claude-code-session-manager 0.87.0 → 0.88.0

package/src/main/__tests__/scheduler-boot-orphans.test.cjs

@@ -4,44 +4,106 @@
  * external watchdog's reconcileQueueOffline(), which is now deleted from
  * src/main/lib/watchdogHelpers.cjs).
  *
- * Covers the two behaviors most likely to drift in the move:
- *   - a still-alive orphaned pid must be DEFERRED, never classified from its
- *     (possibly still-being-written) log in the same pass (partitionBootOrphans)
+ * Covers:
+ *   - a proven-alive row is ADOPTED (left running, never signalled) and only
+ *     proven-dead / exited rows are finalized (partitionBootOrphans)
  *   - the ORPHAN_REQUEUE_CAP re-queue/exhaustion boundary (applyOrphanOutcome)
  *
- * Run: timeout 120 node --test src/main/__tests__/scheduler-boot-orphans.test.cjs
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-boot-orphans.test.cjs
  */
 
 'use strict';
 
-const { test } = require('node:test');
+const { spawn } = require('node:child_process');
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 
+const {
+  writeSupervisorRecord,
+} = require('../lib/jobSupervisorRecord.cjs');
 const {
   partitionBootOrphans,
   applyOrphanOutcome,
-  feedbackSweepDue,
-  FEEDBACK_SWEEP_TICK_INTERVAL,
-  sweepFeedback,
 } = require('../scheduler.cjs');
 const { ORPHAN_REQUEUE_CAP } = require('../lib/reaperHelpers.cjs');
 
-test('partitionBootOrphans defers a running job whose pid is still alive', () => {
+function spawnStub() {
+  return spawn(process.execPath, ['-e', 'setTimeout(() => {}, 30000)'], { stdio: 'ignore' });
+}
+
+function withRunsDir(fn) {
+  const runsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sched-boot-runs-'));
+  try { return fn(runsDir); } finally { fs.rmSync(runsDir, { recursive: true, force: true }); }
+}
+
+test('a running row with a live pid survives boot untouched — adopted, no kill issued', () => {
+  const child = spawnStub();
+  const killSpy = vi.spyOn(process, 'kill');
+  try {
+    const jobs = [{ slug: 'alive-orphan', status: 'running', runtime: { pid: child.pid } }];
+    const { immediate, adopted } = partitionBootOrphans(jobs, { pidAlive: (pid) => pid === child.pid, runsDir: os.tmpdir() });
+    assert.deepEqual(adopted, ['alive-orphan']);
+    assert.deepEqual(immediate, []);
+    assert.equal(killSpy.mock.calls.length, 0, 'boot classification must never signal an executor');
+    assert.equal(jobs[0].status, 'running', 'the row must not transition');
+  } finally {
+    killSpy.mockRestore();
+    child.kill();
+  }
+});
+
+test('a dead-pid row and a pidless row with no liveness evidence are finalized', () => {
   const jobs = [
-    { slug: 'alive-orphan', status: 'running', runtime: { pid: 111 } },
     { slug: 'dead-orphan', status: 'running', runtime: { pid: 222 } },
     { slug: 'no-pid-orphan', status: 'running', runtime: {} },
     { slug: 'not-running', status: 'pending' },
   ];
-  const isAlive = (pid) => pid === 111;
+  const { immediate, adopted } = partitionBootOrphans(jobs, { pidAlive: () => false, runsDir: os.tmpdir() });
+  assert.deepEqual(immediate.sort(), ['dead-orphan', 'no-pid-orphan']);
+  assert.deepEqual(adopted, []);
+});
 
-  const { immediate, deferred } = partitionBootOrphans(jobs, isAlive);
+test('a pidless row is adopted on any one of the reaper liveness signals', () => {
+  const job = () => ({ slug: 'p', status: 'running', runtime: {} });
+  const base = { pidAlive: (pid) => pid === 77, runsDir: os.tmpdir(), now: 1_000_000 };
+  assert.deepEqual(partitionBootOrphans([job()], { ...base, getLogMtimeMs: () => 999_000, logFreshWindowMs: 5_000 }).adopted, ['p'], 'fresh log');
+  assert.deepEqual(partitionBootOrphans([job()], { ...base, getLogPid: () => 77 }).adopted, ['p'], 'log pid alive');
+  assert.deepEqual(partitionBootOrphans([job()], { ...base, findLiveProcess: () => 88 }).adopted, ['p'], '/proc scan');
+  assert.deepEqual(partitionBootOrphans([job()], { ...base, getLogMtimeMs: () => 1_000, logFreshWindowMs: 5_000 }).immediate, ['p'], 'stale log');
+});
 
-  assert.deepEqual(deferred, ['alive-orphan']);
-  assert.deepEqual(immediate.sort(), ['dead-orphan', 'no-pid-orphan']);
+test('a row whose supervisor record says exited is finalized from its meta, not adopted', () => {
+  withRunsDir((runsDir) => {
+    const runDir = path.join(runsDir, 'run-1');
+    fs.mkdirSync(runDir, { recursive: true });
+    writeSupervisorRecord({ runDir, slug: 'exited-row', pid: 4242, runId: 'run-1', startedAt: Date.now() });
+    fs.writeFileSync(path.join(runDir, 'exited-row.meta.json'), JSON.stringify({ slug: 'exited-row', exitCode: 0 }));
+    const job = { slug: 'exited-row', status: 'running', runId: 'run-1', runtime: { pid: 4242 } };
+    // Even with the pid reported alive (recycled/lingering), the exit marker wins.
+    const { immediate, adopted } = partitionBootOrphans([job], { pidAlive: () => true, runsDir });
+    assert.deepEqual(immediate, ['exited-row']);
+    assert.deepEqual(adopted, []);
+    applyOrphanOutcome(job, 'success');
+    assert.equal(job.status, 'completed');
+  });
+});
+
+test('a record with a live, same-identity pid is adopted; a dead record without an exit marker is finalized', () => {
+  withRunsDir((runsDir) => {
+    const runDir = path.join(runsDir, 'run-2');
+    fs.mkdirSync(runDir, { recursive: true });
+    writeSupervisorRecord({ runDir, slug: 'live-rec', pid: 31337, runId: 'run-2', startedAt: Date.now() });
+    writeSupervisorRecord({ runDir, slug: 'dead-rec', pid: 31338, runId: 'run-2', startedAt: Date.now() });
+    const jobs = [
+      { slug: 'live-rec', status: 'running', runId: 'run-2', runtime: { pid: 31337 } },
+      { slug: 'dead-rec', status: 'running', runId: 'run-2', runtime: { pid: 31338 } },
+    ];
+    const { immediate, adopted } = partitionBootOrphans(jobs, { pidAlive: (pid) => pid === 31337, identityOf: () => null, runsDir });
+    assert.deepEqual(adopted, ['live-rec']);
+    assert.deepEqual(immediate, ['dead-rec']);
+  });
 });
 
 test('partitionBootOrphans ignores non-running jobs entirely', () => {
@@ -49,9 +111,9 @@ test('partitionBootOrphans ignores non-running jobs entirely', () => {
     { slug: 'a', status: 'completed', runtime: { pid: 1 } },
     { slug: 'b', status: 'failed', runtime: { pid: 2 } },
   ];
-  const { immediate, deferred } = partitionBootOrphans(jobs, () => true);
+  const { immediate, adopted } = partitionBootOrphans(jobs, { pidAlive: () => true, runsDir: os.tmpdir() });
   assert.deepEqual(immediate, []);
-  assert.deepEqual(deferred, []);
+  assert.deepEqual(adopted, []);
 });
 
 test('applyOrphanOutcome: success finalizes to completed, clears runtime', () => {
@@ -89,84 +151,3 @@ test('applyOrphanOutcome: no_result at the cap fails terminally instead of re-qu
   assert.match(job.error, new RegExp(`exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts`));
   assert.equal(job.runtime, undefined);
 });
-
-// ── feedback sweep moved into the 60s poll tick (PRD 686) ───────────────────
-
-test('feedbackSweepDue gates on the tick interval, not every tick', () => {
-  for (let i = 1; i < FEEDBACK_SWEEP_TICK_INTERVAL; i++) {
-    assert.equal(feedbackSweepDue(i), false, `tick ${i} should not be due yet`);
-  }
-  assert.equal(feedbackSweepDue(FEEDBACK_SWEEP_TICK_INTERVAL), true);
-  assert.equal(feedbackSweepDue(FEEDBACK_SWEEP_TICK_INTERVAL + 1), true);
-});
-
-test('scheduler.cjs reuses watchdogHelpers.sweep verbatim (no forked copy)', () => {
-  const { sweep } = require('../lib/watchdogHelpers.cjs');
-  assert.equal(sweepFeedback, sweep, 'scheduler.cjs must import the same sweep function, not reimplement it');
-});
-
-function makeTmpDir() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'sched-boot-sweep-'));
-}
-
-function makeQueue(base) {
-  const queuePath = path.join(base, 'queue.json');
-  fs.writeFileSync(queuePath, JSON.stringify({ version: 1, jobs: [], paused: null }, null, 2));
-  return queuePath;
-}
-
-const FAKE_SKILL = '---\nname: process-feedback\ndescription: x\n---\n\n# process-feedback\n\nbody\n';
-const FAKE_STANDARDS = '# Engineering standards\n\nbody\n';
-
-test('the poll-tick sweep call emits a PRD for an active project with open feedback, and skips one outside the 90-min window', () => {
-  const base = makeTmpDir();
-  try {
-    // Active project (10 min ago) with open feedback → should emit.
-    const activeProj = path.join(base, 'active-proj');
-    fs.mkdirSync(path.join(activeProj, 'session-manager-operations', 'feedback'), { recursive: true });
-    fs.writeFileSync(path.join(activeProj, 'session-manager-operations', 'feedback', '2026-01-01-item.md'), '# Item\n');
-
-    // Stale project (120 min ago, outside the 90-min window) with open feedback → should NOT be scanned at all.
-    const staleProj = path.join(base, 'stale-proj');
-    fs.mkdirSync(path.join(staleProj, 'session-manager-operations', 'feedback'), { recursive: true });
-    fs.writeFileSync(path.join(staleProj, 'session-manager-operations', 'feedback', '2026-01-01-item.md'), '# Item\n');
-
-    // Active project with no open feedback → scanned but not emitted.
-    const noFeedbackProj = path.join(base, 'no-feedback-proj');
-    fs.mkdirSync(noFeedbackProj, { recursive: true });
-
-    const projectsDir = path.join(base, 'projects');
-    const recent = new Date(Date.now() - 10 * 60 * 1000);
-    const stale = new Date(Date.now() - 120 * 60 * 1000);
-    for (const [slug, cwd, mtime] of [
-      ['slug-active', activeProj, recent],
-      ['slug-stale', staleProj, stale],
-      ['slug-no-feedback', noFeedbackProj, recent],
-    ]) {
-      const projDir = path.join(projectsDir, slug);
-      fs.mkdirSync(projDir, { recursive: true });
-      const fp = path.join(projDir, 'a.jsonl');
-      fs.writeFileSync(fp, JSON.stringify({ cwd }) + '\n');
-      fs.utimesSync(fp, mtime, mtime);
-    }
-
-    const prdsDir = path.join(base, 'prds');
-    fs.mkdirSync(prdsDir);
-    const queuePath = makeQueue(base);
-    const skillPath = path.join(base, 'SKILL.md');
-    const standardsPath = path.join(base, 'standards.md');
-    fs.writeFileSync(skillPath, FAKE_SKILL);
-    fs.writeFileSync(standardsPath, FAKE_STANDARDS);
-
-    const result = sweepFeedback({ projectsDir, prdsDir, queuePath, skillPath, standardsPath });
-
-    assert.equal(result.scanned, 2, 'only the two in-window projects should be scanned');
-    assert.equal(result.emitted, 1, 'only the active project with open feedback should get a PRD');
-
-    const emittedFiles = fs.readdirSync(prdsDir).filter((f) => f.endsWith('.md'));
-    assert.equal(emittedFiles.length, 1);
-    assert.match(emittedFiles[0], /feedback-active-proj\.md$/);
-  } finally {
-    fs.rmSync(base, { recursive: true, force: true });
-  }
-});

package/src/main/__tests__/scheduler-default-eligible-heal.test.cjs

@@ -0,0 +1,161 @@
+/**
+ * scheduler-default-eligible-heal.test.cjs — the periodic heal ladder is
+ * default-ELIGIBLE (2026-09-18, 1229-fo-03 parked shared_tree_reverted and
+ * blocked 19 of 20 pending rows because that verdict was on no allow-list).
+ *
+ * Covers: any needs_review verdict is a candidate unless named in
+ * RESCAN_EXCLUDED_VERDICTS; the evidence rung is bounded; a row that cannot
+ * heal terminates under the bounded ladder; health names a silent blocker.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-default-eligible-heal.test.cjs
+ */
+
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+process.env.HOME = fs.mkdtempSync(path.join(os.tmpdir(), 'default-eligible-heal-test-'));
+
+const {
+  isRescanCandidate,
+  isTranscriptRescannable,
+  isStrandedAutoFixPark,
+  isEligibleForNeedsReviewAutoResolve,
+  shouldRunPeriodicReverify,
+  selectEvidenceScanTargets,
+  selectAutoFixTargets,
+  selectMechanicalRecoveryTarget,
+  selectResumeRecoveryTarget,
+  applyNeedsReviewAutoResolve,
+  RESCAN_EXCLUDED_VERDICTS,
+  RESCANNABLE_VERDICTS,
+  EVIDENCE_SCAN_MAX_PER_PASS,
+  EVIDENCE_SCAN_MIN_INTERVAL_MS,
+  REVERIFY_INTERVAL_MS,
+  NEEDS_REVIEW_RESOLVE_CAP,
+} = require('../scheduler.cjs');
+const { evaluateBlockingParkHealth } = require('../health.cjs');
+
+const row = (o = {}) => ({ slug: '10-x', status: 'needs_review', runId: 'r1', cwd: '/p', ...o });
+
+test('shared_tree_reverted is a rescan candidate without being on any list', () => {
+  assert.equal(RESCANNABLE_VERDICTS.has('shared_tree_reverted'), false);
+  assert.equal(isRescanCandidate(row({ verifierVerdict: 'shared_tree_reverted' })), true);
+});
+
+test('an invented verdict name the code has never seen is a rescan candidate', () => {
+  const j = row({ verifierVerdict: 'some_future_guard_verdict' });
+  assert.equal(isRescanCandidate(j), true);
+  assert.equal(shouldRunPeriodicReverify([j]), true);
+  // Not transcript-rescannable: it gets the evidence rung, never a verifyRun heal.
+  assert.equal(isTranscriptRescannable(j), false);
+  assert.deepEqual(selectEvidenceScanTargets([j]).map((x) => x.slug), ['10-x']);
+});
+
+test('a needs_review row with no runId and no verdict is still a candidate', () => {
+  assert.equal(isRescanCandidate({ slug: 's', status: 'needs_review' }), true);
+});
+
+test('only the named exclusions are refused, each verdict in the set', () => {
+  for (const v of RESCAN_EXCLUDED_VERDICTS) assert.equal(isRescanCandidate(row({ verifierVerdict: v })), false, v);
+  assert.deepEqual([...RESCAN_EXCLUDED_VERDICTS].sort(), ['budget_exceeded', 'uncommitted_changes', 'worktree_integration_failed']);
+});
+
+test('rescannable verdict keeps the transcript rung as a hint', () => {
+  assert.equal(isTranscriptRescannable(row({ verifierVerdict: 'transcript_errors' })), true);
+  assert.deepEqual(selectEvidenceScanTargets([row({ verifierVerdict: 'transcript_errors' })]), []);
+});
+
+test('1229-fo-03 shape: stranded auto-fix park is an auto-resolve door AND an evidence-scan target', () => {
+  const j = row({ verifierVerdict: 'shared_tree_reverted', autoFixAttempted: true });
+  assert.equal(isStrandedAutoFixPark(j, [j]), true);
+  assert.equal(isEligibleForNeedsReviewAutoResolve(j, [j]), true);
+  assert.equal(selectEvidenceScanTargets([j]).length, 1, 'looksDone evidence is now computed for it, so the door can fire');
+});
+
+test('a live auto-fix history that is not an auto-resolve door gets no evidence scan (PRD 1136)', () => {
+  const j = row({ verifierVerdict: 'some_future_guard_verdict', autoFixAttempted: true, autoFixOutcome: 'plan' });
+  assert.equal(selectEvidenceScanTargets([j]).length, 0);
+});
+
+test('cost bound: per-pass cap, looksDone skip, and per-row re-scan throttle', () => {
+  const now = Date.now();
+  const many = Array.from({ length: 100 }, (_, i) => row({ slug: `${i}-p`, verifierVerdict: 'v_new' }));
+  assert.equal(selectEvidenceScanTargets(many, now).length, EVIDENCE_SCAN_MAX_PER_PASS);
+  const done = many.map((j) => ({ ...j, looksDone: { commits: ['a'] } }));
+  assert.equal(selectEvidenceScanTargets(done, now).length, 0);
+  const fresh = many.map((j) => ({ ...j, evidenceScannedAt: new Date(now - EVIDENCE_SCAN_MIN_INTERVAL_MS + 1000).toISOString() }));
+  assert.equal(selectEvidenceScanTargets(fresh, now).length, 0);
+  // never-scanned rows go before stale-scanned ones
+  const mixed = [
+    row({ slug: 'old', verifierVerdict: 'v', evidenceScannedAt: new Date(now - 10 * EVIDENCE_SCAN_MIN_INTERVAL_MS).toISOString() }),
+    row({ slug: 'never', verifierVerdict: 'v' }),
+  ];
+  assert.equal(selectEvidenceScanTargets(mixed, now)[0].slug, 'never');
+});
+
+test('unhealable row terminates: N passes yield a bounded number of recovery attempts, reason intact', () => {
+  let now = Date.now();
+  const job = row({ slug: '20-stuck', verifierVerdict: 'some_future_guard_verdict' });
+  const jobs = [job];
+  let evidenceScans = 0;
+  let autoFixDispatches = 0;
+  let resumeOrMechanical = 0;
+  const PASSES = 500;
+  for (let n = 0; n < PASSES; n++) {
+    now += REVERIFY_INTERVAL_MS;
+    for (const t of selectEvidenceScanTargets(jobs, now)) { evidenceScans++; t.evidenceScannedAt = new Date(now).toISOString(); }
+    resumeOrMechanical += jobs.filter((j) => selectMechanicalRecoveryTarget(j) || selectResumeRecoveryTarget(j)).length;
+    for (const t of selectAutoFixTargets(jobs, { fixSlugExists: () => false, resolveJobRunId: () => 'r1' })) {
+      autoFixDispatches++;
+      // what reverifyNeedsReview stamps before spawning
+      t.autoFixRetries = t.autoFixAttempted === true ? (t.autoFixRetries ?? 0) + 1 : t.autoFixRetries;
+      t.autoFixAttempted = true;
+    }
+  }
+  assert.ok(autoFixDispatches <= 2, `auto-fix dispatched ${autoFixDispatches}x`);
+  assert.equal(resumeOrMechanical, 0);
+  // one scan per throttle window, not one per pass
+  assert.ok(evidenceScans <= Math.ceil(PASSES * REVERIFY_INTERVAL_MS / EVIDENCE_SCAN_MIN_INTERVAL_MS), `evidence scans ${evidenceScans}`);
+  assert.ok(evidenceScans < PASSES / 2);
+  assert.equal(job.status, 'needs_review');
+  assert.equal(job.verifierVerdict, 'some_future_guard_verdict');
+});
+
+test('auto-resolve ladder is capped: requeue attempts stop at NEEDS_REVIEW_RESOLVE_CAP then skip', () => {
+  const j = row({ slug: '30-cap', verifierVerdict: 'x', autoFixAttempted: true });
+  const outcomes = [];
+  for (let i = 0; i < NEEDS_REVIEW_RESOLVE_CAP + 3; i++) {
+    const o = applyNeedsReviewAutoResolve(j, [j]);
+    if (!o) break;
+    outcomes.push(o);
+    if (o === 'requeued') j.status = 'needs_review';
+    if (o === 'skipped') break;
+  }
+  assert.equal(outcomes.filter((o) => o === 'requeued').length, NEEDS_REVIEW_RESOLVE_CAP);
+  assert.equal(outcomes.at(-1), 'skipped');
+});
+
+describe('evaluateBlockingParkHealth', () => {
+  const now = Date.parse('2026-09-18T20:00:00Z');
+  const parkedAgo = (ms) => [{ to: 'needs_review', at: new Date(now - ms).toISOString() }];
+  const park = (ms, o = {}) => ({ slug: '5-park', status: 'needs_review', cwd: '/p', verifierVerdict: 'shared_tree_reverted', statusHistory: parkedAgo(ms), ...o });
+  const dep = (slug, dependsOn) => ({ slug, status: 'pending', cwd: '/p', dependsOn });
+
+  test('parked past one interval with pending dependents (transitive) is non-green, naming row + count', () => {
+    const r = evaluateBlockingParkHealth([park(REVERIFY_INTERVAL_MS + 1000), dep('6-a', ['5-park']), dep('7-b', ['6-a']), dep('8-c', [])], now);
+    assert.equal(r.ok, false);
+    assert.equal(r.parks[0].slug, '5-park');
+    assert.equal(r.parks[0].dependents, 2);
+    assert.match(r.message, /5-park/);
+    assert.match(r.message, /blocking 2 pending dependent/);
+  });
+
+  test('young park, or park with no dependents, is healthy', () => {
+    assert.equal(evaluateBlockingParkHealth([park(1000), dep('6-a', ['5-park'])], now).ok, true);
+    assert.equal(evaluateBlockingParkHealth([park(REVERIFY_INTERVAL_MS * 5), dep('6-a', [])], now).ok, true);
+  });
+});

package/src/main/__tests__/scheduler-dispatch-loop.test.cjs

@@ -0,0 +1,58 @@
+/**
+ * scheduler-dispatch-loop.test.cjs — dispatch cadence is the loop's, not the billing
+ * poller's: with the meter failing (backoff at 480 s) a pending dispatchable row still
+ * gets a tickQueue within 30 s.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-dispatch-loop.test.cjs
+ */
+'use strict';
+
+import { test, expect, vi, beforeAll, afterAll } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+let tmpHome;
+let originalHome;
+let scheduler;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-dispatch-loop-'));
+  process.env.HOME = tmpHome;
+  process.env.SM_AUTOFIX_DISABLE = '1';
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager'), { recursive: true });
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'projects'), { recursive: true });
+  scheduler = require('../scheduler.cjs');
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  delete process.env.SM_AUTOFIX_DISABLE;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+test('with the billing poll backed off to 480 s, a pending row is still ticked within 30 s', async () => {
+  const { startDispatchLoop } = require('../lib/dispatchLoop.cjs');
+  await scheduler.writeQueue({
+    jobs: [{ slug: `9004-dispatch-loop-${process.pid}`, title: 'x', cwd: tmpHome, status: 'pending', dependsOn: [] }],
+    config: {},
+    paused: null,
+  });
+  vi.useFakeTimers({ toFake: ['setInterval', 'clearInterval'] });
+  const seen = [];
+  const h = startDispatchLoop({
+    // Same wiring init() uses (tick: () => tickQueue()), observed.
+    tick: async () => { seen.push(await scheduler.tickQueue()); },
+  });
+  try {
+    // Billing poll is at 480 s backoff: nothing else fires. The loop's own 30 s cadence does.
+    await vi.advanceTimersByTimeAsync(30_000);
+    // tickQueue does real file I/O; wait for the (real-time) pass to settle.
+    await vi.waitFor(() => expect(seen.length).toBe(1), { timeout: 10_000 });
+    expect(seen[0]).toBeTruthy(); // tickQueue ran and recorded an outcome for the pending row
+  } finally {
+    h.stop();
+    vi.useRealTimers();
+  }
+});

package/src/main/__tests__/scheduler-epic-digest.test.cjs

@@ -19,6 +19,7 @@ import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
 
 let tmpHome;
 let originalHome;
@@ -51,17 +52,14 @@ afterEach(() => {
 // Stub `claude` binary: captures the '-p' prompt argv to `capturePath`, then
 // emits one stream-json result line and exits 0.
 function writeClaudeStub(capturePath) {
-  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
-  const body = `
+  return claudeStub.writeClaudeStub({ body: `
     const fs = require('fs');
     const idx = process.argv.indexOf('-p');
     const prompt = idx >= 0 ? process.argv[idx + 1] : '';
     fs.writeFileSync(${JSON.stringify(capturePath)}, prompt, 'utf8');
     process.stdout.write(JSON.stringify({ type: 'result', subtype: 'success', result: 'ok' }) + '\\n');
     process.exit(0);
-  `;
-  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\n`, { mode: 0o755 });
-  return stubPath;
+  ` });
 }
 
 function setupProject(prefix) {

package/src/main/__tests__/scheduler-force-tick-outcome.test.cjs

@@ -8,12 +8,12 @@
  * against a manual force-tick click), the message must say so instead of
  * flatly claiming nothing is pending.
  *
- * Run: timeout 120 node --test src/main/__tests__/scheduler-force-tick-outcome.test.cjs
+ * Run: timeout 300 npx vitest run src/main/__tests__/scheduler-force-tick-outcome.test.cjs
  */
 
 'use strict';
 
-const { test } = require('node:test');
+import { test } from 'vitest';
 const assert = require('node:assert/strict');
 const { forceTickOutcome } = require('../scheduler.cjs');
 

package/src/main/__tests__/scheduler-gate-shadow.test.cjs

@@ -0,0 +1,119 @@
+/**
+ * scheduler-gate-shadow.test.cjs — the shadow gate records `gateShadow` on the
+ * verdicts sidecar and the row, and NEVER changes a status.
+ *
+ * HOME is overridden BEFORE requiring scheduler.cjs (top-level consts bake in
+ * os.homedir() — see scheduler-looks-done.test.cjs).
+ *
+ * Run: timeout 180 npx vitest run src/main/__tests__/scheduler-gate-shadow.test.cjs
+ */
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'gate-shadow-test-'));
+process.env.HOME = tmpHome;
+
+const { runGateShadow } = require('../scheduler.cjs');
+const { runGateSequence } = require('../lib/definitionOfDone.cjs');
+const { resolveEpicPrdWriteDir } = require('../lib/prdLocations.cjs');
+const { bustCwdCache } = require('../lib/queueStore.cjs');
+
+function git(args, cwd) { return execFileSync('git', args, { cwd, encoding: 'utf8' }); }
+
+function setup(name, gateBody) {
+  const cwd = path.join(tmpHome, name);
+  fs.mkdirSync(cwd, { recursive: true });
+  git(['init', '-q'], cwd);
+  git(['config', 'user.email', 't@example.com'], cwd);
+  git(['config', 'user.name', 'T'], cwd);
+  fs.writeFileSync(path.join(cwd, 'README.md'), 'x\n');
+  git(['add', '-A'], cwd);
+  git(['commit', '-q', '-m', 'init'], cwd);
+  const slugDir = path.join(tmpHome, '.claude', 'projects', `${name}-slug`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 't.jsonl'), JSON.stringify({ cwd }) + '\n');
+  bustCwdCache();
+  const prdDir = resolveEpicPrdWriteDir(cwd, 'gate-epic');
+  fs.mkdirSync(prdDir, { recursive: true });
+  const slug = `01-${name}`;
+  fs.writeFileSync(path.join(prdDir, `${slug}.md`), `---\ntitle: T\ncwd: ${cwd}\nestimateMinutes: 5\n---\n${gateBody}\n`);
+  const runId = `run-${name}`;
+  const runDir = path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', runId);
+  fs.mkdirSync(runDir, { recursive: true });
+  const verdictsPath = path.join(runDir, `${slug}.verdicts.json`);
+  fs.writeFileSync(verdictsPath, JSON.stringify({ verdict: 'transcript_errors', reason: 'r' }));
+  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
+  fs.mkdirSync(stateDir, { recursive: true });
+  const queuePath = path.join(stateDir, 'queue.json');
+  const job = { slug, status: 'needs_review', cwd, runId, verifierVerdict: 'transcript_errors', startedAt: new Date().toISOString(), finishedAt: new Date().toISOString() };
+  fs.writeFileSync(queuePath, JSON.stringify({ jobs: [job] }, null, 2));
+  return { cwd, slug, job, verdictsPath, queuePath };
+}
+
+const ac = (cmd) => `# Acceptance criteria\n\n- [ ] Gate: \`${cmd}\`\n`;
+
+test('green gate: recorded on sidecar + row, status untouched, verdict keys preserved', async () => {
+  const t = setup('green', ac('timeout 30 node -e "process.exit(0)" && timeout 30 node -e "process.exit(0)"'));
+  const rec = await runGateShadow(t.job);
+  assert.equal(rec.status, 'green');
+  assert.equal(rec.results.length, 2);
+  const sidecar = JSON.parse(fs.readFileSync(t.verdictsPath, 'utf8'));
+  assert.equal(sidecar.verdict, 'transcript_errors', 'read-merge keeps runVerify keys');
+  assert.equal(sidecar.gateShadow.status, 'green');
+  const row = JSON.parse(fs.readFileSync(t.queuePath, 'utf8')).jobs.find((j) => j.slug === t.slug);
+  assert.equal(row.status, 'needs_review', 'shadow never transitions');
+  assert.equal(row.gateShadow.status, 'green');
+});
+
+test('red gate stops at the first failure and records red; status still untouched', async () => {
+  const t = setup('red', ac('timeout 30 node -e "process.exit(3)" && timeout 30 node -e "process.exit(0)"'));
+  const rec = await runGateShadow(t.job);
+  assert.equal(rec.status, 'red');
+  assert.equal(rec.results.length, 1);
+  assert.equal(rec.results[0].code, 3);
+  const row = JSON.parse(fs.readFileSync(t.queuePath, 'utf8')).jobs.find((j) => j.slug === t.slug);
+  assert.equal(row.status, 'needs_review');
+});
+
+test('the gate runs with CI=1 and an isolated TMPDIR', async () => {
+  const t = setup('env', ac('timeout 30 node -e "process.exit(process.env.CI===\'1\'&&process.env.TMPDIR.includes(\'sm-gate-shadow-\')?0:9)"'));
+  assert.equal((await runGateShadow(t.job)).status, 'green');
+});
+
+test('gate: none is recorded as an explicit opt-out (unavailable), nothing spawned', async () => {
+  const t = setup('optout', '# Acceptance criteria\n\n- [ ] `timeout 30 node -e "process.exit(9)"`\n');
+  t.job.slug = t.slug;
+  fs.writeFileSync(path.join(resolveEpicPrdWriteDir(t.cwd, 'gate-epic'), `${t.slug}.md`), `---\ntitle: T\ncwd: ${t.cwd}\ngate: none\n---\nbody\n`);
+  const rec = await runGateShadow(t.job);
+  assert.equal(rec.status, 'unavailable');
+  assert.equal(rec.reason, 'gate-opt-out');
+  assert.deepEqual(rec.results, []);
+});
+
+test('no parseable gate → unavailable', async () => {
+  const t = setup('nogate', '# Acceptance criteria\n\n- [ ] just prose\n');
+  const rec = await runGateShadow(t.job);
+  assert.equal(rec.status, 'unavailable');
+  assert.equal(rec.reason, 'no-parseable-gate');
+});
+
+test('at most one shadow gate in flight: a concurrent run reports busy and runs nothing', async () => {
+  const slow = [{ argv: ['node', '-e', 'setTimeout(()=>{},400)'], timeoutMs: 10_000, env: {} }];
+  const first = runGateSequence(slow, { cwd: tmpHome });
+  const second = await runGateSequence(slow, { cwd: tmpHome });
+  assert.equal(second.status, 'busy');
+  assert.deepEqual(second.results, []);
+  assert.equal((await first).status, 'green');
+});
+
+test('a hung command is killed at its timeout and the gate is red', async () => {
+  const hang = [{ argv: ['node', '-e', 'setTimeout(()=>{},60000)'], timeoutMs: 300, env: {} }];
+  const r = await runGateSequence(hang, { cwd: tmpHome });
+  assert.equal(r.status, 'red');
+  assert.equal(r.results[0].timedOut, true);
+});

package/src/main/__tests__/scheduler-guard-verdict-autoresolve.test.cjs

@@ -83,6 +83,17 @@ test('GUARD_VERDICT_EVIDENCE_ELIGIBLE contains exactly the benign guard verdicts
   assert.equal(GUARD_VERDICT_EVIDENCE_ELIGIBLE.has('worktree_integration_failed'), false);
 });
 
+// reaperHelpers.resolvePidlessFailureOverride parks a pidless reap on this
+// exact verdict when the row already carries a landedCommit — same shape as
+// silent_no_op/shared_tree_reverted (exit never observed, no autoFixAttempted,
+// real commit evidence), so it must share this ladder too, or a pidless-reap
+// row stalls in needs_review with nothing to spend and nothing to exhaust —
+// the same bug this file's other tests exist to prevent for the other two
+// verdicts.
+test('GUARD_VERDICT_EVIDENCE_ELIGIBLE also contains pidless_reap_with_landed_commit', () => {
+  assert.ok(GUARD_VERDICT_EVIDENCE_ELIGIBLE.has('pidless_reap_with_landed_commit'));
+});
+
 // --- isGuardParkedWithoutAutoFix / isEligibleForNeedsReviewAutoResolve ---
 
 test('a guard-verdict park with no auto-fix history is guard-parked-without-autofix', () => {
@@ -342,3 +353,38 @@ test('reverifyNeedsReview never computes looksDone for a worktree_integration_fa
   assert.equal(jobs[0].looksDone, undefined, 'a stranded-branch verdict must never be treated as evidence-gatherable');
   assert.equal(jobs[0].status, 'needs_review');
 });
+
+test('reverifyNeedsReview heals a stale shared_tree_reverted row (autoFixAttempted, no outcome) whose landedCommit is still an ancestor of HEAD', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-stale-shared-tree');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-stale-shared-tree-slug');
+  writePrd(projectCwd, '1229-stale-shared-tree', '# Implementation notes\nEdit `src/thing.js`.');
+
+  const startedAt = new Date(Date.now() - 5000).toISOString();
+  await wait(1100);
+  commitFile(projectCwd, 'src/thing.js', 'job work', 'the job own commit');
+  const landed = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  commitFile(projectCwd, 'docs/unrelated.md', 'human', 'human commit after the job');
+
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: '1229-stale-shared-tree',
+      status: 'needs_review',
+      cwd: projectCwd,
+      runId: 'run-1229',
+      startedAt,
+      finishedAt: new Date().toISOString(),
+      exitCode: 0,
+      verifierVerdict: 'shared_tree_reverted',
+      landedCommit: landed,
+      autoFixAttempted: true,
+    },
+  ]);
+
+  await reverifyNeedsReview();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  // Healed rows are archived out of the live queue on the same pass.
+  const row = jobs.find((j) => j.slug === '1229-stale-shared-tree');
+  assert.ok(!row || row.status === 'completed', 'row must no longer be parked in needs_review');
+});