claude-code-session-manager 0.87.0 → 0.88.1

package/src/main/__tests__/scheduler-rate-limit-pause.test.cjs

@@ -5,6 +5,13 @@
  * resume timer when both the log and the billing endpoint come up empty
  * (the live failure mode: the usage endpoint itself 429s).
  *
+ * Also (usage-meter circuit PRD): neither function may arm a PAST reset —
+ * resolveRateLimitPauseReset/computeEffectiveResumeAt now reject a stale ISO
+ * via usageCircuit.isResetFresh and fall back to the bounded 30-MINUTE pause
+ * instead. A stale reset used to survive straight into computeResumeDelay's
+ * `Math.max(30_000, <negative>)`, arming a 30-SECOND nap that spun the queue
+ * right back into the same still-active rate limit.
+ *
  * These test the PURE decision functions scheduler.cjs's setPaused() and the
  * spawnJob() rateLimited branch delegate to — never the real setPaused/mutate
  * path, which writes the machine's live scheduler queue.json at a fixed
@@ -21,9 +28,11 @@ const assert = require('node:assert/strict');
 const path = require('node:path');
 const {
   resolveRateLimitPauseReset,
+  billingResetForPause,
   computeEffectiveResumeAt,
   computeResumeDelay,
 } = require('../scheduler.cjs');
+const billing = require('../usage.cjs');
 
 // Repo-tracked, byte-for-byte copy of the real 2026-09-05 starry-night-ships
 // incident log (see src/main/lib/__tests__/rateLimitWindow.test.cjs for the
@@ -32,37 +41,84 @@ const {
 const FIXTURE = path.join(__dirname, '..', 'lib', '__tests__', 'fixtures', '204-mercury-steam-horse.log.txt');
 const FIVE_HOUR_ISO = new Date(1788643800 * 1000).toISOString(); // what refreshNextReset() would have returned
 const SEVEN_DAY_ISO = new Date(1789059600 * 1000).toISOString(); // the actually-binding window
+// Fixed "now" contemporaneous with the fixture's own timestamps (BEFORE both
+// resets above), so freshness checks read the fixture the way it looked at
+// incident time — not relative to whenever this suite happens to run.
+const FIXTURE_NOW = Date.parse('2026-09-05T16:32:00.000Z');
 
 test('resolveRateLimitPauseReset: prefers the log-derived seven-day reset over the billing five_hour reset', () => {
-  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO);
+  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO, FIXTURE_NOW);
   assert.strictEqual(resetIso, SEVEN_DAY_ISO);
   assert.notStrictEqual(resetIso, FIVE_HOUR_ISO);
 });
 
 test('resolveRateLimitPauseReset: falls back to the billing reset when the log yields none', () => {
-  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO);
+  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO, FIXTURE_NOW);
   assert.strictEqual(resetIso, FIVE_HOUR_ISO);
 });
 
 test('resolveRateLimitPauseReset: null when BOTH the log and the billing endpoint are unavailable', () => {
-  assert.strictEqual(resolveRateLimitPauseReset('/nonexistent/path/job.log', null), null);
+  assert.strictEqual(resolveRateLimitPauseReset('/nonexistent/path/job.log', null, FIXTURE_NOW), null);
+});
+
+test('resolveRateLimitPauseReset: a PAST log-derived reset is rejected, not returned stale', () => {
+  // "now" is AFTER both fixture resets have already elapsed.
+  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
+  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO, longAfter);
+  assert.strictEqual(resetIso, null);
+});
+
+test('resolveRateLimitPauseReset: log yields nothing and the billing reset has already passed -> null, not the stale value', () => {
+  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
+  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO, longAfter);
+  assert.strictEqual(resetIso, null);
 });
 
 test('computeEffectiveResumeAt: rate_limit with no resumeAt gets the same bounded 30-minute fallback as network', () => {
-  const now = Date.parse('2026-09-05T16:32:00.000Z');
+  const now = FIXTURE_NOW;
   const resumeAt = computeEffectiveResumeAt('rate_limit', null, now);
   assert.strictEqual(resumeAt, new Date(now + 30 * 60_000).toISOString());
 });
 
-test('computeEffectiveResumeAt: an explicit resumeAt (the log-derived reset) is never overridden', () => {
-  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, Date.now());
+test('computeEffectiveResumeAt: a FRESH explicit resumeAt (the log-derived reset) is never overridden', () => {
+  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, FIXTURE_NOW);
   assert.strictEqual(resumeAt, SEVEN_DAY_ISO);
 });
 
+test('computeEffectiveResumeAt: a PAST resumeAt gets the 30-minute fallback, not a ~30-second nap', () => {
+  // now is well AFTER SEVEN_DAY_ISO has already elapsed — the exact shape of
+  // the bug: Math.max(30_000, <negative>) used to arm a 30-second resume.
+  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
+  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, longAfter);
+  assert.strictEqual(resumeAt, new Date(longAfter + 30 * 60_000).toISOString());
+  assert.notStrictEqual(resumeAt, SEVEN_DAY_ISO);
+  const { delayMs } = computeResumeDelay(resumeAt, longAfter);
+  assert.ok(delayMs >= 30 * 60_000, `expected >= 30 minutes, got ${delayMs}ms`);
+});
+
 test('computeEffectiveResumeAt: other reasons (e.g. auth) get no fallback — stays indefinite', () => {
   assert.strictEqual(computeEffectiveResumeAt('auth', null, Date.now()), null);
 });
 
+test('billingResetForPause: skips refreshNextReset() (no billing.fetchUsage call) while the shared circuit is OPEN', async () => {
+  const originalFetchUsage = billing.fetchUsage;
+  let fetchCalls = 0;
+  billing.fetchUsage = async () => { fetchCalls++; return { kind: 'ok', data: { usage: {} } }; };
+  try {
+    // Force the shared circuit open (3 consecutive failures), same threshold usageCircuit.cjs uses.
+    billing.usageCircuit.recordFailure('a');
+    billing.usageCircuit.recordFailure('a');
+    billing.usageCircuit.recordFailure('a');
+    assert.strictEqual(billing.usageCircuit.state(), 'open');
+
+    await billingResetForPause();
+    assert.strictEqual(fetchCalls, 0, 'refreshNextReset() must not call billing.fetchUsage() while the circuit is open');
+  } finally {
+    billing.usageCircuit.recordSuccess({}); // close the shared circuit back up for later tests/files
+    billing.fetchUsage = originalFetchUsage;
+  }
+});
+
 test('computeResumeDelay: a seven-day-out reset (~5 days from now) is armed, not treated as too-far', () => {
   const now = Date.parse('2026-09-05T16:32:00.000Z');
   // ~5 days out — comfortably under the 0x7fffffff (~24.8 day) setTimeout cap.

package/src/main/__tests__/scheduler-rate-limit-spin-guard.test.cjs

@@ -27,6 +27,7 @@ import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
 const { execFileSync } = require('node:child_process');
 
 let tmpHome;
@@ -92,15 +93,12 @@ function writeProjectQueue(cwd, jobs) {
 // non-zero almost instantly, and bumps a counter file each invocation so the
 // test can assert exactly how many times it was actually spawned.
 function writeAlways429ClaudeStub(counterPath) {
-  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-429-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
-  const body = `
+  return claudeStub.writeClaudeStub({ body: `
     const fs = require('fs');
     fs.appendFileSync(${JSON.stringify(counterPath)}, 'x');
     process.stdout.write(JSON.stringify({ type: 'result', subtype: 'error', is_error: true, api_error_status: 429 }) + '\\n');
     process.exit(1);
-  `;
-  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\n`, { mode: 0o755 });
-  return stubPath;
+  ` });
 }
 
 test('a manual Resume immediately followed by a permanently-429ing job never produces a runaway dispatch loop', async () => {

package/src/main/__tests__/scheduler-reap-dead-running-jobs.test.cjs

@@ -38,7 +38,7 @@ const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'reap-dead-running-jobs-te
 process.env.HOME = tmpHome;
 
 const { reapDeadRunningJobs, PIDLESS_SPAWN_GRACE_MS } = require('../scheduler.cjs');
-const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+const { auditLogPath } = require('../lib/auditLog.cjs');
 // queueStore's cwd discovery is cached for 30s (queueStore.cjs's CACHE_MS) —
 // a project registered by THIS test after an earlier test already populated
 // that cache (and didn't itself bust it, e.g. because it found nothing
@@ -68,10 +68,29 @@ function registerActiveProject(cwd) {
   fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
 }
 
+// Every real scheduler row is born from a real PRD .md file — reconcile()'s
+// auto-archive-drop path (a terminal job whose slug has no on-disk PRD
+// anywhere is treated as "archived on purpose": dropped from queue.json and
+// backfilled to history.jsonl, see scheduler-reconcile-history-backfill.
+// test.cjs) fires the very next time broadcast({flush:true}) reconciles —
+// which reapDeadRunningJobs() itself does on every reap. Without a matching
+// PRD source, a row this test just reaped to a terminal status vanishes from
+// queue.json before the assertions below ever read it back. Epic-scoped (not
+// the legacy flat prds/ dir) so it's never swept by consolidateFlatPrds
+// either.
+function writeFixturePrd(cwd, slug) {
+  const prdsDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'epics', 'test-fixture-epic', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), 'Test fixture PRD.', 'utf8');
+}
+
 function writeProjectQueue(cwd, jobs) {
   const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
   fs.mkdirSync(stateDir, { recursive: true });
   fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({ jobs }, null, 2));
+  for (const job of jobs) {
+    if (job && job.slug) writeFixturePrd(job.cwd || cwd, job.slug);
+  }
   return path.join(stateDir, 'queue.json');
 }
 
@@ -131,7 +150,7 @@ test('reapDeadRunningJobs reaps a pidless row older than PIDLESS_SPAWN_GRACE_MS
   // Empty run dir: created, but never written to (the exact 2026-09-01 repro).
   fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', 'run-pidless-zombie'), { recursive: true });
 
-  const auditSizeBefore = fs.existsSync(AUDIT_LOG_PATH) ? fs.statSync(AUDIT_LOG_PATH).size : 0;
+  const auditSizeBefore = fs.existsSync(auditLogPath()) ? fs.statSync(auditLogPath()).size : 0;
 
   await reapDeadRunningJobs();
 
@@ -142,7 +161,7 @@ test('reapDeadRunningJobs reaps a pidless row older than PIDLESS_SPAWN_GRACE_MS
   assert.equal(jobs[0].runtime, undefined);
   assert.equal(jobs[0].gateOutcome, 'never_ran', 'a pidless reap means the gate never had a chance to run');
 
-  const auditText = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').slice(auditSizeBefore);
+  const auditText = fs.readFileSync(auditLogPath(), 'utf8').slice(auditSizeBefore);
   const auditLines = auditText.trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
   const pidlessEvent = auditLines.find((e) => e.kind === 'job_reaped_pidless' && e.slug === 'pidless-zombie');
   assert.ok(pidlessEvent, 'reaping a pidless row must leave an audit trace');
@@ -184,7 +203,7 @@ test('reapDeadRunningJobs: a pidless row past grace with a landedCommit already
   // multi-byte characters (e.g. an em dash in a reaper reason string), and
   // slicing a utf8-decoded JS string (UTF-16 code units) at a byte offset
   // then silently corrupts the boundary. The slug is unique to this test.
-  const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  const auditLines = fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
   const pidlessEvent = auditLines.find((e) => e.kind === 'job_reaped_pidless' && e.slug === 'shipped-but-pidless');
   assert.ok(pidlessEvent, 'reaping this row must still leave an audit trace');
   assert.equal(pidlessEvent.landedCommit, landedSha, 'the audit event must carry the landed-commit evidence so the decision is reconstructable from the audit log alone');

package/src/main/__tests__/scheduler-reconcile-cwd-preserve.test.cjs

@@ -0,0 +1,100 @@
+/**
+ * scheduler-reconcile-cwd-preserve.test.cjs — regression test for the
+ * data-loss bug found while chasing PRD 1218's test:unit gate: reconcile()
+ * rebuilt a queue row's `cwd` unconditionally from its PRD's own
+ * frontmatter (`cwd: p.cwd`) at all three of its row-construction sites. A
+ * PRD file with no `cwd:` frontmatter key — every hand-written or legacy PRD,
+ * and every fixture in this test suite before this fix — parses to
+ * `p.cwd === undefined`, which nulled the row's real, already-correct `cwd`.
+ * queueStore.writeSplit's `job.cwd || defaultCwd` bucketing then relocated
+ * the row into schedulerBatch.cjs's DEFAULT_PROJECT_CWD shard
+ * (`~/Projects/session-manager`) — the WRONG project — while the row's own
+ * project's shard was rewritten without it. A PRD's frontmatter `cwd` must
+ * REFINE a row's existing `cwd`, never erase one.
+ *
+ * Covers the normal refresh path (an existing row matched to its PRD) and
+ * the fresh-discovery path (a PRD with no prior row, falling back to the
+ * project root it was actually found under via
+ * prdLocations.deriveProjectCwdFromPrdPath rather than nulling to
+ * DEFAULT_PROJECT_CWD).
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-reconcile-cwd-preserve.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+let tmpHome;
+let originalHome;
+let reconcile;
+let DEFAULT_PROJECT_CWD;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-reconcile-cwd-preserve-'));
+  process.env.HOME = tmpHome;
+  ({ reconcile } = require('../scheduler.cjs'));
+  ({ DEFAULT_PROJECT_CWD } = require('../lib/schedulerBatch.cjs'));
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+// allProjectCwds()/activeProjectCwds() (queueStore.cjs's stateCwds) discover
+// project cwds by scanning ~/.claude/projects/*/*.jsonl for a `cwd` field —
+// same pattern as scheduler-reap-dead-running-jobs.test.cjs and friends.
+function registerActiveProject(cwd) {
+  const projectsDir = path.join(tmpHome, '.claude', 'projects');
+  const slugDir = path.join(projectsDir, `fake-project-slug-${path.basename(cwd)}`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
+}
+
+test('reconcile() never nulls an existing row\'s cwd because its PRD has no cwd: frontmatter', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-reconcile-cwd-preserve-project-'));
+  registerActiveProject(projectCwd);
+
+  const slug = `1218-cwd-preserve-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'epics', 'test-fixture-epic', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  // Deliberately NO `cwd:` frontmatter key — the exact shape of every
+  // hand-written or legacy PRD that triggered the bug.
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), '# Goal\n\nNo cwd frontmatter here.\n', 'utf8');
+
+  const job = { slug, title: 'x', cwd: projectCwd, status: 'pending' };
+  const state = { jobs: [job] };
+
+  await reconcile(state);
+
+  const row = state.jobs.find((j) => j.slug === slug);
+  expect(row).toBeDefined();
+  expect(row.cwd).toBe(projectCwd);
+  expect(row.cwd).not.toBe(DEFAULT_PROJECT_CWD);
+});
+
+test('reconcile() gives a freshly-discovered, frontmatter-less PRD the project root it was actually found under, never DEFAULT_PROJECT_CWD', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-reconcile-cwd-preserve-fresh-'));
+  registerActiveProject(projectCwd);
+
+  const slug = `1218-cwd-preserve-fresh-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'epics', 'test-fixture-epic', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), '# Goal\n\nNo cwd frontmatter here either.\n', 'utf8');
+
+  // No prior row at all — this PRD is discovered fresh by reconcile()'s own
+  // onDisk scan, not handed in via `state.jobs`.
+  const state = { jobs: [] };
+
+  await reconcile(state);
+
+  const row = state.jobs.find((j) => j.slug === slug);
+  expect(row).toBeDefined();
+  expect(row.cwd).toBe(projectCwd);
+  expect(row.cwd).not.toBe(DEFAULT_PROJECT_CWD);
+});

package/src/main/__tests__/scheduler-reconcile-invalid-repair.test.cjs

@@ -127,8 +127,8 @@ test('reconcile() repairs a queue row with an invalid status back to pending, lo
     // require time, so spying on the module's export property after the
     // fact wouldn't intercept scheduler.cjs's already-bound reference —
     // assert against the real (tmpHome-isolated) audit log file instead.
-    const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
-    expect(AUDIT_LOG_PATH.startsWith(tmpHome)).toBe(true);
+    const { auditLogPath } = require('../lib/auditLog.cjs');
+    expect(auditLogPath().startsWith(tmpHome)).toBe(true);
 
     queueStore.bustCwdCache();
     await scheduler.reconcile(state);
@@ -142,7 +142,7 @@ test('reconcile() repairs a queue row with an invalid status back to pending, lo
     );
     expect(warnedRepair).toBe(true);
 
-    const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const auditLines = fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
     const auditedRepair = auditLines.some(
       (rec) => rec.kind === 'scheduler_row_repaired' && rec.slug === badRow.slug && rec.oldStatus === 'queued',
     );

package/src/main/__tests__/scheduler-reconcile-quarantine.test.cjs

@@ -80,7 +80,7 @@ test('reconcile() quarantines a newly-discovered PRD with no createdVia provenan
     fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({ jobs: [] }, null, 2), 'utf8');
 
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+    const { auditLogPath } = require('../lib/auditLog.cjs');
 
     queueStore.bustCwdCache();
     const state = { jobs: [], invalidJobs: [], paused: null };
@@ -95,7 +95,7 @@ test('reconcile() quarantines a newly-discovered PRD with no createdVia provenan
     );
     expect(warned).toBe(true);
 
-    const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const auditLines = fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
     expect(auditLines.some((rec) => rec.kind === 'prd_quarantined' && rec.slug === '9001-hand-written')).toBe(true);
   } finally {
     fs.rmSync(cwd, { recursive: true, force: true });
@@ -230,7 +230,7 @@ test('reconcile() adopts a quarantined row to pending once its PRD file is stamp
     fm.issuedAt = '2026-08-07T01:00:00.000Z';
     fs.writeFileSync(prdPath, serializePrdFile(fm, body), 'utf8');
 
-    const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+    const { auditLogPath } = require('../lib/auditLog.cjs');
     queueStore.bustCwdCache();
     const state = { jobs: [quarantinedRow], invalidJobs: [], paused: null };
     await scheduler.reconcile(state);
@@ -239,7 +239,7 @@ test('reconcile() adopts a quarantined row to pending once its PRD file is stamp
     expect(row).toBeDefined();
     expect(row.status).toBe('pending');
 
-    const auditLines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const auditLines = fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
     expect(auditLines.some((rec) => rec.kind === 'scheduler_prd_adopted' && rec.slug === '9004-adopt-me')).toBe(true);
   } finally {
     fs.rmSync(cwd, { recursive: true, force: true });

package/src/main/__tests__/scheduler-shard-quarantine.test.cjs

@@ -0,0 +1,110 @@
+/**
+ * scheduler-shard-quarantine.test.cjs — a torn per-project queue shard
+ * quarantines THAT project only. tickQueue keeps dispatching the healthy
+ * project, never scans/mints rows for the torn project's PRDs, never touches
+ * the torn file, and health names the quarantined cwd (non-GREEN).
+ *
+ * Everything runs under a temp HOME; the stub `claude` writes a marker into
+ * its own cwd so the test can prove where a spawn did (not) happen.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-shard-quarantine.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
+
+let tmpHome;
+let originalHome;
+let originalWt;
+let scheduler;
+
+function registerActiveProject(cwd) {
+  const slugDir = path.join(tmpHome, '.claude', 'projects', `fake-project-slug-${path.basename(cwd)}`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
+}
+
+function makeProject(name) {
+  const cwd = path.join(tmpHome, 'Projects', name);
+  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
+  const prdsDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'epics', 'fixture-epic', 'prds');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.mkdirSync(prdsDir, { recursive: true });
+  registerActiveProject(cwd);
+  return { cwd, prdsDir, queueFile: path.join(stateDir, 'queue.json') };
+}
+
+function writeClaudeStub() {
+  return claudeStub.writeClaudeStub({ body: `
+    require('fs').writeFileSync(require('path').join(process.cwd(), 'ran-here.marker'), 'yes');
+    process.stdout.write(JSON.stringify({ type: 'result', subtype: 'success', result: 'ok\\nSCHEDULER_VERDICT: PASS' }) + '\\n');
+    process.exit(0);
+  ` });
+}
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  originalWt = process.env.SM_JOB_WORKTREE_DISABLE;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-shard-quarantine-'));
+  process.env.HOME = tmpHome;
+  process.env.SM_JOB_WORKTREE_DISABLE = '1';
+  process.env.SM_AUTOFIX_DISABLE = '1';
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager'), { recursive: true });
+  scheduler = require('../scheduler.cjs');
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  if (originalWt === undefined) delete process.env.SM_JOB_WORKTREE_DISABLE;
+  else process.env.SM_JOB_WORKTREE_DISABLE = originalWt;
+  delete process.env.SM_AUTOFIX_DISABLE;
+  delete process.env.SM_CLAUDE_BIN;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+test('tickQueue dispatches the healthy project while the torn project is skipped; health names it', async () => {
+  const good = makeProject('good-proj');
+  const torn = makeProject('torn-proj');
+  const goodSlug = `9101-good-${process.pid}`;
+  const tornSlug = `9102-torn-${process.pid}`;
+  fs.writeFileSync(path.join(good.prdsDir, `${goodSlug}.md`), 'Healthy PRD.', 'utf8');
+  fs.writeFileSync(path.join(torn.prdsDir, `${tornSlug}.md`), 'PRD in the torn project.', 'utf8');
+  fs.writeFileSync(good.queueFile, JSON.stringify({
+    jobs: [{ slug: goodSlug, title: 'good', status: 'pending', cwd: good.cwd, dependsOn: [], createdAt: new Date().toISOString() }],
+  }));
+  // A running row was in flight when the shard tore — must never become pending.
+  const TORN = '{"jobs":[{"slug":"' + tornSlug + '","status":"running"}]}{"jobs":[{"slug":"';
+  fs.writeFileSync(torn.queueFile, TORN);
+  const before = fs.readFileSync(torn.queueFile);
+  process.env.SM_CLAUDE_BIN = writeClaudeStub();
+
+  const result = await scheduler.tickQueue({ bypassLoadGate: true });
+  expect(result.reason).not.toBe('unreadable');
+  expect(result.fired).toBe(true);
+  // flagUnreadable (via tickQueue's readQueue) snapshots the torn shard beside itself.
+  const snaps = fs.readdirSync(path.dirname(torn.queueFile)).filter((f) => f.startsWith('queue.json.corrupt-'));
+  expect(snaps).toHaveLength(1);
+
+  await new Promise((resolve, reject) => {
+    const t0 = Date.now();
+    const poll = () => {
+      if (fs.existsSync(path.join(good.cwd, 'ran-here.marker'))) return resolve();
+      if (Date.now() - t0 > 20_000) return reject(new Error('healthy project never dispatched'));
+      setTimeout(poll, 100);
+    };
+    poll();
+  });
+
+  expect(fs.existsSync(path.join(torn.cwd, 'ran-here.marker'))).toBe(false);
+  expect(fs.readFileSync(torn.queueFile).equals(before)).toBe(true);
+
+  const health = await require('../health.cjs').check();
+  expect(health.components.scheduler_queue.ok).toBe(false);
+  expect(health.components.scheduler_queue.quarantinedCwds).toEqual([torn.cwd]);
+  expect(health.issues.some((i) => i.includes(torn.cwd))).toBe(true);
+}, 120_000); // health.check() alone can take tens of seconds

package/src/main/__tests__/scheduler-shared-tree-guard.test.cjs

@@ -285,7 +285,13 @@ test('checkSharedTreeGuard end-to-end: the real 2026-09-12 incident shape — un
   vi.spyOn(scheduler, 'gitHead').mockResolvedValue('sha-after');
   vi.spyOn(scheduler, 'pathsChangedSince').mockResolvedValue(['.gitignore']);
   vi.spyOn(scheduler, 'uncommittedChanges').mockResolvedValue([]); // the log path no longer shows up at all
-  vi.spyOn(fs, 'existsSync').mockImplementation((p) => String(p).includes('errors-2026-09-12.jsonl'));
+  // checkSharedTreeGuard's existence check runs concurrently via
+  // fs.promises.access (fsp === fs.promises — same object) rather than
+  // fs.existsSync, so a large untracked baseline doesn't block the event
+  // loop with hundreds of synchronous stats back-to-back.
+  vi.spyOn(fs.promises, 'access').mockImplementation((p) => (
+    String(p).includes('errors-2026-09-12.jsonl') ? Promise.resolve() : Promise.reject(new Error('ENOENT'))
+  ));
 
   const result = await checkSharedTreeGuard({
     cwd: '/repo',
@@ -298,3 +304,77 @@ test('checkSharedTreeGuard end-to-end: the real 2026-09-12 incident shape — un
   expect(result.reverted).toBeUndefined();
   expect(result.nowIgnored).toEqual([logPath]);
 });
+
+// --- landedCommit ground truth (2026-09-18, 1229-fo-03 false positive) ---
+// Real temp git fixture, never the live repo. Baseline-dirty path `cfg.txt`
+// goes clean with no commit covering it (the shape that makes the baseline
+// diff say "reverted"); only the landedCommit ancestry decides the verdict.
+const { execFileSync } = require('node:child_process');
+const os = require('node:os');
+const nodePath = require('node:path');
+
+function gitIn(dir, ...args) {
+  return execFileSync('git', args, { cwd: dir, encoding: 'utf8' }).trim();
+}
+
+function fixtureRepo() {
+  const dir = fs.mkdtempSync(nodePath.join(os.tmpdir(), 'shared-tree-landed-'));
+  gitIn(dir, 'init', '-q');
+  gitIn(dir, 'config', 'user.email', 't@example.com');
+  gitIn(dir, 'config', 'user.name', 'T');
+  fs.writeFileSync(nodePath.join(dir, 'cfg.txt'), 'base\n');
+  gitIn(dir, 'add', '-A');
+  gitIn(dir, 'commit', '-q', '-m', 'base');
+  const base = gitIn(dir, 'rev-parse', 'HEAD');
+  fs.writeFileSync(nodePath.join(dir, 'cfg.txt'), 'human wip\n'); // baseline-dirty
+  return { dir, base };
+}
+
+function commitPath(dir, rel, msg) {
+  fs.writeFileSync(nodePath.join(dir, rel), `${msg}\n`);
+  gitIn(dir, 'add', rel);
+  gitIn(dir, 'commit', '-q', '-m', msg);
+  return gitIn(dir, 'rev-parse', 'HEAD');
+}
+
+test('checkSharedTreeGuard: landedCommit still an ancestor of HEAD plus an unrelated later commit is NOT reverted', async () => {
+  const { dir, base } = fixtureRepo();
+  const landed = commitPath(dir, 'job.txt', 'job work');
+  gitIn(dir, 'checkout', '--', 'cfg.txt'); // baseline-dirty path goes clean, no commit covers it
+  commitPath(dir, 'later.txt', 'unrelated human commit');
+
+  const result = await checkSharedTreeGuard({
+    cwd: dir, stashBaseline: [], dirtyBaseline: [{ code: ' M', path: 'cfg.txt' }],
+    headBefore: base, slug: 'job-a', landedCommit: landed,
+  });
+  expect(result).toBeNull();
+});
+
+test('checkSharedTreeGuard: landedCommit absent from history still parks as reverted', async () => {
+  const { dir, base } = fixtureRepo();
+  const landed = commitPath(dir, 'job.txt', 'job work');
+  gitIn(dir, 'reset', '-q', '--hard', base); // job commit discarded
+  commitPath(dir, 'later.txt', 'unrelated human commit');
+
+  const result = await checkSharedTreeGuard({
+    cwd: dir, stashBaseline: [], dirtyBaseline: [{ code: ' M', path: 'cfg.txt' }],
+    headBefore: base, slug: 'job-b', landedCommit: landed,
+  });
+  expect(result).toEqual({ reverted: ['cfg.txt'] });
+});
+
+test('checkSharedTreeGuard: no landedCommit at all still parks as reverted', async () => {
+  const { dir, base } = fixtureRepo();
+  gitIn(dir, 'checkout', '--', 'cfg.txt');
+  const result = await checkSharedTreeGuard({
+    cwd: dir, stashBaseline: [], dirtyBaseline: [{ code: ' M', path: 'cfg.txt' }],
+    headBefore: base, slug: 'job-c', landedCommit: null,
+  });
+  expect(result).toEqual({ reverted: ['cfg.txt'] });
+});
+
+test('landedCommitIsAncestorOfHead: empty/unknown sha is false, never throws', async () => {
+  const { dir } = fixtureRepo();
+  expect(await scheduler.landedCommitIsAncestorOfHead(dir, '')).toBe(false);
+  expect(await scheduler.landedCommitIsAncestorOfHead(dir, 'deadbeefdeadbeef')).toBe(false);
+});

package/src/main/__tests__/scheduler-stall-per-project.test.cjs

@@ -110,3 +110,17 @@ test('findStaleQuarantinedJobs: fires past threshold, not before', () => {
   assert.deepStrictEqual(slugs, ['exactly-at-threshold', 'stale']);
   assert.strictEqual(stale.find((s) => s.slug === 'stale').cwd, '/p1');
 });
+
+test('computeStallSummary: a fully drained project (all completed) is idle, not stalled', () => {
+  const state = {
+    paused: null,
+    jobs: [
+      { slug: 'a', cwd: '/p1', status: 'completed' },
+      { slug: 'b', cwd: '/p2', status: 'running' },
+    ],
+    invalidJobs: [],
+  };
+  const summary = computeStallSummary(state);
+  assert.strictEqual(summary.byProject['/p1'].stalled, false);
+  assert.strictEqual(computeStallSummary({ paused: null, jobs: [{ slug: 'a', cwd: '/p1', status: 'completed' }], invalidJobs: [] }).stalled, false);
+});

package/src/main/__tests__/scheduler-starve-escalation.test.cjs

@@ -39,7 +39,7 @@ const {
   STARVE_ESCALATION_MS,
   attachWindow,
 } = require('../scheduler.cjs');
-const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
+const { auditLogPath } = require('../lib/auditLog.cjs');
 
 afterAll(() => {
   process.env.HOME = originalHome;
@@ -52,7 +52,7 @@ const CWD_B = '/home/bilko/Projects/session-manager';
 function readAuditKind(kind) {
   let lines;
   try {
-    lines = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').split('\n').filter(Boolean);
+    lines = fs.readFileSync(auditLogPath(), 'utf8').split('\n').filter(Boolean);
   } catch {
     return [];
   }
@@ -75,8 +75,8 @@ function fakeWindow() {
 beforeEach(() => {
   // Fresh scratch audit log per test so escalation counts never bleed across
   // tests in this file.
-  fs.mkdirSync(path.dirname(AUDIT_LOG_PATH), { recursive: true });
-  fs.writeFileSync(AUDIT_LOG_PATH, '');
+  fs.mkdirSync(path.dirname(auditLogPath()), { recursive: true });
+  fs.writeFileSync(auditLogPath(), '');
   attachWindow(null);
 });