@lincoln504/pi-research 1.2.0 → 1.3.0

package/src/orchestration/research-orchestration-service.ts

@@ -39,6 +39,7 @@ import { getCachedScrapedContent, normalizeUrl, cleanupSharedLinks } from '../ut
 import { runResearcher } from './researcher-executor.ts';
 import { ResearchRunSemaphore, ResearchRunCapacityError } from '../infrastructure/research-run-semaphore.ts';
 import { recordResearcherFailure, shouldStopResearch, createResearchStopError } from './session-state.ts';
+import { isAbortSentinel, boundSessionAbort } from './abort-utils.ts';
 import type { ResearchSessionService } from './research-session-service.ts';
 import { QuickResearchOrchestrator } from './quick-research-orchestrator.ts';
 import { DeepResearchOrchestrator } from './deep-research-orchestrator.ts';
@@ -344,8 +345,34 @@ export class ResearchOrchestrationService implements IResearchOrchestration {
       // without this an early check, up to maxConcurrent-1 extra researchers could
       // start past the stop threshold and waste a browser slot + an LLM call.
       if (shouldStopResearch(sessionId, researchId, maxFailedResearchers)) {
-        const sessionService = await getService<ResearchSessionService>(ServiceNames.RESEARCH_SESSION_SERVICE, ctx, container);
-        await sessionService.abortAllSessions(researchId);
+        // A SIGTERM mid-run disposes the container, and getService then throws
+        // "Cannot get service … during container disposal" — which would REPLACE
+        // the already-decided stop error with a raw service error. Teardown is
+        // happening either way, so a failure here must not gate the stop throw.
+        try {
+          const sessionService = await getService<ResearchSessionService>(ServiceNames.RESEARCH_SESSION_SERVICE, ctx, container);
+          // Bounded: abortAllSessions awaits each session's abort, and session.abort()
+          // can wedge on the very in-flight call it is cancelling — an unbounded await
+          // here would hang the fast-stop throw for as long as the wedged call takes.
+          // Proceed after the bound; the abandoned aborts drain in the background.
+          await boundSessionAbort(
+            sessionService.abortAllSessions(researchId),
+            () => logger.debug('[ResearchOrchestrationService] Fast-stop abortAllSessions did not settle within bound; proceeding with stop'),
+          );
+        } catch (abortErr) {
+          logger.debug(`[ResearchOrchestrationService] Fast-stop session abort unavailable (container disposing?): ${abortErr instanceof Error ? abortErr.message : String(abortErr)}`);
+        }
+        // abortAllSessions only reaches REGISTERED sessions; a researcher still
+        // building a session, in a retry backoff, or in its initial-links search
+        // loop self-stops via shouldStopResearch (researcher-executor.ts). Bound-
+        // await the active set so those self-stops settle BEFORE the stop error
+        // returns the run and releases its run-cap slot — bounded for the same
+        // reason as boundSessionAbort: one wedged researcher must not hang the
+        // already-decided stop.
+        await boundSessionAbort(
+          Promise.allSettled(active).then(() => undefined),
+          () => logger.debug('[ResearchOrchestrationService] Fast-stop: active researchers did not settle within bound; proceeding with stop'),
+        );
         throw createResearchStopError(sessionId, researchId);
       }
 
@@ -365,7 +392,7 @@ export class ResearchOrchestrationService implements IResearchOrchestration {
         }) : null;
         try {
           await Promise.race([...active, ...(abortPromise ? [abortPromise] : [])])
-            .catch(err => { if (err.message !== 'Aborted') throw err; });
+            .catch(err => { if (!isAbortSentinel(err.message)) throw err; });
         } finally {
           if (signal && onAbort) signal.removeEventListener('abort', onAbort);
         }
@@ -394,11 +421,18 @@ export class ResearchOrchestrationService implements IResearchOrchestration {
           });
         } catch (err) {
           const errMsg = err instanceof Error ? err.message : String(err);
-          // A user cancellation (quit mid-run) surfaces here as an 'Aborted' throw.
-          // That is a clean stop, not a researcher failure: don't log it at ERROR,
-          // don't count it toward the fast-stop threshold, and don't paint the TUI
-          // researcher slice red. Mirrors the guard in researcher-executor.ts.
-          if (signal?.aborted || errMsg === 'Aborted') {
+          // A user cancellation (quit mid-run) surfaces here as an abort-sentinel
+          // throw — either the race's bare 'Aborted' or the '<id>: Aborted' that
+          // ensureAssistantResponse raises for an externally-aborted session (the
+          // fast-stop path). Container disposal (SIGTERM mid-run) is the same
+          // clean-teardown class: the executor stops retrying on it, and counting
+          // its "during container disposal" throw as a researcher failure both
+          // paints a red slice with a bogus root cause and can trip
+          // shouldStopResearch during shutdown. None of these are researcher
+          // failures: don't log at ERROR, don't count toward the fast-stop
+          // threshold, don't paint the TUI slice red. Mirrors the guard in
+          // researcher-executor.ts.
+          if (signal?.aborted || isAbortSentinel(errMsg) || container?.isDisposing || errMsg.includes('during container disposal')) {
             logger.debug(`[ResearchOrchestrationService] Researcher ${id} cancelled (aborted).`);
           } else {
             logger.error(`[ResearchOrchestrationService] Researcher ${id} failed: ${errMsg}`);
@@ -436,9 +470,27 @@ export class ResearchOrchestrationService implements IResearchOrchestration {
       }
 
       if (shouldStopResearch(sessionId, researchId, maxFailedResearchers)) {
-        const sessionService = await getService<ResearchSessionService>(ServiceNames.RESEARCH_SESSION_SERVICE, ctx, container);
-        // Abort sessions specifically for this researchId, not the whole piSessionId
-        await sessionService.abortAllSessions(researchId);
+        // getService can throw during container disposal — same guard as the
+        // pre-launch fast-stop above: the stop error must win, not a raw
+        // "Cannot get service … during container disposal".
+        try {
+          const sessionService = await getService<ResearchSessionService>(ServiceNames.RESEARCH_SESSION_SERVICE, ctx, container);
+          // Abort sessions specifically for this researchId, not the whole piSessionId.
+          // Bounded for the same reason as the pre-launch fast-stop above: a wedged
+          // session.abort() must not gate the stop error that is already decided.
+          await boundSessionAbort(
+            sessionService.abortAllSessions(researchId),
+            () => logger.debug('[ResearchOrchestrationService] Fast-stop abortAllSessions did not settle within bound; proceeding with stop'),
+          );
+        } catch (abortErr) {
+          logger.debug(`[ResearchOrchestrationService] Fast-stop session abort unavailable (container disposing?): ${abortErr instanceof Error ? abortErr.message : String(abortErr)}`);
+        }
+        // Bound-await the active set so unregistered researchers self-stop before
+        // the stop error releases the run-cap slot (see the pre-launch site).
+        await boundSessionAbort(
+          Promise.allSettled(active).then(() => undefined),
+          () => logger.debug('[ResearchOrchestrationService] Fast-stop: active researchers did not settle within bound; proceeding with stop'),
+        );
 
         throw createResearchStopError(sessionId, researchId);
       }

package/src/orchestration/research-session-service.ts

@@ -12,6 +12,7 @@ import type { AgentSession } from '@earendil-works/pi-coding-agent';
 import { logger } from '../logger.ts';
 import { ServiceLifecycle, type IService } from '../core/service-registry.ts';
 import { ServiceNames } from '../core/interfaces/service-names.ts';
+import { boundSessionAbort } from './abort-utils.ts';
 
 /**
  * Session entry with abort capability
@@ -99,26 +100,51 @@ export class ResearchSessionService implements IService {
   }
 
   /**
-   * Abort all active sessions for a specific sessionId, or all sessions if sessionId is omitted
+   * Abort all active sessions for a specific sessionId, or all sessions if sessionId is omitted.
+   *
+   * Each abort is bounded (boundSessionAbort): entry.abort() awaits the very
+   * in-flight call it is cancelling, which may never settle — and this method
+   * gates both the fast-stop throw (runResearchers) and run()'s finally via
+   * cleanup(), so one wedged session would otherwise hang the whole run's
+   * return. When the bound fires, teardown proceeds and the abandoned abort
+   * keeps draining in the background.
    */
   async abortAllSessions(sessionId?: string): Promise<void> {
     if (sessionId) {
-      const sessionMap = this.getSessionMap(sessionId);
-      const aborts = Array.from(sessionMap.values()).map((entry, index) =>
-        entry.abort().catch((err) => {
-          logger.warn(`[ResearchSessionService] Failed to abort session ${index}:`, err);
-        })
+      // Read path: peek, never create — getSessionMap would resurrect an empty
+      // bucket for an already-completed researchId and leak it forever.
+      const sessionMap = this.peekSessionMap(sessionId);
+      if (!sessionMap) return;
+      // Snapshot BEFORE awaiting: only the entries aborted below may be removed.
+      // A session registered (or re-registered under the same id) DURING the
+      // bounded awaits — e.g. a researcher retry building a fresh session — was
+      // never aborted here; a blanket clear() would silently orphan it live.
+      const snapshot = Array.from(sessionMap.entries());
+      const aborts = snapshot.map(([, entry], index) =>
+        boundSessionAbort(
+          entry.abort().catch((err) => {
+            logger.warn(`[ResearchSessionService] Failed to abort session ${index}:`, err);
+          }),
+          () => logger.debug(`[ResearchSessionService] Session ${index} abort did not settle within bound; continuing teardown`),
+        )
       );
       await Promise.all(aborts);
-      sessionMap.clear();
-      this.sessions.delete(sessionId);
+      for (const [id, entry] of snapshot) {
+        // Identity check: delete only the exact entry we aborted, not a
+        // same-id replacement registered while we awaited.
+        if (sessionMap.get(id) === entry) sessionMap.delete(id);
+      }
+      if (sessionMap.size === 0) this.sessions.delete(sessionId);
     } else {
       const aborts: Promise<void>[] = [];
       for (const sessionMap of this.sessions.values()) {
         aborts.push(...Array.from(sessionMap.values()).map((entry, index) =>
-          entry.abort().catch((err) => {
-            logger.warn(`[ResearchSessionService] Failed to abort session ${index}:`, err);
-          })
+          boundSessionAbort(
+            entry.abort().catch((err) => {
+              logger.warn(`[ResearchSessionService] Failed to abort session ${index}:`, err);
+            }),
+            () => logger.debug(`[ResearchSessionService] Session ${index} abort did not settle within bound; continuing teardown`),
+          )
         ));
       }
       await Promise.all(aborts);

package/src/orchestration/researcher-executor.ts

@@ -19,7 +19,8 @@ import { getService, tryGetServiceContainerFromCtx } from '../core/service-regis
 import type { ResearchSessionService } from './research-session-service.ts';
 import { loadPrompt } from '../core/llm/prompts.ts';
 import { injectCurrentDate } from '../core/llm/inject-date.ts';
-import { recordResearcherFailure, getSteeringMessages } from './session-state.ts';
+import { recordResearcherFailure, getSteeringMessages, shouldStopResearch } from './session-state.ts';
+import { isAbortSentinel, boundSessionAbort } from './abort-utils.ts';
 import type { RunResearcherOptions } from './orchestration-types.ts';
 import { search } from '../web-research/search.ts';
 
@@ -46,6 +47,15 @@ export async function runResearcher(options: RunResearcherOptions): Promise<void
   
   const id = String(researcherConfig.id);
   const container = tryGetServiceContainerFromCtx(ctx);
+
+  // Fast-stop self-check: when the run's failure threshold trips, runResearchers'
+  // fast-stop path aborts only REGISTERED sessions — a researcher that is still
+  // acquiring initial links, sleeping between attempts, or rebuilding a session
+  // has none, and would otherwise sail on into a full LLM session + scrape burst
+  // AFTER the run already returned and released its run-cap slot. Every launch /
+  // retry boundary below consults this and exits quietly instead (the stop error
+  // is the run's outcome, not this researcher's failure).
+  const stopRequested = (): boolean => shouldStopResearch(sessionId, researchId, config.MAX_FAILED_RESEARCHERS);
   observer?.onResearcherStart?.(id, researcherConfig.name, researcherConfig.goal, round);
   metrics.increment('researchers_launched_total', 1, { mode: 'deep', complexity: String(complexity), round: String(round) });
 
@@ -81,12 +91,12 @@ export async function runResearcher(options: RunResearcherOptions): Promise<void
     const maxLinkAttempts = config.RESEARCHER_MAX_RETRIES + 1;
     for (let linkAttempt = 1; linkAttempt <= maxLinkAttempts && effectiveInitialLinks.length === 0; linkAttempt++) {
       if (linkAttempt > 1) {
-        if (signal?.aborted || container?.isDisposing) break;
+        if (signal?.aborted || container?.isDisposing || stopRequested()) break;
         const delay = Math.min(1000 * Math.pow(2, linkAttempt - 2), config.RESEARCHER_MAX_RETRY_DELAY_MS);
         logger.warn(`[ResearcherExecutor] Researcher ${id} has no initial search results; retry ${linkAttempt - 1}/${config.RESEARCHER_MAX_RETRIES} after ${delay}ms`);
         await new Promise(r => setTimeout(r, delay));
       }
-      if (signal?.aborted || container?.isDisposing) break;
+      if (signal?.aborted || container?.isDisposing || stopRequested()) break;
       try {
         const queryResults = await search(retryQueries, config, signal, undefined, container);
         const urls = new Set<string>();
@@ -99,6 +109,17 @@ export async function runResearcher(options: RunResearcherOptions): Promise<void
       }
     }
 
+    // A cancel/teardown/fast-stop lands here with zero links because the loop
+    // above breaks on abort/disposal/stop — that is a clean stop, not a "search
+    // produced nothing" researcher failure. Return quietly (mirrors the
+    // cancellation treatment in runResearchers) instead of recording a failure,
+    // bumping the skip metric, and painting a red failed slice with a bogus root
+    // cause on a plain cancel.
+    if (signal?.aborted || container?.isDisposing || stopRequested()) {
+      logger.debug(`[ResearcherExecutor] Researcher ${id} cancelled while acquiring initial links; skipping quietly.`);
+      return;
+    }
+
     if (effectiveInitialLinks.length === 0) {
       logger.warn(`[ResearcherExecutor] Researcher ${id} has no initial search results or historical links after ${maxLinkAttempts} attempt(s); skipping.`);
       // Use the resolved sessionId (= piSessionId), NOT the raw ctx.sessionId: when
@@ -124,11 +145,44 @@ export async function runResearcher(options: RunResearcherOptions): Promise<void
   const deliveredSteeringIds = new Set<string>();
 
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    // Launch boundary: never build a session for a run that is already cancelled
+    // or fast-stopped. The abort sentinel keeps the wrapper's clean-cancel
+    // classification (runResearchers treats it exactly like the race's throw);
+    // the fast-stop exit is quiet — see stopRequested above.
+    if (signal?.aborted) throw new Error('Aborted');
+    if (stopRequested()) {
+      logger.debug(`[ResearcherExecutor] Researcher ${id} exiting before attempt ${attempt}: fast-stop threshold crossed.`);
+      return;
+    }
     if (attempt > 1) {
       const delay = Math.min(1000 * Math.pow(2, attempt - 2), config.RESEARCHER_MAX_RETRY_DELAY_MS);
       logger.warn(`[ResearcherExecutor] Researcher ${id} retry ${attempt - 1}/${config.RESEARCHER_MAX_RETRIES} after ${delay}ms`);
       observer?.onResearcherProgress?.(id, 'retry');
-      await new Promise(r => setTimeout(r, delay));
+      // Abortable: a cancel during this backoff must wake the sleep immediately —
+      // an inert setTimeout held the loop for up to RESEARCHER_MAX_RETRY_DELAY_MS
+      // after the cancel and then re-entered a full attempt (fresh session +
+      // billed prompt). Mirrors the stagger sleep in runResearchers.
+      await new Promise<void>((resolve) => {
+        const timer = setTimeout(() => {
+          if (signal) signal.removeEventListener('abort', onAbort);
+          resolve();
+        }, delay);
+        const onAbort = () => { clearTimeout(timer); resolve(); };
+        if (signal) {
+          if (signal.aborted) onAbort();
+          else signal.addEventListener('abort', onAbort, { once: true });
+        }
+      });
+      // Re-launch boundary after the sleep: a cancel, fast-stop, or container
+      // teardown landing DURING the backoff must not re-enter a full attempt —
+      // this is exactly the window the fast-stop path cannot reach, because
+      // abortAllSessions only aborts registered sessions and a between-attempts
+      // researcher has none.
+      if (signal?.aborted) throw new Error('Aborted');
+      if (stopRequested() || container?.isDisposing) {
+        logger.debug(`[ResearcherExecutor] Researcher ${id} exiting after backoff: fast-stop or container teardown.`);
+        return;
+      }
     }
 
     // Generate prompt for this attempt, incorporating ALL steering messages delivered so far
@@ -229,6 +283,32 @@ export async function runResearcher(options: RunResearcherOptions): Promise<void
       throw registrationError;
     }
 
+    // Post-registration self-check: this session is now visible to
+    // abortAllSessions(), but that scan is point-in-time — a stop/cancel that
+    // landed anywhere between createResearcherSession() resolving and
+    // registerSession() actually running (the `await getService(...)` above can
+    // yield the event loop) would have missed this session entirely, and every
+    // other guard in this function only fires BEFORE session creation or
+    // BETWEEN attempts. Nothing between here and session.prompt() below awaits
+    // anything, so this single check closes the whole window: either it fires
+    // here, or the run is not stopping and prompt() is about to make this
+    // session's registration meaningful. Mirrors the top-of-loop launch
+    // boundary above exactly (signal throws, fast-stop returns quietly) —
+    // deliberately NOT container?.isDisposing: like that boundary, this is
+    // still attempt 1's launch, and a disposing container must let this
+    // attempt's own session.prompt() fail naturally into the catch block's
+    // disposal classification rather than being pre-empted here.
+    if (signal?.aborted || stopRequested()) {
+      logger.debug(`[ResearcherExecutor] Researcher ${id} exiting right after session creation: fast-stop/cancel landed before prompt() was reached.`);
+      await boundSessionAbort(
+        session.abort().catch((err) => logger.warn(`[ResearcherExecutor] Failed to abort researcher session ${id} on post-creation fast-stop:`, err)),
+        () => logger.warn(`[ResearcherExecutor] Researcher ${id} session abort did not settle within 10s; continuing cleanup`),
+      );
+      sessionService.unregisterSession(researchId, id);
+      if (signal?.aborted) throw new Error('Aborted');
+      return;
+    }
+
     let lastSteeringCheck = Date.now();
 
     // User-supplied observer callbacks (SDK consumers) are invoked from inside
@@ -399,13 +479,19 @@ export async function runResearcher(options: RunResearcherOptions): Promise<void
         logger.debug(`[ResearcherExecutor] Researcher ${id} salvage attempt failed:`, salvageErr);
       }
       
-      // Skip retries when the run is being torn down: an aborted signal, an explicit
-      // "Aborted" error, or the service container entering disposal (SIGTERM/quit
-      // mid-run, which throws "…during container disposal" from getService). Retrying
-      // during disposal is futile — services are being destroyed — and it relaunches
-      // search bursts into a WorkerPool that dispose() is simultaneously destroying,
-      // producing a storm of "Cannot execute a task on destroying pool" errors.
-      if (signal?.aborted || errMsg === 'Aborted' || errMsg.includes('during container disposal') || container?.isDisposing) {
+      // Skip retries when the run is being torn down: an aborted signal, the abort
+      // sentinel, or the service container entering disposal (SIGTERM/quit mid-run,
+      // which throws "…during container disposal" from getService). The sentinel has
+      // TWO forms — the race's bare 'Aborted' above AND the '<id>: Aborted' that
+      // ensureAssistantResponse throws when a fast-stop abortAllSessions() aborted
+      // this session externally (prompt() then resolves normally) — so match it via
+      // isAbortSentinel, not exact equality: the prefixed form used to slip past
+      // this guard and RETRY a researcher the fast-stop path had just aborted.
+      // Retrying during disposal is futile — services are being destroyed — and it
+      // relaunches search bursts into a WorkerPool that dispose() is simultaneously
+      // destroying, producing a storm of "Cannot execute a task on destroying pool"
+      // errors.
+      if (signal?.aborted || isAbortSentinel(errMsg) || errMsg.includes('during container disposal') || container?.isDisposing) {
         logger.debug(`[ResearcherExecutor] Researcher ${id} aborted or container disposing, skipping retries.`);
         break; // Break out of the attempt loop
       }
@@ -423,18 +509,12 @@ export async function runResearcher(options: RunResearcherOptions): Promise<void
       // never settle — never let per-attempt cleanup hang the retry loop on it. The
       // retry builds a fresh session; the abandoned abort keeps draining in the
       // background and its session dies with the run's teardown.
-      await Promise.race([
+      await boundSessionAbort(
         session.abort().catch((err) => {
           logger.warn(`[ResearcherExecutor] Failed to abort researcher session ${id}:`, err);
         }),
-        new Promise<void>((resolve) => {
-          const t = setTimeout(() => {
-            logger.warn(`[ResearcherExecutor] Researcher ${id} session abort did not settle within 10s; continuing cleanup`);
-            resolve();
-          }, 10_000);
-          t.unref?.();
-        }),
-      ]);
+        () => logger.warn(`[ResearcherExecutor] Researcher ${id} session abort did not settle within 10s; continuing cleanup`),
+      );
       sessionService?.unregisterSession(researchId, id);
 
       // Restore the default thinking label now that the researcher is done.

package/src/orchestration/researcher.ts

@@ -23,6 +23,7 @@ import { logger } from '../logger.ts';
 
 import { resolveResearchModel } from '../core/llm/research-model-resolver.ts';
 import { getRuntimeForRegistry } from '../core/llm/model-registry-factory.ts';
+import { boundSessionAbort } from './abort-utils.ts';
 
 export interface CreateResearcherSessionOptions {
   cwd: string;
@@ -158,27 +159,45 @@ export async function createResearcherSession(options: CreateResearcherSessionOp
       thinkingLevel: config?.LLM_THINKING_LEVEL ?? 'off',
     });
 
-    // Customize the agent thinking label for researchers (e.g. "Researcher 1.1")
-    // so non-TUI surfaces can tell concurrent researchers apart. Skip this in the
-    // research TUI (mode === 'tui'): the panel already shows every researcher, and
-    // the host renders this label as dim/italic thinking text ABOVE the panel —
-    // stray output the panel was meant to replace. Use the researcherId passed by
-    // the caller (not regex on the prompt, since the ID is never templated in).
-    if (extensionCtx.mode !== 'tui' && extensionCtx.hasUI && typeof extensionCtx.ui.setHiddenThinkingLabel === 'function') {
-      extensionCtx.ui.setHiddenThinkingLabel(
-        researcherId ? `Researcher ${researcherId}` : undefined
-      );
+    // The session above is LIVE from here on, but the caller only receives it at
+    // the return below — a throw anywhere in this tail (a host UI callback, the
+    // validity check) would rethrow a session nobody owns, leaking it unaborted.
+    // Abort it best-effort (bounded: session.abort() awaits the in-flight call it
+    // cancels and may never settle) before rethrowing.
+    try {
+      // Customize the agent thinking label for researchers (e.g. "Researcher 1.1")
+      // so non-TUI surfaces can tell concurrent researchers apart. Skip this in the
+      // research TUI (mode === 'tui'): the panel already shows every researcher, and
+      // the host renders this label as dim/italic thinking text ABOVE the panel —
+      // stray output the panel was meant to replace. Use the researcherId passed by
+      // the caller (not regex on the prompt, since the ID is never templated in).
+      if (extensionCtx.mode !== 'tui' && extensionCtx.hasUI && typeof extensionCtx.ui.setHiddenThinkingLabel === 'function') {
+        extensionCtx.ui.setHiddenThinkingLabel(
+          researcherId ? `Researcher ${researcherId}` : undefined
+        );
+      }
+
+      logger.log(`[Researcher] Created session with model=${modelToUse?.id || 'unknown'}`);
+
+      if (!result || !result.session) {
+        throw new Error('Session creation returned invalid result');
+      }
+
+      sessionRef.session = result.session;
+
+      return { session: result.session, resolvedModel: modelToUse };
+    } catch (tailError) {
+      const session = result?.session;
+      if (session && typeof session.abort === 'function') {
+        await boundSessionAbort(
+          (async () => session.abort())().catch((abortErr) => {
+            logger.warn('[Researcher] Failed to abort never-returned session:', abortErr);
+          }),
+          () => logger.warn('[Researcher] Never-returned session abort did not settle within bound; continuing'),
+        );
+      }
+      throw tailError;
     }
-
-    logger.log(`[Researcher] Created session with model=${modelToUse?.id || 'unknown'}`);
-
-    if (!result || !result.session) {
-      throw new Error('Session creation returned invalid result');
-    }
-
-    sessionRef.session = result.session;
-
-    return { session: result.session, resolvedModel: modelToUse };
   } catch (error) {
     const errorMsg = error instanceof Error ? error.message : String(error);
     throw new Error(`Failed to create researcher session: ${errorMsg}`, {

package/src/orchestration/session-state.ts

@@ -520,6 +520,17 @@ export function endResearchSession(piSessionId: string | undefined, researchId:
   // but preserve steering messages if any remain (they might arrive between
   // the last research end and the next research start)
   if (state.order.length === 0 && state.panels.size === 0) {
+    // Drop steering messages this run already consumed ('active') — and any
+    // 'popped' remnants, which are likewise already resolved — before deciding
+    // whether to keep the session alive. Without this, a message the run that
+    // just ended already consumed stayed in the array and leaked into a later,
+    // unrelated run's steering (both getActiveSteeringMessages/getSteeringMessages
+    // reads and the before_agent_start injection gate), since nothing distinguishes
+    // "steering for THIS run" from "steering already applied to a finished run".
+    // Only messages still 'queued' (arrived in the gap, never attached to any run)
+    // are genuinely eligible for the gap-preservation this block performs.
+    state.steeringMessages = state.steeringMessages.filter(m => m.status === 'queued');
+
     // Only fully delete if there are no remaining steering messages
     const hasRemainingSteering = state.steeringMessages.length > 0;
     if (!hasRemainingSteering) {