@mjasnikovs/pi-task 0.38.32 → 0.39.1

package/dist/task/context-usage.js

@@ -5,7 +5,7 @@
  * directly, because its state is the whole-run `WidgetState`, not one child's.
  */
 import { getConfig } from '../config/config.js';
-import { MODEL_INHERIT, splitSpec } from '../config/group-models.js';
+import { resolveModel } from '../shared/model-resolve.js';
 /**
  * The parent session's context window, or 0 when the model doesn't expose it.
  *
@@ -53,12 +53,7 @@ export function contextWindowForGroup(ctx, group, cfg = getConfig()) {
  * from the one it just checked.
  */
 export function contextWindowForSpec(ctx, spec) {
-    if (spec === MODEL_INHERIT)
-        return getParentContextWindow(ctx);
-    const parts = splitSpec(spec);
-    const found = parts && ctx.modelRegistry?.find(parts.provider, parts.id);
-    const window = found?.contextWindow ?? 0;
-    return window > 0 ? window : getParentContextWindow(ctx);
+    return resolveModel(ctx, spec)?.contextWindow || getParentContextWindow(ctx);
 }
 /**
  * Fold a raw context snapshot into a display snapshot: prefer the child's own

package/dist/task/failure-classifier.js

@@ -5,97 +5,69 @@
 import { updateTaskFrontMatter } from './task-io.js';
 import { flashTerminalWidget } from './widget.js';
 import { publishLifecycleNotice } from '../remote/bridge.js';
-import { BackendDownError, CommandTimeoutError, LoopExhaustedError, LeakedToolCallError, ModelError, USER_CANCELLED } from './child-runner.js';
+import { ChildFailureError, USER_CANCELLED } from './child-runner.js';
+import { streamStallCause } from '../shared/stream-watchdog.js';
 // ─── Classifier ──────────────────────────────────────────────────────────────
+const failed = (reason, flash, notify) => ({
+    state: 'failed',
+    reason,
+    flash,
+    notify,
+    level: 'error'
+});
+/**
+ * What one phase child failure says to the user. A switch over the cause, so a
+ * new arm cannot be added to `ChildFailure` without a notice.
+ */
+function classifyChildFailure(e) {
+    const f = e.failure;
+    switch (f.kind) {
+        case 'stalled':
+            return failed(`model_unreachable: ${e.message}`, 'model_unreachable', 'failed: model unreachable — restart the model, then resume.');
+        // The fix is in the SPEC, not the model, so the notify says which command.
+        case 'command-timeout':
+            return failed(e.message.slice(0, 200), 'command_timeout', `failed: \`${f.toolName}\` never returned on any attempt. Resume to bound it in VERIFY.`);
+        case 'loop':
+            return failed(`loop detected ${f.strikes}× in ${e.phase}`, 'loop_detected', `failed: ${e.phase} loop detected ${f.strikes}×. Resume to retry.`);
+        case 'leaked-tool-call':
+            return failed(`leaked tool call in ${e.phase}: ${f.text.trim()}`, 'leaked_tool_call', `failed: ${e.phase} wrote a tool call as text instead of running it — it never executed. Resume to retry.`);
+        case 'model-error':
+        case 'stream-stall': {
+            const cause = f.kind === 'model-error' ? f.cause : streamStallCause(f.idleMs);
+            return failed(`model_error in ${e.phase}: ${cause.slice(0, 160)}`, 'model_error', `failed: ${e.phase} — model error: ${cause.slice(0, 120)}. Restart the model, then resume.`);
+        }
+        case 'worker-timeout':
+            return failed(e.message.slice(0, 200), 'child_timeout', `failed: ${e.phase} ran out of time on every attempt. Resume to retry.`);
+        case 'aborted':
+        case 'exit':
+        case 'empty-answer':
+            return unreachable(e.message) ?? generic(e.message);
+    }
+}
+const generic = (msg) => failed(msg.slice(0, 200), msg.slice(0, 80), `failed: ${msg.slice(0, 120)}`);
+/**
+ * A failure whose only evidence of a dead backend is an errno in its text: a
+ * child's stderr, the research phase's own network calls, a probe.
+ */
+function unreachable(msg) {
+    if (!/ECONNREFUSED|fetch failed|connect/i.test(msg))
+        return undefined;
+    return failed(`model_unreachable: ${msg.slice(0, 120)}`, 'model_unreachable', 'failed: model unreachable.');
+}
 export function classifyFailure(err, aborted) {
     const msg = err instanceof Error ? err.message : String(err);
     if (aborted || msg === USER_CANCELLED) {
         return { state: 'cancelled', notify: 'cancelled.', level: 'warning' };
     }
-    // Classified by TYPE, above the message-sniffing branch below: this is the one
-    // case where the probe positively established the endpoint did not answer, and
-    // its message names no errno for that branch to match.
-    if (err instanceof BackendDownError) {
-        return {
-            state: 'failed',
-            reason: `model_unreachable: ${err.message}`,
-            flash: 'model_unreachable',
-            notify: 'failed: model unreachable — restart the model, then resume.',
-            level: 'error'
-        };
-    }
-    // The fix is in the SPEC, not the model, so the notify says which command.
-    if (err instanceof CommandTimeoutError) {
-        return {
-            state: 'failed',
-            reason: err.message.slice(0, 200),
-            flash: 'command_timeout',
-            notify: `failed: \`${err.kill.toolName}\` never returned on any attempt. `
-                + `Resume to bound it in VERIFY.`,
-            level: 'error'
-        };
-    }
-    if (err instanceof LoopExhaustedError) {
-        return {
-            state: 'failed',
-            reason: `loop detected ${err.history.length}× in ${err.phase}`,
-            flash: 'loop_detected',
-            notify: `failed: ${err.phase} loop detected ${err.history.length}×. Resume to retry.`,
-            level: 'error'
-        };
-    }
-    if (err instanceof LeakedToolCallError) {
-        return {
-            state: 'failed',
-            reason: `leaked tool call in ${err.phase}: ${err.marker.trim()}`,
-            flash: 'leaked_tool_call',
-            notify: `failed: ${err.phase} wrote a tool call as text instead of running it — it never executed. Resume to retry.`,
-            level: 'error'
-        };
-    }
-    if (err instanceof ModelError) {
-        return {
-            state: 'failed',
-            reason: `model_error in ${err.phase}: ${err.cause.slice(0, 160)}`,
-            flash: 'model_error',
-            notify: `failed: ${err.phase} — model error: ${err.cause.slice(0, 120)}. Restart the model, then resume.`,
-            level: 'error'
-        };
-    }
+    if (err instanceof ChildFailureError)
+        return classifyChildFailure(err);
     if (msg === 'no_verify_block') {
-        return {
-            state: 'failed',
-            reason: 'no_verify_block',
-            flash: 'no_verify_block',
-            notify: 'failed: spec has no VERIFY block. Resume to edit and try again.',
-            level: 'error'
-        };
+        return failed('no_verify_block', 'no_verify_block', 'failed: spec has no VERIFY block. Resume to edit and try again.');
     }
     if (msg.startsWith('compose_invalid')) {
-        return {
-            state: 'failed',
-            reason: msg.slice(0, 200),
-            flash: 'compose_invalid',
-            notify: `failed: compose produced malformed spec (${msg.replace(/^compose_invalid:\s*/, '')}). Resume to retry.`,
-            level: 'error'
-        };
-    }
-    if (/ECONNREFUSED|fetch failed|connect/i.test(msg)) {
-        return {
-            state: 'failed',
-            reason: `model_unreachable: ${msg.slice(0, 120)}`,
-            flash: 'model_unreachable',
-            notify: 'failed: model unreachable.',
-            level: 'error'
-        };
+        return failed(msg.slice(0, 200), 'compose_invalid', `failed: compose produced malformed spec (${msg.replace(/^compose_invalid:\s*/, '')}). Resume to retry.`);
     }
-    return {
-        state: 'failed',
-        reason: msg.slice(0, 200),
-        flash: msg.slice(0, 80),
-        notify: `failed: ${msg.slice(0, 120)}`,
-        level: 'error'
-    };
+    return unreachable(msg) ?? generic(msg);
 }
 /**
  * Persist, flash and announce a failure, and return the classification.

package/dist/task/gate-child.js

@@ -24,7 +24,7 @@
  * `runWorker` and the git helpers are injected, so the ordering, the trail lines
  * and the throwing-child path are directly assertable.
  */
-import { formatLoopHint } from './child-runner.js';
+import { formatLoopHint } from './loop-detector.js';
 import { classifyEnforceChildFailure } from './enforce-guidelines.js';
 /**
  * What each kind may do. Adding a child is a row; it cannot be added without

package/dist/task/impl-widget.d.ts

@@ -42,6 +42,8 @@ export declare function armImplWidget(meta: ImplWidgetMeta, opts: {
 }): void;
 /** Tear down the widget and clear the armed slot (sticky/awaited path). */
 export declare function disarmImplWidget(): void;
+/** @internal Test seam: is a turn currently showing the widget? */
+export declare function implWidgetArmed(): boolean;
 /** Wire the agent-lifecycle handlers that drive the widget. Call once at setup.
  *  All three events are pi's own: `agent_start`, `tool_execution_start` and
  *  `agent_end` each have an `on()` overload, and ToolExecutionStartEvent carries

package/dist/task/impl-widget.js

@@ -107,6 +107,10 @@ export function disarmImplWidget() {
     activeCtx = null;
     lastLine = undefined;
 }
+/** @internal Test seam: is a turn currently showing the widget? */
+export function implWidgetArmed() {
+    return armed !== null;
+}
 /** Wire the agent-lifecycle handlers that drive the widget. Call once at setup.
  *  All three events are pi's own: `agent_start`, `tool_execution_start` and
  *  `agent_end` each have an `on()` overload, and ToolExecutionStartEvent carries

package/dist/task/implementation-hold.d.ts

@@ -45,6 +45,7 @@
  */
 import type { ThinkingLevel } from '@earendil-works/pi-agent-core';
 import { type GroupSetting } from '../config/reasoning.js';
+import { type ModelContext, type PiModel } from '../shared/model-resolve.js';
 import { type HoldStash } from './model-hold-stash.js';
 /**
  * The slice of the extension API this needs, named so tests can drive the
@@ -79,6 +80,16 @@ export interface ImplementationControls<H = unknown> {
     thinking: ThinkingControl;
     model: ModelControl<H>;
 }
+/**
+ * The live session's model as a {@link ModelControl}, for both the turn's hold
+ * and the crash restore at session_start.
+ *
+ * `current()` reads `ctx.model`, which is a live GETTER on the extension
+ * context (pi's `core/extensions/runner.js`), so a read after a set is the new
+ * value. `apply` is the caller's because the setter lives on `ExtensionAPI`,
+ * which the two callers hold differently.
+ */
+export declare function liveModelControl(ctx: ModelContext, apply: (handle: PiModel) => Promise<boolean>): ModelControl<PiModel>;
 /**
  * The whole hold: model, then thinking. Returns the release, which is async and
  * idempotent. Always call it from a `finally`, never the happy path.

package/dist/task/implementation-hold.js

@@ -1,7 +1,27 @@
 import { getConfig } from '../config/config.js';
 import { MODEL_INHERIT } from '../config/group-models.js';
 import { resolveReasoning } from '../config/reasoning.js';
+import { resolveModel } from '../shared/model-resolve.js';
 import { readHoldStash, writeHoldStash, clearHoldStash } from './model-hold-stash.js';
+/**
+ * The live session's model as a {@link ModelControl}, for both the turn's hold
+ * and the crash restore at session_start.
+ *
+ * `current()` reads `ctx.model`, which is a live GETTER on the extension
+ * context (pi's `core/extensions/runner.js`), so a read after a set is the new
+ * value. `apply` is the caller's because the setter lives on `ExtensionAPI`,
+ * which the two callers hold differently.
+ */
+export function liveModelControl(ctx, apply) {
+    return {
+        current: () => {
+            const m = resolveModel(ctx, MODEL_INHERIT);
+            return m && { spec: m.spec, handle: m.handle };
+        },
+        resolve: spec => resolveModel(ctx, spec)?.handle,
+        apply
+    };
+}
 /**
  * `before` is the level read BEFORE any model move; `applied` is what is really
  * in force after both moves.

package/dist/task/implementation-scope.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The implementation-turn bracket: one entry arms both the status widget and the
+ * runaway guard, one `leave` disarms both.
+ *
+ * The two modules keep their own lifecycle handlers, and they draw the turn
+ * boundary differently on purpose: the widget hides on `agent_end` (a sub-turn is
+ * over, the screen should say so), the guard survives until `agent_settled`
+ * (compactions and retries fire `agent_end` INSIDE a turn — see its header). What
+ * they share is the caller's decision — when to arm, and on which paths to disarm
+ * — and a missed disarm on either one outlives the turn: commit ebac475 added a
+ * third disarm site for one path that was covered on the widget and not the guard.
+ */
+import { type ImplWidgetMeta } from './impl-widget.js';
+/**
+ * `oneShot` true (fire-and-forget /task) lets each module's own settle handler
+ * disarm after the single turn; false (awaited /task-auto) keeps both armed
+ * across resume and steer turns until `leave` is called.
+ *
+ * `leave` is idempotent: a second call is a no-op, so a caller can put it in a
+ * `finally` and a `catch` without disarming a bracket entered since.
+ */
+export declare function enterImplementationTurn(meta: ImplWidgetMeta, opts: {
+    oneShot: boolean;
+}): () => void;

package/dist/task/implementation-scope.js

@@ -0,0 +1,34 @@
+/**
+ * The implementation-turn bracket: one entry arms both the status widget and the
+ * runaway guard, one `leave` disarms both.
+ *
+ * The two modules keep their own lifecycle handlers, and they draw the turn
+ * boundary differently on purpose: the widget hides on `agent_end` (a sub-turn is
+ * over, the screen should say so), the guard survives until `agent_settled`
+ * (compactions and retries fire `agent_end` INSIDE a turn — see its header). What
+ * they share is the caller's decision — when to arm, and on which paths to disarm
+ * — and a missed disarm on either one outlives the turn: commit ebac475 added a
+ * third disarm site for one path that was covered on the widget and not the guard.
+ */
+import { armImplWidget, disarmImplWidget } from './impl-widget.js';
+import { armImplementationGuard, disarmImplementationGuard } from './implementation-guards.js';
+/**
+ * `oneShot` true (fire-and-forget /task) lets each module's own settle handler
+ * disarm after the single turn; false (awaited /task-auto) keeps both armed
+ * across resume and steer turns until `leave` is called.
+ *
+ * `leave` is idempotent: a second call is a no-op, so a caller can put it in a
+ * `finally` and a `catch` without disarming a bracket entered since.
+ */
+export function enterImplementationTurn(meta, opts) {
+    armImplWidget(meta, opts);
+    armImplementationGuard(opts);
+    let left = false;
+    return () => {
+        if (left)
+            return;
+        left = true;
+        disarmImplWidget();
+        disarmImplementationGuard();
+    };
+}

package/dist/task/loop-detector.d.ts

@@ -13,11 +13,9 @@
  * Either pattern returns a LoopHit so the caller can kill the child and re-spawn
  * with a hint. No I/O. No imports from index.ts. Trivially unit-testable.
  *
- * The three tuning constants live here rather than in child-runner.ts because
- * worker-profiles.ts reads them at module top level to build DEFAULT_LOOP_DETECTOR.
- * From child-runner.ts that is a cycle — child-runner → worker-profiles →
- * child-runner — and the failure is a TDZ ReferenceError on import order, which
- * no compile step catches. This module imports nothing, so it cannot close one.
+ * This module imports nothing: worker-profiles.ts reads the tuning constants at
+ * module top level, and a dependency from here on any runner would close a cycle
+ * whose only symptom is a TDZ ReferenceError on import order.
  */
 /** Recent tool calls the exact-repeat rule looks back over. */
 export declare const LOOP_WINDOW = 20;
@@ -33,6 +31,14 @@ export interface LoopHit {
     call: ToolCall;
     count: number;
     windowSize: number;
+    /**
+     * Set when the kill came from the whole-run StallDetector rather than this
+     * short-window detector, naming which of its two rules tripped
+     * (stall-detector.ts). Absent for an ordinary loop hit. Carried here so a
+     * stall rides the kill/restart plumbing the loop hit already has instead of
+     * needing a second channel.
+     */
+    stall?: 'no-new-ground' | 'context-churn';
 }
 /**
  * JSON.stringify with sorted object keys so {a:1,b:2} and {b:2,a:1} hash equal.
@@ -78,3 +84,5 @@ export declare class LoopDetector {
      */
     private countRevisits;
 }
+/** The restart hint a re-spawned child gets after a loop kill: names the call. */
+export declare function formatLoopHint(hit: LoopHit): string;

package/dist/task/loop-detector.js

@@ -13,11 +13,9 @@
  * Either pattern returns a LoopHit so the caller can kill the child and re-spawn
  * with a hint. No I/O. No imports from index.ts. Trivially unit-testable.
  *
- * The three tuning constants live here rather than in child-runner.ts because
- * worker-profiles.ts reads them at module top level to build DEFAULT_LOOP_DETECTOR.
- * From child-runner.ts that is a cycle — child-runner → worker-profiles →
- * child-runner — and the failure is a TDZ ReferenceError on import order, which
- * no compile step catches. This module imports nothing, so it cannot close one.
+ * This module imports nothing: worker-profiles.ts reads the tuning constants at
+ * module top level, and a dependency from here on any runner would close a cycle
+ * whose only symptom is a TDZ ReferenceError on import order.
  */
 /** Recent tool calls the exact-repeat rule looks back over. */
 export const LOOP_WINDOW = 20;
@@ -159,3 +157,11 @@ export class LoopDetector {
         return revisits;
     }
 }
+/** The restart hint a re-spawned child gets after a loop kill: names the call. */
+export function formatLoopHint(hit) {
+    const argsStr = JSON.stringify(hit.call.args);
+    return (`[SYSTEM NOTE: Your prior attempt called ${hit.call.name}(${argsStr}) `
+        + `${hit.count} times in the last ${hit.windowSize} tool calls — you appeared to be `
+        + `stuck in a loop. Avoid repeating that exact call; if you've already seen its result, `
+        + `work from memory or pick a different angle.]`);
+}

package/dist/task/model-hold-stash.js

@@ -1,9 +1,9 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { splitSpec } from '../config/group-models.js';
 import { defaultModelRef } from '../shared/model-endpoint.js';
+import { specOf } from '../shared/model-resolve.js';
 import { stateFile } from '../shared/data-home.js';
-import { restoreHeldModel } from './implementation-hold.js';
+import { liveModelControl, restoreHeldModel } from './implementation-hold.js';
 const stashPath = () => stateFile('model-hold.json');
 export function readHoldStash() {
     try {
@@ -47,23 +47,13 @@ export function clearHoldStash() {
  */
 export function registerModelHoldRestore(pi) {
     pi.on('session_start', (_event, ctx) => {
-        const model = {
-            current: () => {
-                const m = ctx.model;
-                return m ? { spec: `${m.provider}/${m.id}`, handle: m } : undefined;
-            },
-            resolve: spec => {
-                const parts = splitSpec(spec);
-                return parts ? ctx.modelRegistry.find(parts.provider, parts.id) : undefined;
-            },
-            apply: handle => pi.setModel(handle)
-        };
+        const model = liveModelControl(ctx, handle => pi.setModel(handle));
         // The saved default, read from the file the crash left wrong — not from
         // `ctx.model`, which a `--model` flag or a resumed session can make say
         // something else entirely.
         const saved = () => {
             const ref = defaultModelRef();
-            return ref && `${ref.provider}/${ref.id}`;
+            return ref && specOf(ref);
         };
         void restoreHeldModel(model, saved).catch(() => { });
     });

package/dist/task/orchestrator.d.ts

@@ -21,16 +21,10 @@ import { type WidgetState } from './widget.js';
 import { type RunTaskFn } from './gate-deps.js';
 import { type GateDeps } from './task-gates.js';
 import { type PhaseSeams } from './child-runner.js';
+import type { PiModel } from '../shared/model-resolve.js';
 import { type ImplementationControls } from './implementation-hold.js';
 import { type RunEnd } from './run-end.js';
 import { type SuperviseOptions } from './implementation-turn.js';
-/**
- * pi's own `Model`, named WITHOUT importing `@earendil-works/pi-ai` — which is
- * neither a dependency, a devDependency nor a peerDependency of this package
- * (see shared/model-endpoint.ts's header). The context already carries the type,
- * so deriving it costs nothing and adds no edge to the dependency graph.
- */
-type PiModel = NonNullable<ExtensionCommandContext['model']>;
 /** Both halves of the implementation hold, over the live session. */
 export declare function piImplementationControls(ctx: ExtensionCommandContext): ImplementationControls<PiModel>;
 /**
@@ -235,4 +229,3 @@ export declare function runGatedTask(ctx: ExtensionCommandContext, cwd: string,
     deps?: GateDeps;
 }): Promise<void>;
 export declare function registerTask(pi: ExtensionAPI): void;
-export {};

package/dist/task/orchestrator.js

@@ -25,8 +25,8 @@ import { normaliseTaskId, parseFrontMatter, extractSection } from './task-parser
 import { readTextFile } from '../shared/fs-text.js';
 import { allocateTaskId, ensureTasksDir, readSection, readTaskFile, setTaskSection, taskFilePath, tasksDir, updateTaskFrontMatter, writeTaskFile } from './task-io.js';
 import { startWidget } from './widget.js';
-import { armImplWidget, disarmImplWidget, setupImplWidget } from './impl-widget.js';
-import { armImplementationGuard, disarmImplementationGuard } from './implementation-guards.js';
+import { setupImplWidget } from './impl-widget.js';
+import { enterImplementationTurn } from './implementation-scope.js';
 import { publishViewer, publishNotify, registerBridgeCommand, getBridge } from '../remote/bridge.js';
 import { pushNotify } from '../remote/push.js';
 import { getConfig } from '../config/config.js';
@@ -38,8 +38,7 @@ import { findDeliveryPhantoms, formatApiOverrideBanner } from '../workers/phanto
 import { titleForDisplay } from './parsers.js';
 import { USER_CANCELLED } from './child-runner.js';
 import { cancelCheckpoint } from './cancel-points.js';
-import { splitSpec } from '../config/group-models.js';
-import { holdImplementation } from './implementation-hold.js';
+import { holdImplementation, liveModelControl } from './implementation-hold.js';
 import { rearmCancelListener } from './cancel-input.js';
 import { takeHeldInput } from './mid-run-input.js';
 import { withRun, announceTerminal } from './run-bracket.js';
@@ -82,27 +81,12 @@ function piThinkingControl() {
 }
 /**
  * The live session's model, as a {@link ModelControl} over pi's own `Model`.
- *
- * `current()` reads `ctx.model`, which is a live GETTER on the extension context
- * (pi's `core/extensions/runner.js`), so a read after a set is the new value.
- * `resolve` goes through `find(provider, id)` — EXACT, deliberately stricter
- * than pi's own CLI, which also substring-matches. We store a canonical
- * `provider/id`, so exact is the only match that should ever count, and being
- * stricter here can only cost us a hold we then decline to take.
+ * Before `registerTask(pi)` has run there is nothing to apply to, so the move
+ * reports failure and the hold declines — same degrade as the thinking half.
  */
 function piModelControl(ctx) {
     const api = piApi;
-    return {
-        current: () => {
-            const m = ctx.model;
-            return m ? { spec: `${m.provider}/${m.id}`, handle: m } : undefined;
-        },
-        resolve: spec => {
-            const parts = splitSpec(spec);
-            return parts ? ctx.modelRegistry.find(parts.provider, parts.id) : undefined;
-        },
-        apply: async (handle) => (api ? api.setModel(handle) : false)
-    };
+    return liveModelControl(ctx, async (handle) => (api ? api.setModel(handle) : false));
 }
 /** Both halves of the implementation hold, over the live session. */
 export function piImplementationControls(ctx) {
@@ -396,10 +380,7 @@ export class TaskRunner {
             label: this._widgetState.label
         };
         if (this._sendSpec) {
-            armImplWidget(meta, { oneShot: !this._implAwaited });
-            // Same lifetime as the widget, and for the same reason: an awaited run
-            // spans resume and steer turns, a fire-and-forget one does not.
-            armImplementationGuard({ oneShot: !this._implAwaited });
+            const leave = enterImplementationTurn(meta, { oneShot: !this._implAwaited });
             let delivered = false;
             try {
                 await this._sendSpec(spec);
@@ -411,18 +392,15 @@ export class TaskRunner {
                 // run: pi's `prompt` rejects on a compaction already in progress, a
                 // missing model, or a failed auth. The next unrelated turn would
                 // inherit it, and this guard can end a turn outright.
-                if (this._implAwaited || !delivered) {
-                    disarmImplWidget();
-                    disarmImplementationGuard();
-                }
+                if (this._implAwaited || !delivered)
+                    leave();
             }
             return;
         }
         if (!piApi) {
             throw new Error('extension not initialised (no ExtensionAPI captured)');
         }
-        armImplWidget(meta, { oneShot: true });
-        armImplementationGuard({ oneShot: true });
+        const leave = enterImplementationTurn(meta, { oneShot: true });
         // Same reason as the awaited path's `delivered` flag: this send can throw
         // SYNCHRONOUSLY — the loader gates every ExtensionAPI action behind
         // `assertActive()` — and a guard left armed over a turn that never starts
@@ -436,8 +414,7 @@ export class TaskRunner {
             piApi.sendUserMessage(spec, { deliverAs: 'followUp' });
         }
         catch (e) {
-            disarmImplWidget();
-            disarmImplementationGuard();
+            leave();
             throw e;
         }
     }

package/dist/task/phases.js

@@ -38,7 +38,7 @@ import { readContracts, buildContractsBlock, buildContractsVerifyBlock } from '.
 import { readRequirements, buildRequirementsBlock, buildOwnedRequirementsBlock, readOwnedRequirements, writeOwnedRequirements, ownedForTitle, appendOwnedConstraints } from './requirements.js';
 import { detachUnsatisfiableRequirements, claimPendingRequirements, unclaimedPendingRequirements, formatReassignActions } from './owned-freeze-reassign.js';
 import { trackedSourceOracle } from './owned-freeze-conflict.js';
-import { groupArgsForChild, runPhaseChild, runWithEmphasisRetry, prependHint, USER_CANCELLED, CommandTimeoutError, isFatalChildCause } from './child-runner.js';
+import { groupArgsForChild, runPhaseChild, runWithEmphasisRetry, prependHint, USER_CANCELLED, ChildFailureError, isFatalChildCause } from './child-runner.js';
 import { runResearchWorker, researchWorkerCacheHeading } from './research-worker.js';
 import { SessionUI } from '../remote/bridge.js';
 import { isYoloMode, yoloPickAutoAnswer } from './yolo.js';
@@ -308,7 +308,7 @@ export async function phaseVerifyTooling(deps, research) {
         // degrade for a child that merely failed. A hung command is different: it
         // cost the ceiling on every strike and says the SPEC named something
         // unbounded, so it is the one cause worth a trail line rather than silence.
-        if (e instanceof CommandTimeoutError) {
+        if (e instanceof ChildFailureError && e.failure.kind === 'command-timeout') {
             deps.logDebug?.(`verify-tooling: ${e.message} — shipping the list unverified`);
         }
         return replaceToolingWithVerified(research, commands);

package/dist/task/stall-detector.d.ts

@@ -6,7 +6,7 @@
  * takes, and that is not a property of the pathology — it is a property of the
  * model, its sampler settings, the reasoning budget and the size of the document
  * being read. Any of those moving turns the margin into a killer of good runs.
- * `PHASE_CHILD_TIMEOUT_MS` is 0 (off) for exactly that reason.
+ * The `phase` profile arms no wall clock (worker-profiles.ts) for exactly that reason.
  *
  * WHAT REPLACES IT. Two bounds, both dimensionless — invariant to model speed,
  * project size and reasoning budget:

package/dist/task/stall-detector.js

@@ -6,7 +6,7 @@
  * takes, and that is not a property of the pathology — it is a property of the
  * model, its sampler settings, the reasoning budget and the size of the document
  * being read. Any of those moving turns the margin into a killer of good runs.
- * `PHASE_CHILD_TIMEOUT_MS` is 0 (off) for exactly that reason.
+ * The `phase` profile arms no wall clock (worker-profiles.ts) for exactly that reason.
  *
  * WHAT REPLACES IT. Two bounds, both dimensionless — invariant to model speed,
  * project size and reasoning budget:

package/dist/workers/model-warning.d.ts

@@ -23,8 +23,9 @@
  * different fixes (`models.json` vs `/task-config`) and that line is already at
  * its length budget.
  */
-import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent';
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
 import { type ChildGroup } from '../config/groups.js';
+import { type GroupModelSnapshot } from '../shared/model-resolve.js';
 /** One cell that will not do what it says. */
 export interface ModelProblem {
     group: ChildGroup;
@@ -42,12 +43,8 @@ export interface ModelProblem {
      */
     why: 'unresolved' | 'extension';
 }
-/** The registry questions this needs, so a test can answer them with a literal. */
-export interface ModelLookup {
-    find: (provider: string, id: string) => unknown;
-    extensionProviders: ReadonlySet<string>;
-}
-export declare function findModelProblems(lookup: ModelLookup, specs: Readonly<Record<ChildGroup, string>>): ModelProblem[];
+/** The cells worth a line, in group order. */
+export declare function modelProblems(snapshot: Readonly<Record<ChildGroup, GroupModelSnapshot>>): ModelProblem[];
 /**
  * The hint line, or null when every cell is fine.
  *
@@ -58,12 +55,3 @@ export declare function formatModelWarning(problems: readonly ModelProblem[]): s
 export declare function registerModelWarning(pi: ExtensionAPI, 
 /** Injected by tests, which must not depend on the developer's saved config. */
 readSpecs?: () => Readonly<Record<ChildGroup, string>>): void;
-/**
- * Answer, once, what every model cell resolves to — and leave both answers where
- * the code that has no `ctx` can read them.
- *
- * `unresolved` only feeds the argv drop: an extension-provided model may well
- * work, since children load explicitly whitelisted extensions, and dropping its
- * flag would break a config that is merely fragile.
- */
-export declare function resolveModelCells(ctx: ExtensionContext, specs: Readonly<Record<ChildGroup, string>>): ModelProblem[];