
+ * Pure predicate: true when a run log was modified within `windowMs` of
+ * `now`. A log that grew recently is positive, independent proof its process
+ * is still alive — stronger evidence than "no runtime.pid recorded", which is
+ * only bookkeeping about a side-channel write that can fail on its own (see
+ * readSpawnedPidFromLog's header). Returns false for a missing/invalid mtime
+ * or window so a caller that couldn't stat the log falls through to the
+ * existing reap logic rather than treating "unknown" as "fresh".
+ */
+function isLogFresh(logMtimeMs, now, windowMs) {
+  if (typeof logMtimeMs !== 'number' || Number.isNaN(logMtimeMs)) return false;
+  if (typeof windowMs !== 'number' || windowMs <= 0) return false;
+  return (now - logMtimeMs) < windowMs;
+}
+
 /**
  * True when `logPath` exists and has non-zero content — the literal "did the
  * run dir produce any log output" check that gates whether a pidless reap may
@@ -224,6 +315,20 @@ const ORPHAN_REQUEUE_CAP = 5;
  * work (2026-09-06 incident — see findLiveProcessForJob's header). Omitting
  * `findLiveProcess` (existing callers/tests) preserves prior behaviour
  * exactly: every pidless row past grace reaps, none are ever recovered.
+ *
+ * Two more optional injections, checked BEFORE `findLiveProcess`, for a
+ * pidless row past grace (2026-09-13 incident — see readSpawnedPidFromLog's
+ * and isLogFresh's own headers):
+ *  - `getLogMtimeMs` (`(job) → number | null`): if the row's run log was
+ *    modified within `logFreshWindowMs`, the row is skipped entirely — not
+ *    pushed to `reapable` OR `recovered` — because a growing log is positive
+ *    proof of life even with no pid evidence at all. One `warnings` entry is
+ *    still emitted so a permanently-pidless-but-chatty row stays visible.
+ *  - `getLogPid` (`(job) → pid | null`): reads the run's own log for the pid
+ *    its spawn actually produced. If `pidAlive(pid)` is true, the row is
+ *    diverted into `recovered` exactly like a `findLiveProcess` hit.
+ * Both default to a no-op when omitted, so existing callers/tests are
+ * unaffected.
  */
 /**
  * Pure, never-throws formatter for the dispatch-phase breadcrumb appended to
@@ -246,7 +351,47 @@ function formatDispatchPhaseSuffix(j) {
     : ` (last dispatch phase: ${j.dispatchPhase})`;
 }
 
-function selectReapableJobs(jobs, now, { pidAlive, grace, findLiveProcess } = {}) {
+/**
+ * resolvePidlessFailureOverride(job) → { verdict, landedCommit, reason } | null
+ *
+ * The evidence-before-failure guard this PRD adds (1173): a pidless reap
+ * about to stamp 'failed' purely because `runtime.pid` was never recorded
+ * must first check whether THIS ROW already carries a `landedCommit` — proof
+ * (from an earlier dispatch of the same slug, since `landedCommit` is
+ * deliberately never cleared by a reset — see scheduler.cjs's comment near
+ * resetJobFields) that a real commit landed on the branch. Returns null when
+ * there is no such evidence, leaving the existing 'failed' transition for a
+ * genuinely-never-spawned row completely untouched.
+ *
+ * DESTINATION CHOICE — needs_review, never completed. `landedCommit` is
+ * real git evidence (it is only ever stamped from an actual HEAD advance or
+ * a proven branch-integration — see jobLandedCommitThisRun / the dead-pid
+ * reap's own isBranchAlreadyIntegrated+computeCommittedDuringRun proof in
+ * scheduler.cjs), so it is never speculative in the sense of "guessed before
+ * the work ran". But the pidless-reap path performs NO fresh integration
+ * check of its own for the CURRENT run (that proof only runs for the dead-pid
+ * branch's `dead` entries with outcome==='success' — see
+ * scheduler.cjs's integrationResults loop) — so at this call site there is no
+ * re-verified guarantee that the recorded commit corresponds to *this*
+ * dispatch rather than surviving, unreaped, from an earlier one. Real
+ * evidence that under-specifies correspondence to the current run is exactly
+ * the needs_review shape, not completed: a human (or the finish-protocol
+ * commit-guard on the next dispatch) can resolve it conclusively with
+ * `git show <sha>`, but this pure predicate must not guess.
+ */
+function resolvePidlessFailureOverride(job) {
+  const landedCommit = job?.landedCommit || null;
+  if (!landedCommit) return null;
+  return {
+    verdict: 'pidless_reap_with_landed_commit',
+    landedCommit,
+    reason: `pidless reap found no runtime.pid, but this row already carries landedCommit ${landedCommit} — routing to needs_review instead of failed; verify with \`git show ${landedCommit}\``,
+  };
+}
+
+function selectReapableJobs(jobs, now, {
+  pidAlive, grace, findLiveProcess, getLogMtimeMs, getLogPid, logFreshWindowMs,
+} = {}) {
   const reapable = [];
   const warnings = [];
   const recovered = [];
@@ -265,6 +410,22 @@ function selectReapableJobs(jobs, now, { pidAlive, grace, findLiveProcess } = {}
     }
     const ageMs = now - startedAt;
     if (ageMs < grace) continue; // spawn may still be mid-flight
+
+    const logMtimeMs = typeof getLogMtimeMs === 'function' ? getLogMtimeMs(j) : null;
+    if (isLogFresh(logMtimeMs, now, logFreshWindowMs)) {
+      warnings.push({
+        slug: j.slug,
+        reason: `pidless row skipped — run log modified ${Math.round((now - logMtimeMs) / 1000)}s ago, still alive by log evidence`,
+      });
+      continue; // neither reapable nor recovered — the log proves it's alive
+    }
+
+    const logPid = typeof getLogPid === 'function' ? getLogPid(j) : null;
+    if (logPid && pidAlive(logPid)) {
+      recovered.push({ slug: j.slug, pid: logPid });
+      continue;
+    }
+
     const livePid = typeof findLiveProcess === 'function' ? findLiveProcess(j) : null;
     if (livePid) {
       recovered.push({ slug: j.slug, pid: livePid });
@@ -275,6 +436,7 @@ function selectReapableJobs(jobs, now, { pidAlive, grace, findLiveProcess } = {}
       pid: null,
       pidless: true,
       reason: `reaped: no runtime.pid recorded after ${Math.round(grace / 60_000)}m — spawn never completed${formatDispatchPhaseSuffix(j)}`,
+      failureOverride: resolvePidlessFailureOverride(j),
     });
   }
   return { reapable, warnings, recovered };
@@ -343,7 +505,11 @@ module.exports = {
   findLiveProcessForJob,
   logHasOutput,
   resolvePidlessGateOutcome,
+  resolvePidlessFailureOverride,
   isAlreadySatisfiedOnMain,
   resolveCommitGuardOutcome,
   formatDispatchPhaseSuffix,
+  readSpawnedPidFromLog,
+  readLogMtimeMs,
+  isLogFresh,
 };

package/src/main/lib/reservationExpiry.cjs

@@ -0,0 +1,30 @@
+/**
+ * reservationExpiry.cjs — the single fail-CLOSED "is this reservation's owner
+ * provably dead?" predicate shared by sessionSlots, quietMachineLease, the
+ * investigation set and gitWorktree's accounting. A reservation is released
+ * only on proof: no live row for its slug AND (a stamped pid that is dead, or
+ * no pid ever stamped and claimedAt older than graceMs). Anything ambiguous
+ * (live row, live pid, inside the grace window, claimed after the pass began)
+ * is kept. Never signals a process.
+ */
+'use strict';
+
+const DEFAULT_GRACE_MS = 10 * 60 * 1000;
+
+function defaultPidAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (e) { return e?.code === 'EPERM'; }
+}
+
+/**
+ * @param {{ claimedAt: number, pid: number|null }} res
+ * @param {{ live: boolean, pidAlive?: (pid:number)=>boolean, now: number, graceMs?: number }} ctx
+ */
+function isProvablyDead(res, { live, pidAlive = defaultPidAlive, now, graceMs = DEFAULT_GRACE_MS }) {
+  if (live) return false;
+  // Made after the pass began (i.e. this tick) — never expire it.
+  if (!Number.isFinite(res.claimedAt) || res.claimedAt > now) return false;
+  if (Number.isInteger(res.pid) && res.pid > 0) return !pidAlive(res.pid);
+  return now - res.claimedAt > graceMs;
+}
+
+module.exports = { isProvablyDead, defaultPidAlive, DEFAULT_GRACE_MS };

package/src/main/lib/runClaudeP.cjs

@@ -15,7 +15,8 @@
  */
 
 const { spawn } = require('node:child_process');
-const { resolveClaudeBin } = require('./claudeBin.cjs');
+const { resolveClaudeBin, claudeSpawnTarget } = require('./claudeBin.cjs');
+const { withProcRole } = require('./cleanEnv.cjs');
 
 const MAX_OUT_BYTES = 8 * 1024 * 1024;
 
@@ -31,7 +32,8 @@ function runClaudeP(prompt, { model = 'sonnet', timeoutMs = 180_000, systemPromp
       '--output-format', 'text',
     ];
     if (systemPrompt) args.push('--append-system-prompt', systemPrompt);
-    const child = spawn(bin, args, { env: { ...process.env, SM_KG_INTERNAL: '1' }, stdio: ['ignore', 'pipe', 'pipe'] });
+    const target = claudeSpawnTarget('aux', 'runclaudep', bin);
+    const child = spawn(target.command, args, { env: withProcRole({ ...process.env, SM_KG_INTERNAL: '1' }, 'aux'), stdio: ['ignore', 'pipe', 'pipe'], ...(target.argv0 ? { argv0: target.argv0 } : {}) });
     let out = '';
     let err = '';
     let killedForSize = false;