@aragon-agent/cli 0.6.21 → 0.6.23

package/README.md

@@ -1148,15 +1148,34 @@ than a fact: the file list is derived from `write_file` / `edit_file`, so a
 write made through `bash` is invisible to it.
 
 **The dispatch supervisor.** A time ceiling on a subagent is an inspection
-trigger, not a death sentence — as long as the fast tier is enabled. Two soft
-timers per child (event silence and a wall clock) hand a bounded snapshot to the
-fast model, which decides: keep waiting, steer a nudge in, rebuild the child
-with an amended brief, or abandon it with a recorded reason. The budgets are
-structural, not settings — 4 inspections and 1 replacement per child per
-dispatch, after which the child runs under its own hard ceilings and the
-supervisor goes quiet. Every applied decision is recorded in the report's
-Supervisor section; `/team overseer off` (or no fast tier) restores the
-pre-supervisor regime exactly.
+trigger, not a death sentence. Every dispatch gets its own supervisor on the
+fast model: a per-child silence window for suspected stalls, plus a periodic
+cadence check over the WHOLE roster — one bounded call that carries every live
+subagent and returns one decision per child: keep waiting, steer a nudge in,
+rebuild the child with an amended brief, or abandon it with a recorded reason.
+The cadence grows geometrically (5 min base, ×1.6, capped at 15 min), so a
+healthy slow subagent is checked logarithmically in its run time rather than
+every five minutes forever. The budgets are structural, not settings — 12
+looks, 3 nudges, 1 replacement and 1 abandon per child per dispatch. When the
+look budget is spent the supervisor says so once (`quiet` in the report) and
+stops waking that child; failed inspection calls cost a look but never an
+action. Every applied decision is recorded in the report's Supervisor section
+with the supervisor's own fast-tier spend, and replace/abandon also surface as
+a transcript notice while the dispatch runs.
+
+**No kill by default.** While `team.overseer` is on (the default),
+`team.subagentTimeoutMs` never aborts anything — a positive value is only the
+supervisor's first cadence check. If the fast tier is missing (no key,
+`/fast off`), a due check degrades to an announced *unassisted wait*: the
+children keep running, the report notes how many checks ran degraded, and
+nothing is killed. A subagent still ends on the user's Esc, the explicit
+`team.dispatchTimeoutMs` / `team.maxTurnsPerSubagent` ceilings, its own idle
+watchdog (lengthened 4× while supervised), or the supervisor's own
+replace/abandon verdict. One boundary to know: a session with NO fast wiring
+at all and `team.overseer: true` runs children with no wall clock whatsoever
+— they finish, or die on their own un-lengthened watchdog. `/team overseer
+off` is the escape hatch back to the legacy regime where
+`team.subagentTimeoutMs` is a hard abort again.
 
 **Talking to each other.** Subagents get two extra tools, `team_send` and
 `team_wait`. Messages are delivered by attaching them to the recipient's next
@@ -2001,10 +2020,11 @@ env / `.env` → CLI flags**.
 | `team.enabled` | `true` | Master switch for team subagents. `false` means the `task` tool is never registered — `/team on` in such a session saves the setting for next launch and says so, rather than advertising a tool that is not there. |
 | `team.maxSubagents` | `5` | Subagents per dispatch, clamped to `[1, 10]`. The 10 is the hard ceiling and is enforced twice — on the config value and again on what the model asks for — so hand-editing this file cannot raise it. |
 | `team.maxConcurrent` | `3` | Subagents in flight at once, clamped to `[1, 10]` and capped at `maxSubagents`. A separate knob because provider rate limits are a different constraint from context economics. |
-| `team.subagentTimeoutMs` | `0` | One subagent's wall clock, clamped to `[0, 1800000]`. With the supervisor off it is a hard abort; with it on (the default) a positive value is the **first wall-clock inspection** — the supervisor looks and decides instead of killing. `0` (the default) = no ceiling — a wedged subagent still dies on its own idle watchdog, exactly like the lead. |
+| `team.subagentTimeoutMs` | `0` | One subagent's wall clock, clamped to `[0, 1800000]`. With `team.overseer: false` it is a hard abort (the legacy regime). With the supervisor on (the default) it **never aborts anything** — a positive value is only a compatibility source for the supervisor's first cadence check. `0` (the default) = use `team.overseerIntervalMs` / the structural 5 min instead. |
 | `team.dispatchTimeoutMs` | `0` | The whole dispatch's wall clock (and the `task` tool timeout), clamped to `[0, 3600000]`. `0` (the default) = no ceiling; only Esc ends a dispatch early. |
 | `team.maxTurnsPerSubagent` | `0` | Runaway-loop cap, clamped to `[0, 100]`. `0` (the default) = no cap, matching the lead. A subagent stopped at a positive cap is reported as `stopped: turn cap reached`, with whatever it had produced. |
-| `team.overseer` | `true` | The dispatch supervisor: time ceilings on subagents become inspection triggers for a fast-tier supervisor that decides wait / nudge / replace / abandon instead of aborting. Needs the fast tier (`fast.enabled`); with the tier off or this `false`, children run under the legacy hard ceilings exactly. `/team overseer on\|off` flips it live, and it is read per dispatch. |
+| `team.overseer` | `true` | The dispatch supervisor: one per dispatch on the fast model, ticking on a geometric cadence over every live subagent and deciding wait / nudge / replace / abandon. With the fast tier missing a tick degrades to an announced unassisted wait — never a kill; with this `false`, children run under the legacy hard ceilings exactly. `/team overseer on\|off` flips it live, and it is read per dispatch. |
+| `team.overseerIntervalMs` | `0` | Supervisor cadence base, clamped to `[0, 3600000]`. `0` (the default) = the structural 300 s; a positive `team.subagentTimeoutMs` is honoured first when this is `0` (compat). Later checks grow ×1.6, clamped to `[60 s, 900 s]`; any nudge/replace/abandon resets that child's cadence to the base. Only meaningful while `team.overseer` is true. |
 | `todo.enabled` | `true` | Master switch for todo planning. `false` means the `todo_write` tool is never registered — `/todo on` in such a session saves the setting for next launch and says so, rather than advertising a tool that is not there. |
 | `todo.panel` | `true` | Render the right-hand rail. Independent of `todo.enabled` on purpose: a screen-reader user wants the planning discipline without the column, and the system prompt varies one sentence accordingly. |
 | `todo.followThrough` | `"notify"` | What happens when a run ends with steps left. `notify` says so and stops; `auto` continues the plan after a 3-second grace window, bounded by two structural limits (one fruitless attempt, 25 continuations per plan) that are deliberately **not** settings; `off` is silent. An unrecognized value falls back to `notify`. |
@@ -2015,7 +2035,7 @@ env / `.env` → CLI flags**.
 | `retry.multiplier` | `2` | Growth factor, clamped to `[1, 5]`. The one **float** key in this section: `2.5` is a legitimate factor and is stored as typed. |
 | `retry.jitter` | `true` | Equal jitter (`d/2 + rand·d/2`), which de-correlates concurrent subagents hitting the same 429 while keeping the announced countdown within a factor of two of the truth. Full jitter can fire 40 ms after announcing 30 s, which reads as a bug. |
 | `retry.respectRetryAfter` | `true` | Honour `Retry-After` (and the provider rate-limit reset headers) as a **floor**, never a replacement — a `Retry-After: 1` on the ninth retry does not undo eight retries of backoff. A stated wait above 60 s is surfaced immediately instead of waited out. |
-| `retry.maxElapsedMs` | `240000` | Wall-clock budget from the first failure, clamped to `[10000, 1800000]`. When `team.subagentTimeoutMs` is positive, keep this below it: an equal budget means a subagent is killed at the same instant its ladder ends, and the user is then told "subagent timed out" for what was a provider outage. |
+| `retry.maxElapsedMs` | `240000` | Wall-clock budget from the first failure, clamped to `[10000, 1800000]`. Under the legacy regime (`team.overseer: false`) with `team.subagentTimeoutMs` positive, keep this below it: an equal budget means a subagent is killed at the same instant its ladder ends, and the user is then told "subagent timed out" for what was a provider outage. |
 | `retry.onPartialStream` | `true` | Allow a restart after content has already streamed to the transcript. The view is rewound and the discarded tool cards removed; engine history is provably clean at that point, because it is only written on a completed turn. `false` refuses the whole path. |
 | `skills.enabled` | `true` | Master switch for the skill system. |
 | `skills.requireApproval` | `true` | Require a human to approve `skill_install` / `skill_create`. |

package/dist/agent/controller.js

@@ -519,6 +519,19 @@ export class AgentController {
                         // Every child runs the lead's own model, so the lead's cost table
                         // is the one honest price for the dispatch total.
                         modelCost: () => this.getModelInfo().cost,
+                        // The FAST table for the supervisor's own spend line
+                        // (subagent-overseer-v2 D-7 / R-P1-2). Reuses the tier
+                        // resolution and the unknown-pricing predicate the fast
+                        // reviewer already uses: undefined prices as `pricing
+                        // unknown`, never as $0.00 (C-11 / RV-4).
+                        fastModelCost: () => {
+                            const tier = this.fast?.getTier();
+                            if (!tier || !tier.ok)
+                                return undefined;
+                            return this.isPricedModel(tier.ref)
+                                ? this.getModelInfoFor(tier.ref).cost
+                                : undefined;
+                        },
                         withPausedWatchdog: (fn) => this.withPausedWatchdog(fn),
                     }),
                 ]
@@ -621,7 +634,15 @@ export class AgentController {
                     // `dispatchTimeoutMs: 0` (the default) reaches the executor as an
                     // override of `0` = NO TIMER AT ALL: the dispatch lasts as long as its
                     // slowest child, and only an Esc ends it early (main-agent parity).
-                    ...(this.teamRegistered ? { task: config.team.dispatchTimeoutMs } : {}),
+                    // D-4, THE SECOND ARMING SITE: the runtime arms its own dispatch
+                    // timer under the same gate, because the executor timeout being
+                    // cooperative means this override must never be the ONLY ceiling.
+                    // With the supervisor gate open the ceiling disarms HERE too, so
+                    // team.overseer can never leave two kill paths alive behind one
+                    // config. Read once at construction, exactly as before.
+                    ...(this.teamRegistered
+                        ? { task: config.team.overseer ? 0 : config.team.dispatchTimeoutMs }
+                        : {}),
                 },
             },
         });

package/dist/agent/reducer.js

@@ -183,18 +183,20 @@ export function reduceEvent(event, cost, patches) {
 }
 /**
  * Tools that render their own transcript entry, so the generic tool card would
- * be a duplicate. EXACTLY ONE MEMBER; read todo-plan-execution §3.8 before
- * adding a second.
+ * be a duplicate. `task` is the second member (F-8 A'3): every dispatch opens
+ * a TeamCard immediately after, so the pair read as TWO dispatches - the first
+ * failed, the second succeeded - when there was only ever one. `todo_write`'s
+ * reasons (todo-plan-execution §3.8 / D-10) carry over unchanged.
  *
  * SUPPRESSING ONLY `tool_call_start` IS SUFFICIENT, AND THAT IS THE WHOLE REASON
  * THIS IS SAFE (D-10). Every later handler — `toolCallDelta` / `toolCallEnd` /
  * `toolExecStart` / `toolExecEnd` — resolves its target through
  * `findToolEntryId`, which returns `undefined` when no entry was created, and
- * every one of them already early-returns on that. There is no fifth handler. A
- * second suppression rule would be four more places to get the id matching
- * wrong, for nothing.
+ * every one of them already early-returns on that. There is no fifth handler.
+ * Blast radius verified: headless and `exec` writers key on EVENTS, not tool
+ * names, and `transcript-text` renders `kind:'team'` on its own.
  */
-const SELF_RENDERING_TOOLS = new Set(['todo_write']);
+const SELF_RENDERING_TOOLS = new Set(['todo_write', 'task']);
 function reduceStreamEvent(se) {
     switch (se.type) {
         case 'thinking_start':

package/dist/commands/builtins.js

@@ -294,7 +294,8 @@ const COMMANDS = [
                     ? `\nRunning: ${snapshot.runs.map((r) => `${r.label} (${r.phase})`).join(', ')}`
                     : '';
                 ctx.notify('info', `Team mode: ${state}. Max subagents: ${cfg.maxSubagents}, ` +
-                    `concurrent: ${cfg.maxConcurrent}, supervisor: ${cfg.overseer ? 'on' : 'off'} (needs the fast tier).${roster}`);
+                    `concurrent: ${cfg.maxConcurrent}, supervisor: ${cfg.overseer ? 'on' : 'off'}` +
+                    `${cfg.overseer ? ' (never kills; checks the fast tier each tick)' : ' (legacy hard timeouts)'}.${roster}`);
                 return;
             }
             if (verb === 'on' || verb === 'off') {

package/dist/config/cli-commands.d.ts

@@ -20,7 +20,7 @@ export declare const LOG_CONFIG_SET_KEYS: readonly ["log.level", "log.toFile", "
  * switch falls through every case, writes nothing, and still prints
  * `Set team.enabled = false`.
  */
-export declare const TEAM_CONFIG_SET_KEYS: readonly ["team.enabled", "team.maxSubagents", "team.maxConcurrent", "team.subagentTimeoutMs", "team.dispatchTimeoutMs", "team.maxTurnsPerSubagent", "team.overseer"];
+export declare const TEAM_CONFIG_SET_KEYS: readonly ["team.enabled", "team.maxSubagents", "team.maxConcurrent", "team.subagentTimeoutMs", "team.dispatchTimeoutMs", "team.maxTurnsPerSubagent", "team.overseer", "team.overseerIntervalMs"];
 /**
  * Config keys under `retry.` that `aragon config set` accepts
  * (llm-api-retry-backoff §8.2).

package/dist/config/cli-commands.js

@@ -44,6 +44,7 @@ export const TEAM_CONFIG_SET_KEYS = [
     'team.dispatchTimeoutMs',
     'team.maxTurnsPerSubagent',
     'team.overseer',
+    'team.overseerIntervalMs',
 ];
 /**
  * Config keys under `retry.` that `aragon config set` accepts
@@ -202,6 +203,8 @@ export function applyTeamConfigSet(key, value) {
             return patch(clampOne('maxTurnsPerSubagent'));
         case 'team.overseer':
             return patch({ overseer: isTrue(value) });
+        case 'team.overseerIntervalMs':
+            return patch(clampOne('overseerIntervalMs'));
         default:
             return null;
     }

package/dist/config/load.js

@@ -6,10 +6,10 @@
  * legitimately long single tool run can never be watchdog-killed.
  */
 import process from 'node:process';
-import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampCompactionConfig, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampBashConfig, clampUpdateConfig, clampTheme, clampThinkingLevel, clampContextWindow, clampMaxTokens, clampMaxRenderInterval, clampScrollResumeMs, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, parseThresholdInput, } from './schema.js';
+import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampCompactionConfig, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampBashConfig, clampUpdateConfig, clampTheme, clampThinkingLevel, clampContextWindow, clampMaxTokens, clampMaxRenderInterval, clampScrollResumeMs, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, legacyTeamCeilingPatch, parseThresholdInput, } from './schema.js';
 import { loadDotenv, readEnvConfig, readEnvDisabledSkills } from './env.js';
-import { readConfigFile } from './store.js';
-import { projectModelProfiles, resolveModelProfileState, resolveModelRoleKey } from './model-profile-resolution.js';
+import { readConfigFile, updatePersistedConfig } from './store.js';
+import { projectModelProfiles, resolveModelProfileState, resolveModelRoleKey, } from './model-profile-resolution.js';
 import { getConfigPath } from './app-paths.js';
 import { setHistoryEnabled } from './prompt-history.js';
 import { setEntryRetain } from '../agent/entry-limits.js';
@@ -439,6 +439,44 @@ function resolveContextWindow(env, file) {
     }
     return DEFAULT_CONFIG.contextWindow;
 }
+/**
+ * Rewrite the cli<=0.6.16 persisted team ceiling defaults to 0 and persist the
+ * change (F-8 A'4). ONE-SHOT and IDEMPOTENT: after the first rewrite the file
+ * carries 0, which matches nothing, so nothing is written again.
+ *
+ * THE FILE LAYER ONLY, deliberately: env and flags are this-launch intent and
+ * survive untouched, and with the D-4 semantics a positive surviving value is
+ * a supervisor cadence hint, never a kill. The raw file object is patched IN
+ * PLACE (the same precedent `readConfigFile` sets with `fullscreen`) so the
+ * `file` layer this function's caller resolves from already reads 0; the
+ * write goes through `updatePersistedConfig`, the one atomic write path every
+ * other settings change uses.
+ *
+ * A FAILED WRITE MUST NOT BLOCK STARTUP: the values are already neutralized
+ * in memory, and the next launch retries — which is why the catch is empty
+ * and the migration is logged instead of surfaced.
+ */
+function migrateLegacyTeamCeilings(raw) {
+    const patch = legacyTeamCeilingPatch(raw?.team);
+    if (patch === null)
+        return;
+    // THE FULL SECTION, not the bare patch: the write port types `team` as a
+    // whole `TeamConfig` (its merge then deep-merges over what is on disk), and
+    // the section the file already carries plus the zeroed keys IS the section
+    // we want on disk.
+    const migratedTeam = { ...raw.team, ...patch };
+    Object.assign(raw.team, patch);
+    try {
+        updatePersistedConfig({ team: migratedTeam });
+    }
+    catch {
+        // Unwritable config dir: in-memory values are already migrated; retry
+        // next launch (idempotent).
+    }
+    getLogger().warn('config', 'team_legacy_ceilings_migrated', {
+        keys: Object.keys(patch).join(','),
+    });
+}
 /**
  * Resolve the effective config by merging all layers, then derive the runtime
  * (non-persisted) fields and enforce the timeout invariant.
@@ -448,6 +486,7 @@ export function loadConfig(flags = {}, options = {}) {
     // `.env` must be loaded before reading env overrides.
     loadDotenv(cwd);
     const read = readConfigFile();
+    migrateLegacyTeamCeilings(read.config);
     const projection = projectModelProfiles(read.config ?? {});
     const file = projection.file;
     const env = readEnvConfig();

package/dist/config/schema.d.ts

@@ -309,10 +309,11 @@ export interface TeamConfig {
      * the lead, whose only in-run ceiling is the event-silence idle watchdog
      * a child already keeps. A wedged child still dies on its OWN watchdog.
        *
-       * WITH `team.overseer` ON (the default) this is the FIRST wall-clock
-       * INSPECTION point, not a hard abort: the supervisor looks and decides
-       * (wait / nudge / replace / abandon), so a slow-but-healthy child is no
-       * longer killed at an arbitrary wall clock.
+       * WITH `team.overseer` ON (the default) this NEVER aborts anything
+       * (subagent-overseer-v2 D-4): a positive value is only a COMPATIBILITY
+       * SOURCE for the supervisor's first cadence check, honouring users who
+       * already treated it as a trigger point. The only hard abort left is
+       * the legacy regime (`team.overseer: false`).
      */
     subagentTimeoutMs: number;
     /**
@@ -329,17 +330,32 @@ export interface TeamConfig {
      */
     maxTurnsPerSubagent: number;
     /**
-     * The dispatch supervisor (team-overseer): time ceilings on children
-     * become inspection triggers for a fast-tier supervisor that decides
-     * wait / nudge / replace / abandon, instead of aborts. Default TRUE.
+     * The dispatch supervisor (team-overseer / subagent-overseer-v2): time
+     * ceilings on children become inspection triggers for a fast-tier
+     * supervisor that decides wait / nudge / replace / abandon, instead of
+     * aborts. Default TRUE.
      *
-     * READ PER DISPATCH. With the supervisor off (or no fast tier), children
-     * run exactly the pre-feature regime: `subagentTimeoutMs` is a hard abort
-     * and silence is the child's own watchdog. With it ON,
-     * `subagentTimeoutMs > 0` is the FIRST wall-clock inspection point, not
-     * a death sentence.
+     * READ PER DISPATCH. The supervisor ticks on a cadence ladder over every
+     * live child, and NO timeout is a death sentence while this is on: with
+     * the fast tier missing a tick degrades to an announced unassisted wait,
+     * never a kill. With this FALSE, children run exactly the pre-feature
+     * legacy regime: `subagentTimeoutMs` is a hard abort and silence is the
+     * child's own watchdog.
      */
     overseer: boolean;
+    /**
+     * Supervisor cadence BASE, in milliseconds (subagent-overseer-v2 D-8).
+     * `0` (the default) = the structural default
+     * (`TEAM_LIMITS.overseerDefaultCheckMs`, 300 s).
+     *
+     * EFFECTIVE FIRST CHECK, derived read-only and never written back:
+     * `overseerIntervalMs > 0` wins; otherwise a positive
+     * `subagentTimeoutMs` is honoured (users who already treated it as a
+     * trigger point); otherwise the structural default. Later checks grow
+     * by `overseerCadenceRatio` (1.6), clamped to [60 s, 900 s]. Only
+     * meaningful while `team.overseer` is true.
+     */
+    overseerIntervalMs: number;
 }
 /**
  * The requirement's ceiling on the fan-out (R-g).
@@ -364,6 +380,31 @@ export declare const DEFAULT_TEAM_CONFIG: TeamConfig;
  * the two disagree would make the panel's `n/m` readout confusing for no gain.
  */
 export declare function clampTeamConfig(raw: unknown): TeamConfig;
+/**
+ * The team ceilings cli <= 0.6.16 (7a6bf5630) persisted as its OWN defaults:
+ * every user who touched team mode back then still carries this exact triple
+ * in config.json, because `resolveTeamConfig` merges file values verbatim and
+ * no migration ever rewrote them. They are the kill ceilings behind F-8's
+ * "first block all failed" dispatches, so loading rewrites them to 0 (= no
+ * ceiling, the shipped default since 2ff15a9c3).
+ *
+ * EXACT-EQUALITY ONLY: a value that differs was a deliberate user choice and
+ * survives untouched. The price of that test is that a user who hand-types
+ * 300000 today is migrated to 0 too - the accepted trade, and the safe
+ * direction (no ceiling, not a cliff).
+ */
+export declare const LEGACY_TEAM_CEILING_DEFAULTS: Readonly<{
+    subagentTimeoutMs: number;
+    dispatchTimeoutMs: number;
+    maxTurnsPerSubagent: number;
+}>;
+/**
+ * The `{ key: 0 }` patch for legacy-default-equal ceilings, or `null` when
+ * nothing matches. Pure on purpose: `loadConfig` decides WHERE the patch is
+ * applied and persisted; this function only answers WHICH keys match, so the
+ * equality test lives beside the constants it reads.
+ */
+export declare function legacyTeamCeilingPatch(raw: unknown): Partial<TeamConfig> | null;
 export interface TodoConfig {
     /** Register `todo_write` at all. Default TRUE. */
     enabled: boolean;

package/dist/config/schema.js

@@ -455,6 +455,8 @@ export const DEFAULT_TEAM_CONFIG = {
     // The dispatch supervisor, default ON (team-overseer): ceilings become
     // inspections; the fast-tier supervisor decides what to do.
     overseer: true,
+    // 0 = the structural cadence default (300 s). See the field docstring.
+    overseerIntervalMs: 0,
 };
 const SUBAGENTS_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
 const CONCURRENT_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
@@ -463,6 +465,7 @@ const CONCURRENT_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
 // ("my setting won't stick"), the exact trap `scrollResumeMs` records above.
 const SUBAGENT_TIMEOUT_RANGE = { min: 0, max: 1_800_000 };
 const DISPATCH_TIMEOUT_RANGE = { min: 0, max: 3_600_000 };
+const OVERSEER_INTERVAL_RANGE = { min: 0, max: 3_600_000 };
 const TURNS_RANGE = { min: 0, max: 100 };
 /**
  * THE single gate for every team-config read AND write, mirroring
@@ -486,8 +489,47 @@ export function clampTeamConfig(raw) {
         dispatchTimeoutMs: clampIntAllowingZero(src.dispatchTimeoutMs, DEFAULT_TEAM_CONFIG.dispatchTimeoutMs, DISPATCH_TIMEOUT_RANGE),
         maxTurnsPerSubagent: clampIntAllowingZero(src.maxTurnsPerSubagent, DEFAULT_TEAM_CONFIG.maxTurnsPerSubagent, TURNS_RANGE),
         overseer: bool(src.overseer, DEFAULT_TEAM_CONFIG.overseer),
+        overseerIntervalMs: clampIntAllowingZero(src.overseerIntervalMs, DEFAULT_TEAM_CONFIG.overseerIntervalMs, OVERSEER_INTERVAL_RANGE),
     };
 }
+/**
+ * The team ceilings cli <= 0.6.16 (7a6bf5630) persisted as its OWN defaults:
+ * every user who touched team mode back then still carries this exact triple
+ * in config.json, because `resolveTeamConfig` merges file values verbatim and
+ * no migration ever rewrote them. They are the kill ceilings behind F-8's
+ * "first block all failed" dispatches, so loading rewrites them to 0 (= no
+ * ceiling, the shipped default since 2ff15a9c3).
+ *
+ * EXACT-EQUALITY ONLY: a value that differs was a deliberate user choice and
+ * survives untouched. The price of that test is that a user who hand-types
+ * 300000 today is migrated to 0 too - the accepted trade, and the safe
+ * direction (no ceiling, not a cliff).
+ */
+export const LEGACY_TEAM_CEILING_DEFAULTS = {
+    subagentTimeoutMs: 300_000,
+    dispatchTimeoutMs: 900_000,
+    maxTurnsPerSubagent: 24,
+};
+/**
+ * The `{ key: 0 }` patch for legacy-default-equal ceilings, or `null` when
+ * nothing matches. Pure on purpose: `loadConfig` decides WHERE the patch is
+ * applied and persisted; this function only answers WHICH keys match, so the
+ * equality test lives beside the constants it reads.
+ */
+export function legacyTeamCeilingPatch(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const src = raw;
+    const patch = {};
+    let matched = false;
+    for (const key of Object.keys(LEGACY_TEAM_CEILING_DEFAULTS)) {
+        if (src[key] === LEGACY_TEAM_CEILING_DEFAULTS[key]) {
+            patch[key] = 0;
+            matched = true;
+        }
+    }
+    return matched ? patch : null;
+}
 export const DEFAULT_TODO_CONFIG = {
     enabled: true,
     panel: true,

package/dist/team/limits.d.ts

@@ -102,11 +102,12 @@ export declare const TEAM_LIMITS: {
     readonly maxColdStartRetries: 1;
     readonly retryBackoffMs: 2000;
     /**
-     * Wall-clock budget of everything one inspection may carry. The digest holds
-     * run facts, the supervisor's own memory and the tail of the child's live
-     * history; unbounded, one look at a child that read five big files would
-     * make the "cheap" supervision call cost more than the child (the argument
-     * FAST_LIMITS.digestMaxChars makes, one level up).
+     * Wall-clock budget of everything one SINGLE inspection may carry (the
+     * silence-triggered path). The digest holds run facts, the supervisor's own
+     * memory and the tail of the child's live history; unbounded, one look at a
+     * child that read five big files would make the "cheap" supervision call
+     * cost more than the child (the argument FAST_LIMITS.digestMaxChars makes,
+     * one level up).
      */
     readonly overseerDigestBytes: 8000;
     /** Clamp on a `nudge` guidance text. Advice, not a second brief. */
@@ -114,11 +115,48 @@ export declare const TEAM_LIMITS: {
     /** Clamp on the decision `reason` recorded in the report. */
     readonly overseerReasonChars: 200;
     /**
-     * Inspections PER CHILD per dispatch. An indecisive supervisor must stop
-     * burning fast-tier calls; past the budget the child simply runs under its
-     * hard ceilings and the supervisor goes quiet.
+     * Per-child slice of a BATCH digest (D-3 / R-P2-5). 6.7x tighter than the
+     * single-inspection budget above: a batch carries up to ten children in one
+     * call, and memory plus the history tail are the first to give way (the
+     * facts-first assembly order already puts them last).
      */
-    readonly overseerMaxInspectionsPerChild: 4;
+    readonly overseerPerChildDigestBytes: 1200;
+    /** Whole-batch digest ceiling (D-3): 10 children x 1 200 B fits exactly. */
+    readonly overseerBatchDigestBytes: 12000;
+    /**
+     * Output budget of ONE batch inspection (R-P0-1). The single-inspection path
+     * keeps `FAST_LIMITS.reviewOutputTokens` (512); a batch must return up to
+     * ten decision objects, and 512 tokens cannot physically hold ten x
+     * (reason <= 200 + guidance <= 1200). A truncated batch reply fails
+     * "first `[` to last `]`" parsing and degrades to all-wait - exactly the
+     * failure this separate, larger budget exists to prevent.
+     */
+    readonly overseerBatchOutputTokens: 2048;
+    /** Tighter `reason` clamp inside the batch protocol (R-P0-1). */
+    readonly overseerBatchReasonChars: 80;
+    /** Tighter `guidance` clamp inside the batch protocol (R-P0-1). */
+    readonly overseerBatchGuidanceChars: 400;
+    /**
+     * LOOKS per child per dispatch (D-5). A look is cost, not mutation: every
+     * inspection of a child - silence-triggered, cadence tick or post-mortem -
+     * spends one, including a call that failed softly. Twelve with the cadence
+     * ladder covers hours of healthy slow work; past the budget the supervisor
+     * says so once (`trigger: 'quiet'`) and stops waking that child up.
+     */
+    readonly overseerMaxLooksPerChild: 12;
+    /**
+     * LOOKS per dispatch, the fool-proof total (R-P1-6):
+     * hardMaxSubagents x overseerMaxLooksPerChild = 120. A mathematical upper
+     * bound, not a tuning knob - the per-child budget always binds first; this
+     * one exists so a bug cannot loop calls forever. When it trips, the whole
+     * MonitorLoop stops with one aggregate notice.
+     */
+    readonly overseerMaxLooksPerDispatch: number;
+    /**
+     * NUDGES per child per dispatch (D-5). Advice is cheap but not free: a
+     * supervisor that steers the same child forever is one that never decided.
+     */
+    readonly overseerMaxNudgesPerChild: 3;
     /**
      * Rebuilds PER CHILD per dispatch. One: a replacement that also stalls dies
      * on its own watchdog rather than ping-ponging fresh children at a task the
@@ -126,13 +164,25 @@ export declare const TEAM_LIMITS: {
      */
     readonly overseerMaxReplacementsPerChild: 1;
     /**
-     * First wall-clock check when `team.subagentTimeoutMs === 0` (the shipped
-     * default): the supervisor still looks even when no ceiling was configured.
+     * Abandons PER CHILD per dispatch (D-5). One, so a supervisor that has
+     * already given up on a brief cannot keep re-killing bodies of it.
+     */
+    readonly overseerMaxAbandonsPerChild: 1;
+    /**
+     * Cadence ladder growth factor (D-2). Each no-action inspection schedules
+     * the next `previous * ratio` out, so a healthy slow child is looked at
+     * logarithmically in its run time rather than every five minutes.
+     */
+    readonly overseerCadenceRatio: 1.6;
+    /**
+     * First cadence check when neither `team.overseerIntervalMs` nor
+     * `team.subagentTimeoutMs` names one (the shipped defaults): the supervisor
+     * still looks even when no ceiling was configured.
      */
     readonly overseerDefaultCheckMs: 300000;
-    /** Clamp on the model-chosen `nextCheckMs`, lower bound. */
+    /** Clamp on a ladder step / model-chosen `nextCheckMs`, lower bound. */
     readonly overseerNextCheckMinMs: 60000;
-    /** Clamp on the model-chosen `nextCheckMs`, upper bound. */
+    /** Clamp on a ladder step / model-chosen `nextCheckMs`, upper bound. */
     readonly overseerNextCheckMaxMs: 900000;
     /**
      * A child's OWN idle watchdog, multiplied by this while the supervisor is
@@ -142,6 +192,16 @@ export declare const TEAM_LIMITS: {
      */
     readonly overseerWatchdogFactor: 4;
 };
+/**
+ * The pseudo-label the runtime's AGGREGATE supervisor notices travel under
+ * (subagent-overseer-v2 D-5 / R-P1-6): the dispatch-total look-budget notice
+ * is one fact about the whole roster, not a row any child owns. RESERVED at
+ * normalization (`normalizeSubagentSpecs` seeds `dedupeLabel` with it), so a
+ * spec asking for the bare label `team` is handed `team-2` instead - the
+ * report ledger and the exec stream can then never attribute an aggregate
+ * notice to a real child, or swallow that child's own quiet note.
+ */
+export declare const TEAM_AGGREGATE_LABEL = "team";
 /**
  * The two comm tools, which are POLICY-EXEMPT inside a child (§3.11).
  *