claude-code-session-manager 0.87.0 → 0.88.0

package/src/main/scheduler.cjs

@@ -47,13 +47,15 @@ const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
+const { startDispatchLoop } = require('./lib/dispatchLoop.cjs');
+const schedulerPaths = require('./lib/schedulerPaths.cjs');
 const { randomUUID } = require('node:crypto');
 const { execFile, execFileSync } = require('node:child_process');
 const { ipcMain } = require('electron');
 const billing = require('./usage.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./lib/cleanEnv.cjs');
 const supervisor = require('./supervisor.cjs');
-const { resolveClaudeBin, probeClaudeVersion } = require('./lib/claudeBin.cjs');
+const { resolveClaudeBin, claudeSpawnTarget, probeClaudeVersion } = require('./lib/claudeBin.cjs');
 const launchFailure = require('./lib/launchFailure.cjs');
 const { appendError } = require('./lib/opsErrorLog.cjs');
 const { readTail } = require('./lib/fileTail.cjs');
@@ -67,6 +69,7 @@ const { sweepStrandedJobBranches } = require('./lib/branchSweep.cjs');
 const { detectRateLimitInLog } = require('./lib/rateLimitDetect.cjs');
 const { stripAppOwnedChurn } = require('./lib/jobDirtFilter.cjs');
 const { resolveBindingRateLimitReset } = require('./lib/rateLimitWindow.cjs');
+const { isResetFresh, bindingWindow, degradedBudget } = require('./lib/usageCircuit.cjs');
 const { computeQueueHealth } = require('./lib/queueHealth.cjs');
 const { createLoadGate, topCpuConsumers } = require('./lib/loadGate.cjs');
 const { openLog, withChildAndLog } = require('./lib/childWithLog.cjs');
@@ -83,6 +86,7 @@ const { latestTerminalOutcomeForSlug, COMPLETED_EQUIVALENT_VERDICTS } = require(
 const { isFixPlanSlug, classifyDiscoveredFixPlan, resolveIsFixPlan } = require('./lib/fixPlanSlug.cjs');
 const { landedSinceRun, landedOnMainSince } = require('./lib/landedSinceRun.cjs');
 const { declaredPathsForPrd } = require('./lib/prdDeclaredPaths.cjs');
+const { identity: procIdentityOf, isDifferentProcess } = require('./lib/procIdentity.cjs');
 const logs = require('./logs.cjs');
 const { schemas, validated, SCHEDULE_SLUG_RE } = require('./ipcSchemas.cjs');
 const { readBody, sendJson } = require('./lib/localAdminHttp.cjs');
@@ -131,19 +135,21 @@ const { pickForProject, pickNextBatch, findStarvedProjects, DEFAULT_PROJECT_CWD,
 const { runDefinitionOfDoneOnDrain } = require('./lib/dodDrainHook.cjs');
 const { writeRcaReport, extractRcaBlock } = require('./lib/rcaReport.cjs');
 const queueHistory = require('./lib/queueHistory.cjs');
+const { resolveGate, runGateSequence } = require('./lib/definitionOfDone.cjs');
 const queueOps = require('./queueOps.cjs');
 // Feedback-auto-PRD sweep — formerly only run by the external scheduler-watchdog
 // while the app was down (PRD 686 moved it in-app so it also runs while alive).
 // Plain Node module, no Electron dependency; queuePath/prdsDir defaults already
 // match ROOT/QUEUE_PATH below since both resolve the same ~/.claude/session-manager
 // home-dir layout.
-const { resolvePrdsDirs, resolveArchivedPrdsDirs, resolvePrdWriteDir, listEpicPrdDirs, listArchivedPrdDirs } = require('./lib/prdLocations.cjs');
+const { resolvePrdsDirs, resolveArchivedPrdsDirs, resolvePrdWriteDir, listEpicPrdDirs, listArchivedPrdDirs, deriveProjectCwdFromPrdPath } = require('./lib/prdLocations.cjs');
 const { ensureEpic, appendPrdCreatedEvent, readActiveIndex } = require('./lib/epicMint.cjs');
 const agentModelResolve = require('./lib/agentModelResolve.cjs');
 const { transitionJob, STATUS_HISTORY_CAP, LEGAL_TRANSITIONS } = require('./lib/scheduleJobTransitions.cjs');
 const { buildContextDigest, composeExecutorPrompt } = require('./lib/epicContextDigest.cjs');
 const { JOB_STATUSES } = require('./lib/scheduleJobSchema.cjs');
 const { appendAuditEvent } = require('./lib/auditLog.cjs');
+const { withTimeout } = require('./lib/withTimeout.cjs');
 
 // ---------- origin session resolution (PRD 832) ----------
 // An Epic IS a tagged claude session — job rows carry the originating
@@ -164,12 +170,15 @@ function resolveOriginSessionId(cwd, epicId) {
 }
 const sessionSlots = require('./lib/sessionSlots.cjs');
 const quietMachineLease = require('./lib/quietMachineLease.cjs');
+const runtimeState = require('./lib/schedulerRuntimeState.cjs');
 const jobWorktree = require('./lib/jobWorktree.cjs');
 const gitWorktree = require('./lib/gitWorktree.cjs');
 const { buildJobWorktreeIsLive } = require('./lib/jobWorktreeBootLive.cjs');
 const { buildTerminalOrphanIsLive } = require('./lib/jobWorktreeTerminalOrphanLive.cjs');
 const { reconcileEpicWorktreesOnBoot } = require('./lib/epicWorktreeBoot.cjs');
 const queueStore = require('./lib/queueStore.cjs');
+const supervisorRecord = require('./lib/jobSupervisorRecord.cjs');
+const adoptedRunSupervisor = require('./lib/adoptedRunSupervisor.cjs');
 const { splitFrontmatter, parsePrdFile, serializePrdFile } = require('./lib/prdFrontmatter.cjs');
 const { resolveDepSlug, findNearMatches } = require('./lib/depSlugResolve.cjs');
 const { computeDispositionRewrite } = require('./lib/prdDisposition.cjs');
@@ -182,20 +191,26 @@ const { allProjectCwds } = require('./lib/activeSessions.cjs');
 // an exemption it should have applied landed on disk, and nothing in the
 // run record showed that; this is the fix).
 const SCHEDULER_BOOTED_AT = new Date().toISOString();
-// Resolves against __dirname (this app's OWN source checkout) — unaffected by
-// PRD 994's job worktrees, which live under a job's PROJECT cwd, never under
-// this app's install directory.
-const SCHEDULER_CODE_SHA = (() => {
-  try {
-    return execFileSync('git', ['-C', __dirname, 'rev-parse', '--short', 'HEAD'], {
-      timeout: 5000,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-  } catch {
-    return null;
-  }
-})();
+// A production npx install ships no .git at all, so a runtime `git
+// rev-parse` from __dirname was structurally always null there — every
+// production run-meta sidecar recorded schedulerCodeSha: null. buildIdentity
+// resolves build-info.json (baked at publish time) first, falling back to a
+// non-walking git read only in a dev checkout / job worktree — see
+// src/main/lib/buildIdentity.cjs's header.
+const { resolveBuildIdentity, readInstalledBuildInfo } = require('./lib/buildIdentity.cjs');
+const upgradeDrain = require('./lib/upgradeDrain.cjs');
+const SCHEDULER_BUILD_IDENTITY = resolveBuildIdentity({ bootedAt: SCHEDULER_BOOTED_AT });
+const SCHEDULER_CODE_SHA = SCHEDULER_BUILD_IDENTITY.codeSha;
+// Spread into EVERY metaPath writer below (grep `metaPath` for the full
+// list) — single source so a future field never lands in some sidecars and
+// not others, the exact gap that left 3 of 5 writers silently missing
+// schedulerBootedAt/schedulerCodeSha before this constant existed.
+const SCHEDULER_META_IDENTITY = {
+  schedulerBootedAt: SCHEDULER_BOOTED_AT,
+  schedulerCodeSha: SCHEDULER_CODE_SHA,
+  schedulerVersion: SCHEDULER_BUILD_IDENTITY.version,
+  schedulerBuiltAt: SCHEDULER_BUILD_IDENTITY.builtAt,
+};
 
 const MAX_INVESTIGATION_DURATION_MS = 30 * 60_000;
 
@@ -590,7 +605,7 @@ function evaluateSharedTreeGuard({ stashBefore, stashAfter, dirtyBefore, dirtyAf
 // executor-created stash (never guesses when there are 2+); reports anything
 // it can't safely resolve on the returned object so the caller can surface it
 // on the job row instead of finishing silently green.
-async function checkSharedTreeGuard({ cwd, stashBaseline, dirtyBaseline, headBefore, slug }) {
+async function checkSharedTreeGuard({ cwd, stashBaseline, dirtyBaseline, headBefore, slug, landedCommit }) {
   try {
     const [stashAfter, headAfter] = await Promise.all([
       module.exports.stashList(cwd),
@@ -655,7 +670,16 @@ async function checkSharedTreeGuard({ cwd, stashBaseline, dirtyBaseline, headBef
       pathsCommittedDuringRun,
       existsAfter,
     });
-    if (reverted.length) {
+    // Ground truth outranks the baseline diff (2026-09-18, 1229-fo-03): the
+    // dirty baseline is invalidated by ANY later writer (a human commit that
+    // sweeps the same paths), so it can't prove a revert on its own. The
+    // job's own landedCommit still being an ancestor of HEAD proves its work
+    // was not discarded — anchored to that sha, not to the baseline.
+    const workSurvives = reverted.length > 0
+      && await module.exports.landedCommitIsAncestorOfHead(cwd, landedCommit);
+    if (workSurvives) {
+      console.log(`[scheduler] ${slug}: shared-tree guard: ${reverted.length} baseline path(s) went clean but landed commit ${String(landedCommit).slice(0, 7)} is still an ancestor of HEAD — not a revert`);
+    } else if (reverted.length) {
       result.reverted = reverted;
       console.error(`[scheduler] ${slug}: shared-tree guard: ${reverted.length} path(s) reverted in the shared tree with no commit to explain it (${reverted.slice(0, 3).join(', ')})`);
     }
@@ -895,13 +919,9 @@ function isQueueRowRegression({ statusBefore, statusAfter, historyLenBefore, his
   return statusBefore === 'running' && statusAfter === 'pending' && historyLenAfter < historyLenBefore;
 }
 
-const ROOT = path.join(os.homedir(), '.claude', 'session-manager', 'scheduled-plans');
-const PRDS_DIR = path.join(ROOT, 'prds');
-const RUNS_DIR = path.join(ROOT, 'runs');
-const PRDS_ARCHIVE_DIR = path.join(ROOT, 'prds-archived');
-const QUEUE_PATH = path.join(ROOT, 'queue.json');
-const SCHEDULER_STATE_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'scheduler-state.json');
-const HEARTBEAT_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'scheduler-heartbeat.log');
+// Machine-wide roots resolve lazily via lib/schedulerPaths.cjs (SM_SCHEDULER_HOME
+// override) — never module-scope consts. The ROOT/PRDS_DIR/RUNS_DIR/
+// SCHEDULER_STATE_PATH exports below are lazy getters over the same resolver.
 const HEARTBEAT_MAX_BYTES = 1024 * 1024;
 // DEFAULT_PROJECT_CWD imported from lib/schedulerBatch.cjs (single source of truth).
 
@@ -1020,7 +1040,7 @@ function biasJobOomScore(pid) {
  * (reconcile, list-prds, lint, rescan).
  */
 function candidatePrdsDirs() {
-  return [PRDS_DIR, ...resolvePrdsDirs()];
+  return [schedulerPaths.prdsRoot(), ...resolvePrdsDirs()];
 }
 
 /**
@@ -1141,7 +1161,7 @@ function prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd,
   const finishedAt = Date.now();
   config.writeJsonSync(metaPath, {
     slug: job.slug, cwd, sessionId, exitCode: 0, skipped: reason,
-    note: msg, startedAt, finishedAt, durationMs: 0,
+    note: msg, startedAt, finishedAt, durationMs: 0, ...SCHEDULER_META_IDENTITY,
   });
   return { exitCode: 0, durationMs: 0, skipped: reason, note: msg, sessionId };
 }
@@ -1283,17 +1303,21 @@ async function retireCompletedSlugs(slugs) {
 // Bundled authoring guide seeded into the scheduler dir so the session-manager-dev
 // plugin's /develop and /prd skills — which reference this stable `~`-absolute
 // path — work on any user's machine, not just the author's.
+// Line 1 of the template is `<!-- PRD_AUTHORING.md vN -->`: bump vN whenever the
+// template changes, or existing installs never receive the update.
 const PRD_AUTHORING_TEMPLATE = path.join(__dirname, 'templates', 'PRD_AUTHORING.md');
-const PRD_AUTHORING_DEST = path.join(ROOT, 'PRD_AUTHORING.md');
 
 function ensureDirs() {
-  fs.mkdirSync(PRDS_DIR, { recursive: true });
-  fs.mkdirSync(RUNS_DIR, { recursive: true });
-  // Seed the authoring guide once; never clobber a user's edited copy.
+  fs.mkdirSync(schedulerPaths.prdsRoot(), { recursive: true });
+  fs.mkdirSync(schedulerPaths.runsDir(), { recursive: true });
+  // Re-seed the guide whenever the bundled template's version stamp differs.
   try {
-    if (!fs.existsSync(PRD_AUTHORING_DEST) && fs.existsSync(PRD_AUTHORING_TEMPLATE)) {
-      fs.copyFileSync(PRD_AUTHORING_TEMPLATE, PRD_AUTHORING_DEST);
-    }
+    const authoringDest = path.join(schedulerPaths.scheduledPlansRoot(), 'PRD_AUTHORING.md');
+    seedAuthoringGuide({
+      src: PRD_AUTHORING_TEMPLATE,
+      dest: authoringDest,
+      write: (abs, text) => config.writeTextAtomic(abs, text, { writer: 'scheduler' }),
+    }).catch(() => { /* non-fatal, same as below */ });
   } catch { /* non-fatal: the guide is a convenience, not load-bearing for a run */ }
 }
 
@@ -1321,8 +1345,9 @@ function ensureDirs() {
  * queue row yet at that point, so it is never in LIVE_JOB_STATUSES and this
  * sweep archives it before reconcile can ever turn it into a pending job.
  */
-async function consolidateAllFlatPrds(cwds) {
+async function consolidateAllFlatPrds(cwds, skipCwds) {
   for (const cwd of cwds) {
+    if (skipCwds?.has(cwd)) continue; // torn shard: its PRDs are not ours to touch this pass
     try {
       const c = await consolidateFlatPrds(cwd);
       if (c.moved > 0) {
@@ -1354,7 +1379,7 @@ async function consolidateAllFlatPrds(cwds) {
 async function runPrdMigration() {
   let result;
   try {
-    result = await migratePrds(PRDS_DIR);
+    result = await migratePrds(schedulerPaths.prdsRoot());
   } catch (e) {
     logs.writeLine({ level: 'error', scope: 'scheduler', message: 'PRD migration failed', meta: { error: e?.message } });
     return null;
@@ -1365,7 +1390,7 @@ async function runPrdMigration() {
       level: 'warn',
       scope: 'scheduler',
       message: `PRD migration: ${result.unresolved.length} file(s) left in legacy dir`,
-      meta: { legacyDir: PRDS_DIR, unresolved: result.unresolved },
+      meta: { legacyDir: schedulerPaths.prdsRoot(), unresolved: result.unresolved },
     });
     for (const u of result.unresolved) {
       console.warn(`[scheduler] PRD migration: left ${u.file} in legacy dir (${u.reason})`);
@@ -1432,7 +1457,7 @@ const QUEUE_BAK_KEEP = 5;
 async function sweepQueueBackups() {
   let entries;
   try {
-    entries = await fsp.readdir(ROOT);
+    entries = await fsp.readdir(schedulerPaths.scheduledPlansRoot());
   } catch {
     return;
   }
@@ -1448,7 +1473,7 @@ async function sweepQueueBackups() {
   let removed = 0;
   for (const f of toDelete) {
     try {
-      await fsp.unlink(path.join(ROOT, f));
+      await fsp.unlink(path.join(schedulerPaths.scheduledPlansRoot(), f));
       removed++;
     } catch (e) {
       console.warn('[scheduler] backup sweep: unlink failed', f, e?.message);
@@ -1464,20 +1489,24 @@ async function sweepQueueBackups() {
 // callback that must flush meta.json before resolving) — replacing with async
 // would deadlock the exit path.
 const config = require('./config.cjs');
+const { seedAuthoringGuide } = require('./lib/prdAuthoringSeed.cjs');
 const atomicWriteJsonSync = (p, data) => config.writeJsonSync(p, data);
 
 // ---------- scheduler-state.json (sidecar) ----------
 
 function loadSchedulerState() {
   try {
-    const raw = fs.readFileSync(SCHEDULER_STATE_PATH, 'utf8');
+    const raw = fs.readFileSync(schedulerPaths.schedulerStatePath(), 'utf8');
     const s = JSON.parse(raw);
     if (s.lastObservedReset) cachedNextReset = s.lastObservedReset;
+    if (typeof s.lastResetObservedAt === 'number') lastResetObservedAtMs = s.lastResetObservedAt;
     if (typeof s.consecutiveFailures === 'number') consecutiveFailures = s.consecutiveFailures;
     if (typeof s.backoffMs === 'number') backoffMs = s.backoffMs;
     if (typeof s.pauseClearedManuallyAt === 'number') pauseClearedManuallyAt = s.pauseClearedManuallyAt;
     if (typeof s.lastPollAt === 'number') lastPollAt = s.lastPollAt;
     if (typeof s.failureStreakWarned === 'boolean') failureStreakWarned = s.failureStreakWarned;
+    if (typeof s.failureStreakWarnedAt === 'number') failureStreakWarnedAt = s.failureStreakWarnedAt;
+    if (typeof s.lastEscalationAt === 'number') lastEscalationAtMs = s.lastEscalationAt;
   } catch { /* first boot or corrupt — start fresh */ }
 }
 
@@ -1487,10 +1516,14 @@ function persistSchedulerState() {
   // require threading awaits through pause/resume bookkeeping for negligible
   // benefit — the file is well under one page.
   try {
-    config.writeJsonSync(SCHEDULER_STATE_PATH, {
+    config.writeJsonSync(schedulerPaths.schedulerStatePath(), {
       version: 1,
       lastObservedReset: cachedNextReset,
-      lastResetObservedAt: cachedNextReset ? Date.now() : null,
+      // Only stamped at the moment a FRESH reset was actually observed (see
+      // recordObservedReset) — never Date.now() on every persist call, which
+      // used to make a stale cachedNextReset look freshly-confirmed on every
+      // tick even when nothing new had been read.
+      lastResetObservedAt: lastResetObservedAtMs,
       lastPollAt,
       consecutiveFailures,
       backoffMs,
@@ -1498,6 +1531,13 @@ function persistSchedulerState() {
       pausedSince: null,
       pauseClearedManuallyAt,
       failureStreakWarned,
+      failureStreakWarnedAt,
+      lastEscalationAt: lastEscalationAtMs,
+      // Circuit fields are read fresh from the live shared breaker each
+      // persist — health.cjs (a separate `npm run health` process) reads
+      // THESE persisted values, since it never holds the in-memory circuit.
+      usageCircuitState: billing.usageCircuit.state(),
+      usageCircuitOpenedAt: billing.usageCircuit.openedAt(),
     });
   } catch (e) {
     console.warn('[scheduler] failed to persist scheduler state', e?.message);
@@ -1510,18 +1550,279 @@ function appendHeartbeat(entry) {
   try {
     const line = JSON.stringify(entry) + '\n';
     let size = 0;
-    try { size = fs.statSync(HEARTBEAT_PATH).size; } catch { /* new file */ }
+    try { size = fs.statSync(schedulerPaths.heartbeatPath()).size; } catch { /* new file */ }
     if (size >= HEARTBEAT_MAX_BYTES) {
-      const rotated = HEARTBEAT_PATH + '.1';
+      const rotated = schedulerPaths.heartbeatPath() + '.1';
       try { fs.unlinkSync(rotated); } catch { /* */ }
-      try { fs.renameSync(HEARTBEAT_PATH, rotated); } catch { /* */ }
+      try { fs.renameSync(schedulerPaths.heartbeatPath(), rotated); } catch { /* */ }
     }
-    fs.appendFileSync(HEARTBEAT_PATH, line);
+    fs.appendFileSync(schedulerPaths.heartbeatPath(), line);
   } catch (e) {
     console.warn('[scheduler] heartbeat write failed', e?.message);
   }
 }
 
+// Build identity stamped on every heartbeat line — memoized at boot
+// (SCHEDULER_BUILD_IDENTITY), so a tick costs no git or fs work.
+function heartbeatBuild() {
+  const { version, codeSha, builtAt } = SCHEDULER_BUILD_IDENTITY;
+  return { version, codeSha, builtAt };
+}
+
+// ---------- upgrade drain driver (lib/upgradeDrain.cjs) ----------
+
+// Set by index.cjs: performs the actual app teardown + relaunch + exit.
+let restartHandler = null;
+function setRestartHandler(fn) { restartHandler = typeof fn === 'function' ? fn : null; }
+let drainDriving = false;
+
+function drainSnapshot(jobs) {
+  const running = new Set();
+  let investigating = 0;
+  for (const j of jobs ?? []) {
+    if (j?.status === 'running') running.add(j.slug);
+    else if (j?.status === 'investigating') investigating++;
+  }
+  for (const slug of runningSet) running.add(slug);
+  // Deferred investigations are not busy: while draining they never spawn.
+  return { running: running.size, investigating: Math.max(investigating, runtimeState.investigationCount()) };
+}
+
+/**
+ * Restart is triggered automatically ONLY when the installed build-info.json
+ * differs from the running codeSha (an install/update already happened) —
+ * never by polling npm. SM_AUTO_UPGRADE_RESTART=0 disables it.
+ */
+function maybeAutoRequestRestart() {
+  if (process.env.SM_AUTO_UPGRADE_RESTART === '0' || process.env.SM_DEV === '1') return null;
+  const installed = readInstalledBuildInfo();
+  const installedSha = typeof installed?.gitShortSha === 'string' ? installed.gitShortSha : null;
+  if (!upgradeDrain.installedBuildDiffers({ running: SCHEDULER_CODE_SHA, installed: installedSha })) return null;
+  return upgradeDrain.requestRestart({ reason: `installed build ${installedSha} differs from running ${SCHEDULER_CODE_SHA}`, requestedBy: 'auto-upgrade' });
+}
+
+async function driveUpgradeDrain(state) {
+  if (drainDriving) return;
+  drainDriving = true;
+  try {
+    let request = upgradeDrain.readRestartRequest();
+    if (!request && !state.drain?.active) request = maybeAutoRequestRestart();
+    const { action, reason } = upgradeDrain.evaluateDrain({
+      request,
+      queueSnapshot: drainSnapshot(state.jobs),
+      drainState: state.drain,
+      now: Date.now(),
+    });
+    if (action === 'none' || action === 'wait') { drainActive = Boolean(state.drain?.active); return; }
+    if (action === 'pause') {
+      await mutate((s) => { s.drain = { active: true, since: new Date().toISOString(), requestedAt: request.requestedAt }; });
+      drainActive = true;
+      appendAuditEvent('upgrade_drain_started', { reason: request.reason, requestedBy: request.requestedBy });
+      await broadcast({ flush: true });
+      return;
+    }
+    if (action === 'abort') {
+      upgradeDrain.retireRestartRequest();
+      await mutate((s) => { s.drain = null; });
+      drainActive = false;
+      appendAuditEvent('upgrade_drain_aborted', { reason });
+      await broadcast({ flush: true });
+      runDueJobs().catch(() => {});
+      return;
+    }
+    // 'restart': the FINAL zero-busy check runs inside a mutate, immediately
+    // before exit — the snapshot above may be stale by now.
+    let go = false;
+    await mutate((s) => {
+      const snap = drainSnapshot(s.jobs);
+      if (!s.drain?.active || snap.running + snap.investigating > 0) return;
+      upgradeDrain.stampDrainCompleted();
+      go = true;
+    });
+    if (!go) return;
+    appendAuditEvent('upgrade_drain_restart', { reason: request.reason, requestedBy: request.requestedBy });
+    try {
+      if (!restartHandler) throw new Error('no restart handler registered');
+      upgradeDrain.markRestarting();
+      await restartHandler(request);
+      // Only reached when the handler did NOT exit the process (dev-server
+      // in-place reboot): the restart is done, so retire the drain here.
+      upgradeDrain.clearRestartingMarker();
+      upgradeDrain.retireRestartRequest();
+      await mutate((s) => { s.drain = null; });
+      drainActive = false;
+    } catch (e) {
+      // Never strand the queue drained-and-paused: fall back to an abort.
+      console.error('[scheduler] drain restart failed — aborting drain:', e?.message ?? e);
+      upgradeDrain.clearRestartingMarker();
+      upgradeDrain.retireRestartRequest();
+      await mutate((s) => { s.drain = null; });
+      drainActive = false;
+      runDueJobs().catch(() => {});
+    }
+  } finally {
+    drainDriving = false;
+  }
+}
+
+/** Boot: clear a leftover drain whose request is complete (the restart happened) or gone. */
+async function clearStaleDrainAtBoot(boot) {
+  const request = upgradeDrain.readRestartRequest();
+  const action = upgradeDrain.bootDrainAction({ drainState: boot.drain, request });
+  upgradeDrain.clearRestartingMarker();
+  if (request?.drainCompletedAt) upgradeDrain.retireRestartRequest();
+  if (action === 'clear') await mutate((s) => { s.drain = null; });
+  drainActive = action === 'keep';
+}
+
+/**
+ * heartbeatTick(deps?) — one 60 s heartbeat interval body. Each subsystem
+ * (queue read + starvation watchdog, stall detector, heartbeat write) runs in
+ * its own try/catch so one throw can't silently skip the others. Any failure
+ * makes the written line `degraded: true` + `errors`; watchdogHelpers'
+ * heartbeatFresh() and health.cjs's readFreshHeartbeat() treat such a line as
+ * NOT fresh, so a throw never disarms the external watchdog or fakes
+ * utilization health never read.
+ */
+function heartbeatTick(deps = {}) {
+  const readQueue = deps.readQueueSync ?? readQueueSync;
+  const errors = [];
+  const guard = (subsystem, fn) => {
+    try {
+      return fn();
+    } catch (e) {
+      errors.push({ subsystem, error: e?.message ?? String(e) });
+      console.error(`[scheduler] heartbeat subsystem "${subsystem}" failed`, e);
+      return undefined;
+    }
+  };
+
+  const s = guard('queue-read-starvation-watchdog', () => {
+    const q = readQueue();
+    // NEVER-STOP INVARIANT: if a queue holds ready PRDs and nothing is
+    // running, something must drive it. This is the only driver that does
+    // not depend on the billing poll loop, a pause timer, or a completing
+    // job to schedule the next tick — every one of which has failed at
+    // least once. See classifyQueueStarvation.
+    if (!q.unreadable) {
+      runQueueStarvationWatchdog(q).catch((e) => console.error('[scheduler] starvation watchdog error', e));
+      // Restart-request drain state machine rides this same 60 s interval —
+      // no new driver.
+      driveUpgradeDrain(q).catch((e) => console.error('[scheduler] upgrade drain error', e));
+    }
+    return q;
+  });
+
+  let stall;
+  if (s) {
+    stall = guard('stall-detector', () => {
+      const summary = computeStallSummary(s);
+      // Per-project alerting (see computeStallSummary's header): a project
+      // stalled while others are busy must still fire, and one project
+      // recovering must not clear or suppress another's still-open episode —
+      // that is exactly what a single module-level stallSince/stallToasted
+      // flag masked before (the burrow-vs-others incident this PRD fixes).
+      const now = Date.now();
+      const stalledCwds = Object.keys(summary.byProject).filter((cwd) => summary.byProject[cwd].stalled);
+      for (const cwd of [...stallSince.keys()]) {
+        if (!stalledCwds.includes(cwd)) {
+          stallSince.delete(cwd);
+          stallToasted.delete(cwd);
+        }
+      }
+      const toAlert = [];
+      for (const cwd of stalledCwds) {
+        if (!stallSince.has(cwd)) stallSince.set(cwd, now);
+        if (!stallToasted.get(cwd) && now - stallSince.get(cwd) >= POLL_INTERVAL_MS) {
+          stallToasted.set(cwd, true);
+          toAlert.push(cwd);
+        }
+      }
+      if (toAlert.length > 0) {
+        console.error(
+          `[scheduler] STALL DETECTED in project(s): ${toAlert.join(', ')} — 0 running, 0 pending, not paused, `
+          + `for >= ${Math.round(POLL_INTERVAL_MS / 1000)}s`,
+          summary.byProject,
+        );
+        appendAuditEvent('scheduler_stall_detected', { projects: toAlert, total: summary.total, byProject: summary.byProject });
+        if (mainWindow && !mainWindow.isDestroyed()) {
+          sendIfAlive(mainWindow, 'schedule:stall', {
+            message: `Scheduler stall in ${toAlert.length} project(s): ${toAlert.join(', ')}. Check the Scheduler tab.`,
+            projects: toAlert,
+            total: summary.total,
+            byProject: summary.byProject,
+          });
+        }
+      }
+      return summary;
+    });
+  }
+
+  let entry = null;
+  if (s && stall && errors.length === 0) {
+    entry = guard('heartbeat-write', () => {
+      // Initialise from the real status union (scheduleJobSchema.cjs) rather
+      // than a hand-maintained subset — the old `{ pending, running, completed,
+      // failed }` literal silently minted a NEW key for any other value, which
+      // is how a heartbeat with a `queued: 2` bucket looked like "normal" 24h
+      // visibility instead of the alarm it should have been. Any row whose
+      // status isn't in JOB_STATUSES routes into `unknown`, never a
+      // freshly-minted key.
+      const counts = Object.fromEntries(JOB_STATUSES.map((st) => [st, 0]));
+      counts.unknown = 0;
+      for (const j of s.jobs) {
+        if (Object.prototype.hasOwnProperty.call(counts, j.status) && j.status !== 'unknown') {
+          counts[j.status] += 1;
+        } else {
+          counts.unknown += 1;
+        }
+      }
+      // Logical-liveness signal for the external watchdog (see watchdogHelpers
+      // evaluateDispatchLiveness): computed once per heartbeat from the same
+      // queue snapshot. pendingDispatchable = pending rows minus those
+      // terminally blocked behind a failed/skipped dependency.
+      const blockedPending = computeBlockedChains(s.jobs).reduce((n, c) => n + c.blocked, 0);
+      const dispatch = {
+        lastDispatchAttemptAt: s.lastDispatchAttemptAt ?? null,
+        lastRunAt: s.lastRunAt ?? null,
+        lastTickReason: lastTick?.reason ?? null,
+        pendingDispatchable: Math.max(0, counts.pending - blockedPending),
+        runningCount: counts.running,
+        paused: Boolean(s.paused),
+        drain: s.drain?.active ? { since: s.drain.since ?? null, requestedAt: s.drain.requestedAt ?? null } : null,
+      };
+      return {
+        ts: Date.now(),
+        pid: process.pid,
+        build: heartbeatBuild(),
+        counts,
+        dispatch,
+        stall: { stalled: stall.stalled, total: stall.total },
+        paused: s.paused ? { reason: s.paused.reason, resumeAt: s.paused.resumeAt } : null,
+        quarantinedCwds: (s.unreadableCwds ?? []).map((u) => u.cwd),
+        nextReset: cachedNextReset,
+        utilization: cachedUtilization,
+        consecutiveFailures,
+        // State/consecutiveFailures/degraded-budget snapshot of the shared
+        // usage-meter breaker, so a human reading only the heartbeat log can
+        // see the meter's own health apart from the queue's.
+        usageMeter: {
+          state: billing.usageCircuit.state(),
+          consecutiveFailures,
+          degradedBudget: computeDegradedBudget(),
+        },
+      };
+    });
+  }
+  if (!entry || errors.length > 0) {
+    // Deliberately carries no utilization/counts: this line says "I ran but
+    // could not read state", and consumers must not mistake it for a fresh read.
+    entry = { ts: Date.now(), pid: process.pid, build: heartbeatBuild(), degraded: true, errors };
+  }
+  appendHeartbeat(entry);
+  return entry;
+}
+
 /**
  * computeStallSummary(state) → { stalled, total, running, pending, byProject }
  *
@@ -2015,6 +2316,22 @@ function findStrandedInvestigations(jobs, now, maxMs, isAlive = claudePidAlive)
 // the .bak-* snapshots.
 const quarantinedPaths = new Set();
 function flagUnreadable(state) {
+  // Per-shard quarantine (queueStore.unreadableCwds): snapshot each torn shard
+  // once and name it, but never halt — other projects keep dispatching.
+  for (const u of state.unreadableCwds ?? []) {
+    if (!quarantinedPaths.has(u.file)) {
+      quarantinedPaths.add(u.file);
+      try {
+        fs.copyFileSync(u.file, `${u.file}.corrupt-${Date.now()}`);
+      } catch { /* best-effort: the read already failed, the copy may too */ }
+      console.error(`[scheduler] project queue shard quarantined (${u.cwd}): ${u.error}`);
+      logs.writeLine({
+        level: 'error', scope: 'scheduler',
+        message: `project queue shard unreadable — ${u.cwd} is quarantined, other projects keep dispatching`,
+        meta: { cwd: u.cwd, path: u.file, error: u.error },
+      });
+    }
+  }
   if (!state.unreadable) return state;
   if (state.unreadablePath && !quarantinedPaths.has(state.unreadablePath)) {
     quarantinedPaths.add(state.unreadablePath);
@@ -2073,8 +2390,35 @@ async function writeQueue(state) {
 // preceding mutate threw, so the chain never deadlocks.
 let mutateTail = Promise.resolve();
 
+// Observe-only watchdog: a mutate body over MUTATE_WATCHDOG_MS is logged and
+// audited once per episode (latched until a mutate completes). mutateTail is
+// deliberately NEVER reset — it is what enforces the single-writer law, and
+// abandoning a live writer would let two read-modify-writes interleave.
+const MUTATE_WATCHDOG_MS = 60_000;
+let mutateWedgeLatched = false;
+
 function mutate(fn) {
   const next = mutateTail.then(async () => {
+    const wedgeTimer = setTimeout(() => {
+      if (mutateWedgeLatched) return;
+      mutateWedgeLatched = true;
+      console.warn(`[scheduler] MUTATE WEDGED: a queue mutation has run > ${MUTATE_WATCHDOG_MS}ms`);
+      appendAuditEvent('mutate_wedged', { budgetMs: MUTATE_WATCHDOG_MS });
+    }, MUTATE_WATCHDOG_MS);
+    if (typeof wedgeTimer.unref === 'function') wedgeTimer.unref();
+    try {
+      return await mutateBody(fn);
+    } finally {
+      clearTimeout(wedgeTimer);
+      mutateWedgeLatched = false;
+    }
+  });
+  mutateTail = next.catch(() => {}); // keep chain alive on errors
+  return next;
+}
+
+async function mutateBody(fn) {
+  {
     const state = await readQueue();
     // Bail BEFORE fn runs: a mutator handed an unreadable (therefore empty)
     // state would compute its result from a queue that isn't there, and
@@ -2120,9 +2464,7 @@ function mutate(fn) {
     }
     await writeQueue(state);
     return ret;
-  });
-  mutateTail = next.catch(() => {}); // keep chain alive on errors
-  return next;
+  }
 }
 
 // ---------- PRD parsing ----------
@@ -2142,11 +2484,23 @@ const parsePrd = prdParser.parsePrd;
 // one — acceptable: PRD counts per project are bounded (hundreds, not
 // millions), and correctness across multiple project dirs matters more than
 // preserving the single-dir cache's steady-state zero-read fast path.
-async function listPrdFiles() {
+async function listPrdFiles(skipCwds) {
   ensureDirs();
   const dirs = candidatePrdsDirs();
   const perDir = await Promise.all(dirs.map((dir) => prdParser.listPrdFiles(dir)));
-  return { files: perDir.flat().sort(), dirCount: dirs.length };
+  let files = perDir.flat();
+  // A quarantined project has no job rows this pass; scanning its PRDs would
+  // mint fresh `pending` rows for work that may already be running.
+  if (skipCwds && skipCwds.size > 0) {
+    const prefixes = [...skipCwds].map((c) => c + path.sep);
+    files = files.filter((f) => !prefixes.some((p) => f.startsWith(p)));
+  }
+  return { files: files.sort(), dirCount: dirs.length };
+}
+
+/** Set of cwds whose shard is quarantined in this merged read. */
+function quarantinedCwdSet(state) {
+  return new Set((state?.unreadableCwds ?? []).map((u) => u.cwd));
 }
 
 /**
@@ -2186,7 +2540,22 @@ async function allocateParallelGroup(cwd) {
  * Safety:
  *   - PID-recycling: between app death and this call, another process may have
  *     reused the PID. We read /proc/<pid>/cmdline (Linux) or `ps -p` (macOS)
- *     and only SIGTERM if the cmdline starts with the claude bin path.
+ *     and only SIGTERM if the cmdline matches /\bclaude\b/. Since procName
+ *     aliasing, cmdline[0] is the alias path (`.../procnames/sm-claude-job`) or
+ *     the smArgv0 label (`sm-claude-job:<slug>`), NOT the claude bin path —
+ *     both still contain the word `claude`. The macOS `ps -p <pid> -o command=`
+ *     branch has the same exposure and the same guarantee (ps shows argv0).
+ *     Migration: cmdline is fixed at exec, and no claude procIdentity is
+ *     persisted (job.runtime carries none), so a pre-aliasing process recorded
+ *     and compared after upgrade still compares equal to itself — no
+ *     tolerance needed; unaliased legacy cmdlines also match /\bclaude\b/.
+ *   - recordedIdentity (optional): when the caller has a COMPLETE prior
+ *     procIdentity for this pid (startTicks + cmdline), it is used only as a
+ *     VETO — if it provably differs from the pid's live identity right now,
+ *     the pid was recycled and the kill is refused ('mismatch') even before
+ *     the cmdline heuristic below runs. No recorded identity (today's only
+ *     case — job.runtime carries no identity yet) falls through unchanged to
+ *     the existing /\bclaude\b/ + `ps -p` heuristics.
  *   - Detached process group: jobs are spawned with detached:true so we kill
  *     -pid (the group). If the group leader is already gone, that fails
  *     silently and we fall back to single-pid kill.
@@ -2194,12 +2563,17 @@ async function allocateParallelGroup(cwd) {
  *     scheduled via setTimeout to clean up any process ignoring SIGTERM.
  *
  * Returns: 'killed' (cmdline matched + signal sent), 'gone' (pid not alive),
- *          'mismatch' (pid alive but cmdline doesn't look like claude),
+ *          'mismatch' (pid alive but cmdline doesn't look like claude, or a
+ *          complete recorded identity proves the pid was recycled),
  *          'unknown' (couldn't read cmdline — leave the pid alone).
  */
-function killOrphanClaudePid(pid) {
+function killOrphanClaudePid(pid, recordedIdentity = null) {
   if (!pid || typeof pid !== 'number' || pid <= 1) return 'gone';
   try { process.kill(pid, 0); } catch { return 'gone'; }
+  if (recordedIdentity && recordedIdentity.complete
+    && isDifferentProcess(recordedIdentity, procIdentityOf(pid))) {
+    return 'mismatch';
+  }
   let cmdline = '';
   try {
     cmdline = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
@@ -2307,25 +2681,48 @@ async function reconcile(state) {
   // has no queue row yet, so it is never "live" and gets archived here
   // instead of ever reaching the onDisk scan below.
   let phaseStartMs = Date.now();
-  await consolidateAllFlatPrds(allProjectCwds());
+  const skipCwds = quarantinedCwdSet(state);
+  await consolidateAllFlatPrds(allProjectCwds(), skipCwds);
   phaseMs.flatPrdSweep = Date.now() - phaseStartMs;
 
   phaseStartMs = Date.now();
-  const { files, dirCount } = await listPrdFiles();
+  const { files, dirCount } = await listPrdFiles(skipCwds);
   phaseMs.prdDirResolve = Date.now() - phaseStartMs;
 
   phaseStartMs = Date.now();
   const onDisk = new Map();
+  // Slugs derive from title text with no cwd salt, so two different projects
+  // can legitimately queue an identically-slugged PRD — onDisk alone can
+  // only hold ONE parsed PRD per slug (last-file-wins), which would silently
+  // hand an EXISTING row the wrong project's PRD (or none at all) when two
+  // projects collide on a slug. This side index lets the two existing-row
+  // lookups below (job refresh + invalid-row repair) disambiguate by the
+  // row's own cwd first; the fresh-discovery loop further down still reads
+  // the bare `onDisk` (unscoped) since a same-slug NEW-PRD collision across
+  // two projects is a rarer edge this reconcile pass doesn't yet resolve.
+  const onDiskByCwd = new Map();
   for (const f of files) {
     try {
       // Per-file await: parsing is mtime-cached so steady-state hits zero
       // disk reads; on cold cache the awaits keep the main thread responsive.
       const p = await parsePrd(f);
       onDisk.set(p.slug, p);
+      if (p.cwd) onDiskByCwd.set(`${p.slug}::${p.cwd}`, p);
     } catch (e) {
       console.warn('[scheduler] failed to parse', f, e?.message);
     }
   }
+  // resolvePrdForJob(slug, cwd) — cwd-scoped PRD lookup for an EXISTING
+  // queue row, falling back to the unscoped onDisk entry when this exact
+  // (slug, cwd) pair has no PRD (e.g. cwd is null/stale) — same behavior as
+  // a bare onDisk.get() for every slug that isn't cross-project-colliding.
+  function resolvePrdForJob(slug, cwd) {
+    if (cwd) {
+      const scoped = onDiskByCwd.get(`${slug}::${cwd}`);
+      if (scoped) return scoped;
+    }
+    return onDisk.get(slug);
+  }
   phaseMs.parseLoop = Date.now() - phaseStartMs;
 
   const next = [];
@@ -2345,7 +2742,7 @@ async function reconcile(state) {
   // historyTerminalBySlug() below and backfilled before being dropped.
   const terminalDroppedNeedingHistoryCheck = [];
   for (const job of state.jobs) {
-    const p = onDisk.get(job.slug);
+    const p = resolvePrdForJob(job.slug, job.cwd);
     if (!p) {
       // A terminal job whose .md is gone was archived on purpose — dropping
       // its row is the intended end of the auto-archive flow, PROVIDED it's
@@ -2379,10 +2776,24 @@ async function reconcile(state) {
       continue;
     }
     seen.add(job.slug);
+    // p.cwd REFINES the row's existing cwd; it never erases one. A PRD
+    // file with no `cwd:` frontmatter parses p.cwd as undefined — falling
+    // through to a bare `cwd: p.cwd` here nulled the row's real cwd,
+    // which queueStore.writeSplit then buckets into
+    // schedulerBatch.js's DEFAULT_PROJECT_CWD, silently relocating the
+    // row into the WRONG project's queue.json shard and emptying the
+    // owning project's shard underneath it (2026-09 data-loss incident).
+    // Resolved ONCE into a local so originSessionId's fallback below
+    // resolves against the SAME cwd this row actually gets, not the raw
+    // (possibly undefined) p.cwd — resolveOriginSessionId(undefined, ...)
+    // returns null unconditionally, which silently dropped the origin link
+    // for every PRD with no `cwd:` frontmatter even though a good cwd was
+    // available one line below.
+    const refreshedCwd = p.cwd ?? job.cwd ?? null;
     const updatedJob = {
       ...job,
       title: p.title,
-      cwd: p.cwd,
+      cwd: refreshedCwd,
       parallelGroup: p.parallelGroup,
       estimateMinutes: p.estimateMinutes,
       sourcePromptId: reconcileSourcePromptId(job, p.sourcePromptId),
@@ -2396,7 +2807,7 @@ async function reconcile(state) {
       quietMachine: p.quietMachine === true,
       budgetExempt: p.budgetExempt === true,
       originSessionId: job.originSessionId
-        ?? resolveOriginSessionId(p.cwd, p.epicId ?? reconcileSourcePromptId(job, p.sourcePromptId)),
+        ?? resolveOriginSessionId(refreshedCwd, p.epicId ?? reconcileSourcePromptId(job, p.sourcePromptId)),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
       agentType: p.agentType ?? job.agentType ?? null,
     };
@@ -2479,7 +2890,7 @@ async function reconcile(state) {
   for (const inv of invalidJobs) {
     if (seen.has(inv.slug)) continue; // a valid row for this slug already exists
     const oldStatus = inv.row?.status;
-    const hist = historyBySlug.get(inv.slug) ?? latestTerminalOutcomeForSlug(inv.slug, { runsDir: RUNS_DIR });
+    const hist = historyBySlug.get(inv.slug) ?? latestTerminalOutcomeForSlug(inv.slug, { runsDir: schedulerPaths.runsDir() });
     if (hist) {
       // Never resurrect: this slug already has a durable terminal record
       // elsewhere (history.jsonl or a run sidecar) — repairing its corrupted
@@ -2492,17 +2903,22 @@ async function reconcile(state) {
       });
       continue;
     }
-    const p = onDisk.get(inv.slug);
+    const p = resolvePrdForJob(inv.slug, inv.row?.cwd);
     if (!p) {
       // PRD file also gone with no terminal record anywhere — nothing to
       // repair against. queueStore already logged the quarantine once.
       continue;
     }
+    // Same cwd-refines-not-erases rule as the normal refresh path above, and
+    // same reason for resolving it once into a local: originSessionId's
+    // fallback must resolve against the cwd this row actually gets, not the
+    // raw (possibly undefined) p.cwd.
+    const repairedCwd = p.cwd ?? inv.row?.cwd ?? null;
     const job = {
       ...inv.row,
       slug: inv.slug,
       title: p.title,
-      cwd: p.cwd,
+      cwd: repairedCwd,
       parallelGroup: p.parallelGroup,
       estimateMinutes: p.estimateMinutes,
       sourcePromptId: p.sourcePromptId ?? inv.row?.sourcePromptId ?? null,
@@ -2512,7 +2928,7 @@ async function reconcile(state) {
       disposition: p.disposition ?? null,
       quietMachine: p.quietMachine === true,
       budgetExempt: p.budgetExempt === true,
-      originSessionId: inv.row?.originSessionId ?? resolveOriginSessionId(p.cwd, p.epicId ?? p.sourcePromptId),
+      originSessionId: inv.row?.originSessionId ?? resolveOriginSessionId(repairedCwd, p.epicId ?? p.sourcePromptId),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
       agentType: p.agentType ?? inv.row?.agentType ?? null,
     };
@@ -2616,17 +3032,27 @@ async function reconcile(state) {
     // guard above inert. Fall back to reading the slug's own newest run
     // sidecars straight off disk — same "don't resurrect an already-terminal
     // slug" intent, independent of history.jsonl's existence.
-    const fallback = latestTerminalOutcomeForSlug(slug, { runsDir: RUNS_DIR });
+    const fallback = latestTerminalOutcomeForSlug(slug, { runsDir: schedulerPaths.runsDir() });
     if (fallback) {
       if (fallback.status === 'completed') {
         historyArchiveCandidates.push({ slug, status: fallback.status, finishedAt: fallback.finishedAt });
       }
       continue;
     }
+    // No prior row exists to fall back to (this is a fresh discovery), so a
+    // PRD file with no `cwd:` frontmatter falls back to the project root it
+    // was actually found under (derived from its own file path) rather than
+    // nulling out to schedulerBatch.js's DEFAULT_PROJECT_CWD. Resolved once
+    // so originSessionId (below) resolves against this SAME cwd — passing
+    // the raw p.cwd there instead would resolve against `undefined` for
+    // exactly the no-frontmatter case this fallback exists to handle, since
+    // resolveOriginSessionId(cwd, ...) returns null unconditionally when
+    // `cwd` is falsy.
+    const discoveredCwd = p.cwd ?? deriveProjectCwdFromPrdPath(p.path) ?? null;
     const entry = {
       slug,
       title: p.title,
-      cwd: p.cwd,
+      cwd: discoveredCwd,
       parallelGroup: p.parallelGroup,
       estimateMinutes: p.estimateMinutes,
       sourcePromptId: p.sourcePromptId,
@@ -2636,7 +3062,7 @@ async function reconcile(state) {
       disposition: p.disposition ?? null,
       quietMachine: p.quietMachine === true,
       budgetExempt: p.budgetExempt === true,
-      originSessionId: resolveOriginSessionId(p.cwd, p.epicId ?? p.sourcePromptId),
+      originSessionId: resolveOriginSessionId(discoveredCwd, p.epicId ?? p.sourcePromptId),
       bodyPreview: p.body.split('\n').slice(0, 6).join('\n'),
       agentType: p.agentType ?? null,
       status: 'pending',
@@ -2787,14 +3213,73 @@ async function reconcile(state) {
 // ---------- next-reset detection ----------
 
 let cachedNextReset = null; // bare ISO string or null
-let cachedUtilization = null; // five_hour utilization %, 0–100, or null if unknown
+let cachedUtilization = null; // binding-window utilization %, 0–100, or null if unknown
+// ms timestamp of the last FRESH reset observation (see recordObservedReset)
+// — distinct from Date.now(), so persistSchedulerState never re-stamps a
+// stale cachedNextReset as "just observed" on every poll cycle.
+let lastResetObservedAtMs = null;
+// Full usage payload (`{ five_hour, limits?, ... }`) from the last SUCCESSFUL
+// poll — the input degradedBudget() carries forward while the meter is down.
+// Never itself defaults to 0; absent (null) reads as "no signal yet" and
+// degradedBudget() treats that conservatively (100% / capped concurrency).
+let lastGoodUsagePayload = null;
+// Non-null while the meter is degraded (circuit open, or a poll otherwise
+// failed to return 'ok') — narrows tickQueue's freeSlots as a picker-side
+// hold instead of a second slot pool (see tickQueue's freeSlots computation).
+// Cleared to null the moment a poll succeeds or the meter is inapplicable.
+let degradedConcurrencyCapValue = null;
+// Deliberately a named constant, not a bare zero literal assigned straight
+// into cachedUtilization: a genuine "no consumer meter to poll" (enterprise
+// auth) is categorically different from "the meter is down and we don't
+// know" — the latter must never read as 0%/full-speed-ahead.
+const NO_METER_UTILIZATION = 0;
+
+/**
+ * Records a freshly-observed reset, stamping lastResetObservedAtMs only when
+ * there actually WAS a reset to observe (never on every poll regardless of
+ * payload content — see persistSchedulerState's header).
+ */
+function recordObservedReset(resetIso) {
+  if (resetIso) {
+    cachedNextReset = resetIso;
+    lastResetObservedAtMs = Date.now();
+  } else {
+    cachedNextReset = null;
+  }
+}
+
+/** Pure: this poll/executor cycle's conservative budget while the meter is degraded. */
+function computeDegradedBudget() {
+  return degradedBudget(lastGoodUsagePayload, {
+    observed429: lastFailureKind === 'meter_rate_limited',
+    resetsAt: cachedNextReset,
+    now: Date.now(),
+    configuredCap: sessionSlots.snapshot().total,
+  });
+}
+
+/**
+ * Computes AND applies this cycle's degraded budget to cachedUtilization /
+ * degradedConcurrencyCapValue in one call — every "meter down" branch in
+ * pollLoop/runQueueStarvationWatchdog needs the exact same
+ * compute-then-assign-both-fields pair, so it lives once here rather than
+ * being copy-pasted at each call site (where a future change to how the
+ * budget applies would otherwise have to be made N times).
+ */
+function applyDegradedBudget() {
+  const budget = computeDegradedBudget();
+  cachedUtilization = budget.utilization;
+  degradedConcurrencyCapValue = budget.concurrencyCap;
+  return budget;
+}
 
 /** Fetches latest usage from billing API. Throws on any error — callers handle it. */
 async function refreshNextReset() {
   const r = await billing.fetchUsage();
   if (r.kind !== 'ok') throw new Error(`usage fetch failed (${r.kind}): ${r.message ?? ''}`);
-  cachedNextReset = r.data?.usage?.five_hour?.resets_at ?? null;
-  cachedUtilization = r.data?.usage?.five_hour?.utilization ?? cachedUtilization;
+  const window = bindingWindow(r.data?.usage);
+  recordObservedReset(window.resets_at ?? null);
+  cachedUtilization = Number.isFinite(window.utilization) ? window.utilization : cachedUtilization;
   return cachedNextReset;
 }
 
@@ -2805,15 +3290,38 @@ function getNextResetCached() {
 /**
  * Pure: picks the reset to pause against for a rate-limited run (PRD 1118).
  * Prefers the BINDING window read off the run's own log — refreshNextReset()
- * only ever reports five_hour, which is the wrong clock when a
- * seven_day/seven_day_overage_included window is what actually 429'd
- * (five_hour can read 0% utilization at the very same moment). Falls back
- * to the billing-endpoint-derived reset only when the log yields nothing.
- */
-function resolveRateLimitPauseReset(logPath, billingResetIso) {
+ * only ever reports the binding window at POLL time, which can be a
+ * different clock than what actually 429'd this run (five_hour can read 0%
+ * utilization at the very same moment a seven_day window binds). Falls back
+ * to the billing-endpoint-derived reset only when the log yields nothing —
+ * and rejects EITHER source when it has already passed relative to `nowMs`
+ * (usageCircuit.isResetFresh): a stale reset must never arm a resume timer
+ * that already elapsed (that's the 30-second-nap bug computeEffectiveResumeAt
+ * below also guards against), so a stale value here returns null and lets
+ * the caller's 30-minute fallback take over instead.
+ */
+function resolveRateLimitPauseReset(logPath, billingResetIso, nowMs = Date.now()) {
   const logReset = resolveBindingRateLimitReset(logPath);
-  if (logReset != null) return new Date(logReset * 1000).toISOString();
-  return billingResetIso ?? null;
+  if (logReset != null) {
+    const iso = new Date(logReset * 1000).toISOString();
+    if (isResetFresh(iso, nowMs)) return iso;
+  }
+  if (billingResetIso && isResetFresh(billingResetIso, nowMs)) return billingResetIso;
+  return null;
+}
+
+/**
+ * Shared by both rate-limit pause sites (spawnJob's rateLimited branch and
+ * reapDeadRunningJobs): the billing-endpoint-derived fallback reset used
+ * when the run's own log yields no binding window. While the shared
+ * usageCircuit is OPEN, skip calling refreshNextReset() — it would just be
+ * another request against the endpoint the breaker just decided is down —
+ * and fall back to whatever was last cached instead (resolveRateLimitPauseReset
+ * itself still rejects that cached value if it has since gone stale).
+ */
+async function billingResetForPause() {
+  if (billing.usageCircuit.state() === 'open') return cachedNextReset;
+  return refreshNextReset().catch(() => cachedNextReset);
 }
 
 // ---------- health / poll state ----------
@@ -2828,10 +3336,27 @@ let firstFailureAt = null;
 let firstNon429FailureAt = null; // tracks only transient/config failures; 429s don't count toward network-pause threshold
 let lastFailureKind = null; // 'transient' | 'meter_rate_limited' | 'auth' | null
 let pauseClearedManuallyAt = null;
+// In-memory only (no new persisted field): when clearPause last actually lifted a pause — a
+// legitimate restart point of the dispatch-idleness clock (dispatchIdleMs).
+let lastPauseClearedAt = null;
 // PRD: the usage-poller silent-failure-streak WARN is emitted once per streak,
 // not once per failure (57 failures must produce ONE opsErrorLog line, not 57).
 // Reset alongside consecutiveFailures everywhere that resets to 0.
 let failureStreakWarned = false;
+// ms timestamp the initial WARN fired this streak — anchors the periodic
+// escalation cadence below. Reset to null alongside failureStreakWarned.
+let failureStreakWarnedAt = null;
+// ms timestamp of the last periodic escalation (audit event + opsErrorLog
+// line) this streak. Reset to null alongside failureStreakWarned so a LATER
+// streak re-arms both the initial WARN and the escalation cadence.
+let lastEscalationAtMs = null;
+
+/** The failure-streak-WARN trio must always reset together — one helper, not 3 copies. */
+function resetFailureStreak() {
+  failureStreakWarned = false;
+  failureStreakWarnedAt = null;
+  lastEscalationAtMs = null;
+}
 // Ceiling on pollLoop's exponential poll backoff (both the 'transient'/'config'
 // branch and the 'meter_rate_limited' branch below share this cap — a single
 // constant so the two never drift to different ceilings).
@@ -2840,6 +3365,11 @@ const BACKOFF_MAX_MS = 480_000; // 8 minutes
 // jitter and becomes worth a human's attention. health.cjs imports this so the
 // WARN and the `npm run health` non-GREEN trip at the exact same count.
 const FAILURE_STREAK_WARN_THRESHOLD = 5;
+// How often a PERSISTING failure streak re-escalates (audit event +
+// opsErrorLog line) after the initial WARN, and the health.cjs YELLOW->RED
+// threshold for how long the usageCircuit has been open — one constant so
+// the log cadence and the health-color flip never drift apart.
+const FAILURE_STREAK_ESCALATION_MS = 30 * 60_000; // 30 minutes
 
 /** Pure: exponential backoff with a cap, shared by every pollLoop failure branch. Exported for unit testing. */
 function nextBackoffMs(prevBackoffMs) {
@@ -2856,19 +3386,59 @@ function shouldWarnFailureStreak(consecutiveFailures, alreadyWarned, threshold =
   return consecutiveFailures >= threshold && !alreadyWarned;
 }
 
-/** Emits the one-time opsErrorLog WARN for a failure streak crossing the threshold, if not already warned this streak. */
+/**
+ * Pure: does a PERSISTING failure streak warrant another escalation (audit
+ * event + opsErrorLog line) at `nowMs`? Exported for unit testing. Only
+ * relevant once the streak has already crossed `warnThreshold` (the initial
+ * WARN); `lastEscalatedAtMs` null means no escalation has fired yet this
+ * streak, so the first one is due immediately. Re-arms automatically once a
+ * streak clears (the caller resets `lastEscalatedAtMs` to null alongside
+ * `failureStreakWarned`), so a later independent streak escalates again.
+ */
+function shouldEscalateFailureStreak(consecutiveFailures, lastEscalatedAtMs, nowMs, thresholdMs = FAILURE_STREAK_ESCALATION_MS, warnThreshold = FAILURE_STREAK_WARN_THRESHOLD) {
+  if (consecutiveFailures < warnThreshold) return false;
+  if (!lastEscalatedAtMs) return true;
+  return nowMs - lastEscalatedAtMs >= thresholdMs;
+}
+
+/**
+ * Emits the one-time opsErrorLog WARN the moment a failure streak crosses
+ * the threshold, then — while that streak PERSISTS — re-escalates (audit
+ * event + another opsErrorLog line) every FAILURE_STREAK_ESCALATION_MS so a
+ * human watching only the audit log still sees a live incident, not just the
+ * single opening WARN from hours ago.
+ */
 function warnFailureStreakIfNeeded() {
-  if (!shouldWarnFailureStreak(consecutiveFailures, failureStreakWarned)) return;
-  failureStreakWarned = true;
-  try {
-    appendError({
-      cwd: DEFAULT_PROJECT_CWD,
-      scope: 'scheduler',
-      level: 'warn',
-      message: `usage/rate-limit poller has failed ${consecutiveFailures} consecutive times (kind=${lastFailureKind}, backoffMs=${backoffMs}) — see ${SCHEDULER_STATE_PATH}`,
-      meta: { consecutiveFailures, backoffMs, lastFailureKind },
-    });
-  } catch { /* durable logging must never break the poll loop */ }
+  const nowMs = Date.now();
+  if (shouldWarnFailureStreak(consecutiveFailures, failureStreakWarned)) {
+    failureStreakWarned = true;
+    failureStreakWarnedAt = nowMs;
+    lastEscalationAtMs = nowMs;
+    try {
+      appendError({
+        cwd: DEFAULT_PROJECT_CWD,
+        scope: 'scheduler',
+        level: 'warn',
+        message: `usage/rate-limit poller has failed ${consecutiveFailures} consecutive times (kind=${lastFailureKind}, backoffMs=${backoffMs}) — see ${schedulerPaths.schedulerStatePath()}`,
+        meta: { consecutiveFailures, backoffMs, lastFailureKind },
+      });
+    } catch { /* durable logging must never break the poll loop */ }
+    return;
+  }
+  if (failureStreakWarned && shouldEscalateFailureStreak(consecutiveFailures, lastEscalationAtMs, nowMs)) {
+    lastEscalationAtMs = nowMs;
+    const persistedMinutes = failureStreakWarnedAt ? Math.round((nowMs - failureStreakWarnedAt) / 60_000) : null;
+    try {
+      appendAuditEvent('usage_poller_failure_streak_persists', { consecutiveFailures, backoffMs, lastFailureKind, persistedMinutes });
+      appendError({
+        cwd: DEFAULT_PROJECT_CWD,
+        scope: 'scheduler',
+        level: 'warn',
+        message: `usage/rate-limit poller streak still failing after ${persistedMinutes}m (${consecutiveFailures} consecutive, kind=${lastFailureKind}, backoffMs=${backoffMs}) — see ${schedulerPaths.schedulerStatePath()}`,
+        meta: { consecutiveFailures, backoffMs, lastFailureKind, persistedMinutes },
+      });
+    } catch { /* durable logging must never break the poll loop */ }
+  }
 }
 // PRD 1119: consecutive-rapid-rate-limit hard-pause tracking, keyed per slug.
 // See isCooldownSuppressed/nextRapidRateLimitCount below for the pure rules.
@@ -2882,6 +3452,7 @@ let resumeTimer = null;
 let pollLoopTimer = null;
 let rescheduleInterval = null;
 let heartbeatInterval = null;
+let dispatchLoopHandle = null;
 // Stall-detector state (computeStallSummary), read/written only inside the
 // heartbeat interval below. Keyed per-project cwd (never a single value) —
 // a single module-level flag would let one busy project's activity clear or
@@ -2905,12 +3476,13 @@ const runningSet = new Set();
 // N concurrent Opus processes — the >3-concurrent class that OOM-killed Electron.
 // Over-cap requests are QUEUED (not dropped) and drained as slots free, so a failed
 // PRD that never reaches 'needs_review' still eventually gets its fix-plan authored.
-let investigationsInFlight = 0;
 const MAX_CONCURRENT_INVESTIGATIONS = 1;
 const deferredInvestigations = new Map(); // fixable-job slug -> { failedJob, runDir }
+// Mirror of machine `drain.active`, kept in memory so spawn sites need no queue read.
+let drainActive = false;
 
 function drainDeferredInvestigation() {
-  if (investigationsInFlight >= MAX_CONCURRENT_INVESTIGATIONS) return;
+  if (drainActive || runtimeState.investigationCount() >= MAX_CONCURRENT_INVESTIGATIONS) return;
   const next = deferredInvestigations.entries().next();
   if (next.done) return;
   const [slug, ctx] = next.value;
@@ -3001,6 +3573,7 @@ function buildScheduleStatePayload(state) {
     lastDispatchAttemptAt: state.lastDispatchAttemptAt ?? null,
     nextReset: getNextResetCached(),
     paused: state.paused,
+    drain: state.drain ?? null,
     // Launch circuit breaker (issue #11): which personas cannot launch right
     // now and why, plus any degraded-mode env in force. Empty objects when healthy.
     launchBlocks: state.launchBlocks ?? {},
@@ -3170,13 +3743,17 @@ function nextRapidRateLimitCount(prevCount, { rateLimited, durationMs }) {
 /**
  * Pure: decides the resumeAt actually armed for a pause. 'network' and
  * 'rate_limit' (PRD 1118) both get a bounded 30-minute fallback when no
- * explicit resumeAt is supplied — the live rate_limit failure mode is the
- * billing usage endpoint itself 429ing while the log yields no binding
- * window either, which used to leave an indefinite pause with no resume
- * timer at all (a queue that never comes back on its own).
+ * explicit resumeAt is supplied, OR when the supplied resumeAtIso has
+ * already passed (usageCircuit.isResetFresh) — a stale reset used to produce
+ * `Math.max(30_000, <negative>)` downstream in computeResumeDelay, a
+ * 30-SECOND nap instead of a real pause, spinning the queue right back into
+ * the same still-active rate limit. The live failure mode is the billing
+ * usage endpoint itself 429ing while the log yields no fresh binding window
+ * either, which used to leave an indefinite pause with no resume timer at
+ * all (a queue that never comes back on its own) — this covers both.
  */
 function computeEffectiveResumeAt(reason, resumeAtIso, nowMs = Date.now()) {
-  if (resumeAtIso) return resumeAtIso;
+  if (resumeAtIso && isResetFresh(resumeAtIso, nowMs)) return resumeAtIso;
   if (reason === 'network' || reason === 'rate_limit') {
     return new Date(nowMs + 30 * 60_000).toISOString();
   }
@@ -3196,11 +3773,14 @@ function computeResumeDelay(effectiveResumeAtIso, nowMs = Date.now()) {
 
 async function setPaused(reason, resumeAtIso, opts = {}) {
   const { observedAt = null, force = false } = opts;
+  const isManual = reason === 'manual';
   // Honor manual-override cooldown: if the user cleared a pause within the
   // last 5 minutes, suppress auto-pause re-engagement UNLESS this pause is
   // backed by a fresh observation (a run that started after the clear) or is
   // forced (the rapid-repeat hard pause, which the cooldown cannot suppress).
-  if (isCooldownSuppressed({ pauseClearedManuallyAt, now: Date.now(), observedAt, force })) {
+  // A user-initiated 'manual' pause is never an auto-detection, so the cooldown
+  // (which exists to ignore STALE auto-detections) does not apply to it.
+  if (!isManual && isCooldownSuppressed({ pauseClearedManuallyAt, now: Date.now(), observedAt, force })) {
     console.log(`[scheduler] setPaused(${reason}) suppressed by manual override cooldown`);
     return;
   }
@@ -3210,15 +3790,24 @@ async function setPaused(reason, resumeAtIso, opts = {}) {
     console.log(`[scheduler] setPaused(${reason}) engaging despite manual override cooldown — triggering run started after the manual clear`);
   }
 
-  const effectiveResumeAt = computeEffectiveResumeAt(reason, resumeAtIso);
+  // 'manual' never arms a resume timer: only schedule:resume / run-now clears it.
+  const effectiveResumeAt = isManual ? null : computeEffectiveResumeAt(reason, resumeAtIso);
 
-  await mutate((s) => {
+  const kept = await mutate((s) => {
+    // A user pause outranks every auto-pause (rate_limit/auth/network): the
+    // auto path must not overwrite it, or its resume timer would auto-clear it.
+    if (!isManual && s.paused && s.paused.reason === 'manual') return true;
     if (s.paused && s.paused.reason === reason) {
       if (effectiveResumeAt) s.paused.resumeAt = effectiveResumeAt;
     } else {
       s.paused = { reason, since: new Date().toISOString(), resumeAt: effectiveResumeAt || null };
     }
+    return false;
   });
+  if (kept) {
+    console.log(`[scheduler] setPaused(${reason}) ignored: a manual pause is in force`);
+    return;
+  }
   await broadcast({ flush: true });
   cancelToken.cancelled = true;
   if (resumeTimer) { clearTimeout(resumeTimer); resumeTimer = null; }
@@ -3256,6 +3845,7 @@ async function clearPause(source) {
   });
   // Un-cancel the tick guard on every recovery path, not just runDueJobs().
   applyPauseCleared(wasPaused, cancelToken);
+  if (wasPaused) lastPauseClearedAt = Date.now();
   // Track manual clears for the auto-pause cooldown.
   if (source === 'manual' || source === 'run-now') {
     pauseClearedManuallyAt = Date.now();
@@ -3268,7 +3858,7 @@ async function clearPause(source) {
     firstFailureAt = null;
     firstNon429FailureAt = null;
     lastFailureKind = null;
-    failureStreakWarned = false;
+    resetFailureStreak();
     persistSchedulerState();
   }
   if (wasPaused) await broadcast({ flush: true });
@@ -3351,37 +3941,65 @@ function resetJobFields(job, errorMsg, opts = {}) {
   return true;
 }
 
-// Grace period between a boot orphan's SIGTERM and reading its log to
-// classify the outcome — matches killOrphanClaudePid's own internal 5s
-// SIGKILL follow-up delay, plus a small margin so classification always runs
-// after that SIGKILL has had a chance to land.
-const BOOT_ORPHAN_KILL_GRACE_MS = 6000;
-
 /**
- * partitionBootOrphans(jobs, isAlive?) → { immediate: string[], deferred: string[] }
+ * partitionBootOrphans(jobs, liveness) → { immediate: string[], adopted: string[] }
  *
- * Pure decision split for boot reconciliation. A 'running' job whose recorded
- * pid is still alive must NOT be classified from its log yet — the orphaned
- * process may still be writing to it, so reading now risks misclassifying a
- * job that is about to emit result:success as no_result and double-running it.
- * Ported from reconcileQueueOffline's cross-tick escalation (see
- * src/main/lib/watchdogHelpers.cjs) — here it's a single deferred window since
- * this process stays up to revisit it, rather than a separate short-lived
- * watchdog process needing another tick.
- */
-function partitionBootOrphans(jobs, isAlive = claudePidAlive) {
+ * Pure decision split for boot reconciliation of 'running' rows. A row PROVEN
+ * ALIVE is `adopted`: left `running`, never signalled — the steady-state
+ * reaper (reapDeadRunningJobs) finishes it on exit, exactly as it does for any
+ * pidless-recovered row. Only rows proven dead or exited are `immediate` and go
+ * through applyOrphanOutcome. `liveness` is the same injected set
+ * selectReapableJobs takes (plus readRecord/runsDir/identityOf):
+ * { pidAlive, getLogPid, getLogMtimeMs, logFreshWindowMs, findLiveProcess,
+ *   readRecord(runDir, slug) }.
+ *
+ * classifyAdoption runs FIRST when the row has a supervisor record: 'adopt' and
+ * 'over-budget' are alive (budget re-arm across restart is a separate PRD, so
+ * an over-budget row is spared, not killed); 'exited' / 'dead' / 'foreign-pid'
+ * are not. A row with no record falls to the reaper's own ladder: recorded
+ * pid alive, then fresh log, log-pid alive, /proc cwd scan.
+ * Complexity: O(jobs) plus one /proc probe per running row.
+ */
+function partitionBootOrphans(jobs, {
+  pidAlive = claudePidAlive, getLogPid, getLogMtimeMs, logFreshWindowMs, findLiveProcess,
+  readRecord = supervisorRecord.readSupervisorRecord, runsDir = null, identityOf = procIdentityOf,
+  now = Date.now(),
+} = {}) {
   const immediate = [];
-  const deferred = [];
+  const adopted = [];
   for (const j of jobs) {
     if (j.status !== 'running') continue;
-    const pid = j.runtime?.pid;
-    if (pid && isAlive(pid)) {
-      deferred.push(j.slug);
-    } else {
-      immediate.push(j.slug);
-    }
+    if (isBootRowAlive(j, {
+      pidAlive, getLogPid, getLogMtimeMs, logFreshWindowMs, findLiveProcess, readRecord, runsDir, identityOf, now,
+    })) adopted.push(j.slug);
+    else immediate.push(j.slug);
+  }
+  return { immediate, adopted };
+}
+
+function isBootRowAlive(j, {
+  pidAlive, getLogPid, getLogMtimeMs, logFreshWindowMs, findLiveProcess, readRecord, runsDir, identityOf, now,
+}) {
+  const logMtimeMs = typeof getLogMtimeMs === 'function' ? getLogMtimeMs(j) : null;
+  const runDir = j.runId ? path.join(runsDir || schedulerPaths.runsDir(), j.runId) : null;
+  const record = runDir && typeof readRecord === 'function' ? readRecord(runDir, j.slug) : null;
+  if (record && record.pid) {
+    const alive = !!pidAlive(record.pid);
+    const verdict = supervisorRecord.classifyAdoption(record, {
+      identity: alive ? identityOf(record.pid) : null,
+      pidAlive: alive,
+      logMtimeMs,
+      exitMarker: supervisorRecord.hasExitMarker(runDir, record),
+      now,
+    });
+    return verdict === 'adopt' || verdict === 'over-budget';
   }
-  return { immediate, deferred };
+  const pid = j.runtime?.pid;
+  if (pid && pidAlive(pid)) return true;
+  if (typeof logFreshWindowMs === 'number' && Number.isFinite(logMtimeMs) && now - logMtimeMs <= logFreshWindowMs) return true;
+  const logPid = typeof getLogPid === 'function' ? getLogPid(j) : null;
+  if (logPid && pidAlive(logPid)) return true;
+  return !!(typeof findLiveProcess === 'function' && findLiveProcess(j));
 }
 
 /**
@@ -3647,7 +4265,7 @@ async function notifyOriginatingTab(job, {
     const epicIdForTranscript = prd?.sourcePromptId || prd?.sourceTabId || job.epicId || null;
     if (epicIdForTranscript && job.cwd) {
       try {
-        const logPath = job.runId ? path.join(RUNS_DIR, job.runId, `${job.slug}.log`) : null;
+        const logPath = job.runId ? path.join(schedulerPaths.runsDir(), job.runId, `${job.slug}.log`) : null;
         const resultText = readResultFromLog(logPath);
         await appendTranscriptTurn(job.cwd, epicIdForTranscript, {
           role: 'assistant',
@@ -4378,6 +4996,39 @@ async function resolveLandedCommitEvidence(cwd, sha, sinceIso) {
   }
 }
 
+/**
+ * True when `sha` is a non-empty commit that is an ancestor of (or equal to)
+ * HEAD in the repo at `cwd` (`git merge-base --is-ancestor`). Bounded, never
+ * throws: an empty sha, an unknown sha, or any git failure is `false`, so the
+ * caller's safe default is "cannot prove the work survived".
+ */
+async function landedCommitIsAncestorOfHead(cwd, sha) {
+  if (!sha || typeof sha !== 'string' || !cwd) return false;
+  try {
+    await execGitAt(resolveProjectRoot(cwd), ['merge-base', '--is-ancestor', sha, 'HEAD'], { timeout: 10_000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Pure predicate: a needs_review row parked as shared_tree_reverted that
+ * carries a landedCommit — the only shape reverifyNeedsReview can re-check
+ * against ground truth (landedCommitIsAncestorOfHead). Deliberately
+ * independent of autoFixAttempted: 1229-fo-03 was parked with
+ * autoFixAttempted:true and no autoFixOutcome (isStrandedAutoFixPark shape),
+ * yet isStrandedAutoFixPark could not release it — that ladder only resolves
+ * once job.looksDone is set, and reverifyNeedsReview computes looksDone only
+ * for isRescanCandidate / isGuardParkedWithoutAutoFix rows, neither of which
+ * a shared_tree_reverted + autoFixAttempted row is.
+ */
+function isStaleSharedTreeRevertedPark(job) {
+  return !!job && job.status === 'needs_review'
+    && job.verifierVerdict === 'shared_tree_reverted'
+    && typeof job.landedCommit === 'string' && job.landedCommit.length > 0;
+}
+
 /**
  * Commit exactly `paths` (must already be dirty on disk) onto a dedicated
  * `sm-salvage/<slug>` ref, built from `headBefore` (or current HEAD when
@@ -4557,7 +5208,7 @@ function buildClaudeSpawnArgs({ prompt, model, sessionId, resume, systemPrompt }
 // create it — `recursive: true` makes that race safe.
 function pickRunDir() {
   const ts = new Date().toISOString().replace(/[:.]/g, '-');
-  const dir = path.join(RUNS_DIR, ts);
+  const dir = path.join(schedulerPaths.runsDir(), ts);
   return { runId: ts, dir };
 }
 
@@ -4617,7 +5268,7 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
     // Sync write: this is an early-exit error path inside an async function,
     // so we could await, but using the sync variant keeps the error path
     // ordering identical to the spawn-failed branch below (also sync).
-    config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs: 0 });
+    config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs: 0, ...SCHEDULER_META_IDENTITY });
     return { exitCode: -1, durationMs: 0, error: errMsg, sessionId };
   }
 
@@ -4778,7 +5429,7 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
   if (!promptCheck.ok) {
     safeLog(`[scheduler] ${promptCheck.error}\n`);
     closeFd();
-    config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: promptCheck.error, startedAt, finishedAt: Date.now(), durationMs: 0 });
+    config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: promptCheck.error, startedAt, finishedAt: Date.now(), durationMs: 0, ...SCHEDULER_META_IDENTITY });
     return { exitCode: -1, durationMs: 0, error: promptCheck.error, sessionId };
   }
 
@@ -4972,13 +5623,17 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
 
     // ---------- spawn ----------
 
+    // Distinct comm (`sm-claude-job`) + slug-labelled argv0 for System Monitor.
+    // Both keep the word `claude`, which the /\bclaude\b/ reaper gates need.
+    const jobSpawn = claudeSpawnTarget('job', job.slug, claudeBin);
+
     const { child } = withChildAndLog({
       fd,
       logPath,
       safeLog,
       closeFd,
       spawn: {
-        command: claudeBin,
+        command: jobSpawn.command,
         // Resume mode passes `--resume <sessionId>` (reconnect to the SAME
         // session) INSTEAD of `--session-id <sessionId>` (mint a new one) —
         // never both, see buildClaudeSpawnArgs.
@@ -4992,6 +5647,7 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
         options: {
           cwd: spawnCwd,
           env: childEnv,
+          ...(jobSpawn.argv0 ? { argv0: jobSpawn.argv0 } : {}),
           // detached:true puts the child in its own process group so we can kill
           // the entire descendant tree (including any stray background bashes the
           // agent spawned) with `process.kill(-pid)`. Without this, child.kill()
@@ -5017,7 +5673,7 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
           sl(`\n[scheduler] ${errMsg}\n`);
           // Sync write: inside a Promise executor callback; must flush meta
           // before resolve() so the spawnJob mutate() that follows sees it.
-          config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs, leakedDescendants: leaked, schedulerBootedAt: SCHEDULER_BOOTED_AT, schedulerCodeSha: SCHEDULER_CODE_SHA, originSessionId, contextDigestApplied });
+          config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs, leakedDescendants: leaked, ...SCHEDULER_META_IDENTITY, originSessionId, contextDigestApplied });
           resolve({ exitCode: -1, durationMs, error: errMsg, leakedDescendants: leaked, sessionId });
           return;
         }
@@ -5079,7 +5735,7 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
           startedAt, finishedAt: Date.now(), durationMs, leakedDescendants: leaked,
           agentResultSubtype, mappedFromSignal: mappedToSuccess ? signal || `code=${exitCode}` : null,
           killedByWatchdog: effectiveKilledByWatchdog, budgetKillReason,
-          schedulerBootedAt: SCHEDULER_BOOTED_AT, schedulerCodeSha: SCHEDULER_CODE_SHA,
+          ...SCHEDULER_META_IDENTITY,
           originSessionId, contextDigestApplied,
         });
         resolve({
@@ -5091,6 +5747,22 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
 
     if (child) {
       safeLog(`[scheduler] spawned pid=${child.pid} sessionId=${sessionId} (process group)\n\n`);
+      // The one synchronous, authoritative dispatch record (see
+      // jobSupervisorRecord.cjs). detached:true → setsid → pgid === pid, so
+      // no process.getpgid. A write failure must never fail the dispatch.
+      try {
+        supervisorRecord.writeSupervisorRecord({
+          runDir, slug: job.slug, cwd, runId: path.basename(runDir), pid: child.pid, pgid: child.pid,
+          identity: procIdentityOf(child.pid), execCwd: spawnCwd,
+          worktreeDir: execCwd || null, worktreeBranch: execCwd ? `sm-job/${job.slug}` : null,
+          sessionId, startedAt, budgetMs: budgetExempt ? null : jobBudgetMs, maxDurationMs: null,
+          idleKillMs: IDLE_OUTPUT_KILL_MS, schedulerPid: process.pid, codeSha: SCHEDULER_CODE_SHA,
+        });
+      } catch (e) {
+        const message = e?.message ?? String(e);
+        console.error(`[scheduler] FAILED to write supervisor record for ${job.slug} pid=${child.pid}: ${message}`);
+        appendAuditEvent('supervisor_record_write_failed', { slug: job.slug, cwd, pid: child.pid, error: message });
+      }
       // Make this job the OOM killer's preferred victim over Electron.
       biasJobOomScore(child.pid);
       // Persist runtime.pid with one retry — still fire-and-forget (must
@@ -5380,7 +6052,8 @@ async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {})
       return { deferred: false };
     }
   }
-  if (investigationsInFlight >= MAX_CONCURRENT_INVESTIGATIONS) {
+  // A drain (lib/upgradeDrain.cjs) admits no NEW work: queue instead of spawning.
+  if (drainActive || runtimeState.investigationCount() >= MAX_CONCURRENT_INVESTIGATIONS) {
     // Queue for retry when a slot frees rather than dropping — otherwise a failed
     // job (never 'needs_review', so reverifyNeedsReview won't retry it) would
     // silently never get an auto-authored fix-plan.
@@ -5394,12 +6067,12 @@ async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {})
   // both pass the cap check. Released in onExit, on any pre-spawn early return, or
   // on a synchronous throw (try/catch below) — and releasing hands the slot to a
   // queued investigation so none are stranded.
-  investigationsInFlight++;
+  runtimeState.reserveInvestigation(failedJob.slug);
   let slotReleased = false;
   const releaseSlot = () => {
     if (slotReleased) return;
     slotReleased = true;
-    investigationsInFlight--;
+    runtimeState.releaseInvestigation(failedJob.slug);
     drainDeferredInvestigation();
   };
   try {
@@ -5504,13 +6177,14 @@ async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {})
   };
 
   // Phase 2: spawn with lifecycle managed by withChildAndLog.
+  const probeSpawn = claudeSpawnTarget('aux', 'investigate', claudeBin);
   const { child } = withChildAndLog({
     fd,
     logPath: investigationLogPath,
     safeLog,
     closeFd,
     spawn: {
-      command: claudeBin,
+      command: probeSpawn.command,
       args: [
         '-p', prompt,
         '--model', 'opus',
@@ -5519,7 +6193,7 @@ async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {})
         '--verbose',
         '--session-id', sessionId,
       ],
-      options: { cwd, env: childEnv },
+      options: { cwd, env: childEnv, ...(probeSpawn.argv0 ? { argv0: probeSpawn.argv0 } : {}) },
     },
     watchdogs: [deadmanWatchdog],
     onExit({ exitCode, error, spawnFailed, safeLog: sl }) {
@@ -5621,6 +6295,20 @@ async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {})
 
   if (child) {
     safeLog(`[scheduler] investigation pid=${child.pid}\n\n`);
+    try {
+      supervisorRecord.writeSupervisorRecord({
+        runDir, slug: `${failedJob.slug}.investigation`, kind: 'investigation', cwd: failedJob.cwd ?? null,
+        runId: path.basename(runDir), pid: child.pid, pgid: child.pid, identity: procIdentityOf(child.pid),
+        execCwd: failedJob.cwd ?? null, worktreeDir: null, worktreeBranch: null, sessionId: null,
+        startedAt: Date.now(), budgetMs: null, maxDurationMs: MAX_INVESTIGATION_DURATION_MS, idleKillMs: null,
+        schedulerPid: process.pid, codeSha: SCHEDULER_CODE_SHA,
+      });
+    } catch (e) {
+      const message = e?.message ?? String(e);
+      console.error(`[scheduler] FAILED to write supervisor record for investigation ${failedJob.slug} pid=${child.pid}: ${message}`);
+      appendAuditEvent('supervisor_record_write_failed', { slug: failedJob.slug, cwd: failedJob.cwd, pid: child.pid, error: message, kind: 'investigation' });
+    }
+    runtimeState.stampInvestigationPid(failedJob.slug, child.pid);
     // Recorded so findStrandedInvestigations (a post-restart maintenance
     // sweep — the live process has no other way to know a probe is still
     // running) can tell a live probe apart from one whose owning process is
@@ -5722,9 +6410,22 @@ async function computeDepHistorySatisfaction(state) {
       for (const slug of await queueHistory.completedSlugsForCwd(cwd)) satisfied.add(slug);
       for (const dir of listArchivedPrdDirs(cwd)) {
         let entries;
-        try { entries = await fsp.readdir(dir); } catch { continue; }
-        for (const name of entries) {
-          if (name.endsWith('.md')) satisfied.add(name.slice(0, -3));
+        try { entries = await fsp.readdir(dir, { withFileTypes: true }); } catch { continue; }
+        for (const ent of entries) {
+          if (ent.isFile() && ent.name.endsWith('.md')) { satisfied.add(ent.name.slice(0, -3)); continue; }
+          // Option (b) of PRD 1286: a manual archive (queueOps.archiveOne, the
+          // schedule:archive-prd route and scheduler_archive_prd MCP tool) files the PRD
+          // under prds-archived/<ISO-ts>/<slug>.md — one level DEEPER than the auto-archive
+          // layout. Reading only the top level made every manually-archived slug invisible
+          // here, so once its row aged out its dependents held forever as 'unresolved'.
+          // A dep whose PRD file was archived is satisfied; a dep with NO file, row or
+          // history record (never ran, or a typo) still holds — nothing is dropped.
+          if (!ent.isDirectory()) continue;
+          let inner;
+          try { inner = await fsp.readdir(path.join(dir, ent.name)); } catch { continue; }
+          for (const name of inner) {
+            if (name.endsWith('.md')) satisfied.add(name.slice(0, -3));
+          }
         }
       }
     } catch (e) {
@@ -5821,7 +6522,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
   // Session-Manager owns the machine-wide `claude -p` pool (sessionSlots.cjs)
   // — the scheduler REQUESTS capacity, it doesn't own a private cap. A miss
   // leaves the job pending; the next tick retries when a slot frees up.
-  const slotToken = sessionSlots.acquire(`scheduler:${job.slug}`);
+  const slotToken = sessionSlots.acquire(`scheduler:${job.slug}`, { claimedAt: Date.now() });
   if (!slotToken) {
     console.log(`[scheduler] no session slot free for ${job.slug} — deferring (${JSON.stringify(sessionSlots.snapshot().holders.map((h) => h.owner))})`);
     return;
@@ -5947,7 +6648,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
         // targets a specific prior session on purpose) and for anything not
         // currently 'pending' (e.g. a needs_review->running recovery row).
         if (!resumeTarget && s.jobs[idx].status === 'pending') {
-          const outcome = latestTerminalOutcomeForSlug(job.slug, { runsDir: RUNS_DIR });
+          const outcome = latestTerminalOutcomeForSlug(job.slug, { runsDir: schedulerPaths.runsDir() });
           const reconcileDecision = evaluateDispatchSidecarReconcile({
             rowStatus: s.jobs[idx].status,
             rowRunId: s.jobs[idx].runId ?? null,
@@ -5956,7 +6657,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
             outcome,
           });
           if (reconcileDecision.skip) {
-            const sidecar = readRunOutcomeSidecars(path.join(RUNS_DIR, reconcileDecision.runId), job.slug);
+            const sidecar = readRunOutcomeSidecars(path.join(schedulerPaths.runsDir(), reconcileDecision.runId), job.slug);
             transitionJob(s.jobs[idx], 'completed', {
               reason: `prior run ${reconcileDecision.runId} already completed this slug (sidecar-reconciled)`,
               source: 'spawnJob:dispatch-sidecar-reconcile',
@@ -5986,7 +6687,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
           // pass_no_commit_prior_run_verified exemption can fire on this
           // run if it turns out to be another no-op re-verification.
           if (!s.jobs[idx].landedCommit && outcome?.runId) {
-            const sidecar = readRunOutcomeSidecars(path.join(RUNS_DIR, outcome.runId), job.slug);
+            const sidecar = readRunOutcomeSidecars(path.join(schedulerPaths.runsDir(), outcome.runId), job.slug);
             if (sidecar.outcome?.landedCommit) {
               s.jobs[idx].landedCommit = sidecar.outcome.landedCommit;
             }
@@ -6169,6 +6870,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     const foreignWip = worktree.ok ? { carriedPaths } : { preRunDirtyPaths };
     try {
       res = await executeJob(job, runDir, defaultCwd, async (pid, sessionId, cwd) => {
+        sessionSlots.stampPid(slotToken, pid);
         await mutate((s) => {
           const idx = s.jobs.findIndex((x) => x.slug === job.slug);
           if (idx >= 0) {
@@ -6312,8 +7014,13 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
     }
 
     if (res.rateLimited) {
+      // The executor itself observed a 429 — open the shared circuit even if
+      // the billing poller has been reporting 'ok' all along (AC3: a
+      // different window can 429 the executor than the one binding the
+      // poller's own reads).
+      billing.usageCircuit.recordFailure('executor_429');
       const logPath = path.join(runDir, `${job.slug}.log`);
-      const billingResetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const billingResetIso = await billingResetForPause();
       const resetIso = resolveRateLimitPauseReset(logPath, billingResetIso);
       const observedAt = dispatchStartedAtMs;
       const prevCount = consecutiveRapidRateLimitsBySlug.get(job.slug) || 0;
@@ -6401,6 +7108,8 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
         allJobs: stateForDeps.jobs,
         committedDuringRun,
         priorLandedCommit,
+        jobLandedCommitThisRun,
+        exitCode: res.exitCode,
       }).catch((e) => ({
         verdict: 'verify_unavailable',
         reason: `verifier threw: ${e?.message ?? String(e)}`,
@@ -6506,6 +7215,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null) {
         dirtyBaseline: guardBaselineEntries,
         headBefore: guardHeadBefore,
         slug: job.slug,
+        landedCommit: jobLandedCommitThisRun,
       });
       // A restored stash alone isn't silence — it's logged loudly above and
       // surfaced on the job row below — but a path that's still missing
@@ -7251,36 +7961,122 @@ async function spawnResumeRecovery(job, resumeTarget) {
 // is synchronous and spawnJob is fire-and-forget.
 let tickTail = Promise.resolve();
 
+// Tick watchdog. The tick BODY (not enqueue-to-settle) is bounded: a body
+// that never settles (hung reconcile / git walk) is declared wedged, the
+// chain is reset, and `tickGeneration` is bumped so the abandoned body —
+// which may resume much later — fails its generation re-check after every
+// await and returns without spawning or mutating. mutateTail is NOT touched.
+let tickGeneration = 0;
+let tickWedgeLatched = false;
+function tickWatchdogMs() {
+  const raw = process.env.SM_TICK_WATCHDOG_MS;
+  if (raw === undefined || raw === '') return 120_000;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : 120_000;
+}
+
 // `bypassLoadGate` is set only by the explicit human run-now / force-tick
 // paths (via runDueJobs): the human is asking, so the CPU-load gate yields
 // and logs that it did. Every automatic caller leaves it false.
+/**
+ * Fail-CLOSED expiry of runtime reservations (slot tokens, quiet-machine
+ * lease, investigation set, worktree accounting) whose owner is provably
+ * dead. `now` is the pass start: reservations claimed after it are never
+ * expired. Accounting only — never signals or removes anything.
+ */
+function runReservationExpiryPass(jobs, now = Date.now()) {
+  try {
+    const liveSlugs = new Set(runningSet);
+    const terminal = new Set();
+    for (const j of jobs || []) {
+      if (j.status === 'running' || j.status === 'investigating') liveSlugs.add(j.slug);
+      else if (j.status === 'completed' || j.status === 'failed' || j.status === 'skipped') terminal.add(j.slug);
+    }
+    const pidAlive = (pid) => claudePidAlive(pid);
+    sessionSlots.expireDead({ liveSlugs, pidAlive, now });
+    quietMachineLease.expireDead({ liveSlugs, now });
+    runtimeState.expireDeadInvestigations({ liveSlugs, pidAlive, now });
+    gitWorktree.expireDeadWorktreeRegistrations({
+      isTerminalBranch: (branch) => {
+        const key = gitWorktree.keyFromBranch('job', branch);
+        return !!key && !liveSlugs.has(key) && terminal.has(key);
+      },
+    });
+  } catch (e) {
+    console.warn('[scheduler] reservation expiry pass failed', e?.message);
+  }
+}
+
 function tickQueue({ bypassLoadGate = false } = {}) {
-  const next = tickTail.then(async () => {
+  const budgetMs = tickWatchdogMs();
+  const next = tickTail.then(() => {
+    const gen = tickGeneration;
+    return withTimeout(() => tickBody(gen, { bypassLoadGate }), budgetMs, () => {
+      tickGeneration++; // fence the abandoned body
+      console.warn(`[scheduler] TICK WEDGED: tick body exceeded ${budgetMs}ms — resetting tick chain`);
+      if (!tickWedgeLatched) {
+        tickWedgeLatched = true;
+        appendAuditEvent('tick_wedged', { budgetMs });
+      }
+      // CAS: only reset if nothing has queued behind this wedged link.
+      if (tickTail === tail) tickTail = Promise.resolve();
+      return recordTick({ fired: false, reason: 'wedged' }, { detail: `tick body exceeded ${budgetMs}ms` });
+    }).then((r) => {
+      if (r?.reason !== 'wedged') tickWedgeLatched = false;
+      return r;
+    });
+  });
+  const tail = next.catch(() => {});
+  tickTail = tail;
+  return next;
+}
+
+// The stale sentinel a fenced body returns: never recorded, never acted on.
+const STALE_TICK = Object.freeze({ fired: false, reason: 'stale-generation' });
+
+async function tickBody(gen, { bypassLoadGate }) {
+  const tickStartedAt = Date.now();
+  {
+    const stale = () => gen !== tickGeneration;
     const state = await readQueue();
+    if (stale()) return STALE_TICK;
     // Never reconcile against an unreadable queue: reconcile() would see zero
     // job rows for every PRD on disk and resurrect the lot as 'pending'.
     if (state.unreadable) {
       console.error('[scheduler] tickQueue skipped: queue.json unreadable');
       return { fired: false, reason: 'unreadable' };
     }
+    // Supervision of an adopted executor is independent of dispatch: it runs
+    // even while paused, before any early return below.
+    await superviseAdoptedRunsPass(state.jobs);
+    if (stale()) return STALE_TICK;
     if (state.paused) {
       console.log('[scheduler] tickQueue skipped: paused');
       return recordTick({ fired: false, reason: 'paused' }, { detail: 'scheduler paused' });
     }
+    // Upgrade drain (lib/upgradeDrain.cjs): a separate field from `paused`, so a
+    // rate-limit pause can't overwrite it. Nothing new dispatches; running and
+    // investigating rows finish.
+    if (state.drain?.active) {
+      return recordTick({ fired: false, reason: 'draining' }, { detail: 'draining for restart' });
+    }
     if (cancelToken.cancelled) return { fired: false, reason: 'cancelled' };
 
     // Stamped here — the moment tickQueue actually reaches the picker,
     // regardless of whether this pass ends in a launch — so
     // classifyQueueStarvation can tell "the engine keeps evaluating the
     // queue" apart from "nothing has invoked tickQueue in a long time".
-    // Distinct from `lastRunAt` below, which stays true to its existing
-    // meaning (a batch actually launched) since other readers depend on that.
+    // Distinct from `lastRunAt` below (a batch actually launched): this one
+    // means only "the loop is alive" (heartbeat/health) and must NEVER feed
+    // the idle clock — see dispatchIdleMs.
     await mutate((s) => { s.lastDispatchAttemptAt = new Date().toISOString(); });
+    if (stale()) return STALE_TICK;
 
     // The retired-flat-dir sweep now lives inside reconcile() itself (see its
     // own comment) so every caller of reconcile — not just this tick — gets
     // the guarantee.
     await reconcile(state);
+    if (stale()) return STALE_TICK;
     // Reclaim any job-kind worktree whose owning row already resolved
     // (completed/failed/skipped) without the run ever reaching
     // cleanupWorktree — a leaked checkout that would otherwise sit until the
@@ -7297,9 +8093,19 @@ function tickQueue({ bypassLoadGate = false } = {}) {
     // to also carry a private `concurrencyCap` of 3 — the exact per-consumer
     // cap that sessionSlots.cjs was written to replace — which silently
     // ceilinged the queue at 3 while the pool the user configured said 5.
-    const freeSlots = sessionSlots.available();
+    // While the usage meter is degraded (degradedConcurrencyCapValue set by
+    // pollLoop — circuit open, or a poll otherwise failed), a picker-side
+    // hold narrows this SAME freeSlots figure instead of standing up a
+    // second pool: the row count admitted this tick simply can't exceed the
+    // degraded cap minus what's already running.
+    runReservationExpiryPass(state.jobs, tickStartedAt);
+    const freeSlots = degradedConcurrencyCapValue != null
+      ? Math.max(0, Math.min(sessionSlots.available(), degradedConcurrencyCapValue - runningSet.size))
+      : sessionSlots.available();
     const heldSlugs = await computeLaunchHolds(state);
+    if (stale()) return STALE_TICK;
     const satisfiedSlugsByCwd = await computeDepHistorySatisfaction(state);
+    if (stale()) return STALE_TICK;
     const { batch, reason: holdReason, holds } = pickNextBatch(state.jobs, runningSet, freeSlots, {
       leaseHeld: quietMachineLease.isHeld(),
       machineInUse: sessionSlots.inUse(),
@@ -7399,18 +8205,18 @@ function tickQueue({ bypassLoadGate = false } = {}) {
     }
 
     await mutate((s) => { s.lastRunAt = new Date().toISOString(); });
+    if (stale()) return STALE_TICK;
     await broadcast();
+    if (stale()) return STALE_TICK;
 
     const { runId, dir: runDir } = pickRunDir();
     for (const job of gatedBatch) {
-      if (cancelToken.cancelled) break;
+      if (cancelToken.cancelled || stale()) break;
       // spawnJob is fire-and-forget; it calls tickQueue() on completion.
       spawnJob(job, runId, runDir, state.config.defaultCwd).catch(() => {});
     }
     return recordTick({ fired: true, count: gatedBatch.length, group: gatedBatch[0]?.parallelGroup }, { holds });
-  });
-  tickTail = next.catch(() => {});
-  return next;
+  }
 }
 
 // Translates a tickQueue()/runDueJobs() outcome descriptor into a renderer-facing
@@ -7486,6 +8292,40 @@ async function maybeLaunchWhenAvailable(state) {
  *  second scheduler. */
 const QUEUE_STARVATION_MS = 10 * 60_000;
 
+/**
+ * dispatchIdleMs({ lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, now }) → ms
+ *
+ * Pure. The ONE dispatch-idleness clock: `now - max(lastRunAt, lastPauseClearedAt,
+ * schedulerBootedAt)`. `lastRunAt` has exactly one writer (tickQueue, right
+ * before the spawn loop) so it already means "a batch actually launched";
+ * a pause clear and a scheduler boot are the other two moments the queue
+ * legitimately (re)starts. Deliberately NOT `lastDispatchAttemptAt`, which
+ * tickQueue stamps before every gate — a queue that ticks every 30 s and
+ * launches nothing (leaked slot, stuck hold) would refresh that stamp
+ * forever and never look idle (the structural repeat of the f18e161 bug
+ * where lastRunAt was refreshed every poll). No finite input → Infinity.
+ */
+function dispatchIdleMs({ lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, now } = {}) {
+  const stamps = [lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs].filter(Number.isFinite);
+  return stamps.length ? now - Math.max(...stamps) : Infinity;
+}
+
+/**
+ * launchBlockedSlugs(jobs, launchBlocks) → Set<slug>
+ *
+ * Pure, sync (health.cjs runs as a cold process). Pending rows whose persona
+ * has ANY launch-breaker entry — a superset of computeLaunchHolds, which
+ * additionally lets one half-open probe row through per persona.
+ */
+function launchBlockedSlugs(jobs, launchBlocks) {
+  const out = new Set();
+  if (!launchBlocks || !Object.keys(launchBlocks).length) return out;
+  for (const j of Array.isArray(jobs) ? jobs : []) {
+    if (j && j.status === 'pending' && launchBlocks[launchFailure.launchBlockKeyFor(j)]) out.add(j.slug);
+  }
+  return out;
+}
+
 /**
  * classifyQueueStarvation({ jobs, paused, runningCount, lastRunAtMs, now, thresholdMs })
  *   → null | { kind: 'starved' | 'blocked', pending, dispatchable, blockedChains, idleMs }
@@ -7513,22 +8353,28 @@ const QUEUE_STARVATION_MS = 10 * 60_000;
  * Returns null when the queue is healthy (work running, nothing pending,
  * paused on purpose, or simply not idle long enough yet).
  */
-function classifyQueueStarvation({ jobs, paused, runningCount, lastRunAtMs, now, thresholdMs = QUEUE_STARVATION_MS } = {}) {
+function classifyQueueStarvation({ jobs, paused, runningCount, lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, heldSlugs, now, thresholdMs = QUEUE_STARVATION_MS } = {}) {
   if (paused) return null;                      // paused is a DECISION, not a stall
   if (runningCount > 0) return null;            // work is flowing
   const rows = Array.isArray(jobs) ? jobs : [];
   const pending = rows.filter((j) => j && j.status === 'pending');
   if (pending.length === 0) return null;        // nothing to run — not a stall
 
-  const idleMs = Number.isFinite(lastRunAtMs) ? now - lastRunAtMs : Infinity;
+  const idleMs = dispatchIdleMs({ lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, now });
   if (idleMs < thresholdMs) return null;        // give the normal path its chance first
 
   // Which pending rows could actually dispatch? Anything NOT named by a
-  // blocked chain. computeBlockedChains already walks dependsOn with the
-  // picker's own resolution, so the two can never disagree.
+  // blocked chain (computeBlockedChains walks dependsOn with the picker's own
+  // resolution, so the two can never disagree) and NOT held by an open launch
+  // breaker / the quietMachine lease (`heldSlugs` — a separate input, never
+  // folded into the dependsOn walker). Held rows can't launch no matter how
+  // often we tick, so they read as 'blocked' (needs a human), not 'starved'.
   const blockedChains = computeBlockedChains(rows);
-  const blockedTotal = blockedChains.reduce((n, c) => n + c.blocked, 0);
-  const dispatchable = pending.length - blockedTotal;
+  const held = heldSlugs?.has ? heldSlugs : new Set(heldSlugs ?? []);
+  const open = held.size > 0 ? rows.filter((j) => !(j.status === 'pending' && held.has(j.slug))) : rows;
+  const openBlocked = held.size > 0 ? computeBlockedChains(open) : blockedChains;
+  const openPending = open.filter((j) => j.status === 'pending').length;
+  const dispatchable = openPending - openBlocked.reduce((n, c) => n + c.blocked, 0);
 
   return {
     kind: dispatchable > 0 ? 'starved' : 'blocked',
@@ -7551,14 +8397,14 @@ function classifyQueueStarvation({ jobs, paused, runningCount, lastRunAtMs, now,
  * projects sat starved/blocked for hours, and the watchdog never fired once
  * because "work is flowing" was true somewhere else. Partitioning by cwd
  * (the same grouping computeBlockedChains already does) fixes DETECTION only
- * — the idle clock (`lastRunAtMs`) stays machine-wide, since
- * `lastDispatchAttemptAt` is machine-level state, and only one tick is ever
+ * — the idle clock (see dispatchIdleMs) stays machine-wide, since
+ * `lastRunAt` is machine-level state, and only one tick is ever
  * forced per watchdog pass regardless of how many cwds are starved.
  *
  * Pure, no IO. Returns [] when paused (a DECISION, not a stall) or when no
  * project has a verdict.
  */
-function classifyQueueStarvationByProject({ jobs, paused, runningSet: runningSlugs, lastRunAtMs, now, thresholdMs = QUEUE_STARVATION_MS } = {}) {
+function classifyQueueStarvationByProject({ jobs, paused, runningSet: runningSlugs, lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, heldSlugs, now, thresholdMs = QUEUE_STARVATION_MS } = {}) {
   if (paused) return [];
   const rows = (Array.isArray(jobs) ? jobs : []).filter(Boolean);
   const byCwd = new Map();
@@ -7580,6 +8426,9 @@ function classifyQueueStarvationByProject({ jobs, paused, runningSet: runningSlu
       paused: false,
       runningCount: projRunningCount,
       lastRunAtMs,
+      lastPauseClearedAtMs,
+      schedulerBootedAtMs,
+      heldSlugs,
       now,
       thresholdMs,
     });
@@ -7590,7 +8439,7 @@ function classifyQueueStarvationByProject({ jobs, paused, runningSet: runningSlu
 
 /**
  * classifyQueueHealth({ jobs, paused, launchBlocks, runningSet, freeSlots,
- *                        totalSlots, lastDispatchAttemptAtMs, now, cwd, thresholdMs })
+ *                        totalSlots, lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, now, cwd, thresholdMs })
  *   → { kind, cwd, pending, dispatchable, blockedChains, needsReviewCount, runningCount, ... }
  *
  * Single source of truth for the Scheduler page's queue-health header: the
@@ -7601,7 +8450,7 @@ function classifyQueueStarvationByProject({ jobs, paused, runningSet: runningSlu
  *
  * Reuses classifyQueueStarvation for the blocked/stalled read so the header
  * can never disagree with runQueueStarvationWatchdog's own decision to force
- * a tick: both are handed the same lastDispatchAttemptAt-based idle clock and
+ * a tick: both are handed the same launch-keyed idle clock (dispatchIdleMs) and
  * the same computeBlockedChains walk under the hood. Called here with
  * `thresholdMs: 0` first (a live header must say "blocked" the instant every
  * pending row is dependency-stuck, not wait out the watchdog's own 10-minute
@@ -7638,7 +8487,7 @@ function classifyQueueStarvationByProject({ jobs, paused, runningSet: runningSlu
  */
 function classifyQueueHealth({
   jobs, paused, launchBlocks, runningSet: runningSlugs, freeSlots, totalSlots,
-  lastDispatchAttemptAtMs, now, cwd = null, thresholdMs = QUEUE_STARVATION_MS,
+  lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, now, cwd = null, thresholdMs = QUEUE_STARVATION_MS,
 } = {}) {
   const rows = (Array.isArray(jobs) ? jobs : []).filter(Boolean);
   const projectJobs = cwd ? rows.filter((j) => j.cwd === cwd) : rows;
@@ -7688,19 +8537,22 @@ function classifyQueueHealth({
   // over the same rows), so `base` already carries them.
   const immediate = classifyQueueStarvation({
     jobs: projectJobs, paused: false, runningCount: 0,
-    lastRunAtMs: lastDispatchAttemptAtMs, now, thresholdMs: 0,
+    lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, now, thresholdMs: 0,
   });
   // pending.length is already > 0 above, so `immediate` can only be null when
-  // lastDispatchAttemptAtMs is itself in the future (clock skew) — fall back
-  // to computing idleMs the same way rather than asserting a kind we can't
+  // the clock stamp is itself in the future (clock skew) — fall back to
+  // computing idleMs the same way rather than asserting a kind we can't
   // back up with a real number.
   const idleMs = immediate ? immediate.idleMs
-    : (Number.isFinite(lastDispatchAttemptAtMs) ? now - lastDispatchAttemptAtMs : Infinity);
+    : dispatchIdleMs({ lastRunAtMs, lastPauseClearedAtMs, schedulerBootedAtMs, now });
   if (dispatchable === 0) return { ...base, kind: 'blocked', idleMs };
   const kind = idleMs >= thresholdMs ? 'stalled' : 'running';
   return { ...base, kind, idleMs };
 }
 
+// Per-cwd latch for runQueueStarvationWatchdog: cwd → { kind, at, running }.
+const starvationLatch = new Map();
+
 /**
  * The watchdog half: acts on classifyQueueStarvationByProject. Called from
  * the heartbeat, which already runs on its own timer independent of the
@@ -7713,33 +8565,55 @@ function classifyQueueHealth({
  * the tick itself is machine-wide (it drives whatever the picker finds
  * across every project), only the DETECTION is per-project.
  */
-async function runQueueStarvationWatchdog(state, { now = Date.now(), thresholdMs = QUEUE_STARVATION_MS } = {}) {
-  // lastDispatchAttemptAt, not lastRunAt: the latter only advances when a
-  // batch actually launches, so a poll that keeps succeeding while dispatch
-  // itself never gets invoked would otherwise mask a stall behind a fresh-
-  // looking timestamp that was never actually tracking dispatch liveness.
+async function runQueueStarvationWatchdog(state, {
+  now = Date.now(), thresholdMs = QUEUE_STARVATION_MS,
+  bootedAtMs = Date.parse(SCHEDULER_BOOTED_AT), pauseClearedAtMs = lastPauseClearedAt,
+} = {}) {
+  // The idle clock is launch-keyed (dispatchIdleMs): NOT lastDispatchAttemptAt,
+  // which tickQueue stamps before every gate — a queue whose 30 s loop ticks
+  // and launches nothing would refresh it forever and the watchdog would
+  // never fire. Rows held by an open launch breaker or the quietMachine lease
+  // can't launch however often we tick, so they're passed in as `heldSlugs`
+  // and read as 'blocked' (needs a human) rather than a false 'starved'.
+  const heldSlugs = new Set((await computeLaunchHolds(state)).keys());
+  if (quietMachineLease.isHeld()) {
+    for (const j of state?.jobs ?? []) if (j?.status === 'pending' && j.quietMachine === true) heldSlugs.add(j.slug);
+  }
   const verdicts = classifyQueueStarvationByProject({
     jobs: state?.jobs,
-    paused: state?.paused,
+    paused: upgradeDrain.effectivePaused(state),
     runningSet,
-    lastRunAtMs: Date.parse(state?.lastDispatchAttemptAt ?? ''),
+    lastRunAtMs: Date.parse(state?.lastRunAt ?? ''),
+    lastPauseClearedAtMs: pauseClearedAtMs,
+    schedulerBootedAtMs: bootedAtMs,
+    heldSlugs,
     now,
     thresholdMs,
   });
+  // Latch: one episode per (cwd, kind) — re-arms only once QUEUE_STARVATION_MS
+  // has elapsed again or the project's running count changes; forgotten the
+  // moment the cwd stops having a verdict at all.
+  const activeKeys = new Set(verdicts.map((v) => v.cwd));
+  for (const cwd of [...starvationLatch.keys()]) if (!activeKeys.has(cwd)) starvationLatch.delete(cwd);
   if (verdicts.length === 0) return null;
 
   let anyStarved = false;
   let primary = null;
   for (const verdict of verdicts) {
     const mins = Math.round(verdict.idleMs / 60_000);
+    const running = (state?.jobs ?? []).filter((j) => j?.cwd === verdict.cwd && (j.status === 'running' || runningSet.has(j.slug))).length;
+    const latched = starvationLatch.get(verdict.cwd);
+    const suppressed = !!latched && latched.kind === verdict.kind && latched.running === running && now - latched.at < QUEUE_STARVATION_MS;
+    if (!primary) primary = verdict;
+    if (suppressed) continue;
+    starvationLatch.set(verdict.cwd, { kind: verdict.kind, at: now, running });
     if (verdict.kind === 'blocked') {
       console.warn(
         `[scheduler] QUEUE BLOCKED (${verdict.cwd}): ${verdict.pending} pending job(s), 0 running, idle ${mins}m — every ready row is behind a `
-        + `terminal or parked dependency, so ticking cannot help. Blockers: `
+        + `terminal or parked dependency, an open launch breaker, or the quietMachine lease, so ticking cannot help. Blockers: `
         + verdict.blockedChains.map((c) => `${c.cwd} [${c.blockedBy.join(', ')}]`).join(' · '),
       );
       appendAuditEvent('queue_blocked_stall', { cwd: verdict.cwd, pending: verdict.pending, idleMs: verdict.idleMs, chains: verdict.blockedChains });
-      if (!primary) primary = verdict;
       continue;
     }
 
@@ -7756,9 +8630,12 @@ async function runQueueStarvationWatchdog(state, { now = Date.now(), thresholdMs
 
   // A never-populated utilization reading is itself one of the ways the
   // when-available path silently never fires (maybeLaunchWhenAvailable
-  // returns early on null). Treat unknown as safe here, exactly as the
-  // billing meter's own 429 fallback already does.
-  if (cachedUtilization === null || cachedUtilization === undefined) cachedUtilization = 0;
+  // returns early on null). Absence of information, not a green light: fall
+  // back to the same conservative degraded budget the poll loop itself uses
+  // rather than a blind cachedUtilization=0.
+  if (cachedUtilization === null || cachedUtilization === undefined) {
+    applyDegradedBudget();
+  }
   // The in-process cancelToken is only ever reset by runDueJobs() (force-tick
   // / run-now / resume-timer) — every other path that clears a pause
   // (clearPause(), the poll loop's own auto-recovery) leaves it untouched
@@ -7924,6 +8801,72 @@ async function runBranchSweep(jobs) {
  * skipped too (spawn may still be mid-flight) — see selectReapableJobs for
  * the full predicate. Exported so unit tests can invoke it directly.
  */
+// Adopted-run supervision (see lib/adoptedRunSupervisor.cjs). In-memory by
+// design: the supervisors die with this process, and the next boot re-arms.
+const adoptedSupervisors = new Map();
+
+/** Pid of a boot-time running row via the same ladder isBootRowAlive uses:
+ * supervisor record → runtime.pid → pid spawned per the run log. */
+function bootRowPid(j, logPathOf) {
+  const runDir = j.runId ? path.join(schedulerPaths.runsDir(), j.runId) : null;
+  const record = runDir ? supervisorRecord.readSupervisorRecord(runDir, j.slug) : null;
+  return record?.pid || j.runtime?.pid || readSpawnedPidFromLog(logPathOf(j)) || null;
+}
+
+function signalAdoptedGroup(pgid, signal, pid) {
+  try { process.kill(-pgid, signal); } catch {
+    try { process.kill(pid, signal); } catch { /* already dead */ }
+  }
+}
+
+async function superviseAdoptedRunsPass(jobs) {
+  try {
+    const rows = jobs || (await readQueue()).jobs;
+    const runDirOf = (j) => (j.runId ? path.join(schedulerPaths.runsDir(), j.runId) : null);
+    return await adoptedRunSupervisor.superviseAdoptedRuns(rows, {
+      registry: adoptedSupervisors,
+      runDir: runDirOf,
+      readRecord: supervisorRecord.readSupervisorRecord,
+      lease: quietMachineLease,
+      markSupervised: async (row) => {
+        await mutate((s) => {
+          const j = s.jobs.find((x) => x.slug === row.slug);
+          if (j && j.status === 'running' && (j.runId ?? null) === (row.runId ?? null)) j.supervisedAt = new Date().toISOString();
+        });
+      },
+      makeDeps: (row, record) => {
+        const logPath = path.join(runDirOf(row), `${row.slug}.log`);
+        return {
+          logPath,
+          statLogMtimeMs: readLogMtimeMs,
+          pidAlive: claudePidAlive,
+          identityOf: procIdentityOf,
+          isDifferentProcess,
+          killGroup: signalAdoptedGroup,
+          // Stamped BEFORE the signal so reapDeadRunningJobs, which finalizes
+          // the row once the process is gone, always sees why it died.
+          stampKill: async (kind, reason) => {
+            await mutate((s) => {
+              const j = s.jobs.find((x) => x.slug === row.slug);
+              if (j && j.status === 'running' && (j.runId ?? null) === (row.runId ?? null)) {
+                j.adoptedKill = { watchdog: kind, reason, at: new Date().toISOString() };
+              }
+            });
+            try { fs.appendFileSync(logPath, `\n[scheduler] adopted-run ${kind} watchdog: ${reason}\n`); } catch { /* best-effort */ }
+          },
+          log: (msg) => console.log(`[scheduler] ${row.slug}: ${msg}`),
+          checkIntervalMs: IDLE_CHECK_INTERVAL_MS,
+          sigkillAfterMs: POST_RESULT_KILL_MS,
+          defaultMaxDurationMs: MAX_JOB_DURATION_MS,
+        };
+      },
+    });
+  } catch (e) {
+    console.warn('[scheduler] adopted-run supervision pass failed', e?.message);
+    return [];
+  }
+}
+
 async function reapDeadRunningJobs() {
   try {
     // Do NOT gate on runningSet: spawnJob()'s finally block unconditionally
@@ -7932,9 +8875,13 @@ async function reapDeadRunningJobs() {
     // status:"running" with no slug left in runningSet to trigger reconciliation.
     // queue.json is the source of truth for which jobs are actually running.
     const state = await readQueue();
+    // A quarantined shard's rows never loaded; the filter is defence in depth
+    // so a reap can never terminalize a row of a project we cannot persist.
+    const reapSkip = quarantinedCwdSet(state);
+    if (reapSkip.size > 0) state.jobs = state.jobs.filter((j) => !reapSkip.has(j.cwd));
     // Shared by the log-evidence injections below and the reapable-processing
     // loop further down — same `j.runId` → run log path formula either way.
-    const logPathForJob = (j) => (j?.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null);
+    const logPathForJob = (j) => (j?.runId ? path.join(schedulerPaths.runsDir(), j.runId, `${j.slug}.log`) : null);
     const { reapable, warnings, recovered } = selectReapableJobs(state.jobs, Date.now(), {
       pidAlive: claudePidAlive,
       grace: PIDLESS_SPAWN_GRACE_MS,
@@ -8008,8 +8955,12 @@ async function reapDeadRunningJobs() {
     // the same still-active rate limit — the spin loop this PRD exists to
     // stop. Done once, outside mutate(), before finalizing any row below.
     if (dead.some((d) => d.outcome === 'rate_limited')) {
+      // Same rationale as spawnJob's own rateLimited branch: a dead-process
+      // reap that classifies as rate-limited is just as much an executor-
+      // observed 429 as a live one, and must open the same shared circuit.
+      billing.usageCircuit.recordFailure('executor_429');
       const triggering = dead.find((d) => d.outcome === 'rate_limited');
-      const billingResetIso = await refreshNextReset().catch(() => cachedNextReset);
+      const billingResetIso = await billingResetForPause();
       const resetIso = resolveRateLimitPauseReset(triggering.logPath, billingResetIso);
       const triggeringRow = triggering ? state.jobs.find((x) => x.slug === triggering.slug) : null;
       const observedAtMs = triggeringRow?.startedAt ? Date.parse(triggeringRow.startedAt) : null;
@@ -8115,9 +9066,10 @@ async function reapDeadRunningJobs() {
     // this runs the whole dead-job batch concurrently rather than one
     // dispatch's git-spawn latency at a time.
     await Promise.all(dead.map(async (d) => {
-      if (d.outcome === 'rate_limited' || d.outcome === 'success') return;
-      if (d.pidless && d.failureOverride) return;
       const row = state.jobs.find((x) => x.slug === d.slug);
+      const adoptedBudgetKill = row?.adoptedKill?.watchdog === 'budget';
+      if (d.outcome === 'rate_limited' || (d.outcome === 'success' && !adoptedBudgetKill)) return;
+      if (d.pidless && d.failureOverride) return;
       if (!row?.landedCommit) return;
       const rowCwd = row.cwd || state.config?.defaultCwd || DEFAULT_PROJECT_CWD;
       const resolved = await resolveLandedCommitEvidence(rowCwd, row.landedCommit, row.startedAt);
@@ -8150,7 +9102,7 @@ async function reapDeadRunningJobs() {
               const baseSet = new Set(s.jobs[idx].guardBaseline);
               deltaPaths = after.filter((p) => !baseSet.has(p));
               if (deltaPaths.length) {
-                const salvagePath = path.join(RUNS_DIR, s.jobs[idx].runId, `${slug}.uncommitted.patch`);
+                const salvagePath = path.join(schedulerPaths.runsDir(), s.jobs[idx].runId, `${slug}.uncommitted.patch`);
                 const salvage = await jobWorktree.salvageJobDirtyDelta({ cwd: rowCwd, paths: deltaPaths, outFile: salvagePath });
                 if (salvage && salvage.ok) {
                   s.jobs[idx].salvagePatch = salvagePath;
@@ -8198,6 +9150,17 @@ async function reapDeadRunningJobs() {
         if (pidless && !effectiveSuccess && !rateLimited && !notLandedInfo && failureOverride) {
           notLandedInfo = { verdict: failureOverride.verdict, reason: failureOverride.reason };
         }
+        // An adopted run the budget watchdog killed (adoptedKill, stamped
+        // before the signal) parks exactly like a native budget kill: the
+        // shared classifyBudgetKill decides, and it wins over success/failure.
+        const adoptedBudgetKill = rateLimited ? null : classifyBudgetKill({
+          killedByWatchdog: s.jobs[idx].adoptedKill?.watchdog,
+          budgetKillReason: s.jobs[idx].adoptedKill?.reason,
+        }, landedCommitEvidence.get(slug) || null);
+        if (adoptedBudgetKill) {
+          effectiveSuccess = false;
+          notLandedInfo = { verdict: 'budget_exceeded', reason: adoptedBudgetKill.reason };
+        }
 
         const leftoverSuffix = deltaPaths && deltaPaths.length
           ? ` — left ${deltaPaths.length} files uncommitted`
@@ -8249,6 +9212,7 @@ async function reapDeadRunningJobs() {
           s.jobs[idx].gateOutcome = gateOutcome;
           if (confirmedLandedCommit) s.jobs[idx].landedCommit = confirmedLandedCommit;
           if (landedCommit) s.jobs[idx].landedCommit = landedCommit;
+          if (adoptedBudgetKill?.landedCommit) s.jobs[idx].landedCommit = adoptedBudgetKill.landedCommit;
         }
         // A pidless spawn that never wrote its own '<slug>.log' into the
         // batch runId dir it was stamped with must not keep that runId —
@@ -8263,6 +9227,7 @@ async function reapDeadRunningJobs() {
           s.jobs[idx].runId = null;
         }
         delete s.jobs[idx].runtime;
+        delete s.jobs[idx].adoptedKill;
         delete s.jobs[idx].dispatchPhase;
         delete s.jobs[idx].dispatchPhaseAt;
         delete s.jobs[idx].overrun;
@@ -8327,14 +9292,21 @@ async function pollLoop() {
     // 404/time-out and eventually pause the queue on 'network' — treat usage as
     // wide-open and fire on pending + memory alone. (Blackrock-style machines.)
     if (!billing.usageMeterApplicable()) {
-      cachedUtilization = 0;
+      // Close the shared circuit if a PRIOR consumer-auth session left it
+      // open/half_open — this process has stopped polling the meter
+      // entirely, so nothing else will ever call recordSuccess() to clear
+      // it, and health.cjs would otherwise read a stale open circuit as
+      // YELLOW/RED forever even though nothing is actually degraded.
+      if (billing.usageCircuit.state() !== 'closed') billing.usageCircuit.recordSuccess({});
+      cachedUtilization = NO_METER_UTILIZATION;
+      degradedConcurrencyCapValue = null;
       consecutiveFailures = 0;
       backoffMs = 0;
       backoffNextAt = null;
       firstFailureAt = null;
       firstNon429FailureAt = null;
       lastFailureKind = null;
-      failureStreakWarned = false;
+      resetFailureStreak();
       lastPollAt = Date.now();
       lastPollOk = true;
       persistSchedulerState();
@@ -8350,18 +9322,40 @@ async function pollLoop() {
       return; // finally re-arms the timer
     }
 
+    // Shared breaker over the meter (AC1): while it is OPEN, no request is
+    // made except the half-open probe below (billing.fetchUsage() is only
+    // ever reached, further down, from the closed/half_open paths). "Meter
+    // down" reads as absence of information, not a green light — the
+    // conservative degraded budget stands in for both the utilization-
+    // threshold gate (maybeLaunchWhenAvailable) and the concurrency cap
+    // (tickQueue's freeSlots), never a blind cachedUtilization=0.
+    if (billing.usageCircuit.state() === 'open') {
+      applyDegradedBudget();
+      lastPollAt = Date.now();
+      lastPollOk = false;
+      warnFailureStreakIfNeeded();
+      persistSchedulerState();
+      const cur = await readQueue();
+      await maybeLaunchWhenAvailable(cur);
+      await broadcast();
+      return;
+    }
+
     const r = await billing.fetchUsage();
 
     if (r.kind === 'ok') {
-      cachedNextReset = r.data?.usage?.five_hour?.resets_at ?? cachedNextReset;
-      cachedUtilization = r.data?.usage?.five_hour?.utilization ?? cachedUtilization;
+      const window = bindingWindow(r.data?.usage);
+      recordObservedReset(window.resets_at ?? null);
+      cachedUtilization = Number.isFinite(window.utilization) ? window.utilization : cachedUtilization;
+      lastGoodUsagePayload = r.data?.usage ?? lastGoodUsagePayload;
+      degradedConcurrencyCapValue = null;
       consecutiveFailures = 0;
       backoffMs = 0;
       backoffNextAt = null;
       firstFailureAt = null;
       firstNon429FailureAt = null;
       lastFailureKind = null;
-      failureStreakWarned = false;
+      resetFailureStreak();
       lastPollAt = Date.now();
       lastPollOk = true;
       persistSchedulerState();
@@ -8377,14 +9371,14 @@ async function pollLoop() {
       await maybeLaunchWhenAvailable(cur);
       await broadcast();
     } else if (r.kind === 'meter_rate_limited') {
-      // Billing meter is itself being rate-limited. Treat as "utilization unknown but safe":
-      // fire available jobs anyway at utilization=0 rather than pausing the queue.
-      // Still back off the POLL cadence itself (same curve/cap as the transient
-      // branch) and persist state every cycle — without this, a sustained 429
-      // streak hammered the already-rate-limited endpoint every POLL_INTERVAL_MS
-      // forever AND never wrote lastPollAt/consecutiveFailures back to
-      // scheduler-state.json, so the sidecar froze stale while the loop kept
-      // failing silently underneath it (the 57-consecutive-failure incident).
+      // Billing meter is itself being rate-limited — absence of information,
+      // not a green light. Still back off the POLL cadence itself (same
+      // curve/cap as the transient branch) and persist state every cycle —
+      // without this, a sustained 429 streak hammered the already-rate-
+      // limited endpoint every POLL_INTERVAL_MS forever AND never wrote
+      // lastPollAt/consecutiveFailures back to scheduler-state.json, so the
+      // sidecar froze stale while the loop kept failing silently underneath
+      // it (the 57-consecutive-failure incident).
       lastPollAt = Date.now();
       lastPollOk = false;
       consecutiveFailures++;
@@ -8392,8 +9386,8 @@ async function pollLoop() {
       // Don't update firstNon429FailureAt — 429s don't count toward the 30-min network-pause threshold.
       backoffMs = nextBackoffMs(backoffMs);
       backoffNextAt = Date.now() + backoffMs;
-      cachedUtilization = 0; // assume safe; fire any pending work
-      console.log(`[scheduler] billing meter rate-limited (HTTP 429) — firing on heuristic (failure #${consecutiveFailures}); retry in ${backoffMs / 1000}s`);
+      applyDegradedBudget();
+      console.log(`[scheduler] billing meter rate-limited (HTTP 429) — firing on degraded budget (util=${cachedUtilization}%, cap=${degradedConcurrencyCapValue}) (failure #${consecutiveFailures}); retry in ${backoffMs / 1000}s`);
       warnFailureStreakIfNeeded();
       persistSchedulerState();
       const cur = await readQueue();
@@ -8433,13 +9427,12 @@ async function pollLoop() {
       // 'ok' and 'meter_rate_limited' branches used to reach
       // maybeLaunchWhenAvailable, so auth/transient failures left ready
       // pending work untouched until either the queue-starvation watchdog's
-      // 10-minute safety net fired or the poll itself recovered. Utilization
-      // is unknown during a failed poll, not unsafe — treated the same way
-      // the meter_rate_limited branch above already treats a 429 as safe to
-      // fire through. maybeLaunchWhenAvailable itself still honors an
-      // 'auth'/'network' pause (state.paused), so this is a no-op whenever
-      // setPaused() above actually engaged one.
-      if (cachedUtilization === null || cachedUtilization === undefined) cachedUtilization = 0;
+      // 10-minute safety net fired or the poll itself recovered. Absence of
+      // information, not a green light: fall back to the degraded budget
+      // rather than a blind cachedUtilization=0. maybeLaunchWhenAvailable
+      // itself still honors an 'auth'/'network' pause (state.paused), so
+      // this is a no-op whenever setPaused() above actually engaged one.
+      applyDegradedBudget();
       await maybeLaunchWhenAvailable(await readQueue());
       await broadcast();
     }
@@ -8458,7 +9451,7 @@ async function pollLoop() {
     // Same rationale as the auth/transient branch above: the outer catch
     // must not be a silent dispatch dead-end either.
     try {
-      if (cachedUtilization === null || cachedUtilization === undefined) cachedUtilization = 0;
+      applyDegradedBudget();
       await maybeLaunchWhenAvailable(await readQueue());
       await broadcast();
     } catch { /* best-effort — the poll loop must still re-arm below */ }
@@ -8521,6 +9514,34 @@ function selectHistoryJobs(jobs, limit, historyEntries = []) {
 // anyway). For non-fix-plan jobs the exemption never applies, so rescanning
 // their pass_no_commit verdict is a harmless no-op (same facts, same verdict).
 const RESCANNABLE_VERDICTS = new Set(['transcript_errors', 'verify_unavailable', 'no_verdict_sentinel', 'abandoned_background_task', 'pass_no_commit', 'pass_no_commit_already_shipped']);
+// RESCANNABLE_VERDICTS is a HINT, not a gate: it names the verdicts whose
+// recovery rung is a transcript re-verification (verifyRun). Every other
+// needs_review verdict is still a heal candidate (isRescanCandidate) — it just
+// gets the evidence-only rung (computeLooksDone) instead of a transcript
+// rescan, because verifyRun cannot see a commit-guard / shared-tree verdict and
+// would return 'clean' and falsely heal it.
+
+// The ONLY needs_review verdicts NOT eligible for the periodic heal ladder.
+// An allow-list here was reopened three times (2026-09-12 x2, 2026-09-18
+// shared_tree_reverted) because a new park reason was born invisible to
+// self-healing. Add a verdict here only with a one-line proof that no
+// re-verification or evidence scan can ever change it.
+const RESCAN_EXCLUDED_VERDICTS = new Set([
+  // Commit-guard verdict verifyRun never inspects: a rescan returns 'clean' and would heal genuinely unfinished work.
+  'uncommitted_changes',
+  // Its damage IS a commit stranded on an unmerged sm-job branch — a landedCommit restates it; selectMechanicalRecoveryTarget owns the real re-merge.
+  'worktree_integration_failed',
+  // The run overran its own time/cost estimate; no transcript or git evidence can un-overrun it (selectAutoFixTargets excludes it too).
+  'budget_exceeded',
+]);
+
+// Per-pass / per-row bounds on the evidence-only rung (the widened candidate
+// set). Each scan costs one computeLooksDone: a per-cwd-deduped `git fetch`
+// (<=~20s) + a git log. Unbounded, a backlog of N parked rows would pay N of
+// those every 10 minutes forever.
+const REVERIFY_INTERVAL_MS = 10 * 60_000;
+const EVIDENCE_SCAN_MAX_PER_PASS = 20;
+const EVIDENCE_SCAN_MIN_INTERVAL_MS = 6 * REVERIFY_INTERVAL_MS;
 
 // Bounds fix-plan recursion: cap N permits at most N+1 fix jobs per original
 // slug (depth 1 = the original job, depth 2 = its `-fix`, depth 3+ is
@@ -8563,7 +9584,7 @@ function isFixPlanBeyondDepthCap(slug, investigationDepth, isFixPlan) {
  * check, no nested loop over user-scaled data. Dir names are ISO timestamps,
  * so lexical-descending sort picks the newest match. Exported for tests.
  */
-function resolveRunId(job, { runsDir = RUNS_DIR } = {}) {
+function resolveRunId(job, { runsDir = schedulerPaths.runsDir() } = {}) {
   if (!job || job.runId) return job?.runId || null;
   if (!job.slug) return null;
   let dirs;
@@ -8665,18 +9686,71 @@ function isGuardParkedWithoutAutoFix(job) {
   return GUARD_VERDICT_EVIDENCE_ELIGIBLE.has(job.verifierVerdict);
 }
 
+/**
+ * Pure predicate, no I/O: a needs_review row whose auto-fix investigation
+ * genuinely ran (autoFixAttempted === true) but whose outcome was NEVER
+ * durably stamped at all — and that has nothing left in flight to wait on:
+ * no live/queued fix-plan row at fixSlugFor(job).
+ *
+ * Distinct from isExhaustedAutoFix, which requires autoFixRetries >= 1 to
+ * have already accumulated. spawnInvestigation's onExit handler restores the
+ * job's status from 'investigating' back to needs_review in ONE mutate()
+ * call (scheduler.cjs's spawnInvestigation, source
+ * 'spawnInvestigation:onExit') and stamps autoFixOutcome ('plan' / 'no-plan'
+ * / 'error') in a SEPARATE, later mutate() call — an app restart or process
+ * death between the two leaves autoFixOutcome permanently unset, with
+ * autoFixRetries never incremented either, so isExhaustedAutoFix never fires
+ * and the row falls through every existing resolving door forever, re-scanned
+ * by the periodic reverify pass against the same frozen transcript with no
+ * new outcome to observe.
+ *
+ * Job 1218-fo-01 (2026-09-13, findings filed at
+ * session-manager-operations/reviews/2026-09-13-scheduler-stability-investigation.md,
+ * "post-run adjudication" section) sat exactly in this state: needs_review,
+ * verifierVerdict transcript_errors, autoFixAttempted: true, autoFixOutcome:
+ * undefined, autoFixRetries: undefined, statusHistory ending in
+ * "investigation probe exited — restoring prior status" — with a landed
+ * commit no existing ladder rung would credit.
+ *
+ * Deliberately narrower than "unset, 'error', or 'no-plan'": a row that DID
+ * get a durably-stamped 'error'/'no-plan' outcome with its one bounded retry
+ * still unspent (autoFixRetries < 1) is exactly the row
+ * selectAutoFixTargets's own retryEligible check still owns and will retry
+ * on its own — pulling it into THIS ladder instead would race it away from
+ * that retry (scheduler-needs-review-autoresolve.test.cjs's "a non-exhausted
+ * needs_review row … is left alone" guards exactly this). Only the
+ * outcome-truly-never-stamped case is structurally unrecoverable by any
+ * OTHER existing door, because nothing ever wrote a value selectAutoFixTargets
+ * or isExhaustedAutoFix could act on.
+ * Exported for tests.
+ */
+function isStrandedAutoFixPark(job, jobsInProject) {
+  if (!job || job.status !== 'needs_review') return false;
+  if (job.autoFixAttempted !== true) return false;
+  if (job.autoFixOutcome != null) return false;
+  const fixSlug = fixSlugFor(job);
+  const liveOrQueuedChild = (jobsInProject || []).some(
+    (j) => j.slug === fixSlug && j.status !== 'completed' && !DEAD_FIX_CHILD_STATUSES.has(j.status),
+  );
+  return !liveOrQueuedChild;
+}
+
 /**
  * Pure predicate, no I/O: is this needs_review row eligible for the bounded
  * auto-resolve ladder at all — either because its auto-fix path is genuinely
- * spent (isExhaustedAutoFix), or because it was parked by a GUARD verdict
- * that never entered auto-fix in the first place (isGuardParkedWithoutAutoFix).
- * Both classes share ONE ladder (applyNeedsReviewAutoResolve) rather than a
- * duplicated one — the ladder itself doesn't care which door a row came
- * through, only whether it now carries completion evidence (job.looksDone).
+ * spent (isExhaustedAutoFix), because it was parked by a GUARD verdict that
+ * never entered auto-fix in the first place (isGuardParkedWithoutAutoFix),
+ * or because its auto-fix investigation ran but was stranded before
+ * recording any outcome (isStrandedAutoFixPark). All three classes share ONE
+ * ladder (applyNeedsReviewAutoResolve) rather than a duplicated one — the
+ * ladder itself doesn't care which door a row came through, only whether it
+ * now carries completion evidence (job.looksDone). `jobsInProject` is only
+ * consulted by isStrandedAutoFixPark (to check for a live/queued fix-plan
+ * child) and defaults to empty so existing single-arg callers are unaffected.
  * Exported for tests.
  */
-function isEligibleForNeedsReviewAutoResolve(job) {
-  return isExhaustedAutoFix(job) || isGuardParkedWithoutAutoFix(job);
+function isEligibleForNeedsReviewAutoResolve(job, jobsInProject = []) {
+  return isExhaustedAutoFix(job) || isGuardParkedWithoutAutoFix(job) || isStrandedAutoFixPark(job, jobsInProject);
 }
 
 /**
@@ -8789,18 +9863,55 @@ function isFailedUnverifiedShaped(job) {
   if (job.verifierVerdict && RESCANNABLE_VERDICTS.has(job.verifierVerdict)) return true;
   const runId = job.runId || resolveRunId(job);
   if (!runId) return false;
-  const logPath = path.join(RUNS_DIR, runId, `${job.slug}.log`);
+  const logPath = path.join(schedulerPaths.runsDir(), runId, `${job.slug}.log`);
   return classifyRunOutcome(logPath) === 'no_result';
 }
 
 function isRescanCandidate(job) {
   if (!job) return false;
+  // Default-ELIGIBLE: every needs_review row is a heal candidate unless its
+  // verdict is in RESCAN_EXCLUDED_VERDICTS. No runId requirement here — a row
+  // without one still gets the evidence rung and the unresolvable annotation.
+  if (job.status === 'needs_review') return !RESCAN_EXCLUDED_VERDICTS.has(job.verifierVerdict);
   if (!(job.runId || resolveRunId(job))) return false;
-  if (job.status === 'needs_review') return RESCANNABLE_VERDICTS.has(job.verifierVerdict);
   if (job.status === 'failed') return isFailedUnverifiedShaped(job);
   return false;
 }
 
+/**
+ * Which rung a needs_review candidate gets (RESCANNABLE_VERDICTS as a hint):
+ * true = transcript re-verification (needs a run dir to read); false = the
+ * evidence-only rung. I/O only when a rescannable-verdict row lacks a runId.
+ */
+function isTranscriptRescannable(job) {
+  return !!job && RESCANNABLE_VERDICTS.has(job.verifierVerdict) && !!(job.runId || resolveRunId(job));
+}
+
+/**
+ * Pure, no I/O: the bounded subset of evidence-only needs_review candidates
+ * reverifyNeedsReview scans this pass. Skips rows already carrying looksDone,
+ * rows scanned within EVIDENCE_SCAN_MIN_INTERVAL_MS (evidenceScannedAt), and —
+ * PRD 1136 — rows with a live auto-fix history unless they are an
+ * auto-resolve door (isEligibleForNeedsReviewAutoResolve, which is what
+ * consumes looksDone). Never-scanned rows go first, then least-recently
+ * scanned; capped at EVIDENCE_SCAN_MAX_PER_PASS. O(n log n) in needs_review rows.
+ * Per-pass cost ceiling: EVIDENCE_SCAN_MAX_PER_PASS computeLooksDone calls.
+ */
+function selectEvidenceScanTargets(jobs, now = Date.now()) {
+  const due = [];
+  for (const j of jobs ?? []) {
+    if (j.status !== 'needs_review' || !isRescanCandidate(j)) continue;
+    if (isTranscriptRescannable(j)) continue;
+    if (j.looksDone) continue;
+    if (j.autoFixAttempted === true && !isEligibleForNeedsReviewAutoResolve(j, jobs)) continue;
+    const last = Date.parse(j.evidenceScannedAt ?? '');
+    if (!Number.isNaN(last) && now - last < EVIDENCE_SCAN_MIN_INTERVAL_MS) continue;
+    due.push({ j, last: Number.isNaN(last) ? 0 : last });
+  }
+  due.sort((a, b) => a.last - b.last);
+  return due.slice(0, EVIDENCE_SCAN_MAX_PER_PASS).map((d) => d.j);
+}
+
 /**
  * Cheap-guard for the 10-minute periodic reverify tick. MUST be expressed in
  * terms of isRescanCandidate — not a hand-written status test — because the
@@ -8834,6 +9945,14 @@ function isRescanCandidate(job) {
  * that function). Same rule as always: never let this guard be narrower than
  * the work reverifyNeedsReview actually performs.
  *
+ * Reopened a THIRD time 2026-09-18 (shared_tree_reverted parked 1229-fo-03
+ * falsely, 19 of 20 pending rows held): the fix was not another OR-clause but
+ * inverting the default — isRescanCandidate is now default-ELIGIBLE for every
+ * needs_review row (RESCAN_EXCLUDED_VERDICTS names the few exceptions), so a
+ * new park reason can never again be born unhealable. The OR-clauses below
+ * are now redundant for needs_review rows and kept only for their
+ * non-needs_review inputs.
+ *
  * Cost: selectMechanicalRecoveryTarget/selectResumeRecoveryTarget and
  * isGuardParkedWithoutAutoFix are pure (no I/O). selectAutoFixTargets is
  * called with an injected fixSlugExists that always returns false — cheap
@@ -8845,7 +9964,7 @@ function isRescanCandidate(job) {
  */
 function shouldRunPeriodicReverify(jobs) {
   if (!Array.isArray(jobs)) return false;
-  if (jobs.some((j) => isRescanCandidate(j) || isGuardParkedWithoutAutoFix(j))) return true;
+  if (jobs.some((j) => isRescanCandidate(j) || isGuardParkedWithoutAutoFix(j) || isStaleSharedTreeRevertedPark(j))) return true;
   if (jobs.some((j) => selectMechanicalRecoveryTarget(j) || selectResumeRecoveryTarget(j))) return true;
   return selectAutoFixTargets(jobs, { fixSlugExists: () => false }).length > 0;
 }
@@ -9012,11 +10131,12 @@ function needsReviewAutoResolveDisabled() {
  *   [{ slug, cwd, ageMs, attempts }]
  *
  * Pure selector — no IO. Selects `needs_review` rows eligible for the
- * bounded auto-resolve ladder (isEligibleForNeedsReviewAutoResolve — either
- * auto-fix genuinely spent, or parked by a GUARD verdict that never entered
- * auto-fix at all), whose newest statusHistory entry with `to ===
- * 'needs_review'` is older than `thresholdMs`, and whose
- * exhaustedResolveAttempts counter has not yet spent its cap.
+ * bounded auto-resolve ladder (isEligibleForNeedsReviewAutoResolve — auto-fix
+ * genuinely spent, parked by a GUARD verdict that never entered auto-fix at
+ * all, or a stranded auto-fix park with no outcome ever recorded), whose
+ * newest statusHistory entry with `to === 'needs_review'` is older than
+ * `thresholdMs`, and whose exhaustedResolveAttempts counter has not yet
+ * spent its cap.
  *
  * The inclusion bound is inclusive of the cap itself (`<= CAP`, not `<
  * CAP`): NEEDS_REVIEW_RESOLVE_CAP counts REQUEUE attempts already spent, and
@@ -9029,7 +10149,7 @@ function selectExhaustedNeedsReviewTargets(jobs, now, thresholdMs) {
   const targets = [];
   for (const j of jobs ?? []) {
     if (j.status !== 'needs_review') continue;
-    if (!isEligibleForNeedsReviewAutoResolve(j)) continue;
+    if (!isEligibleForNeedsReviewAutoResolve(j, jobs)) continue;
     if ((j.exhaustedResolveAttempts ?? 0) > NEEDS_REVIEW_RESOLVE_CAP) continue;
     const history = j.statusHistory || [];
     let entry = null;
@@ -9073,8 +10193,8 @@ function selectExhaustedNeedsReviewTargets(jobs, now, thresholdMs) {
  * reason text (and the Queue UI's job.error) name the RIGHT evidence — a
  * guard-parked row was never "exhausted auto-fix" and must never claim to be.
  */
-function applyNeedsReviewAutoResolve(j) {
-  if (!j || j.status !== 'needs_review' || !isEligibleForNeedsReviewAutoResolve(j)) return null;
+function applyNeedsReviewAutoResolve(j, jobsInProject = []) {
+  if (!j || j.status !== 'needs_review' || !isEligibleForNeedsReviewAutoResolve(j, jobsInProject)) return null;
   if ((j.exhaustedResolveAttempts ?? 0) > NEEDS_REVIEW_RESOLVE_CAP) return null;
   const originIsGuardParked = !isExhaustedAutoFix(j) && isGuardParkedWithoutAutoFix(j);
 
@@ -9356,6 +10476,55 @@ async function computeLooksDone(job, fetchedCwds) {
   return { commits: attributed.commits, paths, detectedAt: new Date().toISOString(), rule: attributed.rule };
 }
 
+/**
+ * Shadow gate (observation only): run a needs_review row's authored gate at
+ * the project's current HEAD and record what it WOULD have decided as
+ * `gateShadow` on the verdicts sidecar and the row. Changes NO status, takes
+ * no slot (not a claude -p run — runGateSequence keeps one shadow gate in
+ * flight machine-wide). Never called from finalize: only the reverify pass.
+ * Returns the recorded gateShadow, or null when nothing was recorded (already
+ * recorded at this HEAD, PRD unreadable, or another shadow gate is running).
+ */
+async function runGateShadow(job) {
+  if (!job || !job.slug || !job.cwd) return null;
+  const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
+  let prdText;
+  try { prdText = fs.readFileSync(prdPath, 'utf8'); } catch { return null; }
+  const head = await gitHead(job.cwd);
+  if (job.gateShadow && job.gateShadow.head === head) return null;
+  const gate = resolveGate(prdText);
+  let outcome;
+  if (gate.source === 'none') outcome = { status: 'unavailable', reason: 'gate-opt-out', results: [] };
+  else if (!gate.sequence.length) outcome = { status: 'unavailable', reason: 'no-parseable-gate', results: [] };
+  else {
+    const r = await runGateSequence(gate.sequence, { cwd: job.cwd });
+    if (r.status === 'busy') return null;
+    outcome = r;
+  }
+  const gateShadow = { ...outcome, head, source: gate.source, ranAt: new Date().toISOString() };
+  const runId = job.runId || resolveRunId(job);
+  if (runId) {
+    const verdictsPath = path.join(schedulerPaths.runsDir(), runId, `${job.slug}.verdicts.json`);
+    // Read-merge (single-writer law: runVerify owns the sidecar's other keys).
+    // Only merge into an existing run dir — never conjure one.
+    if (fs.existsSync(path.dirname(verdictsPath))) {
+      let existing = {};
+      try { existing = JSON.parse(fs.readFileSync(verdictsPath, 'utf8')) || {}; } catch { /* absent/unparseable → fresh */ }
+      try { atomicWriteJsonSync(verdictsPath, { ...existing, gateShadow }); } catch { /* best-effort */ }
+    }
+  }
+  await mutate((s) => {
+    for (const j of s.jobs) {
+      if (j.slug === job.slug && j.status === 'needs_review') j.gateShadow = gateShadow;
+    }
+  });
+  await broadcast();
+  return gateShadow;
+}
+
+// Tail of the last background shadow gate — lets tests (and only tests) await it.
+let gateShadowPending = null;
+
 async function reverifyNeedsReview() {
   const snap = await readQueue();
   // isGuardParkedWithoutAutoFix rows are NOT isRescanCandidate (their
@@ -9365,7 +10534,7 @@ async function reverifyNeedsReview() {
   // guard-verdict auto-resolve gap this PRD closes. Handled in its own
   // branch below (no transcript rescan — there is no transcript verdict to
   // rescan) rather than through the isRescanCandidate machinery.
-  const candidates = snap.jobs.filter((j) => isRescanCandidate(j) || isGuardParkedWithoutAutoFix(j));
+  const candidates = snap.jobs.filter((j) => isRescanCandidate(j) || isGuardParkedWithoutAutoFix(j) || isStaleSharedTreeRevertedPark(j));
   const healed = [];
   const leftForReview = [];
   const looksDoneUpdates = [];
@@ -9373,12 +10542,33 @@ async function reverifyNeedsReview() {
   // the `git fetch --all --prune` per distinct cwd (see computeLooksDone's
   // header) rather than re-fetching the same repo once per candidate row.
   const fetchedCwds = new Set();
+  const evidenceSlugs = new Set(selectEvidenceScanTargets(snap.jobs).map((j) => j.slug));
+  const evidenceScanned = [];
   for (const job of candidates) {
-    if (!isRescanCandidate(job) && isGuardParkedWithoutAutoFix(job)) {
-      // Guard-verdict park, never auto-fixed: only evidence gathering, never
-      // a transcript rescan (there was never a transcript-verifier verdict
-      // here) and never a direct heal — applyNeedsReviewAutoResolve is the
-      // sole place that turns this annotation into a status change.
+    if (isStaleSharedTreeRevertedPark(job)) {
+      // Re-apply the corrected shared-tree check: the row's own landedCommit
+      // (this dispatch's, per resolveLandedCommitEvidence) still being an
+      // ancestor of HEAD means the park was a false positive — heal it.
+      const cwd = job.cwd || DEFAULT_PROJECT_CWD;
+      if (await resolveLandedCommitEvidence(cwd, job.landedCommit, job.startedAt)
+        && await module.exports.landedCommitIsAncestorOfHead(cwd, job.landedCommit)) {
+        healed.push(job.slug);
+        continue;
+      }
+      if (!isRescanCandidate(job) && !isGuardParkedWithoutAutoFix(job)) {
+        leftForReview.push({ slug: job.slug, reason: 'shared_tree_reverted: landed commit not an ancestor of HEAD' });
+        continue;
+      }
+    }
+    if (job.status === 'needs_review' && !isTranscriptRescannable(job)) {
+      // Any needs_review row whose verdict is not a transcript-verifier one
+      // (a guard verdict, a not-yet-invented verdict, a stranded auto-fix
+      // park): only evidence gathering, never a transcript rescan (verifyRun
+      // would call it clean) and never a direct heal —
+      // applyNeedsReviewAutoResolve is the sole place that turns this
+      // annotation into a status change. Bounded by selectEvidenceScanTargets.
+      if (!evidenceSlugs.has(job.slug)) continue;
+      evidenceScanned.push(job.slug);
       const looksDone = await computeLooksDone(job, fetchedCwds);
       if (looksDone) {
         looksDoneUpdates.push({ slug: job.slug, cwd: job.cwd, looksDone, fromFailed: false });
@@ -9401,7 +10591,7 @@ async function reverifyNeedsReview() {
       }
       continue;
     }
-    const runDir = path.join(RUNS_DIR, job.runId || resolveRunId(job));
+    const runDir = path.join(schedulerPaths.runsDir(), job.runId || resolveRunId(job));
     const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
     // Derive committedDuringRun from the recorded run window. The live
     // commit-guard uses gitHead() (before/after HEAD diff); here the run is
@@ -9424,6 +10614,13 @@ async function reverifyNeedsReview() {
         committedDuringRun,
         allowPreSentinelHeal: true,
         priorLandedCommit,
+        // job.landedCommit is THIS row's own last-run attribution (stamped by
+        // spawnJob's finalize, survives resetJobFields) — the same
+        // ground-truth-outranks-heuristics evidence spawnJob passes live,
+        // just read back post-hoc since there is no in-flight guardHeadBefore/
+        // headAtExit pair to recompute for an already-terminal row.
+        jobLandedCommitThisRun: job.landedCommit ?? null,
+        exitCode: job.exitCode ?? null,
       });
     } catch { leftForReview.push({ slug: job.slug, reason: 'verifyRun threw' }); continue; }
     const refusal = healRefusalReason(job, v, committedDuringRun);
@@ -9454,6 +10651,23 @@ async function reverifyNeedsReview() {
       }
     }
   }
+  // Shadow gate (observation only): at most ONE needs_review row per pass,
+  // fired in the background so a 15-minute gate never stalls this pass.
+  if (!gateShadowPending && process.env.SM_GATE_SHADOW_DISABLE !== '1') {
+    const gateTarget = snap.jobs.find((j) => j.status === 'needs_review' && !j.gateShadow);
+    if (gateTarget) {
+      gateShadowPending = runGateShadow(gateTarget)
+        .catch((e) => { console.error('[scheduler] gate shadow error', gateTarget.slug, e); })
+        .finally(() => { gateShadowPending = null; });
+    }
+  }
+  if (evidenceScanned.length) {
+    const scannedSet = new Set(evidenceScanned);
+    const stamp = new Date().toISOString();
+    await mutate((s) => {
+      for (const j of s.jobs) if (scannedSet.has(j.slug) && j.status === 'needs_review') j.evidenceScannedAt = stamp;
+    });
+  }
   if (looksDoneUpdates.length) {
     const bySlug = new Map(looksDoneUpdates.map((u) => [u.slug, u]));
     await mutate((s) => {
@@ -9666,7 +10880,7 @@ async function reverifyNeedsReview() {
     });
     for (const job of targets) {
       const runId = job.runId || resolveRunId(job);
-      const runDir = path.join(RUNS_DIR, runId);
+      const runDir = path.join(schedulerPaths.runsDir(), runId);
       const isRetryAttempt = job.autoFixAttempted === true;
       const isDeadFixPlanReopen = isFixPlanDead(job, queueForResumeAndAutofix.jobs);
       const deadChild = isDeadFixPlanReopen
@@ -9813,12 +11027,14 @@ function registerScheduleHandlers() {
     const freeSlots = Math.max(0, slotSnapshot.total - slotSnapshot.inUse);
     const verdict = classifyQueueHealth({
       jobs: state.jobs,
-      paused: state.paused,
+      paused: upgradeDrain.effectivePaused(state),
       launchBlocks: state.launchBlocks,
       runningSet,
       freeSlots,
       totalSlots: slotSnapshot.total,
-      lastDispatchAttemptAtMs: Date.parse(state.lastDispatchAttemptAt ?? ''),
+      lastRunAtMs: Date.parse(state.lastRunAt ?? ''),
+      lastPauseClearedAtMs: lastPauseClearedAt,
+      schedulerBootedAtMs: Date.parse(SCHEDULER_BOOTED_AT),
       now,
       cwd,
     });
@@ -9949,6 +11165,11 @@ function registerScheduleHandlers() {
     return { ok: true };
   });
 
+  ipcMain.handle('schedule:pause', async () => {
+    await setPaused('manual', null);
+    return { ok: true };
+  });
+
   ipcMain.handle('schedule:resume', async () => {
     await clearPause('manual');
     return { ok: true };
@@ -9980,7 +11201,7 @@ function registerScheduleHandlers() {
   ipcMain.handle('schedule:clear-queue', async () => {
     ensureDirs();
     const ts = new Date().toISOString().replace(/[:.]/g, '-');
-    const archiveDir = path.join(PRDS_ARCHIVE_DIR, ts);
+    const archiveDir = path.join(schedulerPaths.scheduledPlansRoot(), 'prds-archived', ts);
     const state = await readQueue();
     const victims = state.jobs.filter((j) => j.status !== 'running');
     if (victims.length === 0) {
@@ -10027,7 +11248,7 @@ function registerScheduleHandlers() {
 
   ipcMain.handle('schedule:open-folder', async () => {
     const { shell } = require('electron');
-    await shell.openPath(ROOT);
+    await shell.openPath(schedulerPaths.scheduledPlansRoot());
     return { ok: true };
   });
 
@@ -10045,8 +11266,8 @@ function registerScheduleHandlers() {
   ipcMain.handle('schedule:read-log', validated(schemas.scheduleReadLog, async ({ slug, runId }) => {
     // Defense-in-depth: re-check containment after path.resolve even though
     // SLUG_RE / RUN_ID_RE already forbid path separators.
-    const logPath = path.resolve(path.join(RUNS_DIR, runId, `${slug}.log`));
-    if (!logPath.startsWith(RUNS_DIR + path.sep)) {
+    const logPath = path.resolve(path.join(schedulerPaths.runsDir(), runId, `${slug}.log`));
+    if (!logPath.startsWith(schedulerPaths.runsDir() + path.sep)) {
       return { ok: false, error: 'invalid slug or runId' };
     }
     try {
@@ -10063,8 +11284,8 @@ function registerScheduleHandlers() {
     // template, authored before the user fills in `cwd`) falls back to the
     // legacy global dir until it's re-saved with a real cwd and migrated by
     // the next reconcile-driven scan.
-    const dir = (await findPrdDir(data.slug)) ?? PRDS_DIR;
-    if (dir === PRDS_DIR) ensureDirs();
+    const dir = (await findPrdDir(data.slug)) ?? schedulerPaths.prdsRoot();
+    if (dir === schedulerPaths.prdsRoot()) ensureDirs();
     const resolved = safeSlugPathIn(dir, data.slug);
     if (!resolved) return { ok: false, error: 'invalid slug' };
     try {
@@ -10096,6 +11317,15 @@ function registerScheduleHandlers() {
   });
 }
 
+function stopDispatchLoop() {
+  if (dispatchLoopHandle) { dispatchLoopHandle.stop(); dispatchLoopHandle = null; }
+}
+
+/** Shutdown path: stop the timers this module owns. */
+function stop() {
+  stopDispatchLoop();
+}
+
 async function init() {
   ensureDirs();
   // Boot phase — reconciliation, migrations, self-heal, first reset probe.
@@ -10111,6 +11341,9 @@ async function init() {
     // A slot freed anywhere (e.g. a chat run settled) may unblock a deferred
     // batch — advance the queue without waiting for the next 60s poll.
     sessionSlots.subscribe(() => { tickQueue().catch(() => {}); });
+    // Boot-time expiry pass (process-local state is empty after a restart, so
+    // this is a cheap belt-and-braces run against the freshly read queue).
+    try { runReservationExpiryPass((await readQueue()).jobs); } catch { /* best-effort */ }
     // Retire the global queue.json: split its rows into per-project shards
     // BEFORE the first read below, so boot reconciliation sees the shards.
     try {
@@ -10131,17 +11364,17 @@ async function init() {
     // Boot reconciliation: finalize any job that was 'running' when the app died.
     // Check the run log first — a job that emitted result/success before the crash
     // should be marked 'completed', not 'failed', so it doesn't wedge the queue
-    // via the failure-gate. Also kill any still-live orphan claude child to prevent
-    // it from continuing to write to the project unsupervised (2026-05-21 incident).
+    // via the failure-gate. A still-live executor is spared, not killed.
     //
     // classifyRunOutcome calls readTail → fs.readFileSync (up to 64 KB per job).
     // Pre-compute all outcomes BEFORE entering the mutate lock so the blocking I/O
     // does not stall the event loop or hold the mutateTail chain during startup.
     //
-    // Jobs whose recorded pid is still alive are deferred (not classified here) —
-    // see partitionBootOrphans. Everything else (dead pid or no pid) is safe to
+    // Rows proven alive are adopted (left running, never killed) — see
+    // partitionBootOrphans. Everything else is proven dead/exited and is safe to
     // classify immediately below.
     const bootSnap = readQueueSync();
+    const bootLogPath = (j) => (j?.runId ? path.join(schedulerPaths.runsDir(), j.runId, `${j.slug}.log`) : null);
 
     // Worktree boot reconciliation (PRD 994): a job worktree that survives an
     // app crash/host reboot must not leak disk or a dangling branch forever —
@@ -10156,11 +11389,15 @@ async function init() {
       // itself, proof its run already died. isLive checks the already-read
       // bootSnap (no extra queue read) for a live running-row pid, OR a live
       // /proc cwd holder under the checkout itself. See jobWorktreeBootLive.cjs.
+      // rowPid walks the SAME record → runtime.pid → log-pid ladder
+      // partitionBootOrphans uses, so the sweep and the partition can never
+      // disagree about which executor is alive.
       const isLive = buildJobWorktreeIsLive({
         bootJobs: bootSnap.jobs,
         claudePidAlive,
         hasLiveHolder: gitWorktree.hasLiveHolder,
         cwdHolders: gitWorktree.listCwdHolders(),
+        rowPid: (j) => bootRowPid(j, bootLogPath),
       });
       await jobWorktree.reconcileWorktreesOnBoot([...worktreeCwds], { isLive });
     } catch (e) {
@@ -10180,12 +11417,30 @@ async function init() {
       console.error('[scheduler] boot epic-worktree reconciliation failed', e?.message);
     }
 
-    const { immediate: immediateSlugs, deferred: deferredSlugs } = partitionBootOrphans(bootSnap.jobs);
+    const { immediate: immediateSlugs, adopted: adoptedSlugs } = partitionBootOrphans(bootSnap.jobs, {
+      pidAlive: claudePidAlive,
+      getLogPid: (j) => readSpawnedPidFromLog(bootLogPath(j)),
+      getLogMtimeMs: (j) => readLogMtimeMs(bootLogPath(j)),
+      logFreshWindowMs: IDLE_OUTPUT_KILL_MS,
+      findLiveProcess: (j) => findLiveProcessForJob(j, {
+        worktreeDir: jobWorktree.worktreeDirFor(j.cwd || DEFAULT_PROJECT_CWD, j.slug),
+        runCwd: j.runtime?.cwd || j.cwd,
+      }),
+      readRecord: supervisorRecord.readSupervisorRecord,
+    });
     const bootOutcomes = new Map();
     for (const j of bootSnap.jobs) {
       if (!immediateSlugs.includes(j.slug)) continue;
-      const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
-      bootOutcomes.set(j.slug, logPath ? classifyRunOutcome(logPath) : 'unknown');
+      const logPath = j.runId ? path.join(schedulerPaths.runsDir(), j.runId, `${j.slug}.log`) : null;
+      let outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
+      // A row whose run already wrote its exit marker (meta.json) is finalized
+      // from that meta when the log tail alone can't say (killed/torn tail).
+      if (outcome === 'unknown' || outcome === 'no_result') {
+        let meta = null;
+        try { meta = j.runId ? JSON.parse(fs.readFileSync(path.join(schedulerPaths.runsDir(), j.runId, `${j.slug}.meta.json`), 'utf8')) : null; } catch { /* no/torn meta — keep the log outcome */ }
+        if (meta && typeof meta.exitCode === 'number') outcome = meta.exitCode === 0 ? 'success' : 'failed';
+      }
+      bootOutcomes.set(j.slug, outcome);
     }
     // Same evidence-before-failure gate reapDeadRunningJobs applies, resolved
     // BEFORE mutate() for the same reason (git spawn work must never run
@@ -10215,53 +11470,32 @@ async function init() {
       await archiveCompletedPrd(slug, cwd);
     }
 
-    // Still-alive orphans: SIGTERM (+ killOrphanClaudePid's own deferred SIGKILL
-    // follow-up) now, but classification waits until BOOT_ORPHAN_KILL_GRACE_MS
-    // later — reading the log while the orphan might still be writing to it
-    // could misclassify an about-to-succeed run as no_result and double-run the
-    // same PRD (2026-05-21 incident this guard exists for).
-    for (const slug of deferredSlugs) {
-      const j = bootSnap.jobs.find((x) => x.slug === slug);
-      const pid = j?.runtime?.pid;
-      const bootRunId = j?.runId ?? null; // captured now — guards against reconciling a DIFFERENT later run of the same slug
-      if (!pid) continue;
-      const result = killOrphanClaudePid(pid);
-      const killNote = ` (orphan pid=${pid}: ${result})`;
-      if (result === 'killed') {
-        console.log(`[scheduler] boot: SIGTERM'd orphan claude pid=${pid} for ${slug} — deferring finalize ${BOOT_ORPHAN_KILL_GRACE_MS}ms`);
-      }
-      setTimeout(async () => {
-        const logPath = j.runId ? path.join(RUNS_DIR, j.runId, `${j.slug}.log`) : null;
-        const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
-        // Same evidence-before-failure gate as the immediate-orphan path
-        // above, resolved before mutate() for the same reason (git spawn
-        // work must never run inside mutate()'s serialization chain). Uses
-        // the captured pre-kill snapshot's landedCommit/cwd/startedAt — the
-        // race guard below already confirms `cur` is still this same run
-        // (runId === bootRunId) before this evidence is applied.
-        const confirmedLandedCommit = (outcome !== 'success' && j.landedCommit)
-          ? (await resolveLandedCommitEvidence(j.cwd || DEFAULT_PROJECT_CWD, j.landedCommit, j.startedAt) ? j.landedCommit : null)
-          : null;
-        let deferredCompletedCwd;
-        mutate((state) => {
-          const cur = state.jobs.find((x) => x.slug === slug);
-          // Race guard: bail if the job already resolved, OR if it's already been
-          // re-picked into a NEW run (different runId) within the grace window —
-          // that new run is not the boot orphan we SIGTERM'd and must not be
-          // touched by this stale classification.
-          if (!cur || cur.status !== 'running' || cur.runId !== bootRunId) return;
-          applyOrphanOutcome(cur, outcome, killNote, confirmedLandedCommit);
-          console.log(`[scheduler] boot reconcile (deferred): slug=${slug} outcome=${outcome} → status=${cur.status}`);
-          deferredCompletedCwd = cur.status === 'completed' ? cur.cwd : undefined;
-        }).then(() => {
-          if (deferredCompletedCwd !== undefined) return archiveCompletedPrd(slug, deferredCompletedCwd);
-        }).catch((e) => console.error(`[scheduler] deferred boot reconcile failed for ${slug}:`, e?.message));
-      }, BOOT_ORPHAN_KILL_GRACE_MS).unref?.();
+    // Proven-alive rows stay `running` and are never signalled (the boot worktree
+    // sweep above already spares their checkout). No sessionSlots token is
+    // acquired: pickNextBatch's untrackedRunning correction counts the row
+    // against the pool, and reapDeadRunningJobs finalizes it on exit.
+    if (adoptedSlugs.length) {
+      const adoptedAtBoot = new Date().toISOString();
+      const adoptedRunIds = new Map(bootSnap.jobs.filter((j) => adoptedSlugs.includes(j.slug)).map((j) => [j.slug, j.runId ?? null]));
+      await mutate((state) => {
+        for (const j of state.jobs) {
+          // runId guard: never stamp a DIFFERENT later run of the same slug.
+          if (j.status !== 'running' || !adoptedRunIds.has(j.slug) || (j.runId ?? null) !== adoptedRunIds.get(j.slug)) continue;
+          j.adoptedAtBoot = adoptedAtBoot;
+          delete j.supervisedAt; // a prior process's supervisor died with it
+          console.log(`[scheduler] boot: adopted live executor for ${j.slug} (pid=${j.runtime?.pid ?? 'unknown'}) — left running, no signal`);
+        }
+      });
     }
 
+    // Re-arm budget/idle/deadman + the quietMachine lease for the adopted rows
+    // (a dispatch-loop pass repeats this for any row left without a supervisor).
+    await superviseAdoptedRunsPass();
+
     // If we boot up while paused with a resumeAt in the past, clear it. This
     // happens when the app was closed across the reset window.
     const boot = await readQueue();
+    await clearStaleDrainAtBoot(boot);
     if (boot.paused && boot.paused.resumeAt && new Date(boot.paused.resumeAt).getTime() <= Date.now()) {
       await clearPause('boot-elapsed');
     } else if (boot.paused && boot.paused.resumeAt) {
@@ -10483,7 +11717,7 @@ async function init() {
         }
         for (const target of exhaustedNeedsReviewTargets) {
           const j = ms.jobs.find((x) => x.slug === target.slug);
-          const outcome = applyNeedsReviewAutoResolve(j);
+          const outcome = applyNeedsReviewAutoResolve(j, ms.jobs);
           if (outcome) {
             console.warn(
               `[scheduler] NEEDS_REVIEW AUTO-RESOLVE: project=${j.cwd ?? '(unknown)'} slug=${j.slug} `
@@ -10504,7 +11738,7 @@ async function init() {
         }
       }).catch(() => {});
     }
-  }, 10 * 60_000);
+  }, REVERIFY_INTERVAL_MS);
 
   // Self-rescheduling poll loop with exponential backoff. Replaces the
   // old fixed-interval pollTimer + initialPollTimeout.
@@ -10525,87 +11759,18 @@ async function init() {
   // setInterval callback is sync; readQueueSync stays sync to avoid awaiting
   // inside the timer body (and the 60s cadence makes the cost moot).
   if (heartbeatInterval) clearInterval(heartbeatInterval);
-  heartbeatInterval = setInterval(() => {
-    const s = readQueueSync();
-    // NEVER-STOP INVARIANT: if a queue holds ready PRDs and nothing is
-    // running, something must drive it. This is the only driver that does
-    // not depend on the billing poll loop, a pause timer, or a completing
-    // job to schedule the next tick — every one of which has failed at
-    // least once. See classifyQueueStarvation.
-    if (!s.unreadable) {
-      runQueueStarvationWatchdog(s).catch((e) => console.error('[scheduler] starvation watchdog error', e));
-    }
-    // Initialise from the real status union (scheduleJobSchema.cjs) rather
-    // than a hand-maintained subset — the old `{ pending, running, completed,
-    // failed }` literal silently minted a NEW key for any other value
-    // (`counts[j.status] = (counts[j.status]||0)+1`), which is exactly how a
-    // heartbeat with a `queued: 2` bucket looked like "normal" 24h
-    // visibility instead of the alarm it should have been. Any row whose
-    // status isn't in JOB_STATUSES (shouldn't happen post-quarantine, but
-    // this is the last line of defence) routes into `unknown`, never a
-    // freshly-minted key.
-    const counts = Object.fromEntries(JOB_STATUSES.map((st) => [st, 0]));
-    counts.unknown = 0;
-    for (const j of s.jobs) {
-      if (Object.prototype.hasOwnProperty.call(counts, j.status) && j.status !== 'unknown') {
-        counts[j.status] += 1;
-      } else {
-        counts.unknown += 1;
-      }
-    }
-
-    const stall = computeStallSummary(s);
-    // Per-project alerting (see computeStallSummary's header): a project
-    // stalled while others are busy must still fire, and one project
-    // recovering must not clear or suppress another's still-open episode —
-    // that is exactly what a single module-level stallSince/stallToasted
-    // flag masked before (the burrow-vs-others incident this PRD fixes).
-    const now = Date.now();
-    const stalledCwds = Object.keys(stall.byProject).filter((cwd) => stall.byProject[cwd].stalled);
-    for (const cwd of [...stallSince.keys()]) {
-      if (!stalledCwds.includes(cwd)) {
-        stallSince.delete(cwd);
-        stallToasted.delete(cwd);
-      }
-    }
-    const toAlert = [];
-    for (const cwd of stalledCwds) {
-      if (!stallSince.has(cwd)) stallSince.set(cwd, now);
-      if (!stallToasted.get(cwd) && now - stallSince.get(cwd) >= POLL_INTERVAL_MS) {
-        stallToasted.set(cwd, true);
-        toAlert.push(cwd);
-      }
-    }
-    if (toAlert.length > 0) {
-      console.error(
-        `[scheduler] STALL DETECTED in project(s): ${toAlert.join(', ')} — 0 running, 0 pending, not paused, `
-        + `for >= ${Math.round(POLL_INTERVAL_MS / 1000)}s`,
-        stall.byProject,
-      );
-      appendAuditEvent('scheduler_stall_detected', { projects: toAlert, total: stall.total, byProject: stall.byProject });
-      if (mainWindow && !mainWindow.isDestroyed()) {
-        sendIfAlive(mainWindow, 'schedule:stall', {
-          message: `Scheduler stall in ${toAlert.length} project(s): ${toAlert.join(', ')}. Check the Scheduler tab.`,
-          projects: toAlert,
-          total: stall.total,
-          byProject: stall.byProject,
-        });
-      }
-    }
-
-    appendHeartbeat({
-      ts: Date.now(),
-      pid: process.pid,
-      counts,
-      stall: { stalled: stall.stalled, total: stall.total },
-      paused: s.paused ? { reason: s.paused.reason, resumeAt: s.paused.resumeAt } : null,
-      nextReset: cachedNextReset,
-      utilization: cachedUtilization,
-      consecutiveFailures,
-    });
-  }, 60_000);
+  heartbeatInterval = setInterval(() => heartbeatTick(), 60_000);
   if (heartbeatInterval.unref) heartbeatInterval.unref();
 
+  // Dispatch's own periodic driver: cadence is independent of pollLoop's billing
+  // backoff. A loop tick meeting a cancelled cancelToken returns 'cancelled' from
+  // tickBody; clearing stays with the starvation watchdog's existing force-clear.
+  stopDispatchLoop();
+  dispatchLoopHandle = startDispatchLoop({
+    tick: () => tickQueue(),
+    onError: (e) => console.warn('[scheduler] dispatch loop tick failed', e?.message),
+  });
+
   // Wake-from-sleep: immediately re-poll and re-evaluate the queue.
   try {
     const { powerMonitor } = require('electron');
@@ -10828,8 +11993,8 @@ const remote = {
       }
       await fsp.mkdir(dir, { recursive: true });
     } else {
-      dir = (await findPrdDir(slug)) ?? PRDS_DIR;
-      if (dir === PRDS_DIR) ensureDirs();
+      dir = (await findPrdDir(slug)) ?? schedulerPaths.prdsRoot();
+      if (dir === schedulerPaths.prdsRoot()) ensureDirs();
     }
 
     // writePrd only ever JOINS an existing Epic now (no mintAuthority
@@ -10866,6 +12031,19 @@ const remote = {
     }
   },
 
+  // User-initiated pause/resume — the admin-route/MCP twins of the
+  // schedule:pause / schedule:resume IPC handlers, through the same setPaused /
+  // clearPause. Pause stops NEW dispatch only; running jobs are never touched.
+  async pause() {
+    await setPaused('manual', null);
+    return { ok: true };
+  },
+
+  async resume() {
+    await clearPause('manual');
+    return { ok: true };
+  },
+
   async resetJob(slug, opts = {}) {
     const resolved = await resolveSlugOrReason(slug, opts.cwd);
     if (!resolved.ok) {
@@ -11193,6 +12371,14 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
     sendJson(res, 200, jobs);
   });
 
+  adminHttp.registerRoute('POST', '/admin/scheduler/pause', async (req, res) => {
+    sendJson(res, 200, await remoteObj.pause());
+  });
+
+  adminHttp.registerRoute('POST', '/admin/scheduler/resume', async (req, res) => {
+    sendJson(res, 200, await remoteObj.resume());
+  });
+
   adminHttp.registerRoute('POST', '/admin/scheduler/reset-job', async (req, res) => {
     const raw = await readBody(req);
     let parsed;
@@ -11217,6 +12403,8 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
 module.exports = {
   classifyQueueStarvation,
   classifyQueueStarvationByProject,
+  dispatchIdleMs,
+  launchBlockedSlugs,
   classifyQueueHealth,
   runQueueStarvationWatchdog,
   QUEUE_STARVATION_MS,
@@ -11240,13 +12428,13 @@ module.exports = {
   registerScheduleHandlers,
   attachWindow,
   init,
-  ROOT,
-  PRDS_DIR,
-  SCHEDULER_STATE_PATH,
   BACKOFF_MAX_MS,
   FAILURE_STREAK_WARN_THRESHOLD,
+  FAILURE_STREAK_ESCALATION_MS,
   nextBackoffMs,
   shouldWarnFailureStreak,
+  shouldEscalateFailureStreak,
+  computeDegradedBudget,
   healRefusalReason,
   writeQueue,
   reconcile,
@@ -11269,6 +12457,8 @@ module.exports = {
   memoryLimitedBatchSize,
   availableForJobs,
   reverifyNeedsReview,
+  runGateShadow,
+  awaitGateShadowIdle: async () => { while (gateShadowPending) await gateShadowPending; },
   shouldRunPeriodicReverify,
   findStuckFailedJobs,
   STUCK_FAILED_ESCALATE_MS,
@@ -11283,6 +12473,13 @@ module.exports = {
   NEEDS_REVIEW_RESOLVE_MS,
   needsReviewAutoResolveDisabled,
   isRescanCandidate,
+  isTranscriptRescannable,
+  selectEvidenceScanTargets,
+  RESCAN_EXCLUDED_VERDICTS,
+  RESCANNABLE_VERDICTS,
+  EVIDENCE_SCAN_MAX_PER_PASS,
+  EVIDENCE_SCAN_MIN_INTERVAL_MS,
+  REVERIFY_INTERVAL_MS,
   isFailedUnverifiedShaped,
   computeLooksDone,
   attributeLandedCommits,
@@ -11295,6 +12492,9 @@ module.exports = {
   isExhaustedAutoFix,
   GUARD_VERDICT_EVIDENCE_ELIGIBLE,
   isGuardParkedWithoutAutoFix,
+  isStrandedAutoFixPark,
+  isStaleSharedTreeRevertedPark,
+  landedCommitIsAncestorOfHead,
   isEligibleForNeedsReviewAutoResolve,
   isPlanUnqueued,
   isFixPlanDead,
@@ -11334,7 +12534,6 @@ module.exports = {
   buildScheduleStatePayload,
   partitionBootOrphans,
   applyOrphanOutcome,
-  BOOT_ORPHAN_KILL_GRACE_MS,
   registerAdminRoutes,
   notifyOriginatingTab,
   notifyNeedsReview,
@@ -11360,10 +12559,13 @@ module.exports = {
   SCHEDULER_CODE_SHA,
   resetJobFields,
   executeJob,
+  killOrphanClaudePid,
   prdArchivedSkipResult,
   spawnJob,
   listPrdsInternal,
   computeStallSummary,
+  heartbeatTick,
+  appendHeartbeat,
   findStaleQuarantinedJobs,
   QUARANTINE_ESCALATE_MS,
   selectQuarantineAutoResolveTargets,
@@ -11402,6 +12604,10 @@ module.exports = {
   setPaused,
   clearPause,
   tickQueue,
+  setRestartHandler,
+  driveUpgradeDrain,
+  clearStaleDrainAtBoot,
+  stop,
   runDueJobs,
   pollLoop,
   maybeLaunchWhenAvailable,
@@ -11410,12 +12616,23 @@ module.exports = {
   CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD,
   RAPID_RATE_LIMIT_WINDOW_MS,
   MANUAL_PAUSE_COOLDOWN_MS,
-  RUNS_DIR,
   pickRunDir,
   resolveRateLimitPauseReset,
+  billingResetForPause,
   computeEffectiveResumeAt,
   computeResumeDelay,
   FOREIGN_WIP_BLOCK_STREAK_LIMIT,
   validateForeignWipBlockClaim,
   requeueForeignWipBlockedJobs,
 };
+
+// Lazy path getters: resolved from SM_SCHEDULER_HOME at each read, never frozen
+// at require time (see lib/schedulerPaths.cjs).
+for (const [name, resolve] of [
+  ['ROOT', schedulerPaths.scheduledPlansRoot],
+  ['PRDS_DIR', schedulerPaths.prdsRoot],
+  ['RUNS_DIR', schedulerPaths.runsDir],
+  ['SCHEDULER_STATE_PATH', schedulerPaths.schedulerStatePath],
+]) {
+  Object.defineProperty(module.exports, name, { get: resolve, enumerable: true });
+}