@henryqw/pi-subagent 23.0.1 → 24.0.0

package/dist/runner.js

@@ -69,7 +69,7 @@ class DurableRunStopped extends Error {
 }
 class ProductiveScope {
     signal;
-    constructor(_timeoutMs, _now, outerSignal) {
+    constructor(outerSignal) {
         this.signal = outerSignal ?? new AbortController().signal;
     }
     async call(operation) {
@@ -150,10 +150,6 @@ class FollowupControl {
         this.sealed = true;
         return undefined;
     }
-    invalidate() {
-        this.sealed = true;
-        this.queue.length = 0;
-    }
     close() {
         this.sealed = true;
         this.queue.length = 0;
@@ -305,10 +301,17 @@ function stagedDependencySnapshot(state, taskId, tip) {
 function textRetryEligible(state, task) {
     const attempt = task.attempts.at(-1);
     return task.status === "needs_attention"
-        && attempt?.status === "failed"
+        && (!attempt || attempt.status === "failed" || attempt.status === "superseded")
         && task.attempts.length < 2
         && taskDependenciesCompleted(state, task.taskId);
 }
+function hasPassingPreliminaryEvidence(request, attempt) {
+    return Boolean(attempt.candidate && attempt.candidateBase
+        && checkBatchPasses(attempt.preliminaryChecks, request.checks, attempt.candidate)
+        && (!request.judgment || reviewEvidencePasses(attempt.preliminaryReview, "preliminary", request.judgment.criterion, attempt.candidateBase, attempt.candidate))
+        && !attempt.prompts.some((prompt) => prompt.status === "ambiguous")
+        && allocationByKind(attempt, "agent")?.agentName && !attempt.termination);
+}
 function changesetTaskState(state, id) {
     const task = taskState(state, id);
     if (task.kind !== "changeset")
@@ -523,10 +526,10 @@ export class IsolatedRunner {
         const { states: entries, invalidIds } = await this.store.list(root);
         return { invalidIds, states: entries.map(({ state }) => state), requests: entries.map(({ state }) => ({
                 id: state.request.id, name: state.request.goal,
-                status: state.status === "completed" && (state.tasks.some((task) => task.kind === "changeset" && task.attempts.some((attempt) => attempt.cleanup.some((step) => step.status !== "completed")))
+                status: ["completed", "aborted"].includes(state.status) && (state.tasks.some((task) => task.kind === "changeset" && task.attempts.some((attempt) => attempt.cleanup.some((step) => step.status !== "completed")))
                     || state.integration.generations.some((generation) => generation.cleanup?.some((step) => step.status !== "completed")
                         || (generation.worktree && generation.cleanup?.every((step) => step.status === "completed") !== true)))
-                    ? "completed · retained" : state.status,
+                    ? `${state.status} · retained` : state.status,
                 tasks: state.request.tasks.map((task) => ({
                     id: task.id, name: task.requirements, kind: task.kind,
                     status: state.tasks.find((item) => item.taskId === task.id).status,
@@ -543,7 +546,7 @@ export class IsolatedRunner {
             inventory = await this.withProductiveRun(root, async (lifecycle) => await this.store.withLock(root, async () => {
                 const listed = await this.listRequests(root);
                 for (const request of listed.requests) {
-                    if (request.status !== "pending" && request.status !== "running")
+                    if (!["pending", "running", "needs_attention"].includes(request.status))
                         continue;
                     const handle = await this.store.load(root, request.id);
                     if (this.recoverInterrupted(handle.state))
@@ -560,7 +563,7 @@ export class IsolatedRunner {
         }
         const requests = [];
         for (const request of inventory.requests) {
-            if (["pending", "running", "needs_attention", "completed · retained"].includes(request.status)) {
+            if (["pending", "running", "needs_attention", "completed · retained", "aborted · retained"].includes(request.status)) {
                 requests.push(await this.status(request.id, root));
             }
         }
@@ -655,7 +658,7 @@ export class IsolatedRunner {
     async execute(value, cwd, outerSignal) {
         const request = parseExecuteRequest(value);
         const policy = Object.freeze({ ...this.currentPolicy() });
-        const scope = new ProductiveScope(policy.childMaxMs, () => this.coordinatorRuntime.now(), outerSignal);
+        const scope = new ProductiveScope(outerSignal);
         const canonicalCwd = realpathSync.native(cwd);
         const prepared = await scope.call(async (context) => await this.coordinatorRuntime.preflight({ request, cwd: canonicalCwd }, context));
         const root = realpathSync.native(prepared.root);
@@ -741,8 +744,7 @@ export class IsolatedRunner {
                 return loaded;
             }, { productiveRunLease: lifecycle.lease });
             const state = handle.state;
-            const current = this.currentPolicy();
-            const scope = new ProductiveScope(Math.min(state.policy.childMaxMs, current.childMaxMs), () => this.coordinatorRuntime.now(), outerSignal);
+            const scope = new ProductiveScope(outerSignal);
             try {
                 if (request.action === "finalize")
                     return await this.finalize(handle, scope);
@@ -754,8 +756,8 @@ export class IsolatedRunner {
                         throw new Error(`Text task ${task.taskId} cannot be verified.`);
                     if (!textRetryEligible(state, task)) {
                         const attempt = task.attempts.at(-1);
-                        if (attempt?.status !== "failed" || task.attempts.length >= 2) {
-                            throw new Error(`Text task ${task.taskId} retry requires a failed latest attempt and fewer than two attempts.`);
+                        if ((attempt && !["failed", "superseded"].includes(attempt.status)) || task.attempts.length >= 2) {
+                            throw new Error(`Text task ${task.taskId} retry requires an unstarted, failed or superseded dispatch and fewer than two attempts.`);
                         }
                         throw new Error(`Text task ${task.taskId} dependencies are not completed.`);
                     }
@@ -775,8 +777,6 @@ export class IsolatedRunner {
                 throw error;
             }
             finally {
-                if (scope instanceof DeadlineScope)
-                    scope.close();
                 this.closeRequestControls(root, request.id);
                 if (!lifecycle.stopped) {
                     delete state.recovery;
@@ -813,7 +813,7 @@ export class IsolatedRunner {
                     ? generation.combinedTip ?? generation.stages.at(-1)?.tip ?? generation.integrationBase : state.main;
                 if (!sameIdentity(action.expectedTip, expected))
                     throw new Error("Rejection recovery has a stale integration tip.");
-                const scope = new ProductiveScope(Math.min(state.policy.childMaxMs, this.currentPolicy().childMaxMs), () => this.coordinatorRuntime.now(), outerSignal);
+                const scope = new ProductiveScope(outerSignal);
                 const termination = attempt.termination;
                 const result = await scope.call((context) => this.hostRuntime.reconcileWorkerTermination({
                     task: changesetTaskRequest(state, task.taskId), attempt, workerId: termination.workerId,
@@ -834,7 +834,7 @@ export class IsolatedRunner {
                 || !sameIdentity(attempt.readiness.candidate, action.candidate)) {
                 throw new Error("Stage action refers to a stale or unowned candidate.");
             }
-            const scope = new ProductiveScope(Math.min(state.policy.childMaxMs, this.currentPolicy().childMaxMs), () => this.coordinatorRuntime.now(), outerSignal);
+            const scope = new ProductiveScope(outerSignal);
             const generations = state.integration.generations;
             let generation = generations.at(-1);
             const nextNumber = generation?.status === "superseded" ? generation.number + 1 : generation?.number ?? 1;
@@ -1093,7 +1093,7 @@ export class IsolatedRunner {
             const request = parseExecuteRequest(state.request);
             const generation = state.integration.generations.at(-1);
             if (action.action === "release") {
-                const scope = new ProductiveScope(Math.min(state.policy.childMaxMs, this.currentPolicy().childMaxMs), () => this.coordinatorRuntime.now(), outerSignal);
+                const scope = new ProductiveScope(outerSignal);
                 if (action.taskId !== undefined || action.attempt !== undefined) {
                     if (!action.taskId || !action.attempt || action.generation !== (generation?.number ?? 1)) {
                         throw new Error("Candidate release requires the latest generation and exact task attempt.");
@@ -1142,7 +1142,7 @@ export class IsolatedRunner {
                 if (state.integration.generations.filter((item) => item.worktree && !item.cleanup?.every((step) => step.status === "completed")).length >= MAX_RETAINED_INTEGRATION_GENERATIONS) {
                     throw new Error("Retained integration worktree limit is exhausted.");
                 }
-                const scope = new ProductiveScope(Math.min(state.policy.childMaxMs, this.currentPolicy().childMaxMs), () => this.coordinatorRuntime.now(), outerSignal);
+                const scope = new ProductiveScope(outerSignal);
                 const actualMain = await scope.call((context) => this.gitRuntime.inspectMain({ root }, context));
                 if (!isCleanCommitted(action.newMain) || !sameIdentity(actualMain, action.newMain)) {
                     throw new Error("Refresh requires the exact new clean Main identity.");
@@ -1226,7 +1226,7 @@ export class IsolatedRunner {
                 || (terminal(state) && !(state.status === "completed" && action.action === "cleanup"))
                 || (state.status !== "needs_attention" && !(state.status === "completed" && action.action === "cleanup")))
                 throw new Error("Integration action has a stale generation or combined tip.");
-            const scope = new ProductiveScope(Math.min(state.policy.childMaxMs, this.currentPolicy().childMaxMs), () => this.coordinatorRuntime.now(), outerSignal);
+            const scope = new ProductiveScope(outerSignal);
             const receipts = this.stageReceipts(generation);
             if (action.action === "advance") {
                 if (generation.status !== "staging" || generation.stages.some((stage) => stage.status !== "staged")
@@ -1587,7 +1587,7 @@ export class IsolatedRunner {
         return await this.store.withLock(root, async (lifecycle) => {
             const handle = await this.store.load(root, id);
             const state = handle.state;
-            if (terminal(state))
+            if (terminal(state) && state.status !== "aborted")
                 return this.response(state);
             if (state.integration.candidates.some((candidate) => candidate.worker !== "released")
                 || state.integration.generations.some((generation) => generation.worktree
@@ -1596,7 +1596,7 @@ export class IsolatedRunner {
             }
             const activeControls = this.activeControls(root, id);
             for (const { control } of activeControls)
-                control.invalidate();
+                control.close();
             if (!activeControls.length
                 && !lifecycle.productiveRunLeaseActive
                 && this.recoverInterrupted(state)) {
@@ -1609,7 +1609,31 @@ export class IsolatedRunner {
                 for (const attempt of task.attempts) {
                     if (!allocationByKind(attempt, "agent")?.agentName || attempt.termination?.status === "terminated")
                         continue;
-                    await this.terminateWithSafety(handle, task, attempt, this.terminationCandidate(attempt), outerSignal, safetyDeadline, true);
+                    if (attempt.termination) {
+                        const safety = new DeadlineScope(safetyDeadline, () => this.coordinatorRuntime.now(), outerSignal);
+                        try {
+                            const result = await safety.call((context) => this.hostRuntime.reconcileWorkerTermination({
+                                task: changesetTaskRequest(state, task.taskId), attempt,
+                                workerId: attempt.termination.workerId, candidate: attempt.termination.candidate,
+                            }, context));
+                            if (result.outcome !== "terminated")
+                                throw new Error(result.outcome === "unknown"
+                                    ? result.failure : "Exact worker remains active; termination was not replayed.");
+                            attempt.termination = { ...attempt.termination, status: "terminated", at: this.coordinatorRuntime.now() };
+                            delete attempt.termination.failure;
+                        }
+                        catch (error) {
+                            attempt.termination.status = "unknown";
+                            attempt.termination.failure = errorText(error);
+                            this.attention(task, attempt.termination.failure);
+                        }
+                        finally {
+                            safety.close();
+                        }
+                    }
+                    else {
+                        await this.terminateWithSafety(handle, task, attempt, this.terminationCandidate(attempt), outerSignal, safetyDeadline, true);
+                    }
                 }
             }
             state.status = "aborted";
@@ -1617,9 +1641,73 @@ export class IsolatedRunner {
             state.accepted = false;
             state.updatedAt = this.coordinatorRuntime.now();
             await handle.save();
+            // In-flight checks or allocation callbacks must settle before removing their checkout.
+            if (!lifecycle.productiveRunLeaseActive)
+                await this.cleanupAborted(handle, outerSignal);
             return this.response(state);
         }, { purpose: "abort" });
     }
+    async cleanupAborted(handle, signal) {
+        const state = handle.state;
+        const scope = new DeadlineScope(this.coordinatorRuntime.now() + CLEANUP_SAFETY_BUDGET_MS, () => this.coordinatorRuntime.now(), signal);
+        try {
+            for (const task of state.tasks) {
+                if (task.kind !== "changeset")
+                    continue;
+                for (const attempt of task.attempts) {
+                    if (attempt.cleanup.every((step) => step.status === "completed"))
+                        continue;
+                    const worker = allocationByKind(attempt, "worktree")?.worktree;
+                    const expected = worker ? { ...attempt.waveBase, branch: `refs/heads/${worker.branch}` } : undefined;
+                    let pending = attempt.cleanup.find((step) => step.status !== "completed");
+                    try {
+                        if (attempt.allocations.some((item) => item.status === "allocating" || item.status === "unknown")) {
+                            throw new Error("Allocation ownership is uncertain; preserve the recorded resources for inspection.");
+                        }
+                        if (allocationByKind(attempt, "agent") && attempt.termination?.status !== "terminated") {
+                            throw new Error("Exact worker termination remains unproved.");
+                        }
+                        if (expected && attempt.termination && attempt.termination.candidate.head !== expected.head) {
+                            throw new Error("Aborted worker may contain committed work; automatic cleanup preserves it.");
+                        }
+                        for (const step of attempt.cleanup) {
+                            if (step.status === "completed")
+                                continue;
+                            pending = step;
+                            const kind = step.kind;
+                            step.status = "running";
+                            delete step.failure;
+                            await handle.save();
+                            if ((kind === "worker_tab" || kind === "workspace") && allocationByKind(attempt, kind)) {
+                                const result = await scope.call((context) => this.hostRuntime.cleanupHost({
+                                    requestId: state.request.id, kind,
+                                    task: changesetTaskRequest(state, task.taskId), attempt,
+                                }, context));
+                                if (result.outcome === "blocked")
+                                    throw new Error(result.failure);
+                            }
+                            else if ((kind === "worktree" || kind === "branch") && worker && expected) {
+                                const result = await scope.call((context) => this.integrationGit.release(state.root, worker, expected, kind, context.signal));
+                                if (result.outcome !== "ready")
+                                    throw new Error(result.failure);
+                            }
+                            step.status = "completed";
+                            await handle.save();
+                        }
+                    }
+                    catch (error) {
+                        if (pending.status === "completed")
+                            pending.status = "running";
+                        pending.failure = bounded(`Abort cleanup retained resources: ${errorText(error)}`);
+                        await handle.save();
+                    }
+                }
+            }
+        }
+        finally {
+            scope.close();
+        }
+    }
     async status(id, root, outerSignal) {
         root = realpathSync.native(root);
         return await this.store.withLock(root, async () => {
@@ -2354,9 +2442,7 @@ export class IsolatedRunner {
         if (!attempt.readiness || !attempt.candidate || !attempt.candidateBase || !attempt.preliminaryChecks
             || !sameIdentity(attempt.readiness.candidate, attempt.candidate)
             || !sameIdentity(attempt.readiness.base, attempt.candidateBase)
-            || !checkBatchPasses(attempt.preliminaryChecks, request.checks, attempt.candidate)
-            || (request.judgment && !reviewEvidencePasses(attempt.preliminaryReview, "preliminary", request.judgment.criterion, attempt.candidateBase, attempt.candidate))
-            || !allocationByKind(attempt, "agent")?.agentName || attempt.termination) {
+            || !hasPassingPreliminaryEvidence(request, attempt)) {
             throw new Error(`Task ${task.taskId} has no exact ready live candidate.`);
         }
         if (state.integration.candidates.some((candidate) => candidate.taskId === task.taskId && !candidate.decision)) {
@@ -2380,31 +2466,23 @@ export class IsolatedRunner {
         }, context)), "Retained task candidate identity");
         if (!isCleanCommitted(candidate))
             throw new Error("Retained task candidate is not clean and committed.");
-        if (attempt.readiness) {
-            if (!sameIdentity(candidate, attempt.readiness.candidate))
-                throw new Error("Ready retained task candidate drifted from its exact lineage.");
-            task.status = "ready_to_integrate";
-            task.failure = undefined;
-            await this.saveProductive(handle);
-            this.retainCandidate(handle.state, task);
-            handle.state.status = "needs_attention";
-            await this.saveProductive(handle);
-            return this.response(handle.state);
-        }
         const request = changesetTaskRequest(handle.state, task.taskId);
         if (!attempt.candidate || !attempt.candidateBase || !sameIdentity(candidate, attempt.candidate)
-            || !checkBatchPasses(attempt.preliminaryChecks, request.checks, candidate)) {
-            throw new Error("Retained task work lacks exact passing preliminary candidate evidence.");
+            || !hasPassingPreliminaryEvidence(request, attempt)) {
+            throw new Error("Retained task work lacks exact passing preliminary checks, judgment or live ownership.");
         }
-        attempt.readiness = {
+        if (attempt.readiness && (!sameIdentity(candidate, attempt.readiness.candidate)
+            || !sameIdentity(attempt.candidateBase, attempt.readiness.base))) {
+            throw new Error("Ready retained task candidate drifted from its exact lineage.");
+        }
+        attempt.readiness ??= {
             candidate: attempt.candidate,
             base: attempt.candidateBase,
             at: nextAttemptEventAt(attempt, this.coordinatorRuntime.now()),
         };
+        this.retainCandidate(handle.state, task);
         task.status = "ready_to_integrate";
         task.failure = undefined;
-        await this.saveProductive(handle);
-        this.retainCandidate(handle.state, task);
         handle.state.status = "needs_attention";
         await this.saveProductive(handle);
         return this.response(handle.state);
@@ -2593,6 +2671,26 @@ export class IsolatedRunner {
         await this.saveProductive(handle);
     }
     recoverInterrupted(state) {
+        if (state.status === "needs_attention") {
+            let changed = false;
+            for (const task of state.tasks) {
+                if (task.kind !== "changeset" || task.status !== "ready_to_integrate"
+                    || state.integration.candidates.some((candidate) => candidate.taskId === task.taskId))
+                    continue;
+                const attempt = latestAttempt(task);
+                if (hasPassingPreliminaryEvidence(changesetTaskRequest(state, task.taskId), attempt)) {
+                    this.attention(task, "Candidate readiness was saved before retention; verify to reconstruct the candidate from exact passing evidence.");
+                    changed = true;
+                    continue;
+                }
+                delete attempt.readiness;
+                this.attention(task, "Readiness lacked passing preliminary checks, judgment or live ownership; retained work requires attention.");
+                changed = true;
+            }
+            if (changed)
+                state.updatedAt = this.coordinatorRuntime.now();
+            return changed;
+        }
         if (state.status === "pending") {
             const ready = readyPendingTasks(state).filter((task) => task.attempts.length === 0);
             if (!ready.length)
@@ -2718,11 +2816,6 @@ export class IsolatedRunner {
                 attempt.status = "failed";
                 attempt.failure = boundedFailure;
             }
-            else {
-                if (task.attempts.length >= 2)
-                    throw new Error(`Text task ${task.taskId} cannot record another failed attempt.`);
-                task.attempts.push({ number: task.attempts.length + 1, status: "failed", failure: boundedFailure });
-            }
         }
         task.status = "needs_attention";
         task.failure = boundedFailure;
@@ -2746,12 +2839,15 @@ export class IsolatedRunner {
             }
             else if (attention?.kind === "changeset" && !attention.attempts.at(-1)?.termination) {
                 const attempt = attention.attempts.at(-1);
-                if (attempt && this.correctionAllowed(state, changesetTaskRequest(state, attention.taskId), attempt)) {
+                const hasEvidence = Boolean(attempt && !state.integration.candidates.length
+                    && hasPassingPreliminaryEvidence(changesetTaskRequest(state, attention.taskId), attempt));
+                if (attempt?.readiness && hasEvidence) {
+                    continuation = { id: state.request.id, action: "verify", taskId: attention.taskId };
+                }
+                else if (attempt && this.correctionAllowed(state, changesetTaskRequest(state, attention.taskId), attempt)) {
                     continuation = { id: state.request.id, action: "retry", taskId: attention.taskId };
                 }
-                else if ((attempt?.readiness && !state.integration.candidates.length)
-                    || (attempt?.candidate && attempt.candidateBase
-                        && checkBatchPasses(attempt.preliminaryChecks, changesetTaskRequest(state, attention.taskId).checks, attempt.candidate))) {
+                else if (hasEvidence) {
                     continuation = { id: state.request.id, action: "verify", taskId: attention.taskId };
                 }
             }
@@ -2763,6 +2859,9 @@ export class IsolatedRunner {
             text: bounded([
                 `Pi Subagent ${state.request.id}: ${state.status}.`,
                 `Tasks: ${completed}/${state.tasks.length} completed, ${rejected} rejected. Accepted: ${state.accepted}.`,
+                ...(state.status === "aborted" && state.tasks.some((task) => task.kind === "changeset"
+                    && task.attempts.some((attempt) => attempt.cleanup.some((step) => step.status !== "completed")))
+                    ? ["Aborted resources remain retained. Inspect cleanup evidence; retry subagent_abort after active work settles or cleanup blockers are resolved. Unique commits and uncertain work are never discarded."] : []),
                 ...(main?.status === "current" ? ["Main: current at the recorded exact identity."] : []),
                 ...(main?.status === "drifted" ? [
                     `Main: drifted from ${main.expected.branch}@${main.expected.head} to ${main.actual.branch}@${main.actual.head}.`,

package/dist/schema.d.ts

@@ -139,14 +139,7 @@ type ExecuteRequestInput = Static<typeof ExecuteRequestSchema>;
 export type ExecuteRequest = Omit<ExecuteRequestInput, "finalChecks"> & {
     finalChecks: CheckCommand[];
 };
-export interface ExecutionPolicySnapshot {
-    maxSubagents: number;
-    maxTurns: number;
-    maxTokens?: number;
-    childIdleMs: number;
-    childMaxMs: number;
-    maxCorrections: number;
-}
+export type ExecutionPolicySnapshot = Static<typeof ExecutionPolicySnapshotSchema>;
 export type ResumeRequest = Static<typeof ResumeRequestSchema>;
 export type WorkspaceIdentity = Static<typeof WorkspaceSchema>;
 declare const WorktreeRecordSchema: Type.TObject<{
@@ -1083,6 +1076,14 @@ declare const WaveStateSchema: Type.TObject<{
     taskIds: Type.TArray<Type.TString>;
     status: Type.TUnion<[Type.TLiteral<"dispatching">, Type.TLiteral<"integrating">, Type.TLiteral<"completed">, Type.TLiteral<"needs_attention">]>;
 }>;
+declare const ExecutionPolicySnapshotSchema: Type.TObject<{
+    maxSubagents: Type.TInteger;
+    maxTurns: Type.TInteger;
+    maxTokens: Type.TOptional<Type.TInteger>;
+    childIdleMs: Type.TNumber;
+    childMaxMs: Type.TNumber;
+    maxCorrections: Type.TInteger;
+}>;
 declare const IntegrationCandidateSchema: Type.TObject<{
     taskId: Type.TString;
     attempt: Type.TInteger;

package/dist/schema.js

@@ -653,10 +653,10 @@ function validateTextTaskState(taskState) {
         ? taskState.attempts.length ? "superseded" : undefined
         : taskState.status === "running"
             ? "running"
-            : taskState.status === "completed"
-                ? "completed"
-                : "failed";
-    if (latest?.status !== expectedLatestStatus) {
+            : "completed";
+    if (taskState.status === "needs_attention"
+        ? latest && !["failed", "superseded"].includes(latest.status)
+        : latest?.status !== expectedLatestStatus) {
         throw new Error(`Text task ${taskState.taskId} status ${taskState.status} has an incompatible latest attempt.`);
     }
     if ((taskState.failure !== undefined) !== (taskState.status === "needs_attention")) {
@@ -665,8 +665,8 @@ function validateTextTaskState(taskState) {
     if (taskState.failure !== undefined) {
         requireRuntimeTextByteLength(taskState.failure, `Text task ${taskState.taskId} failure`);
     }
-    if (taskState.status === "needs_attention" && latest?.failure !== taskState.failure) {
-        throw new Error(`Text task ${taskState.taskId} needs-attention failure must exactly match its latest attempt failure.`);
+    if (taskState.status === "needs_attention" && latest?.status === "failed" && latest.failure === undefined) {
+        throw new Error(`Text task ${taskState.taskId} lacks its latest execution failure.`);
     }
 }
 /** Check the persisted integration projection against the request before recovery or promotion. */

package/dist/worktree.d.ts

@@ -57,5 +57,3 @@ export declare function inspectWorktreeDirty(cwd: string, run?: GitRunner, inclu
  * recorded; any uncertainty preserves work and omits unknown measurements.
  */
 export declare function finalizeChildWorktree(info: WorktreeInfo, run?: GitRunner): Promise<WorktreePayload>;
-/** Context block telling the child to work inside its isolated worktree. */
-export declare function worktreeContextNote(info: WorktreeInfo): string;

package/dist/worktree.js

@@ -269,7 +269,3 @@ export async function finalizeChildWorktree(info, run = runGit) {
     }
     return { outcome: "pruned", path: info.path, branch: info.branch };
 }
-/** Context block telling the child to work inside its isolated worktree. */
-export function worktreeContextNote(info) {
-    return `\n\n[WORKTREE ISOLATION] Work only in ${info.path} on ${info.branch}; do not use main checkout. Commit changes to this branch for parent review.`;
-}

package/docs/orchestration.md

@@ -88,7 +88,7 @@ Every task declares `id`, `kind`, `role`, `modelClass`, `requirements`, `deliver
 - A `text` task runs in a disposable child worktree and must leave it unchanged.
 - A `changeset` task requires focused checks and owns one worktree, Herdr workspace, worker tab, and retained worker.
 - `dependsOn` controls ready waves; dependent tasks can run from a selected staged snapshot only after Main explicitly advances it.
-- `contextFrom` may reference completed text tasks only and preserves declaration order.
+- `contextFrom` may reference completed text tasks only, implies scheduling dependencies, and preserves declaration order. It must not overlap `dependsOn`.
 - A graph containing changesets requires final checks. The repository root must have a `package.json` test script; admission prepends canonical `pnpm test` if absent from final checks. Combined validation rejects a changed root test script.
 
 Admission and worker-wave dispatch pin Main's exact committed branch, HEAD, and tree without inspecting or modifying its staged, unstaged, or untracked edits. Worker allocation verifies the same committed identity around worktree creation, including resumed waves; staged-dependent waves verify their clean integration snapshot. A dirty Main can therefore produce a checked retained candidate, but branch/HEAD drift stops new waves. The runner executes ready worker tasks concurrently, inspects clean committed candidates, runs preliminary task checks and optional preliminary judgment, then records ready candidates for Main. **It does not automatically integrate them.** Main selects exact candidates via `subagent_stage` into an owned integration checkout in explicit order. Each stage is a committed merge of the candidate, not a mutation of Main. Conflicts retain the checkout for Main to resolve; `resolve` verifies the exact two-parent merge instead of replaying an uncertain merge. Main can explicitly run dependent tasks from an exact staged tip with `subagent_integrate advance` and stage their results afterward. Independent candidates may be staged without re-running workers.
@@ -118,7 +118,9 @@ State version 5 is stored privately under:
 <agent-dir>/config/pi-subagent/state/<repository-hash>/<request-id>.json
 ```
 
-Strict parsing rejects unknown properties, malformed evidence, invalid lineage, and old v4 state without migration; preserve old files and recover their work manually. Writes are atomic and repository productive work uses a durable process lease. `delegate_task` and `subagent_resume` acknowledge only after durable state is saved, then continue productive work asynchronously. A durably recorded worker attention state sends an immediate once-per-transition Pi follow-up to the launching session, even while siblings run; the wave also reports its final outcome. Isolated workers persist a private exact Pi session under the owned process lease so a proved final answer without a changed clean commit becomes attention rather than an indefinitely pending prompt. Missing or mismatched session proof cannot establish completion and never authorizes prompt replay. `subagent_status` is read-only and remains the recovery authority if a follow-up is missed. `subagent_resume` accepts only the continuation reported by state. `subagent_abort` performs exact worker termination and teardown.
+Strict parsing rejects unknown properties, malformed evidence, invalid lineage, and old v4 state without migration; preserve old files and recover their work manually. Writes are atomic and repository productive work uses a durable process lease. `delegate_task` and `subagent_resume` acknowledge only after durable state is saved, then continue productive work asynchronously. A durably recorded worker attention state sends an immediate once-per-transition Pi follow-up to the launching session, even while siblings run; the wave also reports its final outcome. Isolated workers persist a private exact Pi session under the owned process lease so a proved final answer without a changed clean commit becomes attention rather than an indefinitely pending prompt. Missing or mismatched session proof cannot establish completion and never authorizes prompt replay. `subagent_status` is read-only and remains the recovery authority if a follow-up is missed. `subagent_resume` accepts only the continuation reported by state. `subagent_abort` performs exact worker termination and conservative teardown. Without a retained candidate, it removes only owned checkouts still clean and unchanged from their pinned base, including ignored-file checks. Active productive execution defers cleanup until it settles. Repeating abort on an aborted request reconciles pending cleanup without replaying uncertain termination. Dirty or committed work and uncertain allocations stay retained with visible blockers; `/subagent recover` includes aborted requests with retained resources.
+
+Text attempt history records dispatches, not pre-dispatch inspection failures. Such failures retain task-level attention without adding an attempt or rewriting earlier execution diagnostics. A recorded interrupted dispatch still consumes an attempt. Verification requires the same passing preliminary checks, judgment, and ownership as candidate retention; readiness and the verified candidate are saved together.
 
 Productive execution has no whole-run wall-clock deadline. Long productive work and later resumes remain valid. The request retains its original policy snapshot and correction count; a resume cannot refill them. Current configuration may tighten the correction allowance. Child idle/hard runtime, subprocess I/O, status inspection, termination, cleanup, and outer abort remain bounded independently.
 

package/extensions/admission.ts

@@ -14,10 +14,6 @@ export function roleIsReadOnlyScout(role: Role): boolean {
 	return !roleCanWrite(role) && role.extensions.length === 0 && !role.mcps?.length;
 }
 
-export interface CheckoutAdmission {
-	register(pi: ExtensionAPI, directCanWrite: (input: unknown) => boolean): void;
-}
-
 async function checkoutKey(pi: ExtensionAPI, ctx: ExtensionContext): Promise<string> {
 	const cwd = await realpath(ctx.cwd);
 	const result = await pi.exec("git", ["rev-parse", "--show-toplevel"], { cwd, timeout: 5_000 });
@@ -32,7 +28,7 @@ async function checkoutKey(pi: ExtensionAPI, ctx: ExtensionContext): Promise<str
  * not an OS sandbox: external processes and trusted extension lifecycle code
  * remain outside interception.
  */
-export function createCheckoutAdmission(): CheckoutAdmission {
+export function registerCheckoutAdmission(pi: ExtensionAPI, directCanWrite: (input: unknown) => boolean): void {
 	const ownerByCheckout = new Map<string, string>();
 	const checkoutByCall = new Map<string, string>();
 	const release = (toolCallId: string) => {
@@ -41,30 +37,26 @@ export function createCheckoutAdmission(): CheckoutAdmission {
 		checkoutByCall.delete(toolCallId);
 		if (ownerByCheckout.get(key) === toolCallId) ownerByCheckout.delete(key);
 	};
-	return {
-		register(pi, directCanWrite) {
-			pi.on("tool_call", async (event, ctx) => {
-				const potentiallyWriting = event.toolName === "delegate_task"
-					? directCanWrite(event.input)
-					: !READ_ONLY_TOOLS.has(event.toolName);
-				if (!potentiallyWriting) return;
-				const key = await checkoutKey(pi, ctx);
-				const owner = ownerByCheckout.get(key);
-				if (owner && owner !== event.toolCallId) {
-					return {
-						block: true,
-						reason: `Checkout ${key} already has an admitted Pi writer (${owner}); retry after it settles.`,
-					};
-				}
-				ownerByCheckout.set(key, event.toolCallId);
-				checkoutByCall.set(event.toolCallId, key);
-			});
-			pi.on("tool_result", (event) => release(event.toolCallId));
-			pi.on("tool_execution_end", (event) => release(event.toolCallId));
-			pi.on("session_shutdown", () => {
-				ownerByCheckout.clear();
-				checkoutByCall.clear();
-			});
-		},
-	};
+	pi.on("tool_call", async (event, ctx) => {
+		const potentiallyWriting = event.toolName === "delegate_task"
+			? directCanWrite(event.input)
+			: !READ_ONLY_TOOLS.has(event.toolName);
+		if (!potentiallyWriting) return;
+		const key = await checkoutKey(pi, ctx);
+		const owner = ownerByCheckout.get(key);
+		if (owner && owner !== event.toolCallId) {
+			return {
+				block: true,
+				reason: `Checkout ${key} already has an admitted Pi writer (${owner}); retry after it settles.`,
+			};
+		}
+		ownerByCheckout.set(key, event.toolCallId);
+		checkoutByCall.set(event.toolCallId, key);
+	});
+	pi.on("tool_result", (event) => release(event.toolCallId));
+	pi.on("tool_execution_end", (event) => release(event.toolCallId));
+	pi.on("session_shutdown", () => {
+		ownerByCheckout.clear();
+		checkoutByCall.clear();
+	});
 }

package/extensions/config.ts

@@ -1,5 +1,6 @@
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { createConfigStore, extensionConfigPath } from "@henryqw/pi-config-store";
+import type { ExecutionPolicySnapshot } from "../dist/schema.js";
 
 export interface SubagentTimeoutConfig {
 	/** Minutes a child may stay idle before it is asked to stop. */
@@ -23,14 +24,7 @@ export interface LoadedSubagentConfig {
 	error?: string;
 }
 
-export interface EffectiveExecutionPolicy {
-	maxSubagents: number;
-	maxTurns: number;
-	maxTokens?: number;
-	childIdleMs: number;
-	childMaxMs: number;
-	maxCorrections: number;
-}
+export type EffectiveExecutionPolicy = ExecutionPolicySnapshot;
 
 type ParsedSubagentConfig = Omit<LoadedSubagentConfig, "source">;
 

package/extensions/isolated.ts

@@ -77,7 +77,6 @@ export const createIsolatedComponents: CreateIsolatedComponents = ({
 		resolveRoot,
 		preflightHost: async ({ root }, operation) => await host.preflightHost({ root }, operation),
 		inspectMainBase: async (input, operation) => await git.inspectMainBase(input, operation),
-		executionBudget,
 	});
 	return {
 		resolveRoot,
@@ -659,7 +658,7 @@ export function registerIsolatedExtension(pi: ExtensionAPI, options: RegisterIso
 	pi.registerTool({
 		name: "subagent_abort",
 		label: "Subagent abort",
-		description: "Abort one unfinished isolated request; retained candidates and integration checkouts must be explicitly rejected and released first. Terminate only exact owned workers.",
+		description: "Abort an isolated request; reject and release retained candidates and integration checkouts first. Terminate only exact owned workers. Repeat abort to reconcile cleanup of unchanged no-candidate allocations; preserve dirty or committed work.",
 		parameters: IdOnlySchema,
 		prepareArguments: parseIdOnly,
 		async execute(_toolCallId, params, signal, _onUpdate, ctx) {