@mjasnikovs/pi-task 0.38.30 → 0.38.32

package/dist/task/child-runner.js

@@ -9,21 +9,21 @@ import { spawn } from 'node:child_process';
 import { getPiInvocation } from '../shared/pi-invocation.js';
 import { runChild as runChildUnified } from '../shared/child-process.js';
 import { childBaseArgs } from '../shared/child-extensions.js';
-import { LoopDetector } from './loop-detector.js';
+import { LoopDetector, MAX_LOOP_RESTARTS } from './loop-detector.js';
 import { StallDetector, formatStallHint } from './stall-detector.js';
 import { detectLeakedToolCall, leakedToolCallHint, MAX_LEAK_RETRIES } from '../shared/leaked-tool-call.js';
 import { readSection, setTaskSection } from './task-io.js';
 import { streamStallCause } from '../shared/stream-watchdog.js';
+import { commandCeilingForAttempt, commandTimeoutHint, commandWatch } from '../shared/command-watchdog.js';
+import { childModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
+import { modelSpecFromArgs } from '../config/group-models.js';
+// VALUE import, and it is only safe because worker-profiles.ts reads its loop
+// constants from loop-detector.ts. Point those back at this file and the graph
+// closes into a TDZ ReferenceError that no compile step catches.
+import { workerPolicy } from '../workers/worker-profiles.js';
 import { getConfig } from '../config/config.js';
-import { groupThinkingArgs } from '../config/reasoning-args.js';
-import { reasoningGroupForChild } from '../config/reasoning.js';
-// ─── Loop detection constants ────────────────────────────────────────────────
-// Defined here (not in phases.ts) to avoid a circular dependency:
-//   phases.ts → child-runner.ts → phases.ts
-export const LOOP_WINDOW = 20;
-export const LOOP_THRESHOLD = 5;
-export const MAX_LOOP_RESTARTS = 2; // 3 strikes total (initial attempt + 2 restarts)
-// MAX_LEAK_RETRIES lives in shared/leaked-tool-call.ts (imported above).
+import { groupChildArgs, groupWindow } from '../config/group-args.js';
+import { groupForChild } from '../config/groups.js';
 // ─── Phase-child wall-clock cap ──────────────────────────────────────────────
 /**
  * Optional wall-clock bound on ONE spawn of a phase child. DEFAULT: OFF.
@@ -105,6 +105,75 @@ export class PhaseTimeoutError extends Error {
         this.name = 'PhaseTimeoutError';
     }
 }
+/**
+ * The terminal error for a guard kill, or null when the child was not killed.
+ *
+ * Both spawn paths must ask. A kill reports `exitCode: 0` (child-process.ts uses
+ * `code ?? 0`, and a signal gives null), so a path that tests the exit code
+ * instead returns the truncated text as the phase's answer.
+ */
+export function guardKillError(name, r, opts = {}) {
+    if (r.commandKill)
+        return new CommandTimeoutError(name, r.commandKill);
+    // A dead-backend verdict is only trusted once every attempt has produced it.
+    // The probe now asks about this child's own endpoint rather than ORing over
+    // every provider, so it is exact — but it is still one network call at one
+    // instant, and a blip is indistinguishable from a death in a single sample.
+    // The asymmetry settles it: a backend that really is down costs three 5s
+    // probes, a wrong verdict costs the whole run.
+    if (r.stalled)
+        return opts.finalAttempt === false ? null : new BackendDownError(name);
+    return null;
+}
+/**
+ * The dead-backend probe killed a phase child on its LAST attempt.
+ *
+ * Reaching this means every attempt found no endpoint answering, not one. The
+ * single-probe verdict is not trusted on its own, because one sample cannot tell
+ * a dead server from a blip. Three failed probes cost ~15s; one wrong verdict
+ * costs the run.
+ */
+export class BackendDownError extends Error {
+    childName;
+    constructor(childName) {
+        super(`${childName} child killed: no output for the stall window and the model `
+            + `endpoint did not answer a probe`);
+        this.childName = childName;
+        this.name = 'BackendDownError';
+    }
+}
+/**
+ * A phase child spent every attempt on a command that never returned. Its own
+ * class because the fix is in the SPEC, not the model's exploration: a VERIFY
+ * block naming an unbounded `dev` command re-hangs every attempt.
+ */
+export class CommandTimeoutError extends Error {
+    childName;
+    kill;
+    constructor(childName, kill) {
+        super(`${childName} child ran \`${kill.toolName}\``
+            + `${kill.detail ? ` (${kill.detail})` : ''} past its `
+            + `${Math.round(kill.timeoutMs / 1000)}s ceiling on every attempt`);
+        this.childName = childName;
+        this.kill = kill;
+        this.name = 'CommandTimeoutError';
+    }
+}
+/**
+ * Causes a best-effort `catch` must NOT absorb.
+ *
+ * A phase child that merely answered badly should degrade — that is what those
+ * catches are for. These two are different in kind: the run is over either way,
+ * and swallowing them ships a half-built spec while every later phase dies
+ * against the same dead backend, or turns a user's ESC into silent progress.
+ * `failure-classifier.ts` has a verdict for both; a catch that eats them makes it
+ * unreachable.
+ */
+export function isFatalChildCause(e) {
+    if (e instanceof BackendDownError)
+        return true;
+    return e instanceof Error && e.message === USER_CANCELLED;
+}
 // ─── Connection-error retry ──────────────────────────────────────────────────
 /**
  * A connection-class model error is transient: a single dropped fetch to a live
@@ -120,9 +189,54 @@ export class PhaseTimeoutError extends Error {
  * provider 5xx that names a real fault) still fails fast: re-spawning against
  * the same request won't fix it, so burning the budget only delays the report.
  */
-const CONNECTION_ERROR_RE = /\b(?:connection error|connection (?:lost|closed|reset|refused|aborted)|econnreset|econnrefused|econnaborted|epipe|etimedout|enetunreach|enetdown|eai_again|socket hang up|fetch failed|network (?:error|timeout)|premature close|request timed out|terminated|unreachable)\b/i;
+/**
+ * Transport-level failures worth another attempt.
+ *
+ * SCOPE, and it is deliberate: connection classes only. pi's own
+ * `isRetryableAssistantError` (@earendil-works/pi-ai, `dist/utils/retry.js`) also
+ * retries the provider-LOAD family — `429`, `5xx`, `rate limit`, `overloaded` —
+ * which `does NOT match real, non-transient faults` in child-runner.test.ts
+ * explicitly rejects. That disagreement is real and OPEN; it is not settled here,
+ * because this backoff starts at 500ms and a 429 answered that fast is a retry
+ * storm, not a recovery.
+ *
+ * MEASURED against pi before widening: the transport entries added here — a bare
+ * `timed out`, `getaddrinfo ENOTFOUND`, `upstream connect`, `reset before
+ * headers`, a truncated Anthropic stream and a closed websocket — were all
+ * MISSES. Every one is a REMOTE-provider failure, which is why a local llama.cpp
+ * setup never surfaced the gap. The errno spellings are pi-task's own: a child
+ * reports them through stderr, and pi never sees them.
+ *
+ * pi's bare `timeout` is deliberately NOT reproduced. It matched a provider 400
+ * that merely echoed a `timeout` field back, turning a fail-fast into a full
+ * retry budget, and it caught nothing the `timed out` spellings above miss.
+ */
+const CONNECTION_ERROR_RE = /\b(?:connection error|connection (?:lost|closed|reset|refused|aborted)|econnreset|econnrefused|econnaborted|epipe|etimedout|enetunreach|enetdown|eai_again|socket hang up|socket connection was closed|fetch failed|network (?:error|timeout)|premature close|terminated|unreachable|getaddrinfo|enotfound|upstream.?connect|reset before headers|timed? out|ended without|stream ended before message_stop|websocket.?(?:closed|error))\b/i;
+/**
+ * Provider LOAD, which is transient in a different way: the server is up and
+ * saying "not now". pi retries all of these; 53f0488 did not, but its own message
+ * names only "context overflow, bad request, auth" as the fail-fast set — a
+ * throttle was never argued for, it just rode along in a list written for a LOCAL
+ * server, where none of these can occur.
+ *
+ * Words carry no trailing \b (`overloaded_error` joins on `_`, which is a word
+ * character); the bare status codes carry one, or `500` matches inside `15000`.
+ */
+const PROVIDER_LOAD_RE = /(?:overloaded|rate.?limit|too many requests|service.?unavailable|server.?error|internal.?error|provider.?returned.?error)|\b(?:429|500|502|503|504|524)\b/i;
+/**
+ * Account facts, not liveness: a budget does not refill on a retry. Checked FIRST,
+ * because these arrive worded as a throttle — `429 GoUsageLimitError` is a
+ * subscription limit, not a queue.
+ */
+const NON_RETRYABLE_RE = /\b(?:insufficient_quota|quota exceeded|out of budget|billing|usage limit reached|available balance|GoUsageLimitError|FreeUsageLimitError)\b/i;
+/**
+ * Retry budget is three attempts at 500ms/1s/2s — three requests over 3.5s, which
+ * is not a storm even against a throttle. pi's own ladder is three at 2s/4s/8s.
+ */
 export function isConnectionError(cause) {
-    return CONNECTION_ERROR_RE.test(cause);
+    if (NON_RETRYABLE_RE.test(cause))
+        return false;
+    return CONNECTION_ERROR_RE.test(cause) || PROVIDER_LOAD_RE.test(cause);
 }
 /** Exponential backoff before a connection-error retry: 500ms, 1s, 2s, …, so a
  *  brief saturation window can drain before we re-issue the request. */
@@ -133,12 +247,16 @@ const defaultSleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 // ─── Spawn helpers ───────────────────────────────────────────────────────────
 export function childArgs(tools, extensions = [], 
 /**
- * An already-resolved `['--thinking', level]`, or `[]` for "emit no flag".
- * Resolved by the CALLER, never here: the level is a property of the child's
- * ROLE, and this function is handed tools and extensions, not a name.
- * Omitted ⇒ byte-identical argv to the version before reasoning profiles.
+ * This child's group fragment: `--model` then `--thinking`, either half
+ * possibly absent. Resolved by the CALLER, never here — both are properties
+ * of the child's ROLE, and this function is handed tools and extensions, not
+ * a name. Omitted ⇒ byte-identical argv to the version before group profiles.
+ *
+ * ONE field rather than a `model` beside a `thinking`, because nothing may
+ * compose the two halves by hand: `groupChildArgs` is the only producer, so a
+ * doubled `--thinking` is unreachable rather than merely unlikely.
  */
-thinking = []) {
+groupArgs = []) {
     // `--mode json` puts the child into the structured event stream the
     // unified runner parses in `mode: 'json-events'`. Without it the child
     // emits plain text, every line fails JSON.parse, finalText stays empty,
@@ -160,35 +278,80 @@ thinking = []) {
     // one — the guards all hang off pi's `tool_call` hook.
     const toolFlags = tools === '' ? ['--no-tools'] : ['--tools', tools];
     const internal = tools === '' ? [] : extensions;
-    return [...childBaseArgs(internal), ...thinking, '--mode', 'json', ...toolFlags];
+    return [...childBaseArgs(internal), ...groupArgs, '--mode', 'json', ...toolFlags];
 }
 // Sentinel error thrown when the user dismisses a grill-me dialog.
 // Defined here (not in failure-classifier.ts) to avoid circular dependency.
 export const USER_CANCELLED = '__user_cancelled__';
-export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, thinking }) {
-    const invocation = getPiInvocation(childArgs(tools, extensions, thinking), prompt);
+/**
+ * The `phase` row of WORKER_PROFILES, resolved with this machine's config.
+ *
+ * Read here rather than at module load so a /task-config change reaches the next
+ * child, the same contract childBaseArgs already keeps. Both spawn paths in this
+ * file go through it, so the degraded final attempt cannot drift from the ordinary
+ * one — the mislabel class runDegradedFinalAttempt's own comment warns about.
+ */
+export function phasePolicy() {
+    return workerPolicy('phase', {
+        commandTimeoutMs: getConfig().requestTimeoutMs,
+        streamInactivityMs: getConfig().streamInactivityMs
+    });
+}
+export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, groupArgs, commandCeilingMs }) {
+    const invocation = getPiInvocation(childArgs(tools, extensions, groupArgs), prompt);
     let loopHit;
-    const result = await runChildUnified(spawnFn ?? spawn, invocation, cwd, signal, {
-        mode: 'json-events',
-        // A hung model stream reports nothing at all, so without this the
-        // phase child waits forever. The kill
-        // is reported below as a connection-class cause, which routes it into
-        // the retry/backoff path this file already has for a LOUD disconnect.
-        streamInactivityMs: getConfig().streamInactivityMs,
-        onLine,
-        onContextUsage,
-        ...(contextWindow && contextWindow > 0 ? { contextWindow } : {}),
-        onToolResult: onToolResult ? r => onToolResult(r.text, r.isError) : undefined,
-        onToolCall: call => {
-            if (!onToolCall)
-                return null;
-            const hit = onToolCall(call);
-            if (hit && !loopHit) {
-                loopHit = hit;
+    const guards = phasePolicy().guards;
+    // Null when the user set the ceiling to `off`. Why a phase child needs this at
+    // all is the `phase` row's `why` in worker-profiles.ts.
+    const cmdWatch = commandWatch(commandCeilingMs ?? guards['command-timeout']);
+    const childSignal = cmdWatch ? AbortSignal.any([signal, cmdWatch.signal]) : signal;
+    let result;
+    try {
+        result = await runChildUnified(spawnFn ?? spawn, invocation, cwd, childSignal, {
+            mode: 'json-events',
+            // A hung model stream reports nothing at all, so without this the
+            // phase child waits forever. The kill
+            // is reported below as a connection-class cause, which routes it into
+            // the retry/backoff path this file already has for a LOUD disconnect.
+            streamInactivityMs: guards['stream-stall'],
+            ...(guards.stalled === false ?
+                {}
+                : {
+                    stall: {
+                        afterMs: guards.stalled.afterMs,
+                        probe: guards.stalled.probe
+                            ?? (() => probeModelEndpoints(childModelEndpoints(modelSpecFromArgs(groupArgs ?? []))))
+                    }
+                }),
+            onLine,
+            onContextUsage,
+            ...(contextWindow && contextWindow > 0 ? { contextWindow } : {}),
+            // ALWAYS wired, never conditional on the caller wanting results:
+            // the sink emits a tool-execution-end only when a handler exists,
+            // and without that end the command watchdog's timer is never
+            // disarmed — every healthy tool call would then look hung.
+            onToolResult: r => {
+                cmdWatch?.onEnd(r.toolCallId);
+                onToolResult?.(r.text, r.isError);
+            },
+            onToolCall: call => {
+                // Before the detectors: a call they let through still needs its
+                // clock started.
+                cmdWatch?.onStart(call);
+                if (!onToolCall)
+                    return null;
+                const hit = onToolCall(call);
+                if (hit && !loopHit) {
+                    loopHit = hit;
+                }
+                return hit; // propagate to unified runner so it can kill
             }
-            return hit; // propagate to unified runner so it can kill
-        }
-    });
+        });
+    }
+    finally {
+        cmdWatch?.clear();
+    }
+    const commandKill = cmdWatch?.killed();
     // Use `||` (not `??`) so an empty string from json-events mode falls
     // back to raw stdout. Without this, a child that exits 0 but emits no
     // assistant text (e.g. model API error swallowed in json mode) always
@@ -202,14 +365,16 @@ export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUs
         ?? (result.streamStalled ? streamStallCause(result.streamStalled.idleMs) : undefined);
     return {
         text,
-        // WE killed this child, so its exit status describes our own SIGTERM, not
-        // the child's verdict. Report 0 and let `modelError` carry the cause —
-        // otherwise the wrappers' `exitCode !== 0` guard throws a bare "child
-        // failed" before the connection-error retry ever gets to look.
-        exitCode: result.streamStalled ? 0 : result.exitCode,
+        // WE killed this child, so its exit status is our own SIGTERM. Report 0
+        // and let the named cause carry it. EVERY guard kill must be listed: one
+        // omitted here arrives as exit 0 with partial text, and triageChildResult
+        // returns it as a successful answer.
+        exitCode: result.streamStalled || result.stalled || commandKill ? 0 : result.exitCode,
         stderr: result.stderr.trim(),
         loopHit,
         modelError,
+        ...(commandKill ? { commandKill } : {}),
+        ...(result.stalled ? { stalled: true } : {}),
         // A tool call the model wrote as text (wrong dialect) never executed and
         // sailed past the structured-event guards above; flag it so the wrappers
         // can re-prompt instead of accepting the unexecuted call. Only meaningful
@@ -301,17 +466,17 @@ async function triageChildResult(deps, name, r, attempt, budget, verb) {
  * exit status describes our SIGTERM and says nothing about its verdict.
  */
 /**
- * The `--thinking` fragment for a named child, or `[]` when the name is unmapped.
+ * The group fragment for a named child, or `[]` when the name is unmapped.
  *
  * An unmapped name INHERITS rather than throwing: a child that reaches the model
  * with today's argv is always safe, and aborting a user's task over a missing
  * table row would be a worse failure than the one it reports. The guard that
- * makes the table complete is `reasoning-groups.test.ts`, which fails the BUILD —
+ * makes the table complete is `config/groups.test.ts`, which fails the BUILD —
  * where someone can actually fix it.
  */
-export function thinkingForChild(name) {
-    const group = reasoningGroupForChild(name);
-    return group ? groupThinkingArgs(group) : [];
+export function groupArgsForChild(name) {
+    const group = groupForChild(name);
+    return group ? groupChildArgs(group) : [];
 }
 /**
  * What a PHASE child's invocation carries, said once.
@@ -322,14 +487,29 @@ export function thinkingForChild(name) {
  * which is what the degrade's own comment ("the degrade changes the TOOLS, not
  * the role") claimed while three bare `undefined`s quietly made it false.
  */
-function phaseChildRun(deps, over) {
+/**
+ * The context window a child of this group runs against.
+ *
+ * The GROUP's window when this session resolved one, else the run's. Too small a
+ * window makes the churn rule fire early and kill a healthy child, so an
+ * `inherit` or unresolved group keeps the parent's number rather than a guess.
+ */
+function childContextWindow(deps, group) {
+    return (group === undefined ? undefined : groupWindow(group)) ?? deps.contextWindow;
+}
+function phaseChildRun(deps, 
+/** This child's group, for the window. Undefined ⇒ the run's own window. */
+group, over) {
     return {
         cwd: deps.cwd,
         onLine: deps.onChildOutput,
         onContextUsage: deps.onContextUsage,
         spawn: deps.spawn,
         extensions: deps.childExtensions,
-        contextWindow: deps.contextWindow,
+        // The GROUP's window when this session resolved one, else the run's.
+        // Too small a window makes the churn rule fire early and kill a healthy
+        // child, so an unresolved group keeps the parent's number.
+        contextWindow: (group === undefined ? undefined : groupWindow(group)) ?? deps.contextWindow,
         ...over
     };
 }
@@ -340,41 +520,61 @@ export async function runPhaseChild(deps, name, tools, prompt, opts = {}) {
     // between a loop-kill and its retry would otherwise make the two attempts
     // different experiments, and the retry exists to repeat the first one with a
     // hint. An unmapped name inherits, which is today's argv — the build-time
-    // guard for that is reasoning-groups.test.ts, not a throw in a user's run.
-    const thinking = thinkingForChild(name);
+    // guard for that is config/groups.test.ts, not a throw in a user's run.
+    const groupArgs = groupArgsForChild(name);
+    const group = groupForChild(name);
     const verb = opts.verb ?? 'retry';
     let hint = null;
     const loopHistory = [];
     const budgetMs = deps.timeoutMs ?? PHASE_CHILD_TIMEOUT_MS;
+    // From the `phase` row, not from literals here, so the table is the one place
+    // that answers "how may this child die". The row resolves to the same
+    // DEFAULT_LOOP_DETECTOR / DEFAULT_LOOP_PROGRESS this file used to hard-code.
+    const loopGuard = phasePolicy().guards.loop;
+    // Watchdog kills, NOT total strikes: a loop restart never saw the
+    // bound-your-command hint. Without the halving, three attempts at the default
+    // ceiling cost 45 minutes and nothing else bounds this path.
+    let hangKills = 0;
     for (let attempt = 0; attempt <= MAX_LEAK_RETRIES; attempt++) {
         // A cancel between attempts must not buy another spawn.
         if (deps.signal.aborted)
             throw new Error(USER_CANCELLED);
-        const detector = new LoopDetector(LOOP_WINDOW, LOOP_THRESHOLD);
-        const stall = new StallDetector();
+        const detector = loopGuard.detector === false ?
+            null
+            : new LoopDetector(loopGuard.detector.window, loopGuard.detector.threshold, loopGuard.detector.pathThreshold);
+        const stall = loopGuard.progress === false ?
+            null
+            : new StallDetector(loopGuard.progress.limit, loopGuard.progress.churnFactor);
         // Arm the churn rule BEFORE the first tool call. pi's stream carries no
         // context WINDOW, so a detector that waited to be told one would sit at 0,
         // and the churn rule returns false on a non-positive window. The parent
         // knows the value at spawn time — say it then, not later.
-        stall.noteContext(deps.contextWindow ?? 0);
+        //
+        // The SAME number the child is handed below. Arming it from the run's
+        // window while the child runs on a bigger model's would judge the child
+        // against a window it does not have, for exactly the stretch before the
+        // first `context_usage` event corrects it — which is the stretch this
+        // line exists to cover.
+        stall?.noteContext(childContextWindow(deps, group) ?? 0);
         const clock = phaseTimeout(deps.signal, budgetMs);
         let r;
         try {
-            r = await runChild(phaseChildRun(deps, {
+            r = await runChild(phaseChildRun(deps, group, {
                 tools,
                 prompt: prependHint(hint, prompt),
                 signal: clock.signal,
-                thinking,
+                groupArgs,
                 onContextUsage: snapshot => {
                     // Real window or nothing: `noteContext` ignores 0, which is
                     // why the parent's value must be supplied at spawn — a
                     // stream that only ever reports 0 leaves the churn rule
                     // permanently disarmed.
-                    stall.noteContext(snapshot.contextWindow);
+                    stall?.noteContext(snapshot.contextWindow);
                     deps.onContextUsage?.(snapshot);
                 },
-                onToolCall: call => detector.record(call) ?? stall.record(call),
-                onToolResult: (text, isError) => stall.noteResult(text, isError)
+                commandCeilingMs: commandCeilingForAttempt(phasePolicy().guards['command-timeout'], hangKills),
+                onToolCall: call => detector?.record(call) ?? stall?.record(call) ?? null,
+                onToolResult: (text, isError) => stall?.noteResult(text, isError)
             }));
         }
         finally {
@@ -404,6 +604,36 @@ export async function runPhaseChild(deps, name, tools, prompt, opts = {}) {
             hint = r.loopHit.stall ? formatStallHint(r.loopHit.stall) : formatLoopHint(r.loopHit);
             continue;
         }
+        // Ordered after the loop rule and before the clock, matching RESTART_ORDER
+        // (worker-kill.ts): the loop hint names the offending call and is the more
+        // specific thing to tell a re-spawn, and a watchdog kill leaves the phase
+        // clock's own flag false, so the two cannot be confused.
+        if (r.commandKill) {
+            hangKills++;
+            if (attempt === MAX_LEAK_RETRIES) {
+                throw new CommandTimeoutError(name, r.commandKill);
+            }
+            deps.logDebug?.(`${name}: ${r.commandKill.toolName} outran `
+                + `${Math.round(r.commandKill.timeoutMs / 1000)}s — `
+                + `${verb} ${attempt + 1}/${MAX_LEAK_RETRIES}`);
+            // Tracks the TOOLS, not the phase: verify-tooling holds `read,bash`,
+            // and a half-written node_modules survives the kill.
+            hint = commandTimeoutHint(r.commandKill.toolName, r.commandKill.timeoutMs, {
+                ...(r.commandKill.detail ? { commandDetail: r.commandKill.detail } : {}),
+                editsMayPersist: /\b(?:bash|edit|write)\b/.test(tools)
+            });
+            continue;
+        }
+        // A dead-backend kill spends a strike like the others; guardKillError says
+        // when the verdict has been earned.
+        const killed = guardKillError(name, r, { finalAttempt: attempt === MAX_LEAK_RETRIES });
+        if (killed)
+            throw killed;
+        if (r.stalled) {
+            deps.logDebug?.(`${name}: no output for the stall window and no endpoint answered — `
+                + `${verb} ${attempt + 1}/${MAX_LEAK_RETRIES}`);
+            continue;
+        }
         if (clock.timedOut()) {
             if (attempt === MAX_LEAK_RETRIES) {
                 throw new PhaseTimeoutError(name, budgetMs, MAX_LEAK_RETRIES + 1);
@@ -488,19 +718,26 @@ async function runDegradedFinalAttempt(deps, name, prompt, hit, loopHistory) {
     const clock = phaseTimeout(deps.signal, deps.timeoutMs ?? PHASE_CHILD_TIMEOUT_MS);
     let r;
     try {
-        r = await runChild(phaseChildRun(deps, {
+        r = await runChild(phaseChildRun(deps, groupForChild(name), {
             tools: '', // --no-tools: the model cannot read/grep/list, only answer
             prompt: prependHint(formatDegradeHint(hit), prompt),
             signal: clock.signal,
             // Same group as the attempts that led here. The degrade changes the
-            // TOOLS, not the role — running it at a different thinking level would
-            // make the fallback a different experiment from the thing it rescues.
-            thinking: thinkingForChild(name)
+            // TOOLS, not the role — running it on a different model, or at a
+            // different thinking level, would make the fallback a different
+            // experiment from the thing it rescues.
+            groupArgs: groupArgsForChild(name)
         }));
     }
     finally {
         clock.cleanup();
     }
+    // BEFORE the exit-code test, not inside it: a guard kill reports exit 0, so
+    // asking afterwards would already have returned the truncated text as this
+    // phase's deliverable.
+    const killed = guardKillError(name, r);
+    if (killed)
+        throw killed;
     if (r.exitCode !== 0 || r.modelError || r.text.trim().length === 0) {
         // A wall-clock kill is NOT a loop. Without this check a child that outran
         // its budget is reported as "loop budget exhausted", carrying a loop

package/dist/task/context-usage.d.ts

@@ -5,6 +5,8 @@
  * directly, because its state is the whole-run `WidgetState`, not one child's.
  */
 import type { ContextSnapshot } from '../shared/child-process.js';
+import { type PiTaskConfig } from '../config/config.js';
+import type { ChildGroup } from '../config/groups.js';
 /**
  * The parent session's context window, or 0 when the model doesn't expose it.
  *
@@ -22,6 +24,50 @@ export declare function getParentContextWindow(ctx: {
         contextWindow?: number;
     };
 }): number;
+/**
+ * The window for the model ONE GROUP's children will actually run on.
+ *
+ * This number drives the widget and, more importantly, `StallDetector`'s
+ * context-churn rule, and the two error directions are not symmetric. A parent
+ * window LARGER than the child's makes churn fire late — degraded, and the
+ * no-new-ground rule still covers it. A parent window SMALLER makes churn fire
+ * early and KILL A HEALTHY CHILD. A big-context research model under a small
+ * host model is a real false positive, which is why this exists at all.
+ *
+ * For the same reason there is no `min(parent, group)`: that would import the
+ * dangerous direction on purpose.
+ *
+ * `inherit`, an unresolvable spec, or a model with no declared window all return
+ * exactly `getParentContextWindow(ctx)` — byte-identical to the behaviour before
+ * per-group models existed.
+ *
+ * Callers WITHOUT a ctx read `groupWindow` from config/group-args.ts instead,
+ * which the session pass fills from this. One producer, so the two views cannot
+ * describe different models.
+ */
+export declare function contextWindowForGroup(ctx: {
+    model?: {
+        contextWindow?: number;
+    };
+    modelRegistry?: {
+        find: (p: string, i: string) => unknown;
+    };
+}, group: ChildGroup, cfg?: PiTaskConfig): number;
+/**
+ * The same answer for a spec the caller already has.
+ *
+ * The session pass needs this: it walks an INJECTED spec table, and reaching for
+ * `getConfig()` here would let the window it stores describe a different model
+ * from the one it just checked.
+ */
+export declare function contextWindowForSpec(ctx: {
+    model?: {
+        contextWindow?: number;
+    };
+    modelRegistry?: {
+        find: (p: string, i: string) => unknown;
+    };
+}, spec: string): number;
 /**
  * Fold a raw context snapshot into a display snapshot: prefer the child's own
  * contextWindow, else the last known one, else the parent session's; then derive

package/dist/task/context-usage.js

@@ -4,6 +4,8 @@
  * the planning and gate children; the single-task widget (TaskRunner) calls it
  * directly, because its state is the whole-run `WidgetState`, not one child's.
  */
+import { getConfig } from '../config/config.js';
+import { MODEL_INHERIT, splitSpec } from '../config/group-models.js';
 /**
  * The parent session's context window, or 0 when the model doesn't expose it.
  *
@@ -19,6 +21,45 @@
 export function getParentContextWindow(ctx) {
     return ctx.model?.contextWindow ?? 0;
 }
+/**
+ * The window for the model ONE GROUP's children will actually run on.
+ *
+ * This number drives the widget and, more importantly, `StallDetector`'s
+ * context-churn rule, and the two error directions are not symmetric. A parent
+ * window LARGER than the child's makes churn fire late — degraded, and the
+ * no-new-ground rule still covers it. A parent window SMALLER makes churn fire
+ * early and KILL A HEALTHY CHILD. A big-context research model under a small
+ * host model is a real false positive, which is why this exists at all.
+ *
+ * For the same reason there is no `min(parent, group)`: that would import the
+ * dangerous direction on purpose.
+ *
+ * `inherit`, an unresolvable spec, or a model with no declared window all return
+ * exactly `getParentContextWindow(ctx)` — byte-identical to the behaviour before
+ * per-group models existed.
+ *
+ * Callers WITHOUT a ctx read `groupWindow` from config/group-args.ts instead,
+ * which the session pass fills from this. One producer, so the two views cannot
+ * describe different models.
+ */
+export function contextWindowForGroup(ctx, group, cfg = getConfig()) {
+    return contextWindowForSpec(ctx, cfg.groupModels[group]);
+}
+/**
+ * The same answer for a spec the caller already has.
+ *
+ * The session pass needs this: it walks an INJECTED spec table, and reaching for
+ * `getConfig()` here would let the window it stores describe a different model
+ * from the one it just checked.
+ */
+export function contextWindowForSpec(ctx, spec) {
+    if (spec === MODEL_INHERIT)
+        return getParentContextWindow(ctx);
+    const parts = splitSpec(spec);
+    const found = parts && ctx.modelRegistry?.find(parts.provider, parts.id);
+    const window = found?.contextWindow ?? 0;
+    return window > 0 ? window : getParentContextWindow(ctx);
+}
 /**
  * Fold a raw context snapshot into a display snapshot: prefer the child's own
  * contextWindow, else the last known one, else the parent session's; then derive