pi-crew 0.10.2 → 0.10.4

package/src/runtime/process/zombie-scanner.ts

@@ -23,6 +23,7 @@
  */
 
 import * as fs from "node:fs";
+import { fieldsAfterComm, PROC_STAT_PPID_INDEX, PROC_STAT_STARTTIME_INDEX } from "./proc-stat.ts";
 
 export interface ZombieSubagent {
 	pid: number;
@@ -32,6 +33,15 @@ export interface ZombieSubagent {
 	/** Whether the recorded crew parent PID is still alive. */
 	parentAlive: boolean;
 	role: string | undefined;
+	/**
+	 * Mux kind from PI_CREW_SURFACE ("tmux"|"herdr") when the worker booted in
+	 * a surface pane (T12). Surface workers have NO heartbeat (T9 handoff) —
+	 * env markers are the only identity signal, so the scanner never gates a
+	 * surface entry on liveness telemetry.
+	 */
+	surface?: "tmux" | "herdr";
+	/** Pane id from PI_CREW_SURFACE_PANE — doctor closes orphan panes by it. */
+	surfacePaneId?: string;
 	rssKb: number;
 	elapsedSec: number | undefined;
 	cmd: string;
@@ -66,17 +76,12 @@ function readProcStat(pid: number): { ppid: number; elapsedSec: number | undefin
 	try {
 		const stat = fs.readFileSync(`/proc/${pid}/stat`, "utf-8");
 		// stat format: pid (comm) state ppid ... starttime ...
-		// comm may contain spaces/parens, so parse from the LAST ')' backwards.
-		const closeParen = stat.lastIndexOf(")");
-		if (closeParen < 0) return undefined;
-		const rest = stat
-			.slice(closeParen + 2)
-			.trim()
-			.split(/\s+/);
-		// rest[0] = state, rest[1] = ppid
-		const ppid = Number.parseInt(rest[1] ?? "", 10);
-		// starttime (clock ticks since boot) is field 22 in the full stat → index 19 in `rest`
-		const starttimeTicksRaw = Number.parseInt(rest[19] ?? "", 10);
+		// Shared paren-aware cut (proc-stat.ts) — MUST index identically with
+		// surface-spawn's PI_CREW_PARENT_START_TIME capture.
+		const rest = fieldsAfterComm(stat);
+		if (!rest) return undefined;
+		const ppid = Number.parseInt(rest[PROC_STAT_PPID_INDEX] ?? "", 10);
+		const starttimeTicksRaw = Number.parseInt(rest[PROC_STAT_STARTTIME_INDEX] ?? "", 10);
 		const starttimeTicks = Number.isFinite(starttimeTicksRaw) ? starttimeTicksRaw : undefined;
 		const elapsedSec = computeElapsedSec(starttimeTicks);
 		return { ppid: Number.isFinite(ppid) ? ppid : 0, elapsedSec };
@@ -184,12 +189,17 @@ export function scanZombieSubagents(): ZombieScanResult {
 
 			const crewParentPid = Number.parseInt(environ.PI_CREW_PARENT_PID ?? "", 10);
 			const stat = readProcStat(pid);
+			// Surface identity (T12): strict allowlist — an unrelated PI_CREW_SURFACE
+			// value must not half-populate the fields doctor relies on for pane close.
+			const surface = environ.PI_CREW_SURFACE === "tmux" || environ.PI_CREW_SURFACE === "herdr" ? environ.PI_CREW_SURFACE : undefined;
 			const entry: ZombieSubagent = {
 				pid,
 				ppid: stat?.ppid ?? 0,
 				crewParentPid: Number.isFinite(crewParentPid) ? crewParentPid : 0,
 				parentAlive: Number.isFinite(crewParentPid) && isPidAlive(crewParentPid),
 				role: environ.PI_CREW_ROLE,
+				surface,
+				surfacePaneId: environ.PI_CREW_SURFACE_PANE || undefined,
 				rssKb: readProcRssKb(pid),
 				elapsedSec: stat?.elapsedSec,
 				cmd: readProcCmdline(pid),
@@ -256,11 +266,9 @@ export function formatZombieReport(scan: ZombieScanResult): string {
 		lines.push(`### Zombies — parent dead (${scan.zombies.length})`);
 		lines.push("These sub-agents are orphaned. Safe to kill after review:");
 		lines.push("");
-		lines.push("  PID       PARENT  RSS       ROLE          CMD");
+		lines.push("  PID       PARENT  RSS       ROLE          SURFACE          CMD");
 		for (const z of scan.zombies) {
-			lines.push(
-				`  ${String(z.pid).padEnd(9)}${String(z.crewParentPid).padEnd(8)}${formatRss(z.rssKb).padEnd(10)}${(z.role ?? "?").padEnd(14)}${z.cmd.slice(0, 60)}`,
-			);
+			lines.push(formatZombieRow(z));
 		}
 		lines.push("");
 	}
@@ -269,11 +277,9 @@ export function formatZombieReport(scan: ZombieScanResult): string {
 		lines.push(`### Live — parent still running (${scan.live.length})`);
 		lines.push("NOT zombies. Do not kill (parent PID is alive and may still reap them).");
 		lines.push("");
-		lines.push("  PID       PARENT  RSS       ROLE          CMD");
+		lines.push("  PID       PARENT  RSS       ROLE          SURFACE          CMD");
 		for (const l of scan.live) {
-			lines.push(
-				`  ${String(l.pid).padEnd(9)}${String(l.crewParentPid).padEnd(8)}${formatRss(l.rssKb).padEnd(10)}${(l.role ?? "?").padEnd(14)}${l.cmd.slice(0, 60)}`,
-			);
+			lines.push(formatZombieRow(l));
 		}
 		lines.push("");
 	}
@@ -288,6 +294,13 @@ export function formatZombieReport(scan: ZombieScanResult): string {
 	return lines.join("\n");
 }
 
+/** One table row — shared by the zombie + live sections so columns stay aligned. */
+function formatZombieRow(z: ZombieSubagent): string {
+	// SURFACE = "kind:paneId" (T12) — the pane doctor closes when orphaned.
+	const surface = z.surface ? `${z.surface}:${z.surfacePaneId ?? "?"}` : "-";
+	return `  ${String(z.pid).padEnd(9)}${String(z.crewParentPid).padEnd(8)}${formatRss(z.rssKb).padEnd(10)}${(z.role ?? "?").padEnd(14)}${surface.padEnd(16)}${z.cmd.slice(0, 44)}`;
+}
+
 function formatRss(kb: number): string {
 	if (kb >= 1024 * 1024) return `${(kb / 1024 / 1024).toFixed(1)}G`;
 	if (kb >= 1024) return `${(kb / 1024).toFixed(0)}M`;

package/src/runtime/spawn-policy.ts

@@ -8,26 +8,26 @@
  *
  * Gate dimensions (each with a distinct machine-readable reason + fail-fast
  * message; evaluated in this order — cheapest/most-global first):
- *   1. nesting-disabled   — `nesting.enabled` is false (DEFAULT; fail-closed)
- *   2. role-denied        — the PARENT task's role is not executor-class
- *                           (read-only roles cannot raise spawn privileges),
- *                           or the requested grandchild role is not one of
- *                           the delegate-tool's allowed roles
- *   3. trust-denied       — untrusted escalation context (manual-only trust
+ *   1. trust-denied       — untrusted escalation context (manual-only trust
  *                           gate; the handler resolves trust, policy enforces)
- *   4. depth-exceeded     — child depth (parent.depth + 1) exceeds the
- *                           resolved maxDepth (default 2). Depth comes from
+ *   2. role-denied        — the REQUESTED grandchild role is not one of the
+ *                           delegate-tool's allowed roles (the parent role is
+ *                           NO LONGER gated — D8: every role may delegate;
+ *                           the spawn-side checkCrewDepth cap is the boundary)
+ *   3. depth-exceeded     — child depth (parent.depth + 1) exceeds the
+ *                           resolved maxDepth (default 4). Depth comes from
  *                           the parent task RECORD, never worker env
  *                           (design §7 rev-2 P0-2)
- *   5. slots-exhausted    — nested-slot budget exhausted ("N/M in flight");
+ *   4. slots-exhausted    — nested-slot budget exhausted ("N/M in flight");
  *                           fail-fast, never queue
- *   6. budget-insufficient— requested budgetTokens exceed the parent task's
+ *   5. budget-insufficient— requested budgetTokens exceed the parent task's
  *                           remaining allocation (tokensGranted - tokensSpent)
- *   7. model-invalid      — requested model is not in the resolved model
+ *   6. model-invalid      — requested model is not in the resolved model
  *                           catalog (the unvalidated provider/model
  *                           pass-through — model-fallback.ts:282, the
  *                           429-cascade root — must not be reachable here)
- *   8. timeout-invalid    — timeoutSec outside 1..MAX (default 900)
+ *   7. timeout-invalid    — timeoutSec outside 1..MAX (default 900)
+ *   8. workspace-conflict — write-capable grandchild narrowing cwd overlap
  */
 
 import { modelRefToString } from "./model/model-fallback.ts";
@@ -48,7 +48,6 @@ export const DEFAULT_DELEGATE_TIMEOUT_SEC = 900;
 export const MAX_DELEGATE_TIMEOUT_SEC = 86_400;
 
 export type SpawnPolicyDenyReason =
-	| "nesting-disabled"
 	| "role-denied"
 	| "trust-denied"
 	| "depth-exceeded"
@@ -59,14 +58,14 @@ export type SpawnPolicyDenyReason =
 	| "workspace-conflict";
 
 export interface DelegateAdmissionInput {
-	/** Resolved `nesting.enabled` config (DEFAULT false — fail-closed, ADR-5 §10). */
-	nestingEnabled: boolean;
-	/** Resolved max depth (nesting.maxDepth default 2; env clamp mirrors PI_CREW_MAX_DEPTH 1..10). */
+	/** Resolved max depth (nesting.maxDepth default 4; env clamp mirrors PI_CREW_MAX_DEPTH 1..10). */
 	maxDepth: number;
 	/** Parent task record fields the policy is allowed to trust. */
 	parentTask: {
 		taskId: string;
-		role: string;
+		/** Role for workspace-capability evaluation (policy no longer gates the
+		 *  parent role — D8 opens delegation to every role). */
+		role?: string;
 		/** Absent on pre-v2 records — treated as depth 1 (a worker). */
 		depth?: number;
 		allocation?: { tokensGranted?: number; tokensSpent?: number };
@@ -122,26 +121,13 @@ function deny(reason: SpawnPolicyDenyReason, message: string): SpawnPolicyDecisi
 }
 
 export function evaluateDelegateAdmission(input: DelegateAdmissionInput): SpawnPolicyDecision {
-	const { nestingEnabled, maxDepth, parentTask, requested } = input;
+	const { maxDepth, parentTask, requested } = input;
 	const parentDepth = parentTask.depth ?? 1; // pre-v2 records: workers are depth 1
 	const childDepth = parentDepth + 1;
 
-	// 1. Flag gate — fail-closed default (ADR-5 §10).
-	if (!nestingEnabled) {
-		return deny(
-			"nesting-disabled",
-			"delegate rejected: governed nesting is disabled (nesting.enabled=false, the fail-closed default; enable it in USER config)",
-		);
-	}
-
-	// 2. Role gate — parent must be executor-class; requested role must be in
-	// the tool's allowed set.
-	if (!isExecutorClassRole(parentTask.role)) {
-		return deny(
-			"role-denied",
-			`delegate rejected: role '${parentTask.role}' is not executor-class (${EXECUTOR_CLASS_ROLES.join("/")}) — read-only roles cannot delegate`,
-		);
-	}
+	// 1. Role gate — the REQUESTED grandchild role must be in the tool's allowed
+	// set (the PARENT role is no longer gated — D8: every role may delegate;
+	// the spawn-side checkCrewDepth cap + slot budget below are the boundary).
 	const requestedRole = requested?.role;
 	if (requestedRole !== undefined && !(DELEGATE_ALLOWED_ROLES as readonly string[]).includes(requestedRole)) {
 		return deny(
@@ -150,12 +136,12 @@ export function evaluateDelegateAdmission(input: DelegateAdmissionInput): SpawnP
 		);
 	}
 
-	// 3. Trust gate — untrusted escalation context never spawns.
+	// 2. Trust gate — untrusted escalation context never spawns.
 	if (input.untrusted) {
 		return deny("trust-denied", "delegate rejected: untrusted escalation context (trust gate is manual-only)");
 	}
 
-	// 4. Depth gate — computed from the parent RECORD (never worker env).
+	// 3. Depth gate — computed from the parent RECORD (never worker env).
 	if (childDepth > maxDepth) {
 		return deny(
 			"depth-exceeded",
@@ -163,7 +149,7 @@ export function evaluateDelegateAdmission(input: DelegateAdmissionInput): SpawnP
 		);
 	}
 
-	// 5. Nested-slot budget — fail-fast, never queue.
+	// 4. Nested-slot budget — fail-fast, never queue.
 	if (input.slots.used >= input.slots.max) {
 		return deny(
 			"slots-exhausted",
@@ -171,7 +157,7 @@ export function evaluateDelegateAdmission(input: DelegateAdmissionInput): SpawnP
 		);
 	}
 
-	// 6. Parent allocation sufficiency — reserve up-front or reject.
+	// 5. Parent allocation sufficiency — reserve up-front or reject.
 	if (requested?.budgetTokens !== undefined) {
 		const granted = parentTask.allocation?.tokensGranted ?? 0;
 		const spent = parentTask.allocation?.tokensSpent ?? 0;
@@ -184,7 +170,7 @@ export function evaluateDelegateAdmission(input: DelegateAdmissionInput): SpawnP
 		}
 	}
 
-	// 7. Model validation against the resolved catalog.
+	// 6. Model validation against the resolved catalog.
 	const normalizedModel = requested?.model !== undefined ? modelRefToString(requested.model) : undefined;
 	if (normalizedModel !== undefined && input.modelCatalog !== undefined) {
 		if (!input.modelCatalog.includes(normalizedModel)) {
@@ -192,7 +178,7 @@ export function evaluateDelegateAdmission(input: DelegateAdmissionInput): SpawnP
 		}
 	}
 
-	// 8. Timeout validation (mandatory default 900).
+	// 7. Timeout validation (mandatory default 900).
 	const timeoutSec = requested?.timeoutSec ?? DEFAULT_DELEGATE_TIMEOUT_SEC;
 	if (!Number.isFinite(timeoutSec) || timeoutSec < 1 || timeoutSec > MAX_DELEGATE_TIMEOUT_SEC) {
 		return deny(
@@ -201,7 +187,7 @@ export function evaluateDelegateAdmission(input: DelegateAdmissionInput): SpawnP
 		);
 	}
 
-	// 9. Workspace interaction (ADR-5 §9): a write-capable grandchild sharing
+	// 8. Workspace interaction (ADR-5 §9): a write-capable grandchild sharing
 	// the parent's cwd with ANOTHER in-flight executor is only admitted when
 	// serialization is established (limits.serializeOnPathOverlap) — otherwise
 	// reject; read-only grandchild roles (explorer/analyst) never conflict.

package/src/runtime/stale-reconciler.ts

@@ -270,10 +270,35 @@ function isTaskHeartbeatStale(task: TeamTaskState, now: number): boolean {
 	// Compute elapsed from both sources and use the fresher (minimum) one,
 	// mirroring heartbeat-watcher logic: if either source has recent activity,
 	// the task is not stale even if the other is stale.
-	const heartbeatAge = Number.isFinite(heartbeatAt) ? now - heartbeatAt : Infinity;
-	const activityAge = Number.isFinite(activityAt) ? now - activityAt : Infinity;
+	const heartbeatAge = Number.isFinite(heartbeatAt) ? now - heartbeatAt : Number.MAX_SAFE_INTEGER;
+	const activityAge = Number.isFinite(activityAt) ? now - activityAt : Number.MAX_SAFE_INTEGER;
 	const elapsed = Math.min(heartbeatAge, activityAge);
-	return elapsed > NO_PID_HEARTBEAT_STALE_MS;
+	if (elapsed <= NO_PID_HEARTBEAT_STALE_MS) return false;
+	// F1 part 2 (battery 2026-09-10, live evidence run team_20260910171307): a
+	// surface worker's recorder only flushes at turn boundaries — one slow LLM
+	// turn (observed: 6.7min) freezes lastSeenAt/lastActivityAt while the worker
+	// process is alive and mid-turn. The heartbeat-watcher already has a
+	// PID-liveness gate for exactly this ("alive → downgrade dead→stale"); the
+	// reconciler MUST apply the same gate before repairing, or it kills healthy
+	// runs at the 5-minute mark mid-turn. A truly dead pid still repairs as before.
+	const taskPid = task.heartbeat?.pid ?? task.checkpoint?.childPid;
+	const pidAlive = taskPid ? checkProcessLiveness(taskPid).alive : false;
+	if (taskPid && pidAlive) return false;
+	if (process.env.PI_CREW_DEBUG_STALE === "1") {
+		// F1 forensic (battery 2026-09-10): sidecar log of every STALE verdict so
+		// live repros can show exactly what the reconciler saw (pid present? alive?
+		// elapsed?) — the reconciler may run in ANY host process, hence a fixed
+		// sidecar path instead of console.
+		try {
+			fs.appendFileSync(
+				"/tmp/pi-crew-f1-debug.log",
+				`${JSON.stringify({ ts: new Date().toISOString(), taskId: task.id, status: task.status, taskPid, pidAlive, heartbeatAge, activityAge, hbLastSeen: task.heartbeat?.lastSeenAt })}\n`,
+			);
+		} catch {
+			/* best-effort forensic log */
+		}
+	}
+	return true;
 }
 
 /**

package/src/runtime/supervisor-contact.ts

@@ -22,6 +22,9 @@ export function recordSupervisorContact(manifest: TeamRunManifest, payload: Omit
 		timestamp: new Date().toISOString(),
 	};
 	try {
+		// REVIEW FIX (2026-09-10): reverted M2b buffered conversion —
+		// supervisor.contact events are read back synchronously (tests +
+		// contact-history display); low-frequency by design.
 		appendEvent(manifest.eventsPath, {
 			type: "supervisor.contact",
 			runId: manifest.runId,