taskforce-loop-engineering 0.7.2 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.8.1 - 2026-08-07
+
+- Make the standard OpenClaw installer and upgrade path install and enable a managed per-queue systemd user scheduler, configure required scheduler heartbeats by default, and use an absolute packaged CLI path so systemd does not depend on an interactive shell `PATH`.
+- Make uninstall disable and remove the managed scheduler units, while retaining queue runtime and refusing to overwrite locally modified managed units.
+
+## 0.8.0 - 2026-08-07
+
+- Add project-aware completion semantics: accepted milestones return project tasks to `inbox/` as `project_in_progress` until an explicit project terminal contract is accepted.
+- Replace filename/tail-based checkpoint judgement with milestone lineage, revision ancestry, sequence, and recency so resolved historical blockers and `cp10` ordering cannot corrupt the final judgement.
+- Separate current blockers from `deferred_gates`, and preserve future authorization boundaries without blocking safe local backlog work.
+- Add a durable human-input lifecycle with a distinct `waiting/` queue state. Inputs received while queued, active, failed, or canceled are delivered on the next safe tick, consumed once, and closed by a successor checkpoint.
+- Keep one-time secrets out of task bodies and ordinary JSON artifacts. Store them in permission-restricted temporary files, pass only references and hashes, and destroy plaintext after dispatch.
+- Recover orphaned `active/` tasks immediately after a new runner acquires the queue lock. The task is atomically returned to `inbox/`, recovery metadata is retained, and the same tick resumes from durable checkpoints instead of leaving a zombie active task until the stale timeout.
+- Add required scheduler heartbeat health checks. A queue with `scheduler.required=true` and queued work now fails `doctor` with `scheduler_missing` when no fresh external scheduler tick has been observed.
+- Add regression coverage for project continuation, checkpoint lineage and ordering, human-input state transitions and redaction, orphan recovery, and scheduler heartbeat fail-closed behavior.
+
 ## 0.7.2 - 2026-08-06
 
 - Keep `ready_for_human_review` tasks out of `done/` until an explicit human decision is recorded; emit a scoped acceptance notification, fail closed when delivery routing is missing, and transition approved tasks to `completed` only after approval.

package/MIGRATING.md

@@ -49,6 +49,7 @@ Use `--confirm-install` only after resolving path conflicts. Existing queue runt
 - Worker agent names are installation settings and are not fixed to Ironman.
 - Every task uses an isolated `agent:<worker>:loop-task-<task-id>` session.
 - Asynchronous delivery requires recorded source `channel` and `target`; missing routing metadata fails closed.
+- A confirmed install or managed upgrade now creates and enables a per-queue systemd user scheduler. Queue configs require its heartbeat, so queued project work cannot silently wait forever. Uninstall disables and removes the managed units while retaining queue runtime.
 - `repair-plan` is read-only. Version 0.6 does not add an automatic configuration repair command.
 
 After installation or upgrade, validate the integration:

package/README.md

@@ -59,6 +59,11 @@ already loop-managed to prevent recursive re-enqueue. Existing generated files
 are not overwritten unless `--force` is supplied after review. The installed
 conversation policy treats `走 loop` as enqueue plus immediate execution;
 `只入队` and `只排队` remain explicit queue-only overrides.
+The confirmed installer also creates and enables a managed per-queue systemd
+user timer. It wakes the adaptive scheduler once per minute; the persisted
+scheduler cadence still decides whether work is due. Generated queue configs
+require a fresh scheduler heartbeat, so queued work fails `doctor` with
+`scheduler_missing` instead of waiting indefinitely when the timer is absent.
 After every installed runner tick, the wrapper idempotently scans human-input
 gates and terminal tasks. The generated notifier delivers through
 `openclaw message send` using the task's recorded `channel`, `target`, `account`,
@@ -102,10 +107,12 @@ loop-engineering-openclaw-manage --root /path/to/workspace --action uninstall-pl
 loop-engineering-openclaw-manage --root /path/to/workspace --action uninstall --confirm-uninstall
 ```
 
-The installer manifest records SHA-256 hashes for generated files and the exact
-managed `AGENTS.md` block. Upgrade/uninstall refuses when managed content was
-edited. Uninstall removes only clean managed files and that exact instructions
-block; queue runtime is explicitly retained.
+The installer manifest records SHA-256 hashes for generated files, systemd
+units, and the exact managed `AGENTS.md` block. Upgrade/uninstall refuses when
+managed content was edited. Upgrade installs and enables the scheduler for
+older managed integrations. Uninstall first disables the timer, then removes
+only clean managed files, units, and that exact instructions block; queue
+runtime is explicitly retained.
 
 ## Commands
 

package/lib/core.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { tmpdir } from 'node:os';
+import { createHash } from 'node:crypto';
 
 export const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -785,6 +786,24 @@ export async function doctorReport(root, options = {}) {
         preflightConfig: optionsForQueue.preflightConfig ?? null,
         status
       });
+      if (config.scheduler?.required === true && status.queued > 0) {
+        const schedulerState = await readQueueSchedulerState(root, optionsForQueue.queue);
+        const heartbeatMaxAgeMs = parseScheduleDurationMs(
+          config.scheduler.heartbeatMaxAge ?? '5m',
+          'scheduler.heartbeatMaxAge'
+        );
+        const generatedAtMs = Date.parse(schedulerState?.generatedAt ?? '');
+        const ageMs = Number.isFinite(generatedAtMs) ? Math.max(0, Date.now() - generatedAtMs) : null;
+        const healthy = ageMs !== null && ageMs <= heartbeatMaxAgeMs;
+        add(`queue:${optionsForQueue.queue}:scheduler-heartbeat`, 'fail', healthy, {
+          code: healthy ? 'scheduler_healthy' : 'scheduler_missing',
+          queued: status.queued,
+          state: path.relative(root, queueSchedulerStatePath(root, optionsForQueue.queue)),
+          generatedAt: schedulerState?.generatedAt ?? null,
+          ageMs,
+          heartbeatMaxAgeMs
+        });
+      }
       if (status.locked) add(`queue:${optionsForQueue.queue}:lock`, 'warn', false, status.lockExpiresAt);
       if (status.active > 0) add(`queue:${optionsForQueue.queue}:active`, 'warn', false, `${status.active} active task(s)`);
       if (status.failed > 0) add(`queue:${optionsForQueue.queue}:failed`, 'warn', false, `${status.failed} failed task(s)`);
@@ -924,7 +943,7 @@ export function queueSubdirFor(root, queue, subdir) {
 
 export async function ensureQueueDirs(root, queue) {
   normalizeLoopId(queue);
-  await Promise.all(['inbox', 'active', 'done', 'failed', 'runs', 'canceled', 'tasks']
+  await Promise.all(['inbox', 'active', 'waiting', 'done', 'failed', 'runs', 'canceled', 'tasks']
     .map((subdir) => mkdir(queueSubdirFor(root, queue, subdir), { recursive: true })));
 }
 
@@ -1422,14 +1441,15 @@ export async function projectStatus(root, options = {}) {
     backlog = null;
   }
   const totals = queues.reduce((acc, queue) => {
-    for (const key of ['queued', 'active', 'done', 'failed', 'canceled', 'runs']) {
+    for (const key of ['queued', 'active', 'waiting', 'done', 'failed', 'canceled', 'runs']) {
       acc[key] += queue.status[key] ?? 0;
     }
     if (queue.status.locked) acc.locked += 1;
     return acc;
-  }, { queued: 0, active: 0, done: 0, failed: 0, canceled: 0, runs: 0, locked: 0 });
+  }, { queued: 0, active: 0, waiting: 0, done: 0, failed: 0, canceled: 0, runs: 0, locked: 0 });
   const needsAttention = [];
   if (totals.failed > 0) needsAttention.push('failed_tasks_present');
+  if (totals.waiting > 0) needsAttention.push('human_input_waiting');
   if (totals.active > 0) needsAttention.push('active_tasks_present');
   if (queues.some((queue) => queue.status.locked)) needsAttention.push('queue_locked');
   return {
@@ -1780,7 +1800,7 @@ function humanInputMessage(queue, task, checkpoint, gateId) {
 
 async function tasksById(root, queue) {
   const tasks = new Map();
-  for (const subdir of ['inbox', 'active', 'done', 'failed', 'canceled']) {
+  for (const subdir of ['inbox', 'active', 'waiting', 'done', 'failed', 'canceled']) {
     for (const file of await listJson(queueSubdirFor(root, queue, subdir))) {
       const task = await readJson(path.join(queueSubdirFor(root, queue, subdir), file));
       if (task?.id) tasks.set(task.id, { task, subdir });
@@ -1810,6 +1830,19 @@ export async function notifyHumanInputRequests(root, options = {}) {
       const ledgerFile = path.join(gatesDir, `${safeTaskId(taskId)}.${normalizeLoopId(checkpointId)}.json`);
       if (await exists(ledgerFile)) {
         const gate = await readJson(ledgerFile);
+        if (gate.status === 'waiting_for_human' && entry.subdir === 'inbox') {
+          const inboxFile = path.join(queueSubdirFor(root, queue, 'inbox'), `${safeTaskId(taskId)}.json`);
+          if (await exists(inboxFile)) {
+            const waitingFile = path.join(queueSubdirFor(root, queue, 'waiting'), path.basename(inboxFile));
+            await writeJson(waitingFile, {
+              ...entry.task,
+              status: 'waiting_for_human',
+              waitingGateId: gateId,
+              waitingSince: gate.requested_at ?? new Date().toISOString()
+            });
+            await rm(inboxFile, { force: true });
+          }
+        }
         results.push({ taskId, checkpointId, gateId, outcome: gate.status === 'resolved' ? 'resolved' : 'already_notified', ledger: path.relative(root, ledgerFile) });
         continue;
       }
@@ -1847,6 +1880,19 @@ export async function notifyHumanInputRequests(root, options = {}) {
         requested_at: new Date().toISOString(),
         notification: compactCommandResult(result)
       });
+      if (entry.subdir === 'inbox') {
+        const inboxFile = path.join(queueSubdirFor(root, queue, 'inbox'), `${safeTaskId(taskId)}.json`);
+        if (await exists(inboxFile)) {
+          const waitingFile = path.join(queueSubdirFor(root, queue, 'waiting'), path.basename(inboxFile));
+          await writeJson(waitingFile, {
+            ...entry.task,
+            status: 'waiting_for_human',
+            waitingGateId: gateId,
+            waitingSince: new Date().toISOString()
+          });
+          await rm(inboxFile, { force: true });
+        }
+      }
       results.push({ taskId, checkpointId, gateId, outcome: 'sent', ledger: path.relative(root, ledgerFile) });
     }
   }
@@ -1872,37 +1918,153 @@ export async function resolveHumanInput(root, options = {}) {
   const ledgerFile = path.join(queueDirFor(root, queue), 'human-input', 'gates', `${safeTaskId(taskId)}.${checkpointId}.json`);
   if (!await exists(ledgerFile)) throw new Error(`Human-input gate not found: ${options.gateId}`);
   const gate = await readJson(ledgerFile);
-  if (gate.status === 'resolved') return { gate, outcome: 'already_resolved', ledger: path.relative(root, ledgerFile) };
+  if (['resolved', 'consumed', 'satisfied'].includes(gate.status)) return { gate, outcome: 'already_resolved', ledger: path.relative(root, ledgerFile) };
+  const receivedAt = new Date().toISOString();
+  const response = options.input.trim();
+  const secretDir = path.join(queueDirFor(root, queue), 'human-input', 'secrets');
+  const eventsDir = path.join(queueDirFor(root, queue), 'human-input', 'events');
+  await mkdir(secretDir, { recursive: true, mode: 0o700 });
+  await mkdir(eventsDir, { recursive: true });
+  const secretFile = path.join(secretDir, `${safeTaskId(taskId)}.${checkpointId}.${isoStamp()}.secret`);
+  const handle = await open(secretFile, 'wx', 0o600);
+  try {
+    await handle.writeFile(response);
+  } finally {
+    await handle.close();
+  }
+  const responseSha256 = createHash('sha256').update(response).digest('hex');
   const resolved = {
     ...gate,
     status: 'resolved',
-    response: options.input.trim(),
+    secret_received: true,
+    response_sha256: responseSha256,
+    response_ref: path.relative(root, secretFile),
     response_message_id: options.sourceMessageId ?? null,
-    resolved_at: new Date().toISOString()
+    resolved_at: receivedAt
   };
+  delete resolved.response;
   await writeJson(ledgerFile, resolved);
-  const found = await findTaskFile(root, queue, taskId, ['failed', 'canceled']);
+  const eventFile = path.join(eventsDir, `${safeTaskId(taskId)}.${checkpointId}.${isoStamp()}.json`);
+  await writeJson(eventFile, {
+    version: 1,
+    type: 'human_input_resolved',
+    gate_id: options.gateId,
+    task_id: taskId,
+    checkpoint_id: checkpointId,
+    status: 'pending_consumption',
+    secret_received: true,
+    response_sha256: responseSha256,
+    response_ref: path.relative(root, secretFile),
+    response_message_id: options.sourceMessageId ?? null,
+    created_at: receivedAt
+  });
+  const found = await findTaskFile(root, queue, taskId, ['inbox', 'active', 'waiting', 'failed', 'canceled']);
   let requeued = null;
+  let updated = null;
   if (found) {
     const task = await readJson(found.file);
-    const inboxFile = path.join(queueSubdirFor(root, queue, 'inbox'), path.basename(found.file));
-    await writeJson(inboxFile, {
+    const taskUpdate = {
       ...task,
-      status: 'queued',
-      body: `${task.body}\n\nHuman input for gate ${options.gateId}:\n${options.input.trim()}`,
       humanInput: {
         gate_id: options.gateId,
         checkpoint_id: checkpointId,
-        response: options.input.trim(),
-        received_at: resolved.resolved_at
-      },
-      requeuedAt: resolved.resolved_at,
-      requeuedFrom: found.subdir
+        secret_received: true,
+        response_sha256: responseSha256,
+        event: path.relative(root, eventFile),
+        received_at: receivedAt
+      }
+    };
+    if (['waiting', 'failed', 'canceled'].includes(found.subdir)) {
+      const inboxFile = path.join(queueSubdirFor(root, queue, 'inbox'), path.basename(found.file));
+      await writeJson(inboxFile, {
+        ...taskUpdate,
+        status: 'queued',
+        requeuedAt: receivedAt,
+        requeuedFrom: found.subdir
+      });
+      await rm(found.file, { force: true });
+      requeued = path.relative(root, inboxFile);
+    } else if (found.subdir === 'inbox') {
+      await writeJson(found.file, taskUpdate);
+      updated = path.relative(root, found.file);
+    } else {
+      // An active dispatcher cannot be mutated safely. The durable event is
+      // consumed on the next bounded tick after the active run finishes.
+      updated = path.relative(root, eventFile);
+    }
+  }
+  return {
+    gate: resolved,
+    outcome: requeued ? 'resolved_and_requeued' : found?.subdir === 'active' ? 'resolved_pending_safe_boundary' : 'resolved_for_next_tick',
+    requeued,
+    updated,
+    event: path.relative(root, eventFile)
+  };
+}
+
+async function prepareHumanInputContext(root, queue, taskId) {
+  const gatesDir = path.join(queueDirFor(root, queue), 'human-input', 'gates');
+  const runtimeDir = taskRuntimeDirFor(root, queue, taskId);
+  const contextFile = path.join(runtimeDir, 'human_input_context.json');
+  const gates = [];
+  for (const file of await listJson(gatesDir)) {
+    const full = path.join(gatesDir, file);
+    const gate = await readJson(full);
+    if (gate.task_id !== taskId || !['resolved', 'consumed'].includes(gate.status)) continue;
+    const consumedAt = gate.consumed_at ?? new Date().toISOString();
+    const consumed = gate.status === 'resolved' ? { ...gate, status: 'consumed', consumed_at: consumedAt } : gate;
+    if (gate.status === 'resolved') await writeJson(full, consumed);
+    gates.push({
+      gate_id: consumed.gate_id,
+      checkpoint_id: consumed.checkpoint_id,
+      status: consumed.status,
+      secret_received: Boolean(consumed.secret_received),
+      response_sha256: consumed.response_sha256 ?? null,
+      response_ref: consumed.response_ref ? path.join(root, consumed.response_ref) : null,
+      resolved_at: consumed.resolved_at ?? null,
+      consumed_at: consumed.consumed_at ?? null
+    });
+  }
+  await writeJson(contextFile, { version: 1, task_id: taskId, gates });
+  return contextFile;
+}
+
+async function destroyConsumedHumanInputSecrets(root, queue, taskId) {
+  const gatesDir = path.join(queueDirFor(root, queue), 'human-input', 'gates');
+  for (const file of await listJson(gatesDir)) {
+    const full = path.join(gatesDir, file);
+    const gate = await readJson(full);
+    if (gate.task_id !== taskId || gate.status !== 'consumed' || !gate.response_ref) continue;
+    await rm(path.join(root, gate.response_ref), { force: true });
+    await writeJson(full, {
+      ...gate,
+      secret_destroyed: true,
+      secret_destroyed_at: new Date().toISOString()
+    });
+  }
+}
+
+async function reconcileHumanInputGates(root, queue, taskId) {
+  const gatesDir = path.join(queueDirFor(root, queue), 'human-input', 'gates');
+  const checkpointsDir = path.join(taskRuntimeDirFor(root, queue, taskId), 'checkpoints');
+  const checkpoints = [];
+  for (const file of await listJson(checkpointsDir)) checkpoints.push(await readJson(path.join(checkpointsDir, file)));
+  for (const file of await listJson(gatesDir)) {
+    const full = path.join(gatesDir, file);
+    const gate = await readJson(full);
+    if (gate.task_id !== taskId || gate.status !== 'consumed') continue;
+    const successor = checkpoints
+      .filter((checkpoint) => checkpoint?.revises_checkpoint_id === gate.checkpoint_id)
+      .sort((a, b) => Number(b.sequence ?? 0) - Number(a.sequence ?? 0))[0];
+    if (!successor) continue;
+    await writeJson(full, {
+      ...gate,
+      status: 'satisfied',
+      satisfied_at: new Date().toISOString(),
+      satisfied_by_checkpoint_id: successor.checkpoint_id,
+      successor_status: successor.status ?? null
     });
-    await rm(found.file, { force: true });
-    requeued = path.relative(root, inboxFile);
   }
-  return { gate: resolved, outcome: requeued ? 'resolved_and_requeued' : 'resolved_pending_terminal', requeued };
 }
 
 export function taskRuntimeDirFor(root, queue, taskId) {
@@ -2033,6 +2195,10 @@ function buildTaskContract(queue, task, options = {}) {
   const inferredRisk = inferTaskRisk(task);
   const modelAssessed = task.riskAssessment === 'model_assessed';
   const riskLevel = options.riskLevel ?? (modelAssessed ? 'model_assessed' : inferredRisk.level);
+  const requestText = `${task.title ?? ''}\n${task.body ?? ''}`.toLowerCase();
+  const taskScope = /project[-_ ]level|项目级|完整项目|整体项目|single milestone|单(?:一)?里程碑/.test(requestText)
+    ? 'project'
+    : 'scoped_task';
   return {
     version: 1,
     task_id: task.id,
@@ -2040,6 +2206,7 @@ function buildTaskContract(queue, task, options = {}) {
     title: task.title,
     original_request: task.body,
     goal: task.body,
+    task_scope: taskScope,
     deliverables: [
       'Structured run artifact',
       'Concise completion summary',
@@ -2378,11 +2545,15 @@ function buildDevPlan(contract, acceptancePlan) {
       version: 1,
       task_id: contract.task_id,
       checkpoint_id: firstCheckpointId,
+      milestone_id: firstCheckpointId,
+      revises_checkpoint_id: null,
       status: 'ready_for_acceptance | blocked | needs_human_input',
       summary: 'What changed and why.',
       files_changed: [],
       verification: [],
       blockers: [],
+      deferred_gates: [],
+      project_completion: null,
       risks: [],
       next_action: 'acceptance_review'
     },
@@ -2671,6 +2842,11 @@ export async function writeAcceptanceReviews(root, queue, task, taskContract, ac
     await writeJson(reviewFile, review);
     reviews.push({
       checkpointId: review.checkpoint_id,
+      milestoneId: checkpoint.milestone_id ?? null,
+      revisesCheckpointId: checkpoint.revises_checkpoint_id ?? null,
+      sequence: Number(checkpoint.sequence ?? String(checkpoint.checkpoint_id ?? '').match(/(\d+)$/)?.[1] ?? 0),
+      createdAt: checkpoint.created_at ?? review.created_at,
+      projectCompletion: checkpoint.project_completion ?? null,
       status: review.status,
       file: path.relative(root, reviewFile)
     });
@@ -2688,16 +2864,55 @@ export async function writeAcceptanceReviews(root, queue, task, taskContract, ac
   };
 }
 
-function buildFinalJudgement(contract, acceptancePlan, devPlan, checkpoints, acceptanceReviews, context = {}) {
+function compareReviewSequence(a, b) {
+  const sequenceDelta = Number(a.sequence ?? 0) - Number(b.sequence ?? 0);
+  if (sequenceDelta !== 0) return sequenceDelta;
+  return String(a.createdAt ?? '').localeCompare(String(b.createdAt ?? ''));
+}
+
+function compareReviewRecency(a, b) {
+  const createdDelta = String(a.createdAt ?? '').localeCompare(String(b.createdAt ?? ''));
+  if (createdDelta !== 0 && a.createdAt && b.createdAt) return createdDelta;
+  const aCheckpoint = Number(String(a.checkpointId ?? '').match(/(\d+)$/)?.[1] ?? 0);
+  const bCheckpoint = Number(String(b.checkpointId ?? '').match(/(\d+)$/)?.[1] ?? 0);
+  if (aCheckpoint !== bCheckpoint) return aCheckpoint - bCheckpoint;
+  return compareReviewSequence(a, b);
+}
+
+export function selectEffectiveAcceptanceReviews(devPlan, acceptanceReviews) {
+  const allReviews = acceptanceReviews?.reviews ?? [];
+  const planned = Array.isArray(devPlan?.checkpoints) ? devPlan.checkpoints : [];
+  if (planned.length <= 1) {
+    return [...allReviews].sort(compareReviewRecency).slice(-1);
+  }
+  const selected = [];
+  for (const checkpoint of planned) {
+    const milestoneId = checkpoint.id;
+    const candidates = allReviews.filter((review) =>
+      review.milestoneId === milestoneId || review.checkpointId === milestoneId
+    );
+    if (candidates.length === 0) continue;
+    selected.push([...candidates].sort(compareReviewSequence).at(-1));
+  }
+  return selected;
+}
+
+export function buildFinalJudgement(contract, acceptancePlan, devPlan, checkpoints, acceptanceReviews, context = {}) {
   const reasons = [];
   const nextActions = [];
   const requiredCheckpoints = Array.isArray(devPlan?.checkpoints) ? devPlan.checkpoints.length : 0;
   const checkpointCount = checkpoints?.count ?? 0;
-  const reviewCount = acceptanceReviews?.count ?? 0;
-  const acceptedCount = acceptanceReviews?.accepted ?? 0;
-  const reviseCount = acceptanceReviews?.revise ?? 0;
-  const blockedCount = acceptanceReviews?.blocked ?? 0;
+  const allReviews = acceptanceReviews?.reviews ?? [];
+  // Checkpoints produced after the planned set are revision/progress snapshots,
+  // not additional required milestones. Judge the latest complete set so a
+  // resolved historical blocker does not permanently poison the task.
+  const effectiveReviews = selectEffectiveAcceptanceReviews(devPlan, acceptanceReviews);
+  const reviewCount = effectiveReviews.length;
+  const acceptedCount = effectiveReviews.filter((item) => item.status === 'accepted').length;
+  const reviseCount = effectiveReviews.filter((item) => item.status === 'revise').length;
+  const blockedCount = effectiveReviews.filter((item) => item.status === 'blocked').length;
   const dispatchStatus = context.dispatchStatus ?? 'unknown';
+  const projectCompletionAccepted = effectiveReviews.some((review) => review.projectCompletion?.status === 'accepted');
   let outcome = 'needs_revision';
 
   if (dispatchStatus === 'blocked_preflight') {
@@ -2740,6 +2955,10 @@ function buildFinalJudgement(contract, acceptancePlan, devPlan, checkpoints, acc
     outcome = 'needs_revision';
     reasons.push(`Accepted checkpoints (${acceptedCount}) do not cover required checkpoints (${Math.max(requiredCheckpoints, 1)}).`);
     nextActions.push('Complete and review the remaining planned checkpoints.');
+  } else if (contract.task_scope === 'project' && !projectCompletionAccepted) {
+    outcome = 'project_in_progress';
+    reasons.push('The latest milestone is accepted, but the project terminal contract is not accepted.');
+    nextActions.push('Continue with the next safe actionable project backlog item.');
   } else if (contract.requires_human_gate) {
     outcome = 'ready_for_human_review';
     reasons.push('All reviewed checkpoints are accepted, and the task contract requires a human gate.');
@@ -2771,6 +2990,8 @@ function buildFinalJudgement(contract, acceptancePlan, devPlan, checkpoints, acc
       planned_checkpoints: requiredCheckpoints,
       produced_checkpoints: checkpointCount,
       reviews: reviewCount,
+      historical_reviews: allReviews.length,
+      effective_review_ids: effectiveReviews.map((review) => review.checkpointId),
       accepted: acceptedCount,
       revise: reviseCount,
       blocked: blockedCount,
@@ -2809,6 +3030,7 @@ function queueStatusFromFinalJudgement(currentStatus, finalJudgement) {
   if (currentStatus !== 'completed') return currentStatus;
   const outcome = finalJudgement.judgement.outcome;
   if (outcome === 'ready_to_apply') return currentStatus;
+  if (outcome === 'project_in_progress') return outcome;
   if (outcome === 'ready_for_human_review') return outcome;
   return outcome;
 }
@@ -2945,6 +3167,7 @@ export async function queueStatus(root, queue) {
     queue,
     queued: (await listJson(queueSubdirFor(root, queue, 'inbox'))).length,
     active: activeFiles.length,
+    waiting: (await listJson(queueSubdirFor(root, queue, 'waiting'))).length,
     done: (await listJson(queueSubdirFor(root, queue, 'done'))).length,
     failed: (await listJson(queueSubdirFor(root, queue, 'failed'))).length,
     canceled: (await listJson(queueSubdirFor(root, queue, 'canceled'))).length,
@@ -3561,7 +3784,7 @@ async function nextQueuedTaskFile(root, queue) {
   return path.join(queueSubdirFor(root, queue, 'inbox'), files[0]);
 }
 
-async function findTaskFile(root, queue, taskId, subdirs = ['inbox', 'active', 'failed', 'done', 'canceled']) {
+async function findTaskFile(root, queue, taskId, subdirs = ['inbox', 'active', 'waiting', 'failed', 'done', 'canceled']) {
   const wanted = taskId.endsWith('.json') ? taskId : `${taskId}.json`;
   for (const subdir of subdirs) {
     const file = path.join(queueSubdirFor(root, queue, subdir), wanted);
@@ -4528,7 +4751,7 @@ export async function queueRevisionReview(root, queue, options = {}) {
   };
 }
 
-const TASK_STATE_DIRS = ['inbox', 'active', 'failed', 'done', 'canceled'];
+const TASK_STATE_DIRS = ['inbox', 'active', 'waiting', 'failed', 'done', 'canceled'];
 
 async function listQueueTasks(root, queue) {
   const tasks = [];
@@ -7523,6 +7746,37 @@ async function recoverStaleActive(root, queue, staleActiveMs) {
   return recovered;
 }
 
+async function recoverOrphanActive(root, queue) {
+  const activeDir = queueSubdirFor(root, queue, 'active');
+  const inboxDir = queueSubdirFor(root, queue, 'inbox');
+  const files = await listJson(activeDir);
+  const recovered = [];
+  for (const file of files) {
+    const activeFile = path.join(activeDir, file);
+    const task = await readJson(activeFile);
+    const recoveredAt = new Date().toISOString();
+    const inboxFile = path.join(inboxDir, file);
+    // Move first so a crash cannot leave duplicate active/inbox copies.
+    await rename(activeFile, inboxFile);
+    await writeJson(inboxFile, {
+      ...task,
+      status: 'queued',
+      orphanRecoveredAt: recoveredAt,
+      orphanRecoveryCount: (task.orphanRecoveryCount ?? 0) + 1,
+      requeuedAt: recoveredAt,
+      requeuedFrom: 'active',
+      recoveryReason: 'queue_lock_reacquired_with_active_task'
+    });
+    recovered.push({
+      taskId: task.id,
+      from: path.relative(root, activeFile),
+      file: path.relative(root, inboxFile),
+      recoveredAt
+    });
+  }
+  return recovered;
+}
+
 function compactCommandResult(result) {
   return {
     exitCode: result.exitCode,
@@ -7885,6 +8139,18 @@ export async function runQueueOnce(root, options) {
   }
 
   try {
+    // Holding this newly acquired lock proves no previous runner owns a valid
+    // queue lease. Any task left in active/ is therefore an orphan from an
+    // interrupted parent runner. Requeue it immediately so existing
+    // checkpoints can be reviewed and execution can resume in this tick.
+    const orphanRecovered = await recoverOrphanActive(root, queue);
+    if (orphanRecovered.length > 0) {
+      progress.emit('queue', 'orphan_recovered', `Recovered ${orphanRecovered.length} orphan active task(s)`, {
+        queue,
+        count: orphanRecovered.length,
+        tasks: orphanRecovered.map((entry) => entry.taskId)
+      });
+    }
     const staleRecovered = await recoverStaleActive(root, queue, options.staleActiveMs);
     if (staleRecovered.length > 0) {
       progress.emit('queue', 'recovered', `Recovered ${staleRecovered.length} stale active task(s)`, {
@@ -7903,6 +8169,7 @@ export async function runQueueOnce(root, options) {
         status: 'empty',
         exitCode: 0,
         staleRecovered,
+        orphanRecovered,
         progress: progress.events
       };
     }
@@ -7993,8 +8260,13 @@ export async function runQueueOnce(root, options) {
         finalStatus = 'blocked_preflight';
         exitCode = 2;
       } else {
+        const humanInputContextFile = await prepareHumanInputContext(root, queue, task.id);
         const runContext = {
-          env: taskPlanningEnv(root, taskContract, acceptancePlan, devPlan),
+          env: {
+            ...taskPlanningEnv(root, taskContract, acceptancePlan, devPlan),
+            LOOP_HUMAN_INPUT_CONTEXT_FILE: humanInputContextFile,
+            LOOP_HUMAN_INPUT_CONTEXT_FILE_REL: path.relative(root, humanInputContextFile)
+          },
           progress
         };
         if (finalStatus === 'unknown' && worktreeEnabled(options)) {
@@ -8031,6 +8303,7 @@ export async function runQueueOnce(root, options) {
         if (finalStatus === 'unknown') {
           dispatchAttempts = await runDispatchWithRetry(root, options, queue, task, activeFile, runId, timeoutMs, runContext);
           dispatch = dispatchAttempts[dispatchAttempts.length - 1]?.result ?? null;
+          await destroyConsumedHumanInputSecrets(root, queue, task.id);
           const dispatchClassification = dispatchAttempts[dispatchAttempts.length - 1]?.failureClassification ?? null;
           if (dispatch?.canceled) {
             finalStatus = 'superseded';
@@ -8053,6 +8326,7 @@ export async function runQueueOnce(root, options) {
         }
       }
       checkpoints = await checkpointSummary(root, devPlan);
+      await reconcileHumanInputGates(root, queue, task.id);
       progress.emit('acceptance', 'checkpoint_summary', `Collected ${checkpoints.count} checkpoint(s)`, {
         taskId: task.id,
         count: checkpoints.count,
@@ -8131,26 +8405,32 @@ export async function runQueueOnce(root, options) {
       revisionRequest = await writeRevisionRequest(root, queue, task, taskContract, acceptancePlan, devPlan, finalJudgement, acceptanceReviews);
     }
 
-    destination = finalStatus === 'completed'
+    destination = finalStatus === 'project_in_progress'
+      ? queueSubdirFor(root, queue, 'inbox')
+      : finalStatus === 'completed'
       ? queueSubdirFor(root, queue, 'done')
       : finalStatus === 'superseded' ? queueSubdirFor(root, queue, 'canceled')
       : queueSubdirFor(root, queue, 'failed');
-    exitCode = ['completed', 'superseded'].includes(finalStatus) ? 0 : 1;
+    exitCode = ['completed', 'superseded', 'project_in_progress'].includes(finalStatus) ? 0 : 1;
 
     const finishedAt = new Date().toISOString();
-    progress.emit('queue', finalStatus === 'completed' ? 'completed' : 'needs_attention', `Task finished with status ${finalStatus}`, {
+    progress.emit('queue', finalStatus === 'completed' ? 'completed' : finalStatus === 'project_in_progress' ? 'continued' : 'needs_attention', `Task finished with status ${finalStatus}`, {
       queue,
       taskId: task.id,
       status: finalStatus
     });
     const completedTask = {
       ...task,
-      status: finalStatus,
+      status: finalStatus === 'project_in_progress' ? 'queued' : finalStatus,
       startedAt,
       finishedAt,
       attempts: (task.attempts ?? 0) + Math.max(dispatchAttempts.length, dispatch ? 1 : 0),
       runPath: path.relative(root, runPath)
     };
+    if (finalStatus === 'project_in_progress') {
+      completedTask.projectContinuedAt = finishedAt;
+      completedTask.projectContinuationCount = (task.projectContinuationCount ?? 0) + 1;
+    }
     const completedFile = path.join(destination, path.basename(activeFile));
     await writeJson(completedFile, completedTask);
     await rm(activeFile, { force: true });
@@ -8224,6 +8504,7 @@ export async function runQueueOnce(root, options) {
       } : null,
       verification,
       staleRecovered,
+      orphanRecovered,
       progress: progress.events,
       taskPath: path.relative(root, completedFile),
       runPath: path.relative(root, runPath)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskforce-loop-engineering",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "private": false,
   "description": "OpenClaw-native loop engineering CLI, templates, and skill for verifiable agent work loops.",
   "type": "module",
@@ -16,7 +16,7 @@
   "scripts": {
     "check:config-drift": "node --check scripts/config-drift-self-test.mjs && node scripts/config-drift-self-test.mjs",
     "check:openclaw-install": "node --check scripts/openclaw-install.mjs && node --check scripts/openclaw-doctor.mjs && node --check scripts/openclaw-smoke.mjs && node --check scripts/openclaw-manage.mjs && node scripts/openclaw-install-self-test.mjs",
-    "check": "npm run check:config-drift && npm run check:openclaw-install && node --check bin/loop-engineering.mjs && node --check lib/core.mjs && node scripts/route-notify-self-test.mjs && node bin/loop-engineering.mjs verify --config templates/workspace-health.json --root . && node bin/loop-engineering.mjs queue-status --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs project-intake --root /tmp/loop-engineering-check --name smoke-project --brief \"Build a small website project\" --type auto --check \"npm test\" --json >/dev/null && node bin/loop-engineering.mjs project-plan --root /tmp/loop-engineering-check --project smoke-project --force --json >/dev/null && node bin/loop-engineering.mjs project-status --root /tmp/loop-engineering-check --project smoke-project --json >/dev/null && node bin/loop-engineering.mjs queue-scheduler-tick --queue smoke --root /tmp/loop-engineering-check --plan-only --force-due --json >/dev/null && node bin/loop-engineering.mjs queue-scheduler-tick --queue smoke-progress --root /tmp/loop-engineering-check --plan-only --force-due --progress-report --progress-report-when-not-due --json >/dev/null && node bin/loop-engineering.mjs workflow-metrics --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs workflow-tune-plan --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs code-queue-init --queue smoke-code --root /tmp/loop-engineering-check --force >/dev/null && node bin/loop-engineering.mjs code-worktree-list --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-task-status --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-task-dashboard --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-worktree-cleanup-plan --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-worktree-cleanup --queue smoke-code --root /tmp/loop-engineering-check --confirm-cleanup --json >/dev/null && node bin/loop-engineering.mjs code-patch-verify --patch README.md --root . --json >/dev/null && node bin/loop-engineering.mjs code-patch-apply-plan --patch README.md --root . --json >/dev/null && node bin/loop-engineering.mjs queue-revision-ci-self-test --queue smoke-ci --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs summarize --root . --json >/dev/null && node bin/loop-engineering.mjs doctor --root . --json >/dev/null",
+    "check": "npm run check:config-drift && npm run check:openclaw-install && node --check bin/loop-engineering.mjs && node --check lib/core.mjs && node scripts/final-judgement-self-test.mjs && node scripts/route-notify-self-test.mjs && node scripts/scheduler-heartbeat-self-test.mjs && node bin/loop-engineering.mjs verify --config templates/workspace-health.json --root . && node bin/loop-engineering.mjs queue-status --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs project-intake --root /tmp/loop-engineering-check --name smoke-project --brief \"Build a small website project\" --type auto --check \"npm test\" --json >/dev/null && node bin/loop-engineering.mjs project-plan --root /tmp/loop-engineering-check --project smoke-project --force --json >/dev/null && node bin/loop-engineering.mjs project-status --root /tmp/loop-engineering-check --project smoke-project --json >/dev/null && node bin/loop-engineering.mjs queue-scheduler-tick --queue smoke --root /tmp/loop-engineering-check --plan-only --force-due --json >/dev/null && node bin/loop-engineering.mjs queue-scheduler-tick --queue smoke-progress --root /tmp/loop-engineering-check --plan-only --force-due --progress-report --progress-report-when-not-due --json >/dev/null && node bin/loop-engineering.mjs workflow-metrics --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs workflow-tune-plan --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs code-queue-init --queue smoke-code --root /tmp/loop-engineering-check --force >/dev/null && node bin/loop-engineering.mjs code-worktree-list --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-task-status --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-task-dashboard --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-worktree-cleanup-plan --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-worktree-cleanup --queue smoke-code --root /tmp/loop-engineering-check --confirm-cleanup --json >/dev/null && node bin/loop-engineering.mjs code-patch-verify --patch README.md --root . --json >/dev/null && node bin/loop-engineering.mjs code-patch-apply-plan --patch README.md --json >/dev/null && node bin/loop-engineering.mjs queue-revision-ci-self-test --queue smoke-ci --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs summarize --root . --json >/dev/null && node bin/loop-engineering.mjs doctor --root . --json >/dev/null",
     "pack:dry": "npm pack --dry-run"
   },
   "engines": {

package/scripts/final-judgement-self-test.mjs

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import { buildFinalJudgement, selectEffectiveAcceptanceReviews } from '../lib/core.mjs';
+
+const basePlan = { rubric: [], automation: [] };
+const baseContract = { task_id: 't1', risk_level: 'L1', requires_human_gate: false, task_scope: 'scoped_task' };
+
+{
+  const devPlan = { checkpoints: [{ id: 'cp1' }] };
+  const reviews = {
+    reviews: [
+      { checkpointId: 'cp1', sequence: 1, status: 'blocked' },
+      { checkpointId: 'cp2', sequence: 2, status: 'accepted' },
+      { checkpointId: 'cp10', sequence: 10, status: 'accepted' }
+    ]
+  };
+  assert.equal(selectEffectiveAcceptanceReviews(devPlan, reviews)[0].checkpointId, 'cp10');
+}
+
+{
+  const devPlan = { checkpoints: [{ id: 'cp1' }] };
+  const reviews = {
+    reviews: [
+      { checkpointId: 'cp5', milestoneId: 'G-01-retry', sequence: 5, createdAt: '2026-08-07T04:00:00.000Z', status: 'accepted' },
+      { checkpointId: 'cp14', milestoneId: 'G-01-auth', sequence: 3, createdAt: '2026-08-07T12:00:00.000Z', status: 'blocked' }
+    ]
+  };
+  assert.equal(selectEffectiveAcceptanceReviews(devPlan, reviews)[0].checkpointId, 'cp14');
+}
+
+{
+  const devPlan = { checkpoints: [{ id: 'design' }, { id: 'verify' }] };
+  const reviews = {
+    reviews: [
+      { checkpointId: 'design', milestoneId: 'design', sequence: 1, status: 'accepted' },
+      { checkpointId: 'verify-v1', milestoneId: 'verify', sequence: 2, status: 'blocked' },
+      { checkpointId: 'verify-v2', milestoneId: 'verify', sequence: 3, status: 'accepted' }
+    ]
+  };
+  assert.deepEqual(selectEffectiveAcceptanceReviews(devPlan, reviews).map((review) => review.checkpointId), ['design', 'verify-v2']);
+}
+
+{
+  const devPlan = { checkpoints: [{ id: 'cp1' }] };
+  const reviews = { reviews: [{ checkpointId: 'cp5', sequence: 5, status: 'accepted', projectCompletion: { status: 'in_progress' } }] };
+  const judgement = buildFinalJudgement(
+    { ...baseContract, task_scope: 'project' },
+    basePlan,
+    devPlan,
+    { count: 5 },
+    reviews,
+    { dispatchStatus: 'completed' }
+  );
+  assert.equal(judgement.outcome, 'project_in_progress');
+}
+
+{
+  const devPlan = { checkpoints: [{ id: 'cp1' }] };
+  const reviews = { reviews: [{ checkpointId: 'cp6', sequence: 6, status: 'accepted', projectCompletion: { status: 'accepted' } }] };
+  const judgement = buildFinalJudgement(
+    { ...baseContract, task_scope: 'project' },
+    basePlan,
+    devPlan,
+    { count: 6 },
+    reviews,
+    { dispatchStatus: 'completed' }
+  );
+  assert.equal(judgement.outcome, 'ready_to_apply');
+}
+
+console.log('final judgement self-test passed');

package/scripts/openclaw-install-self-test.mjs

@@ -7,6 +7,10 @@ import path from 'node:path';
 const root = await mkdtemp(path.join(tmpdir(), 'loop-openclaw-install-'));
 const deliveryCapture = path.join(root, 'delivery.json');
 const mockOpenClaw = path.join(root, 'mock-openclaw.mjs');
+const mockSystemctl = path.join(root, 'mock-systemctl.mjs');
+const systemctlCapture = path.join(root, 'systemctl-calls.jsonl');
+process.env.XDG_CONFIG_HOME = path.join(root, 'xdg');
+process.env.SYSTEMCTL_CAPTURE = systemctlCapture;
 await writeFile(mockOpenClaw, `#!/usr/bin/env node
 import { mkdir, writeFile } from 'node:fs/promises';
 import path from 'node:path';
@@ -24,6 +28,11 @@ else {
 }
 `);
 await chmod(mockOpenClaw, 0o755);
+await writeFile(mockSystemctl, `#!/usr/bin/env node
+import { appendFile } from 'node:fs/promises';
+if (process.env.SYSTEMCTL_CAPTURE) await appendFile(process.env.SYSTEMCTL_CAPTURE, JSON.stringify(process.argv.slice(2)) + '\\n');
+`);
+await chmod(mockSystemctl, 0o755);
 const installer = new URL('./openclaw-install.mjs', import.meta.url).pathname;
 function run(args) {
   return new Promise((resolve) => {
@@ -34,21 +43,38 @@ function run(args) {
     child.on('close', (code) => resolve({ code, stdout, stderr }));
   });
 }
-const plan = await run(['--root', root, '--queue', 'test-tasks', '--openclaw-bin', mockOpenClaw, '--json']);
+const installBase = ['--root', root, '--queue', 'test-tasks', '--openclaw-bin', mockOpenClaw, '--systemctl-bin', mockSystemctl];
+const plan = await run([...installBase, '--json']);
 const planReport = JSON.parse(plan.stdout);
 if (plan.code !== 0 || planReport.status !== 'plan_only' || planReport.workerAgent !== 'builder' || planReport.workerSelection !== 'only_available' || !planReport.workerValidated || planReport.createsWorkerAgent) throw new Error(`plan failed: ${plan.stderr}`);
-const missingWorker = await run(['--root', root, '--queue', 'test-tasks', '--worker-agent', 'missing', '--openclaw-bin', mockOpenClaw, '--json']);
+const missingWorker = await run([...installBase, '--worker-agent', 'missing', '--json']);
 if (missingWorker.code === 0 || !missingWorker.stderr.includes('does not exist')) throw new Error('installer accepted a missing worker agent');
-const install = await run(['--root', root, '--queue', 'test-tasks', '--worker-agent', 'builder', '--openclaw-bin', mockOpenClaw, '--confirm-install', '--json']);
+const install = await run([...installBase, '--worker-agent', 'builder', '--confirm-install', '--json']);
 if (install.code !== 0 || JSON.parse(install.stdout).status !== 'installed') throw new Error(`install failed: ${install.stderr}`);
 const queue = JSON.parse(await readFile(path.join(root, 'configs/loops/queues/test-tasks.json'), 'utf8'));
 if (queue.dispatcher !== 'node scripts/loops/openclaw-loop-dispatch.mjs') throw new Error('dispatcher was not installed');
+if (queue.scheduler?.required !== true || queue.scheduler?.heartbeatMaxAgeMs !== 300000) throw new Error('required scheduler heartbeat was not installed');
 const dispatcher = await readFile(path.join(root, 'scripts/loops/openclaw-loop-dispatch.mjs'), 'utf8');
 if (!dispatcher.includes('already loop-managed') || !dispatcher.includes("'--agent', \"builder\"") || !dispatcher.includes('LOOP_LATEST_AMENDMENT_FILE')) throw new Error('worker, recursion guard, or amendment polling missing');
 const instructions = await readFile(path.join(root, 'AGENTS.md'), 'utf8');
 if (!instructions.includes('走 loop') || !instructions.includes('immediately execute')) throw new Error('conversation instructions missing');
 const wrapper = await readFile(path.join(root, 'scripts/loops/openclaw-loop.mjs'), 'utf8');
-if (!wrapper.includes('--supersede-active') || !wrapper.includes('--amend-active') || !wrapper.includes('--progress-notify-command') || !wrapper.includes('runWhenUnlocked') || wrapper.includes("run-queue-drain', '--config'") || !wrapper.includes('queue-human-input-notify') || !wrapper.includes('queue-terminal-notify') || !wrapper.includes('只入队')) throw new Error('supersede/amend routing, live progress, async notification, or queue-only routing missing');
+if (!wrapper.includes('--supersede-active') || !wrapper.includes('--amend-active') || !wrapper.includes('--progress-notify-command') || !wrapper.includes('runWhenUnlocked') || wrapper.includes("run-queue-drain', '--config'") || wrapper.includes("spawn('loop-engineering'") || !wrapper.includes('queue-human-input-notify') || !wrapper.includes('queue-terminal-notify') || !wrapper.includes('queue-scheduler-tick') || !wrapper.includes('只入队')) throw new Error('supersede/amend routing, absolute CLI, scheduler, live progress, async notification, or queue-only routing missing');
+const serviceFile = path.join(process.env.XDG_CONFIG_HOME, 'systemd/user/openclaw-loop-test-tasks-scheduler.service');
+const timerFile = path.join(process.env.XDG_CONFIG_HOME, 'systemd/user/openclaw-loop-test-tasks-scheduler.timer');
+const service = await readFile(serviceFile, 'utf8');
+const timer = await readFile(timerFile, 'utf8');
+if (!service.includes('scheduler-tick') || !timer.includes('OnUnitActiveSec=1min')) throw new Error('scheduler systemd units were not installed');
+const installSystemctlCalls = await readFile(systemctlCapture, 'utf8');
+if (!installSystemctlCalls.includes('["--user","enable","--now","openclaw-loop-test-tasks-scheduler.timer"]')) throw new Error('scheduler timer was not enabled');
+const schedulerTick = await new Promise((resolve) => {
+  const child = spawn(process.execPath, [path.join(root, 'scripts/loops/openclaw-loop.mjs'), 'scheduler-tick', '--force-due', '--plan-only'], { cwd: root, stdio: ['ignore', 'pipe', 'pipe'] });
+  let stdout = ''; let stderr = ''; child.stdout.on('data', (chunk) => { stdout += chunk; }); child.stderr.on('data', (chunk) => { stderr += chunk; });
+  child.on('close', (code) => resolve({ code, stdout, stderr }));
+});
+if (schedulerTick.code !== 0) throw new Error(`installed scheduler tick failed: ${schedulerTick.stderr || schedulerTick.stdout}`);
+const schedulerState = JSON.parse(await readFile(path.join(root, 'runtime/loops/test-tasks/scheduler/state.json'), 'utf8'));
+if (!schedulerState.generatedAt || !schedulerState.nextRunAt) throw new Error('installed scheduler tick did not persist its heartbeat and cadence');
 const notifier = await readFile(path.join(root, 'scripts/loops/openclaw-loop-notify.mjs'), 'utf8');
 if (!notifier.includes("'message', 'send'") || !notifier.includes('source.channel') || !notifier.includes('source.target')) throw new Error('channel-neutral notifier missing');
 const delivery = await new Promise((resolve) => {
@@ -100,7 +126,7 @@ for (const generated of ['scripts/loops/openclaw-loop-dispatch.mjs', 'scripts/lo
   });
   if (check.code !== 0) throw new Error(`generated script syntax failed: ${generated}: ${check.stderr}`);
 }
-const conflict = await run(['--root', root, '--queue', 'test-tasks', '--worker-agent', 'builder', '--openclaw-bin', mockOpenClaw, '--confirm-install', '--json']);
+const conflict = await run([...installBase, '--worker-agent', 'builder', '--confirm-install', '--json']);
 if (conflict.code === 0) throw new Error('installer overwrote existing files without --force');
 const manager = new URL('./openclaw-manage.mjs', import.meta.url).pathname;
 async function manage(args) {
@@ -126,4 +152,7 @@ const uninstall = await manage(['--action', 'uninstall', '--confirm-uninstall'])
 if (uninstall.code !== 0 || JSON.parse(uninstall.stdout).status !== 'uninstalled') throw new Error(`uninstall failed: ${uninstall.stderr}`);
 if (!await readFile(path.join(root, 'runtime/loops/test-tasks/state.json'), 'utf8').catch(() => 'retained')) throw new Error('unexpected runtime cleanup result');
 if (await readFile(path.join(root, 'scripts/loops/openclaw-loop.mjs'), 'utf8').then(() => true).catch(() => false)) throw new Error('managed wrapper survived uninstall');
+if (await readFile(serviceFile, 'utf8').then(() => true).catch(() => false) || await readFile(timerFile, 'utf8').then(() => true).catch(() => false)) throw new Error('managed scheduler units survived uninstall');
+const finalSystemctlCalls = await readFile(systemctlCapture, 'utf8');
+if (!finalSystemctlCalls.includes('["--user","disable","--now","openclaw-loop-test-tasks-scheduler.timer"]')) throw new Error('scheduler timer was not disabled during uninstall');
 console.log('openclaw installer self-test passed');

package/scripts/openclaw-install.mjs

@@ -5,13 +5,14 @@ import { spawn } from 'node:child_process';
 import path from 'node:path';
 
 function parseArgs(argv) {
-  const out = { root: process.cwd(), queue: 'agent-tasks', workerAgent: null, openclawBin: 'openclaw', json: false, confirmInstall: false, force: false };
+  const out = { root: process.cwd(), queue: 'agent-tasks', workerAgent: null, openclawBin: 'openclaw', systemctlBin: 'systemctl', json: false, confirmInstall: false, force: false };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === '--root') out.root = path.resolve(argv[++i]);
     else if (arg === '--queue') out.queue = argv[++i];
     else if (arg === '--worker-agent') out.workerAgent = argv[++i];
     else if (arg === '--openclaw-bin') out.openclawBin = argv[++i];
+    else if (arg === '--systemctl-bin') out.systemctlBin = argv[++i];
     else if (arg === '--confirm-install') out.confirmInstall = true;
     else if (arg === '--force') out.force = true;
     else if (arg === '--json') out.json = true;
@@ -21,6 +22,10 @@ function parseArgs(argv) {
   return out;
 }
 
+function systemdEscape(value) {
+  return String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
 function safeId(value, label) {
   if (!/^[a-zA-Z0-9._-]+$/.test(value)) throw new Error(`${label} contains unsupported characters.`);
   return value;
@@ -86,13 +91,13 @@ child.on('close', (code, signal) => { process.exitCode = code ?? (signal ? 128 :
 `;
 }
 
-function wrapperSource({ queue }) {
+function wrapperSource({ queue, loopBin }) {
   return `#!/usr/bin/env node
 import { spawn } from 'node:child_process';
 const [command, ...rest] = process.argv.slice(2);
 function run(args) {
   return new Promise((resolve) => {
-    const child = spawn('loop-engineering', args, { cwd: process.cwd(), env: process.env, stdio: 'inherit' });
+    const child = spawn(process.execPath, [${JSON.stringify(loopBin)}, ...args], { cwd: process.cwd(), env: process.env, stdio: 'inherit' });
     child.on('close', (code, signal) => resolve(code ?? (signal ? 128 : 1)));
   });
 }
@@ -121,6 +126,11 @@ if (command === 'route') {
   const humanNotifyCode = await run(['queue-human-input-notify', '--queue', ${JSON.stringify(queue)}, '--notify-command', 'node scripts/loops/openclaw-loop-notify.mjs']);
   const terminalNotifyCode = await run(['queue-terminal-notify', '--queue', ${JSON.stringify(queue)}, '--notify-command', 'node scripts/loops/openclaw-loop-notify.mjs']);
   process.exitCode = runCode || humanNotifyCode || terminalNotifyCode;
+} else if (command === 'scheduler-tick') {
+  const tickCode = await run(['queue-scheduler-tick', '--config', ${JSON.stringify(`configs/loops/queues/${queue}.json`)}, '--progress-notify-command', 'node scripts/loops/openclaw-loop-notify.mjs', ...rest]);
+  const humanNotifyCode = await run(['queue-human-input-notify', '--queue', ${JSON.stringify(queue)}, '--notify-command', 'node scripts/loops/openclaw-loop-notify.mjs']);
+  const terminalNotifyCode = await run(['queue-terminal-notify', '--queue', ${JSON.stringify(queue)}, '--notify-command', 'node scripts/loops/openclaw-loop-notify.mjs']);
+  process.exitCode = tickCode || humanNotifyCode || terminalNotifyCode;
 } else {
   console.error('Usage: node scripts/loops/openclaw-loop.mjs route --message "走 loop：任务" [source metadata]');
   process.exitCode = 1;
@@ -128,6 +138,14 @@ if (command === 'route') {
 `;
 }
 
+function schedulerServiceSource({ root, queue }) {
+  return `[Unit]\nDescription=Taskforce Loop Engineering scheduler for ${queue}\nAfter=default.target\n\n[Service]\nType=oneshot\nWorkingDirectory="${systemdEscape(root)}"\nExecStart="${systemdEscape(process.execPath)}" "${systemdEscape(path.join(root, 'scripts', 'loops', 'openclaw-loop.mjs'))}" scheduler-tick --json\n`;
+}
+
+function schedulerTimerSource({ queue }) {
+  return `[Unit]\nDescription=Wake Taskforce Loop Engineering scheduler for ${queue}\n\n[Timer]\nOnBootSec=30s\nOnUnitActiveSec=1min\nAccuracySec=10s\nPersistent=true\nUnit=openclaw-loop-${queue}-scheduler.service\n\n[Install]\nWantedBy=timers.target\n`;
+}
+
 function notifierSource({ openclawBin }) {
   return `#!/usr/bin/env node
 import { spawn } from 'node:child_process';
@@ -164,13 +182,17 @@ function instructionsBlock({ queue }) {
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (args.help) {
-    console.log('Usage: loop-engineering-openclaw-install [--root workspace] [--queue agent-tasks] [--worker-agent agent-id] [--openclaw-bin openclaw] [--confirm-install] [--force] [--json]');
+    console.log('Usage: loop-engineering-openclaw-install [--root workspace] [--queue agent-tasks] [--worker-agent agent-id] [--openclaw-bin openclaw] [--systemctl-bin systemctl] [--confirm-install] [--force] [--json]');
     return;
   }
   safeId(args.queue, 'queue');
   if (args.workerAgent) safeId(args.workerAgent, 'worker agent');
   const worker = await resolveWorkerAgent(args);
   args.workerAgent = worker.workerAgent;
+  args.loopBin = new URL('../bin/loop-engineering.mjs', import.meta.url).pathname;
+  const systemdUserDir = path.join(process.env.XDG_CONFIG_HOME || path.join(process.env.HOME || '', '.config'), 'systemd', 'user');
+  const schedulerUnit = `openclaw-loop-${args.queue}-scheduler.service`;
+  const schedulerTimer = `openclaw-loop-${args.queue}-scheduler.timer`;
   const files = {
     workspaceHealth: path.join(args.root, 'configs', 'loops', 'workspace-health.json'),
     queueConfig: path.join(args.root, 'configs', 'loops', 'queues', `${args.queue}.json`),
@@ -178,11 +200,13 @@ async function main() {
     wrapper: path.join(args.root, 'scripts', 'loops', 'openclaw-loop.mjs'),
     notifier: path.join(args.root, 'scripts', 'loops', 'openclaw-loop-notify.mjs'),
     manifest: path.join(args.root, 'runtime', 'loop-engineering-openclaw-install.json'),
-    instructions: path.join(args.root, 'AGENTS.md')
+    instructions: path.join(args.root, 'AGENTS.md'),
+    schedulerService: path.join(systemdUserDir, schedulerUnit),
+    schedulerTimer: path.join(systemdUserDir, schedulerTimer)
   };
   const conflicts = [];
   for (const [kind, file] of Object.entries(files)) if (!['instructions', 'workspaceHealth', 'manifest'].includes(kind) && await exists(file)) conflicts.push(path.relative(args.root, file));
-  const report = { version: 1, status: args.confirmInstall ? 'installed' : 'plan_only', readOnly: !args.confirmInstall, root: args.root, queue: args.queue, workerAgent: args.workerAgent, workerSelection: worker.selection, availableAgents: worker.availableAgents, workerValidated: true, createsWorkerAgent: false, openclawBin: args.openclawBin, files: Object.fromEntries(Object.entries(files).map(([key, file]) => [key, path.relative(args.root, file)])), conflicts };
+  const report = { version: 1, status: args.confirmInstall ? 'installed' : 'plan_only', readOnly: !args.confirmInstall, root: args.root, queue: args.queue, workerAgent: args.workerAgent, workerSelection: worker.selection, availableAgents: worker.availableAgents, workerValidated: true, createsWorkerAgent: false, openclawBin: args.openclawBin, systemctlBin: args.systemctlBin, scheduler: { required: true, unit: schedulerUnit, timer: schedulerTimer }, files: Object.fromEntries(Object.entries(files).map(([key, file]) => [key, path.relative(args.root, file)])), conflicts };
   report.next = args.confirmInstall ? 'Run loop-engineering-openclaw-doctor, then route a harmless smoke task.' : 'Review this plan, then rerun with --confirm-install.';
   if (conflicts.length && !args.force && args.confirmInstall) throw new Error(`Refusing to overwrite: ${conflicts.join(', ')}. Use --force after review.`);
   if (args.confirmInstall) {
@@ -203,28 +227,42 @@ async function main() {
       dispatcher: 'node scripts/loops/openclaw-loop-dispatch.mjs',
       preflightConfig: 'configs/loops/workspace-health.json',
       timeoutMs: 1800000, leaseMs: 1860000, staleActiveMs: 3600000,
+      scheduler: { required: true, heartbeatMaxAgeMs: 300000, initialInterval: '1m', minInterval: '1m', maxInterval: '4h', speedupFactor: 0.5, backoffFactor: 2, idleBackoffFactor: 2, humanGateBackoffFactor: 3, longRunHeadroomFactor: 1.25, jitter: '10s' },
       retry: { maxAttempts: 1, retryDelayMs: 0, retryExitCodes: [1], requiresHumanActionPatterns: ['requires human', '需要人工', 'Permission denied', 'Operation not permitted'] },
       revisionPolicy: { enabled: true, maxRevisionRounds: 3, sameFailureThreshold: 2, requireStrategyChange: true }
     }, null, 2)}\n`;
     const dispatcherContent = dispatcherSource(args);
     const wrapperContent = wrapperSource(args);
     const notifierContent = notifierSource(args);
+    const schedulerServiceContent = schedulerServiceSource(args);
+    const schedulerTimerContent = schedulerTimerSource(args);
     await writeFile(files.queueConfig, queueContent);
     await writeFile(files.dispatcher, dispatcherContent);
     await writeFile(files.wrapper, wrapperContent);
     await writeFile(files.notifier, notifierContent);
+    await mkdir(systemdUserDir, { recursive: true });
+    await writeFile(files.schedulerService, schedulerServiceContent);
+    await writeFile(files.schedulerTimer, schedulerTimerContent);
+    const daemonReload = await run(args.systemctlBin, ['--user', 'daemon-reload'], { cwd: args.root });
+    if (daemonReload.code !== 0) throw new Error(`Cannot reload user systemd units: ${(daemonReload.stderr || daemonReload.stdout).trim() || `exit ${daemonReload.code}`}`);
+    const enableTimer = await run(args.systemctlBin, ['--user', 'enable', '--now', schedulerTimer], { cwd: args.root });
+    if (enableTimer.code !== 0) throw new Error(`Cannot enable Loop scheduler timer ${schedulerTimer}: ${(enableTimer.stderr || enableTimer.stdout).trim() || `exit ${enableTimer.code}`}`);
     const instructions = await exists(files.instructions) ? await readFile(files.instructions, 'utf8') : '';
     const managedInstructions = instructionsBlock(args);
     if (!instructions.includes('<!-- loop-engineering:openclaw:start -->')) await appendFile(files.instructions, managedInstructions);
     await mkdir(path.dirname(files.manifest), { recursive: true });
     await writeFile(files.manifest, `${JSON.stringify({
-      version: 1, queue: args.queue, workerAgent: args.workerAgent, openclawBin: args.openclawBin, installedAt: new Date().toISOString(),
+      version: 2, queue: args.queue, workerAgent: args.workerAgent, openclawBin: args.openclawBin, systemctlBin: args.systemctlBin, installedAt: new Date().toISOString(),
       managedFiles: [
         { path: path.relative(args.root, files.queueConfig), sha256: sha256(queueContent) },
         { path: path.relative(args.root, files.dispatcher), sha256: sha256(dispatcherContent) },
         { path: path.relative(args.root, files.wrapper), sha256: sha256(wrapperContent) },
         { path: path.relative(args.root, files.notifier), sha256: sha256(notifierContent) }
       ],
+      managedUnits: [
+        { path: files.schedulerService, unit: schedulerUnit, sha256: sha256(schedulerServiceContent) },
+        { path: files.schedulerTimer, unit: schedulerTimer, sha256: sha256(schedulerTimerContent) }
+      ],
       managedInstructions: { path: 'AGENTS.md', sha256: sha256(managedInstructions), content: managedInstructions },
       retainedOnUninstall: [`runtime/loops/${args.queue}`]
     }, null, 2)}\n`);

package/scripts/openclaw-manage.mjs

@@ -6,6 +6,13 @@ import path from 'node:path';
 
 const sha256 = (value) => createHash('sha256').update(value).digest('hex');
 async function exists(file) { try { await access(file); return true; } catch { return false; } }
+function run(command, args, cwd) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = ''; let stderr = ''; child.stdout.on('data', (c) => { stdout += c; }); child.stderr.on('data', (c) => { stderr += c; });
+    child.on('close', (code) => resolve({ code, stdout, stderr }));
+  });
+}
 function parseArgs(argv) {
   const out = { root: process.cwd(), action: 'uninstall-plan', json: false, confirm: false };
   for (let i = 0; i < argv.length; i++) {
@@ -36,15 +43,29 @@ async function main() {
     const current = present ? await readFile(file, 'utf8') : '';
     files.push({ path: entry.path, present, clean: present && sha256(current) === entry.sha256 });
   }
+  const units = [];
+  for (const entry of manifest.managedUnits || []) {
+    const present = await exists(entry.path);
+    const current = present ? await readFile(entry.path, 'utf8') : '';
+    units.push({ ...entry, present, clean: present && sha256(current) === entry.sha256 });
+  }
   const agentsFile = path.join(args.root, manifest.managedInstructions?.path || 'AGENTS.md');
   const agentsText = await exists(agentsFile) ? await readFile(agentsFile, 'utf8') : '';
   const block = manifest.managedInstructions?.content || '';
   const instructionsClean = Boolean(block) && sha256(block) === manifest.managedInstructions?.sha256 && agentsText.includes(block);
-  const modified = files.filter((item) => item.present && !item.clean).map((item) => item.path);
-  const plan = { version: 1, action: args.action, readOnly: args.action.endsWith('-plan'), queue: manifest.queue, workerAgent: manifest.workerAgent, files, instructionsClean, modified, retained: manifest.retainedOnUninstall || [], ready: modified.length === 0 && instructionsClean };
+  const modified = [...files.filter((item) => item.present && !item.clean).map((item) => item.path), ...units.filter((item) => item.present && !item.clean).map((item) => item.path)];
+  const plan = { version: 2, action: args.action, readOnly: args.action.endsWith('-plan'), queue: manifest.queue, workerAgent: manifest.workerAgent, files, units, instructionsClean, modified, retained: manifest.retainedOnUninstall || [], ready: modified.length === 0 && instructionsClean };
   if (args.action === 'uninstall') {
     if (!plan.ready) throw new Error(`Refusing uninstall because managed content changed: ${[...modified, ...(!instructionsClean ? ['AGENTS.md managed block'] : [])].join(', ')}`);
+    const timer = units.find((item) => item.unit?.endsWith('.timer'));
+    if (timer) {
+      const stopped = await run(manifest.systemctlBin || 'systemctl', ['--user', 'disable', '--now', timer.unit], args.root);
+      if (stopped.code !== 0) throw new Error(`Cannot disable Loop scheduler timer ${timer.unit}: ${stopped.stderr || stopped.stdout}`);
+    }
     for (const item of files) if (item.present && item.clean) await rm(path.join(args.root, item.path), { force: true });
+    for (const item of units) if (item.present && item.clean) await rm(item.path, { force: true });
+    const reload = await run(manifest.systemctlBin || 'systemctl', ['--user', 'daemon-reload'], args.root);
+    if (reload.code !== 0) throw new Error(`Cannot reload user systemd units: ${reload.stderr || reload.stdout}`);
     await writeFile(agentsFile, agentsText.replace(block, ''));
     await rm(manifestFile, { force: true });
     plan.status = 'uninstalled'; plan.readOnly = false;
@@ -52,7 +73,7 @@ async function main() {
     if (!plan.ready) throw new Error(`Refusing upgrade because managed content changed: ${[...modified, ...(!instructionsClean ? ['AGENTS.md managed block'] : [])].join(', ')}`);
     const installer = new URL('./openclaw-install.mjs', import.meta.url).pathname;
     const result = await new Promise((resolve) => {
-      const child = spawn(process.execPath, [installer, '--root', args.root, '--queue', manifest.queue, '--worker-agent', manifest.workerAgent, '--openclaw-bin', manifest.openclawBin || 'openclaw', '--confirm-install', '--force', '--json'], { stdio: ['ignore', 'pipe', 'pipe'] });
+      const child = spawn(process.execPath, [installer, '--root', args.root, '--queue', manifest.queue, '--worker-agent', manifest.workerAgent, '--openclaw-bin', manifest.openclawBin || 'openclaw', '--systemctl-bin', manifest.systemctlBin || 'systemctl', '--confirm-install', '--force', '--json'], { stdio: ['ignore', 'pipe', 'pipe'] });
       let stdout = ''; let stderr = ''; child.stdout.on('data', (c) => { stdout += c; }); child.stderr.on('data', (c) => { stderr += c; });
       child.on('close', (code) => resolve({ code, stdout, stderr }));
     });

package/scripts/route-notify-self-test.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import assert from 'node:assert/strict';
-import { mkdtemp, readdir, rm } from 'node:fs/promises';
+import { mkdtemp, readdir, rename, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import {
@@ -78,6 +78,48 @@ const contract = await readJson(path.join(taskRuntimeDirFor(root, queue, routed.
 assert.equal(contract.risk_level, 'model_assessed');
 assert.equal(contract.requires_human_gate, false);
 
+const orphanQueue = 'orphan-recovery-smoke';
+const orphanRouted = await routeLoopMessage(root, {
+  route: true,
+  confirmExecute: true,
+  queue: orphanQueue,
+  message: '走 loop 验证异常退出自动恢复',
+  sourceChannel: 'feishu',
+  sourceTarget: 'user-1'
+});
+const orphanName = `${orphanRouted.task.id}.json`;
+const orphanInbox = path.join(queueSubdirFor(root, orphanQueue, 'inbox'), orphanName);
+const orphanActive = path.join(queueSubdirFor(root, orphanQueue, 'active'), orphanName);
+await writeJson(orphanActive, { ...(await readJson(orphanInbox)), status: 'active', startedAt: new Date().toISOString() });
+await rm(orphanInbox, { force: true });
+await writeJson(path.join(taskRuntimeDirFor(root, orphanQueue, orphanRouted.task.id), 'checkpoints', 'cp-before-crash.json'), {
+  version: 1,
+  task_id: orphanRouted.task.id,
+  checkpoint_id: 'cp-before-crash',
+  status: 'in_progress',
+  summary: 'Durable progress written before the parent runner exited.',
+  files_changed: [],
+  verification: [],
+  blockers: [],
+  risks: [],
+  next_action: 'resume_from_checkpoint'
+});
+const orphanRun = await runQueueOnce(root, {
+  queue: orphanQueue,
+  dispatcher: '/bin/true',
+  timeoutMs: 10_000,
+  leaseMs: 20_000,
+  staleActiveMs: 60_000
+});
+assert.equal(orphanRun.processed, true);
+assert.equal(orphanRun.run.orphanRecovered.length, 1);
+assert.equal(orphanRun.run.orphanRecovered[0].taskId, orphanRouted.task.id);
+assert.ok(orphanRun.progress.some((event) => event.status === 'orphan_recovered'));
+const orphanTerminal = await readJson(path.join(root, orphanRun.taskPath));
+assert.equal(orphanTerminal.orphanRecoveryCount, 1);
+assert.equal(orphanTerminal.requeuedFrom, 'active');
+assert.equal((await readJson(path.join(taskRuntimeDirFor(root, orphanQueue, orphanRouted.task.id), 'checkpoints', 'cp-before-crash.json'))).checkpoint_id, 'cp-before-crash');
+
 const reviewQueue = 'human-review-smoke';
 const reviewTask = await routeLoopMessage(root, {
   route: true,
@@ -332,10 +374,45 @@ const gateId = gateSent.results[0].gateId;
 const resolved = await resolveHumanInput(root, { queue, gateId, input: '123456', sourceMessageId: 'reply-1' });
 assert.equal(resolved.outcome, 'resolved_and_requeued');
 const requeuedTask = await readJson(path.join(queueSubdirFor(root, queue, 'inbox'), path.basename(failedFile)));
-assert.equal(requeuedTask.humanInput.response, '123456');
-assert.match(requeuedTask.body, /Human input for gate/);
+assert.equal(requeuedTask.humanInput.secret_received, true);
+assert.equal(requeuedTask.body.includes('123456'), false);
+const resolvedGate = await readJson(path.join(root, resolved.ledger ?? gateSent.results[0].ledger));
+assert.equal(JSON.stringify(resolvedGate).includes('123456'), false);
+assert.equal(resolvedGate.response_sha256.length, 64);
+
+// Queued tasks receive a non-sensitive event reference without being moved.
+const queuedCheckpoint = path.join(taskRuntimeDirFor(root, queue, routed.task.id), 'checkpoints', 'cp-queued.json');
+await writeJson(queuedCheckpoint, {
+  version: 1, task_id: routed.task.id, checkpoint_id: 'cp-queued', status: 'needs_human_input',
+  blockers: ['Provide queued input.'], verification: [], risks: [], next_action: 'wait'
+});
+await notifyHumanInputRequests(root, { queue, notifyCommand: '/bin/true' });
+const queuedGateId = `${routed.task.id}:cp-queued`;
+const waitingTaskFile = path.join(queueSubdirFor(root, queue, 'waiting'), path.basename(failedFile));
+assert.equal((await readJson(waitingTaskFile)).status, 'waiting_for_human');
+const queuedResolved = await resolveHumanInput(root, { queue, gateId: queuedGateId, input: 'queued-secret' });
+assert.equal(queuedResolved.outcome, 'resolved_and_requeued');
+const queuedAfterInput = await readJson(path.join(queueSubdirFor(root, queue, 'inbox'), path.basename(failedFile)));
+assert.equal(queuedAfterInput.status, 'queued');
+assert.equal(JSON.stringify(queuedAfterInput).includes('queued-secret'), false);
+
+// Active tasks are not mutated; their event is consumed at the next safe tick.
+const inboxRequeued = path.join(queueSubdirFor(root, queue, 'inbox'), path.basename(failedFile));
+const activeRequeued = path.join(queueSubdirFor(root, queue, 'active'), path.basename(failedFile));
+await rename(inboxRequeued, activeRequeued);
+const activeBefore = await readJson(activeRequeued);
+const activeCheckpoint = path.join(taskRuntimeDirFor(root, queue, routed.task.id), 'checkpoints', 'cp-active.json');
+await writeJson(activeCheckpoint, {
+  version: 1, task_id: routed.task.id, checkpoint_id: 'cp-active', status: 'needs_human_input',
+  blockers: ['Provide active input.'], verification: [], risks: [], next_action: 'wait'
+});
+await notifyHumanInputRequests(root, { queue, notifyCommand: '/bin/true' });
+const activeResolved = await resolveHumanInput(root, { queue, gateId: `${routed.task.id}:cp-active`, input: 'active-secret' });
+assert.equal(activeResolved.outcome, 'resolved_pending_safe_boundary');
+assert.deepEqual(await readJson(activeRequeued), activeBefore);
+await rename(activeRequeued, inboxRequeued);
 await writeJson(failedFile, { ...requeuedTask, status: 'needs_human_input' });
-await rm(path.join(queueSubdirFor(root, queue, 'inbox'), path.basename(failedFile)), { force: true });
+await rm(inboxRequeued, { force: true });
 
 const dryRun = await notifyTerminalTasks(root, { queue, dryRun: true });
 assert.equal(dryRun.results[0].outcome, 'dry_run');

package/scripts/scheduler-heartbeat-self-test.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import {
+  doctorReport,
+  enqueueTask,
+  queueSchedulerTick,
+  writeJson
+} from '../lib/core.mjs';
+
+const root = await mkdtemp(path.join(tmpdir(), 'loop-scheduler-heartbeat-'));
+const queue = 'required-scheduler';
+await mkdir(path.join(root, 'configs', 'loops', 'queues'), { recursive: true });
+await writeJson(path.join(root, 'configs', 'loops', 'queues', `${queue}.json`), {
+  queue,
+  dispatcher: '/bin/true',
+  scheduler: {
+    required: true,
+    heartbeatMaxAge: '5m',
+    initialInterval: '1m',
+    minInterval: '1m',
+    maxInterval: '4h'
+  }
+});
+await enqueueTask(root, { queue, title: 'heartbeat smoke', task: 'remain queued' });
+
+const missing = await doctorReport(root);
+const missingCheck = missing.checks.find((check) => check.id === `queue:${queue}:scheduler-heartbeat`);
+assert.equal(missingCheck?.ok, false);
+assert.equal(missingCheck?.detail?.code, 'scheduler_missing');
+
+await queueSchedulerTick(root, {
+  queue,
+  scheduler: { initialInterval: '1m', minInterval: '1m', maxInterval: '4h' },
+  planOnly: true,
+  forceDue: true
+});
+const healthy = await doctorReport(root);
+const healthyCheck = healthy.checks.find((check) => check.id === `queue:${queue}:scheduler-heartbeat`);
+assert.equal(healthyCheck?.ok, true);
+assert.equal(healthyCheck?.detail?.code, 'scheduler_healthy');
+
+await rm(root, { recursive: true, force: true });
+console.log('scheduler heartbeat self-test passed');

package/skills/taskforce-loop-engineering/SKILL.md

@@ -292,6 +292,8 @@ Summaries must cite the latest run/task/project evidence, verification performed
 
 Use scheduler ticks only after manual verification. Adaptive schedules may speed up with successful queued work and back off on empty queues, failures, long runs, or human gates.
 
+`queue-scheduler-tick` is adaptive cadence logic, not a resident daemon. A cron, systemd timer, or equivalent external scheduler must wake it regularly. For project queues that promise automatic continuation, set `scheduler.required=true` and a bounded `scheduler.heartbeatMaxAge`; `doctor` must fail with `scheduler_missing` whenever queued work exists without a fresh scheduler heartbeat.
+
 Progress notification must be scoped and idempotent. Report failures, human gates, status changes, and terminal completion promptly; throttle routine progress and idle updates.
 
 ## Final Checklist