claude-code-session-manager 0.96.0 → 0.98.0

package/src/main/build-info.json

@@ -1,8 +1,8 @@
 {
-  "version": "0.96.0",
-  "gitSha": "32cc4ebad387727ee0d691ffcf524d938efdcfca",
-  "gitShortSha": "32cc4eba",
+  "version": "0.98.0",
+  "gitSha": "a733808122aabbe14f7b37834196eb78bb0c339f",
+  "gitShortSha": "a7338081",
   "gitBranch": "HEAD",
-  "builtAt": "2026-09-24T19:16:51.123Z",
+  "builtAt": "2026-09-26T00:17:48.074Z",
   "dirty": false
 }

package/src/main/ipcSchemas.cjs

@@ -322,10 +322,14 @@ const PrdAgentTypeSchema = z.string().regex(PERSONA_NAME_RE, 'agent name must be
 // Shared shape for a `dependsOn` slug entry — schedulerCreatePrd and
 // adminUpdatePrd (scheduler_update_prd, PRD 1124) must accept the exact same
 // slug shape or an update could write a dependsOn value create would have
-// rejected. Array-level constraints (`.max(20)`, `.optional()`) stay at each
-// call site since update also allows an explicit empty array to CLEAR the
-// dependency, which create has no reason to accept.
+// rejected. Array-level constraints (`.max(MAX_DEPENDS_ON)`, `.optional()`)
+// stay at each call site since update also allows an explicit empty array to
+// CLEAR the dependency, which create has no reason to accept.
 const DepSlugSchema = z.string().min(1).max(160).regex(/^[A-Za-z0-9][\w.-]*$/);
+// Array-level cap shared by every dependsOn field below — a validate PRD in a
+// large /develop plan depends on every other slug in the plan, so this must
+// stay well above the largest plan size the PRD authoring flow allows.
+const MAX_DEPENDS_ON = 100;
 // Wave-authoring decision (scheduler wave-disposition PRD), shared between
 // schedulerCreatePrd (authoring time) and adminPrdFrontmatterPatch (the
 // after-the-fact change path) so both can never disagree on what a valid
@@ -350,7 +354,7 @@ const schedulerCreatePrd = z.object({
   parallelGroup: z.number().int().min(1).max(999999).optional(),
   // Explicit ordering (PRD 832): slugs that must complete before this PRD
   // becomes eligible. Written to frontmatter as `dependsOn: [a, b]`.
-  dependsOn: z.array(DepSlugSchema).max(20).optional(),
+  dependsOn: z.array(DepSlugSchema).max(MAX_DEPENDS_ON).optional(),
   // Explicit wave-authoring decision (scheduler wave-disposition PRD) — only
   // meaningful (and only stamped) when this PRD joins an Epic that already
   // has incomplete PRDs and lands as a wave root (no dependsOn of its own);
@@ -417,7 +421,7 @@ const scheduleSetPrdDisposition = z.object({
   slug: z.string().regex(SCHEDULE_SLUG_RE),
   cwd: z.string().min(1).max(4096).optional(),
   disposition: PrdDispositionSchema,
-  dependsOn: z.array(DepSlugSchema).max(20).optional(),
+  dependsOn: z.array(DepSlugSchema).max(MAX_DEPENDS_ON).optional(),
 });
 
 // Bulk archive: slug list, capped to limit unbounded retag/archive payloads.
@@ -501,7 +505,7 @@ const adminPrdFrontmatterPatch = z.object({
   // non-empty array is validated write-time against the SAME resolver
   // (depSlugResolve.cjs) scheduler_create_prd uses, so update and create
   // can never disagree about what a dependsOn entry resolves to.
-  dependsOn: z.array(DepSlugSchema).max(20).optional(),
+  dependsOn: z.array(DepSlugSchema).max(MAX_DEPENDS_ON).optional(),
   // Patchable after creation too — the Scheduler UI's "change disposition"
   // action (promote a wave to its own head, or attach it behind another
   // chain) rewrites this alongside dependsOn via the same

package/src/main/lib/__tests__/watchdog-helpers.test.cjs

@@ -372,4 +372,70 @@ describe('evaluateDispatchLiveness', () => {
     assert.equal(evaluateDispatchLiveness(null, now).dead, false);
     assert.equal(evaluateDispatchLiveness({ ts: now }, now).dead, false);
   });
+
+  const wedgedDeadMs = 10 * 60_000;
+
+  test('wedged + stale lastDispatchAttemptAt → tick-wedged dead', () => {
+    const e = base();
+    e.dispatch.lastTickReason = 'wedged';
+    e.dispatch.lastDispatchAttemptAt = new Date(now - wedgedDeadMs - 60_000).toISOString();
+    assert.deepEqual(
+      evaluateDispatchLiveness(e, now, { deadMs, wedgedDeadMs }),
+      { dead: true, reason: 'tick-wedged' },
+    );
+  });
+
+  test('wedged but recent attempt → not dead', () => {
+    const e = base();
+    e.dispatch.lastTickReason = 'wedged';
+    e.dispatch.lastDispatchAttemptAt = new Date(now - 60_000).toISOString();
+    // Also clear the unrelated dispatch-dead conditions so a recent wedged
+    // attempt reads as genuinely alive, not merely falling through to a
+    // different dead reason.
+    e.dispatch.lastRunAt = new Date(now - 60_000).toISOString();
+    assert.equal(evaluateDispatchLiveness(e, now, { deadMs, wedgedDeadMs }).dead, false);
+  });
+
+  test('wedged while paused → paused (not dead)', () => {
+    const e = base();
+    e.dispatch.lastTickReason = 'wedged';
+    e.dispatch.lastDispatchAttemptAt = new Date(now - wedgedDeadMs - 60_000).toISOString();
+    e.dispatch.paused = true;
+    assert.deepEqual(
+      evaluateDispatchLiveness(e, now, { deadMs, wedgedDeadMs }),
+      { dead: false, reason: 'paused' },
+    );
+  });
+
+  test('wedged with pendingDispatchable 0 still dead (the 2026-09-25 shape)', () => {
+    const e = base();
+    e.dispatch.lastTickReason = 'wedged';
+    e.dispatch.lastDispatchAttemptAt = new Date(now - wedgedDeadMs - 60_000).toISOString();
+    e.dispatch.pendingDispatchable = 0;
+    assert.deepEqual(
+      evaluateDispatchLiveness(e, now, { deadMs, wedgedDeadMs }),
+      { dead: true, reason: 'tick-wedged' },
+    );
+  });
+
+  test('wedged with unparseable lastDispatchAttemptAt → tick-wedged dead', () => {
+    const e = base();
+    e.dispatch.lastTickReason = 'wedged';
+    e.dispatch.lastDispatchAttemptAt = null;
+    assert.deepEqual(
+      evaluateDispatchLiveness(e, now, { deadMs, wedgedDeadMs }),
+      { dead: true, reason: 'tick-wedged' },
+    );
+  });
+
+  test('default wedgedDeadMs is 10 min', () => {
+    const e = base();
+    e.dispatch.lastTickReason = 'wedged';
+    e.dispatch.lastDispatchAttemptAt = new Date(now - 9 * 60_000).toISOString();
+    assert.equal(evaluateDispatchLiveness(e, now, { deadMs }).reason, 'dispatch-dead');
+    const e2 = base();
+    e2.dispatch.lastTickReason = 'wedged';
+    e2.dispatch.lastDispatchAttemptAt = new Date(now - 11 * 60_000).toISOString();
+    assert.deepEqual(evaluateDispatchLiveness(e2, now, { deadMs }), { dead: true, reason: 'tick-wedged' });
+  });
 });

package/src/main/lib/planValidator.cjs

@@ -8,21 +8,73 @@
  * filesystem or scheduler knowledge — the caller supplies the queue rows.
  */
 
+const { bareSlug } = require('./depSlugResolve.cjs');
+
 /**
  * hasDownstreamValidator(job, jobs) → boolean
  *
  * True iff `jobs` contains a row with `agentType === 'validator'`, status
- * `pending` or `running`, whose `dependsOn` names `job.slug`. A validator job
- * itself never has a downstream validator (it IS the plan's validation pass).
+ * `pending` or `running`, that reaches `job.slug` transitively by walking
+ * `dependsOn` edges through the supplied rows (e.g. validator -> sink ->
+ * job). A validator job itself never has a downstream validator (it IS the
+ * plan's validation pass). Plans over the `dependsOn` cap point the
+ * validator at only the plan's sink PRDs, so a direct-only check would
+ * wrongly say every non-sink work item has no downstream validator.
+ *
+ * `jobs` may be the machine-wide queue (every project's rows merged), so
+ * when `job.cwd` is known the walk excludes rows carrying a DIFFERENT
+ * explicit `cwd` — a same-bare-named PRD in an unrelated project can never
+ * satisfy this job's validator check. A row with no `cwd` recorded is kept
+ * (queue rows may omit it; `scheduleJobSchema.cjs` makes it optional) rather
+ * than guessed at, since a wrong exclusion (a real validator missed) is far
+ * worse than the narrow residual risk of an unstamped row colliding by bare
+ * name. Slug matching within that scope reuses the canonical
+ * `depSlugResolve.cjs` rule (exact slug, else bare-name with the leading
+ * `NN-` stripped) so this walk agrees with the scheduler's own dependency
+ * gate on what a `dependsOn` entry resolves to.
  */
 function hasDownstreamValidator(job, jobs) {
   if (!job || !Array.isArray(jobs)) return false;
   if (job.agentType === 'validator') return false;
-  return jobs.some((row) => row
-    && row.agentType === 'validator'
-    && (row.status === 'pending' || row.status === 'running')
-    && Array.isArray(row.dependsOn)
-    && row.dependsOn.includes(job.slug));
+
+  const projectJobs = job.cwd
+    ? jobs.filter((row) => row && (row.cwd == null || row.cwd === job.cwd))
+    : jobs.filter(Boolean);
+
+  const rowBySlug = new Map();
+  const rowsByBareSlug = new Map();
+  for (const row of projectJobs) {
+    rowBySlug.set(row.slug, row);
+    const bare = bareSlug(row.slug);
+    if (!rowsByBareSlug.has(bare)) rowsByBareSlug.set(bare, []);
+    rowsByBareSlug.get(bare).push(row);
+  }
+  const rowsForSlug = (slug) => {
+    const exact = rowBySlug.get(slug);
+    if (exact) return [exact];
+    return rowsByBareSlug.get(bareSlug(slug)) ?? [];
+  };
+  const matchesJob = (slug) => slug === job.slug || bareSlug(slug) === bareSlug(job.slug);
+
+  const validators = projectJobs.filter((row) => row.agentType === 'validator'
+    && (row.status === 'pending' || row.status === 'running'));
+
+  for (const validator of validators) {
+    const visited = new Set();
+    const queue = Array.isArray(validator.dependsOn) ? [...validator.dependsOn] : [];
+    while (queue.length) {
+      const slug = queue.shift();
+      if (visited.has(slug)) continue;
+      visited.add(slug);
+      if (matchesJob(slug)) return true;
+      for (const row of rowsForSlug(slug)) {
+        for (const depSlug of row.dependsOn ?? []) {
+          if (!visited.has(depSlug)) queue.push(depSlug);
+        }
+      }
+    }
+  }
+  return false;
 }
 
 module.exports = { hasDownstreamValidator };

package/src/main/lib/prdCreate.cjs

@@ -480,23 +480,48 @@ async function createPrd(input, remote) {
     sourceTabId: input.sourceTabId ?? null,
   });
 
+  // PRD 1446: writePrd() succeeding used to just promise "the next scheduler
+  // reconcile pass (~1 minute)" adopts this file — but nothing reliably ran
+  // that pass (the 60s pollLoop only reaches reconcile() via
+  // maybeLaunchWhenAvailable, which returns early while zero rows are
+  // pending; the 10-minute rescheduleTimer could itself stall behind a slow
+  // billing fetch). Trigger one reconcile immediately through the EXISTING
+  // broadcast-coalescer seam (remote.requestReconcile(), same one resetJob
+  // already uses) instead of waiting on either. Best-effort: a reconcile
+  // failure here must not fail a write that already landed on disk — the
+  // PRD file is real regardless, and the next scheduled pass still adopts
+  // it if this one didn't stick.
+  let enqueued = false;
+  if (typeof remote.requestReconcile === 'function') {
+    try {
+      await remote.requestReconcile();
+      if (typeof remote.getJob === 'function') {
+        enqueued = Boolean(await remote.getJob(filenameSlug));
+      }
+    } catch (e) {
+      console.warn(`[prdCreate] immediate requestReconcile failed (non-fatal, next scheduled pass will adopt it): ${e?.message ?? e}`);
+    }
+  }
+
   // No `status` field here, and never one named 'queued' — that string was
   // handed straight to callers as if it were a real ScheduleJob status, and
   // is exactly how the 1021/1022 incident's invalid `"status": "queued"`
   // rows got onto disk (this route's own response was the most likely
   // source). A PRD is a queue row's SOURCE, not the row itself: writePrd
-  // only ever joins an Epic and writes the .md file — the queue row is
-  // created separately, by the next reconcile() pass. `enqueued: false` is
-  // true by construction (this function never touches queue.json), so no
-  // caller can copy a fake job status out of this response again.
+  // only ever joins an Epic and writes the .md file — the queue row above
+  // is created separately, by reconcile(). `enqueued` reflects whether that
+  // reconcile pass (triggered synchronously above) actually produced the
+  // row before this function returned — it is not a fabricated status.
   return {
     ok: true,
     nn,
     filename: `${filenameSlug}.md`,
     prdPath: writeResult.path ?? null,
     epicId: writeResult.epicId ?? null,
-    enqueued: false,
-    note: 'PRD file written; the queue row is derived by the next scheduler reconcile pass, not created here',
+    enqueued,
+    note: enqueued
+      ? 'PRD file written and adopted into the queue as a pending row'
+      : 'PRD file written; the queue row is derived by the next scheduler reconcile pass, not created here',
     // Advisory only (PRD 1403) — never blocks the write. See prdSizing.cjs.
     warnings: sizingWarnings(input),
   };
@@ -542,7 +567,7 @@ function registerAdminRoute(adminHttp, remote) {
       filename: result.filename,
       prdPath: result.prdPath ?? null,
       epicId: result.epicId ?? null,
-      enqueued: false,
+      enqueued: result.enqueued,
       note: result.note,
       warnings: result.warnings,
     });

package/src/main/lib/watchdogHelpers.cjs

@@ -96,19 +96,28 @@ function heartbeatFresh(heartbeatPath = schedulerPaths.heartbeatPath(), maxAgeMs
 }
 
 const DEFAULT_DISPATCH_DEAD_MS = 30 * 60_000;
+const DEFAULT_TICK_WEDGED_DEAD_MS = 10 * 60_000;
 
 /**
- * evaluateDispatchLiveness(entry, now, { deadMs }?) → { dead, reason }
+ * evaluateDispatchLiveness(entry, now, { deadMs, wedgedDeadMs }?) → { dead, reason }
  *
  * Pure. Observability only — a logically-dead scheduler (wedged tick chain,
  * leaked slots) still writes fresh heartbeats, so freshness alone can't see
- * it. `dead` only when ALL hold: heartbeat fresh (not degraded, within
- * DEFAULT_MAX_AGE_MS), dispatch.lastRunAt older than deadMs (absent/unparseable
- * counts as older), pendingDispatchable > 0, runningCount === 0, not paused.
+ * it. `dead` when EITHER:
+ *   - dispatch.lastTickReason === 'wedged' and lastDispatchAttemptAt is
+ *     older than wedgedDeadMs (absent/unparseable counts as older) — a
+ *     wedged reconcile never derives rows, so pendingDispatchable stays 0
+ *     and the rule below can never fire (2026-09-25: watchdog logged
+ *     'alive'/'nothing-dispatchable' every 3 min through a 30+ min mutate
+ *     deadlock because of exactly this gap); or
+ *   - ALL of: dispatch.lastRunAt older than deadMs (absent/unparseable
+ *     counts as older), pendingDispatchable > 0, runningCount === 0.
+ * Both rules require: heartbeat fresh (not degraded, within
+ * DEFAULT_MAX_AGE_MS) and not paused/draining.
  * Callers must NOT relaunch on this: the process is alive, and a relaunch
  * would spawn a second app on top of it.
  */
-function evaluateDispatchLiveness(entry, now = Date.now(), { deadMs = DEFAULT_DISPATCH_DEAD_MS } = {}) {
+function evaluateDispatchLiveness(entry, now = Date.now(), { deadMs = DEFAULT_DISPATCH_DEAD_MS, wedgedDeadMs = DEFAULT_TICK_WEDGED_DEAD_MS } = {}) {
   if (!entry || entry.degraded === true || typeof entry.ts !== 'number') {
     return { dead: false, reason: 'no-fresh-heartbeat' };
   }
@@ -117,6 +126,12 @@ function evaluateDispatchLiveness(entry, now = Date.now(), { deadMs = DEFAULT_DI
   if (!d || typeof d !== 'object') return { dead: false, reason: 'no-dispatch-field' };
   if (d.paused) return { dead: false, reason: 'paused' };
   if (d.drain) return { dead: false, reason: 'draining' };
+  if (d.lastTickReason === 'wedged') {
+    const lastAttemptMs = Date.parse(d.lastDispatchAttemptAt ?? '');
+    if (!Number.isFinite(lastAttemptMs) || now - lastAttemptMs > wedgedDeadMs) {
+      return { dead: true, reason: 'tick-wedged' };
+    }
+  }
   if (!(d.pendingDispatchable > 0)) return { dead: false, reason: 'nothing-dispatchable' };
   if (d.runningCount !== 0) return { dead: false, reason: 'jobs-running' };
   const lastRunMs = Date.parse(d.lastRunAt ?? '');
@@ -461,6 +476,7 @@ module.exports = {
   maybeRelaunchApp,
   DEFAULT_MAX_AGE_MS,
   DEFAULT_DISPATCH_DEAD_MS,
+  DEFAULT_TICK_WEDGED_DEAD_MS,
   DEFAULT_LOCK_STALE_MS,
   DEFAULT_FINALIZE_BUDGET_MS,
   DEFAULT_RELAUNCH_DEBOUNCE_MS,

package/src/main/queueOps.cjs

@@ -341,13 +341,17 @@ async function archiveOne(slug, ts, cwd) {
  * Injected by index.cjs at registration time (see registerQueueOpsHandlers)
  * so a manual archive can retire any still-runnable queue job for the same
  * slug without queueOps.cjs importing scheduler.cjs (circular — scheduler.cjs
- * already requires queueOps.cjs). No-op until set; the auto-archive path
- * never needs it (selectAutoArchivable only ever selects already-completed
- * jobs).
+ * already requires queueOps.cjs). No-op until set. Only ever invoked when
+ * archiveMany is called with { retire: true } (the default, used by the
+ * manual schedule:archive-prd path) — autoArchiveCompleted passes
+ * { retire: false } because it calls retireCompletedSlugsFn (== scheduler's
+ * retireCompletedSlugs) from inside reconcile(), itself always inside a
+ * mutate() body; retireCompletedSlugs's own mutate() call would then queue
+ * behind the mutate awaiting it and deadlock every tick (2026-09-25 incident).
  */
 let retireCompletedSlugsFn = async () => {};
 
-async function archiveMany(slugs, cwd) {
+async function archiveMany(slugs, cwd, { retire = true } = {}) {
   if (!Array.isArray(slugs) || slugs.length === 0) {
     return { ok: true, archived: 0, archivedTo: null, results: [] };
   }
@@ -362,7 +366,7 @@ async function archiveMany(slugs, cwd) {
   }
   const archived = results.filter((r) => r.ok).length;
   const archivedSlugs = results.filter((r) => r.ok).map((r) => r.slug);
-  if (archivedSlugs.length > 0) {
+  if (retire && archivedSlugs.length > 0) {
     await retireCompletedSlugsFn(archivedSlugs).catch((e) => {
       logs.writeLine({ level: 'warn', scope: 'queueOps', message: 'archiveMany: retireCompletedSlugs failed', meta: { error: e?.message } });
     });
@@ -440,6 +444,13 @@ function selectAutoArchivable(jobs, { nowMs, retentionMs } = {}) {
  * the same path-containment. No-op (without touching disk) when
  * SM_PRD_AUTOARCHIVE_DISABLE=1. Each successful move is logged one line
  * (slug -> dest).
+ *
+ * Passes { retire: false } to archiveMany: this runs inside reconcile(),
+ * which always runs inside a mutate() body or tickBody, so invoking
+ * retireCompletedSlugs (which itself calls mutate()) here would queue that
+ * mutate behind the one already awaiting it and deadlock every tick — proven
+ * live 2026-09-25. Also unneeded on the merits: selectAutoArchivable only
+ * ever selects already-completed jobs, so there is nothing left to retire.
  */
 async function autoArchiveCompleted(state, { nowMs } = {}) {
   if (process.env.SM_PRD_AUTOARCHIVE_DISABLE === '1') {
@@ -450,7 +461,7 @@ async function autoArchiveCompleted(state, { nowMs } = {}) {
   if (slugs.length === 0) {
     return { ok: true, archived: 0, archivedTo: null, results: [] };
   }
-  const result = await archiveMany(slugs);
+  const result = await archiveMany(slugs, undefined, { retire: false });
   for (const r of result.results) {
     if (r.ok) {
       logs.writeLine({

package/src/main/scheduler.cjs

@@ -47,6 +47,7 @@ const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
+const { AsyncLocalStorage } = require('node:async_hooks');
 const { startDispatchLoop } = require('./lib/dispatchLoop.cjs');
 const schedulerPaths = require('./lib/schedulerPaths.cjs');
 const { randomUUID } = require('node:crypto');
@@ -1328,9 +1329,17 @@ async function archiveCompletedPrd(slug, cwd) {
  * `schedule:archive-prd`) so a stale queue entry can never survive to fire
  * against a PRD that no longer exists in the live prds/ dir — the same
  * ENOENT-avoidance archivedTwinExists provides in executeJob, applied at the
- * archiving source instead of at fire-time. auto-archived slugs never need
- * this (selectAutoArchivable in queueOps.cjs only selects already-completed
- * jobs), so this is exercised only by the manual archive path.
+ * archiving source instead of at fire-time.
+ *
+ * MUST NEVER be called from inside a mutate() body (directly, or transitively
+ * via reconcile()/tickBody, which always run inside one) — this function
+ * itself calls mutate() below, and a mutate queued from inside a mutate body
+ * queues behind the very mutate awaiting it, so mutateTail never settles:
+ * every tick wedges machine-wide until the app restarts (proven live
+ * 2026-09-25). That is exactly why queueOps.cjs's autoArchiveCompleted (which
+ * DOES run inside reconcile()) calls archiveMany with { retire: false } and
+ * skips this function entirely — it is exercised only by the manual archive
+ * path (queueOps.cjs's `schedule:archive-prd`, called from outside mutate()).
  */
 async function retireCompletedSlugs(slugs) {
   const list = Array.isArray(slugs) ? slugs.filter(Boolean) : [];
@@ -2469,6 +2478,15 @@ async function writeQueue(state) {
 // preceding mutate threw, so the chain never deadlocks.
 let mutateTail = Promise.resolve();
 
+// Tracks whether the current async continuation is running inside a live
+// mutate() body. A mutate() called (and awaited) from inside another mutate's
+// `fn` would otherwise queue behind its own caller on mutateTail and deadlock
+// forever — this turns that class of bug into an immediate, audited rejection.
+// A callback (setTimeout/promise) scheduled from inside a mutate body but
+// firing AFTER that body has finished sees ctx.active === false and proceeds
+// normally, since AsyncLocalStorage propagates the store into it.
+const mutateCtx = new AsyncLocalStorage();
+
 // Observe-only watchdog: a mutate body over MUTATE_WATCHDOG_MS is logged and
 // audited once per episode (latched until a mutate completes). mutateTail is
 // deliberately NEVER reset — it is what enforces the single-writer law, and
@@ -2477,6 +2495,12 @@ const MUTATE_WATCHDOG_MS = 60_000;
 let mutateWedgeLatched = false;
 
 function mutate(fn) {
+  if (mutateCtx.getStore()?.active === true) {
+    const err = new Error('mutate() re-entered from inside a running mutate body — would deadlock');
+    console.error('[scheduler] MUTATE RE-ENTRANT', err.stack);
+    appendAuditEvent('mutate_reentrant', { stack: String(err.stack).split('\n').slice(0, 8).join('\n') });
+    return Promise.reject(err);
+  }
   const next = mutateTail.then(async () => {
     const wedgeTimer = setTimeout(() => {
       if (mutateWedgeLatched) return;
@@ -2485,9 +2509,11 @@ function mutate(fn) {
       appendAuditEvent('mutate_wedged', { budgetMs: MUTATE_WATCHDOG_MS });
     }, MUTATE_WATCHDOG_MS);
     if (typeof wedgeTimer.unref === 'function') wedgeTimer.unref();
+    const ctx = { active: true };
     try {
-      return await mutateBody(fn);
+      return await mutateCtx.run(ctx, () => mutateBody(fn));
     } finally {
+      ctx.active = false;
       clearTimeout(wedgeTimer);
       mutateWedgeLatched = false;
     }
@@ -3775,13 +3801,31 @@ function computeFireAt(state, nextResetIso) {
   return reset + (state.config.offsetMinutes * 60_000);
 }
 
+// PRD 1446: refreshNextReset() awaits billing.fetchUsage(), which can hang
+// or back off for minutes while the usage meter is rate-limited. Left
+// unbounded, that stalled THIS function's own mutate(reconcile) call for as
+// long as the fetch took — the 10-minute rescheduleTimer was meant to be a
+// second, independent path into reconcile() alongside the 60s pollLoop, but
+// a hung fetch silently took it out too, leaving newly-created PRDs
+// unadopted (PRDs 1420-1441, 2026-09-25). Racing against this timeout lets
+// the reconcile still run on the cached reset value; the abandoned
+// refreshNextReset() call is left to resolve on its own and update the
+// cache for next time.
+const RESCHEDULE_TIMER_BILLING_RACE_MS = 10_000;
+
 async function rescheduleTimer() {
   clearFireTimer();
   // Wrap in try/catch — on failure use the cached value so the on-reset
   // timer can still be armed from the last known reset.
   let nextResetIso;
   try {
-    nextResetIso = await refreshNextReset();
+    nextResetIso = await Promise.race([
+      refreshNextReset(),
+      new Promise((resolve) => {
+        const t = setTimeout(() => resolve(cachedNextReset), RESCHEDULE_TIMER_BILLING_RACE_MS);
+        if (typeof t.unref === 'function') t.unref();
+      }),
+    ]);
   } catch {
     nextResetIso = cachedNextReset;
   }
@@ -12453,6 +12497,19 @@ const remote = {
     }
   },
 
+  // Triggers an immediate reconcile pass through the SAME seam resetJob
+  // already uses below (broadcast's coalescer, whose getPayload runs
+  // module.exports.reconcile) — no second reconcile implementation. PRD
+  // 1446: prdCreate.cjs's createPrd() calls this right after a successful
+  // write so a fresh PRD becomes a pending queue row without waiting for
+  // the next scheduled pass — the 60s pollLoop only reaches reconcile() via
+  // maybeLaunchWhenAvailable, which returns early while zero rows are
+  // pending, and the 10-minute rescheduleTimer can itself stall behind a
+  // slow/hung billing fetch (see rescheduleTimer's own bounded race below).
+  async requestReconcile() {
+    await broadcast({ flush: true });
+  },
+
   // User-initiated pause/resume — the admin-route/MCP twins of the
   // schedule:pause / schedule:resume IPC handlers, through the same setPaused /
   // clearPause. Pause stops NEW dispatch only; running jobs are never touched.
@@ -12876,8 +12933,11 @@ module.exports = {
   computeDegradedBudget,
   healRefusalReason,
   writeQueue,
+  _mutateForTests: mutate, // mutate() has no other exported call site; test-only seam.
   reconcile,
   broadcast,
+  rescheduleTimer,
+  RESCHEDULE_TIMER_BILLING_RACE_MS,
   reconcileSourcePromptId,
   allocateParallelGroup,
   selectHistoryJobs,