pi-crew 0.10.4 → 0.10.6

package/src/extension/context-status-injection.ts

@@ -28,7 +28,7 @@
  * - `emitContext` already wraps handlers in try/catch and emits errors instead
  *   of crashing the loop (Pi `runner.ts:933`), so a throw here can't break the
  *   agent — but we also guard defensively.
- * - Opt-out: `runtime.reliability.ambientStatusInjection: false` in config.
+ * - Opt-out: `reliability.ambientStatusInjection: false` in config.
  */
 
 import type { AgentMessage } from "@earendil-works/pi-agent-core";
@@ -163,7 +163,7 @@ export function handleContextEvent(event: ContextEvent, cwd: string, sessionId?:
  * Register the ambient-status `context` event handler. Reads the project cwd
  * from the session context on each call (crew state is per-project).
  *
- * Pass `enabled: false` (from `runtime.reliability.ambientStatusInjection`) to
+ * Pass `enabled: false` (from `reliability.ambientStatusInjection`) to
  * disable the feature without unwiring the handler.
  */
 export function registerContextStatusInjection(pi: ExtensionAPI, opts: { enabled?: boolean } = {}): void {

package/src/extension/knowledge-injection.ts

@@ -437,13 +437,21 @@ export function buildKnowledgeFragment(cwd: string, query?: KnowledgeQuery): str
 
 /**
  * Register the knowledge-injection hook. Appends project knowledge to the
- * MAIN session's system prompt on `before_agent_start`. This hook does NOT
- * fire for crew workers: they are spawned with `--no-extensions`, so the
- * extension layer (and this hook) never loads in their process. Workers
- * instead receive knowledge via `buildKnowledgeFragment(task.cwd)` injected
- * into their prompt stablePrefix by `prompt-builder.ts`. Do NOT "fix" this
- * perceived gap by making the hook reach workers — it would cause
- * double-injection. (Verified by research workflow 2026-06-28.)
+ * MAIN session's system prompt on `before_agent_start`.
+ *
+ * Worker knowledge path (ARCH-2 corrected): children are NOT spawned with
+ * `--no-extensions` anymore — `pi-args.ts` runs extension discovery like
+ * the main session, but a child only loads an extension when the agent's
+ * frontmatter declares it (`extensions:`; builtin pi-crew agents declare
+ * none, so in practice workers never load pi-crew). Workers instead receive
+ * knowledge via `buildKnowledgeFragment(task.cwd)` injected into their
+ * prompt stablePrefix by `prompt-builder.ts`.
+ *
+ * Defense-in-depth: if an agent DOES declare the pi-crew extension, this
+ * hook would fire in the worker process and double-inject knowledge (once
+ * here, once via prompt-builder). The `PI_CREW_KIND=subagent` early-return
+ * below keeps main-session hooks main-session-only regardless of how the
+ * child was spawned. Do NOT remove it.
  *
  * The hook calls buildKnowledgeFragment(cwd) with NO query — so the main
  * session gets conventions-only (no session-log noise), which is the right
@@ -452,6 +460,10 @@ export function buildKnowledgeFragment(cwd: string, query?: KnowledgeQuery): str
  */
 export function registerKnowledgeInjection(pi: ExtensionAPI): void {
 	pi.on("before_agent_start", (event: BeforeAgentStartEvent) => {
+		// ARCH-2: never fire in child worker processes — knowledge reaches
+		// workers via prompt-builder's stablePrefix fragment; firing here too
+		// would double-inject.
+		if (process.env.PI_CREW_KIND === "subagent") return;
 		const options =
 			(
 				event as BeforeAgentStartEvent & {

package/src/extension/post-init-skill-check.ts

@@ -0,0 +1,32 @@
+import { renderSkillInstructions } from "../runtime/skill-instructions.ts";
+
+export type SkillCheckResult = {
+	total: number;
+	resolved: number;
+	missing: string[];
+	severity: "ok" | "warn" | "error";
+	message: string;
+};
+
+export async function runPostInitSkillCheck(cwd: string): Promise<SkillCheckResult> {
+	const result = renderSkillInstructions({ cwd, role: "executor" });
+	const total = result.names.length;
+	const missingMatches = result.block.match(/Skill '([^']+)' was selected but no SKILL\.md file was found/g);
+	const missing = missingMatches ? missingMatches.map((m) => m.match(/'([^']+)'/)![1]) : [];
+	const resolved = total - missing.length;
+
+	let severity: "ok" | "warn" | "error";
+	let message: string;
+	if (resolved === total) {
+		severity = "ok";
+		message = `All ${total} default skills resolved`;
+	} else if (resolved === 0) {
+		severity = "error";
+		message = `0/${total} default skills resolved — likely bundle stale. Run \`npm run build:bundle\`.`;
+	} else {
+		severity = "warn";
+		message = `${resolved}/${total} default skills resolved — degraded: ${missing.join(", ")}`;
+	}
+
+	return { total, resolved, missing, severity, message };
+}

package/src/extension/register.ts

@@ -32,6 +32,7 @@ import { registerCrewShortcuts } from "./crew-shortcuts.ts";
 import { registerCrewVibes } from "./crew-vibes/index.ts";
 import { registerKnowledgeInjection } from "./knowledge-injection.ts";
 import { registerCrewMessageRenderers } from "./message-renderers.ts";
+import { runPostInitSkillCheck } from "./post-init-skill-check.ts";
 import { registerPiCommands } from "./registration/command-registration.ts";
 import { buildRegistrationContext } from "./registration/context-builder.ts";
 import { importCrashRecovery, purgeStaleActiveRunIndexSyncIfLoaded } from "./registration/crash-recovery-cache.ts";
@@ -50,7 +51,7 @@ export { __test__subagentSpawnParams };
 /**
  * Pi extension entry point. See module-level docstring for the full pipeline.
  */
-export function registerPiTeams(pi: ExtensionAPI): void {
+export async function registerPiTeams(pi: ExtensionAPI): Promise<void> {
 	resetTimings();
 	time("register:start");
 
@@ -127,6 +128,13 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 	} catch (err) {
 		console.warn("[pi-crew] crew-vibes initialization failed:", err instanceof Error ? err.message : err);
 	}
+
+	const skillCheck = await runPostInitSkillCheck(process.cwd());
+	if (skillCheck.severity === "error") {
+		console.error(`[pi-crew] ${skillCheck.message}`);
+	} else if (skillCheck.severity === "warn") {
+		console.warn(`[pi-crew] ${skillCheck.message}`);
+	}
 }
 
 // Bottom-of-file import: keeps compaction-guard out of the top-level

package/src/extension/registration/hook-registration.ts

@@ -16,13 +16,14 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { fileURLToPath } from "node:url";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { asRecord, loadConfig } from "../../config/config.ts";
 import { buildValidationBlocker, extractPathFromInput, validateWrittenFile } from "../../runtime/per-write-validator.ts";
+import { packageRoot } from "../../utils/paths.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
 import { shouldBlockDestructiveTeamAction } from "../team-tool/destructive-gate.ts";
 import type { RegistrationContext } from "./registration-types.ts";
+import { installToolLoopGuard } from "./tool-loop-guard.ts";
 
 /**
  * Register all non-lifecycle event hooks on the ExtensionAPI.
@@ -35,6 +36,22 @@ export function installPiHooks(pi: ExtensionAPI, ctx: RegistrationContext): void
 	installResourcesDiscoverHook(pi, ctx);
 	installToolCallHook(pi, ctx);
 	installToolResultHook(pi, ctx);
+	installToolLoopGuardIfEnabled(pi, ctx);
+}
+
+/**
+ * ARCH-1: dispatch loop guard — warn at 3 identical results, block read-only
+ * tools at 5. Toggle via reliability.loopGuard (default on), mirroring
+ * perWriteValidation.
+ */
+function installToolLoopGuardIfEnabled(pi: ExtensionAPI, ctx: RegistrationContext): void {
+	try {
+		const cwd = ctx.currentCtx?.cwd ?? process.cwd();
+		if (loadConfig(cwd).config.reliability?.loopGuard === false) return;
+	} catch {
+		/* config read failure: keep the guard on (fail-safe) */
+	}
+	installToolLoopGuard(pi);
 }
 
 /**
@@ -48,7 +65,7 @@ function installResourcesDiscoverHook(pi: ExtensionAPI, ctx: RegistrationContext
 		pi.on("resources_discover", () => {
 			const sessionCwd = ctx.currentCtx?.cwd ?? process.cwd();
 			const skillDir = path.resolve(sessionCwd, "skills");
-			const extSkillDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "skills");
+			const extSkillDir = path.join(packageRoot(), "skills");
 			const paths: string[] = [];
 			if (fs.existsSync(extSkillDir)) paths.push(extSkillDir);
 			if (skillDir !== extSkillDir && fs.existsSync(skillDir)) {
@@ -97,7 +114,7 @@ function installToolCallHook(_pi: ExtensionAPI, _ctx: RegistrationContext): void
  * tool result on failure — catches malformed config the moment it's
  * written, not at the next load. Latency-safe by construction: no process
  * spawn, one disk read ONLY for validated extensions, dedup'd by content.
- * Toggle via runtime.reliability.perWriteValidation (default true).
+ * Toggle via reliability.perWriteValidation (default true).
  * Process-spawning validators (.js/.sh/.py) are a future opt-in.
  */
 function installToolResultHook(_pi: ExtensionAPI, _ctx: RegistrationContext): void {

package/src/extension/registration/tool-loop-guard.ts

@@ -0,0 +1,243 @@
+/**
+ * ARCH-1: Tool loop guard.
+ *
+ * Detects a session re-issuing the exact same tool call (same tool, same
+ * arguments) consecutively with identical results — how model-side infinite
+ * loops present (precedent: a pi-crew run where a worker re-verified the
+ * same completed files 14+ times; OMO-slim issue #1071).
+ *
+ * Ported from oh-my-opencode-slim src/hooks/tool-loop-guard/hook.ts, adapted
+ * to pi's extension hook surface:
+ * - `tool_result` advances the counter: identical args AND byte-identical
+ *   output continues the run; new output resets it (a legitimate re-read
+ *   after a file changed can never accumulate toward a block).
+ * - `tool_call` blocks when a hard-block tool's confirmed run count reached
+ *   the block threshold. The before-hook never increments — overlapping
+ *   parallel calls cannot inflate the count.
+ * - Hard-block set is read-only file tools only (read/grep/glob/find/ls);
+ *   everything else warns. bash and edit/write stay warn-only: their
+ *   identical repeats may be legitimate side-effect retries.
+ * - Wait-style tool (`ask` — its contract is "stop and wait"): per-turn
+ *   counter keyed by tool name only, warn at 2, block the 3rd; any non-ask
+ *   tool result resets the turn (OMO #1139 semantics).
+ *
+ * Scope is per-process: each child worker runs in its own process, and the
+ * main session is one more, so module-level state needs no session keying.
+ * Tracked fingerprints are FIFO-bounded to guard memory in long sessions.
+ *
+ * Toggle: reliability.loopGuard = false in config disables install
+ * (mirrors perWriteValidation).
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+const LOOP_GUARD_WARN_AT = 3;
+const LOOP_GUARD_BLOCK_AT = 5;
+
+/** Tools exempt from the entire guard: identical repeated invocation is legitimate. */
+const LOOP_GUARD_EXEMPT: Record<string, true> = {
+	team: true,
+	crew_agent: true,
+	Agent: true,
+	get_subagent_result: true,
+};
+
+/** Tools that may be hard-blocked: read-only file analysis only. */
+const LOOP_GUARD_BLOCK_TOOLS: Record<string, true> = {
+	read: true,
+	grep: true,
+	glob: true,
+	find: true,
+	ls: true,
+};
+
+/** Wait-style tools: repeating within a turn is always degenerate. */
+const WAIT_TOOL = "ask";
+const WAIT_GUARD_WARN_AT = 2;
+/** Once this many ask calls have COMPLETED, the next ask call is refused (OMO #1139: warn at 2, refuse the 3rd). */
+const WAIT_GUARD_BLOCK_AT = 2;
+
+/** Max tracked fingerprints before evicting the oldest (FIFO bound). */
+const MAX_TRACKED_FINGERPRINTS = 512;
+
+export const LOOP_GUARD_MARKER = "[REPEATED TOOL CALLS - STOP]";
+export const WAIT_GUARD_MARKER = "[REPEATED WAIT TOOL - END TURN]";
+
+export const LOOP_GUARD_WARNING = `
+${LOOP_GUARD_MARKER}
+
+You have issued the exact same tool call with identical arguments ${LOOP_GUARD_WARN_AT} times in a row and received identical results. This is an infinite loop and you are making no progress.
+
+STOP repeating this call. Instead:
+1. Reconsider what you are looking for — the result above already contains what this call can tell you.
+2. If you need different information, make a DIFFERENT call (different path, pattern, or tool).
+3. If the task is actually done, produce your final answer now instead of calling more tools.
+`;
+
+export const WAIT_GUARD_WARNING = `
+${WAIT_GUARD_MARKER}
+
+You have called \`ask\` ${WAIT_GUARD_WARN_AT} times in this turn. Its contract is to stop and wait — do not call it again in the same turn.
+
+STOP calling tools that wait. Continue with what you can do, or produce your final answer; the reply arrives as a separate message later.
+`;
+
+/** Deterministic JSON: object keys sorted recursively, insensitive to key order. */
+export function stableStringify(value: unknown): string {
+	return JSON.stringify(sortValue(value));
+}
+
+function sortValue(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(sortValue);
+	if (value && typeof value === "object") {
+		const record = value as Record<string, unknown>;
+		const out: Record<string, unknown> = {};
+		for (const key of Object.keys(record).sort()) {
+			out[key] = sortValue(record[key]);
+		}
+		return out;
+	}
+	return value;
+}
+
+/** Deterministic fingerprint of tool + args, insensitive to key order. */
+export function fingerprint(tool: string, args: unknown): string {
+	return `${tool.toLowerCase()}:${stableStringify(args ?? null)}`;
+}
+
+interface FingerprintState {
+	/** Confirmed consecutive identical-args + identical-output count. */
+	runCount: number;
+	/** Last output fingerprint seen for this tool+args (null until first result). */
+	lastOutput: string | null;
+}
+
+export interface LoopGuardResultAppend {
+	type: "text";
+	text: string;
+}
+
+export interface LoopGuardCallVerdict {
+	block?: boolean;
+	reason?: string;
+}
+
+/**
+ * Pure state machine — exported for tests and reused by the hook wiring.
+ * One instance per process.
+ */
+export function createLoopGuardState() {
+	const runs = new Map<string, FingerprintState>();
+	let lastFingerprint: string | null = null;
+	let waitRunCount = 0;
+
+	function evictIfNeeded(): void {
+		while (runs.size > MAX_TRACKED_FINGERPRINTS) {
+			const oldest = runs.keys().next().value;
+			if (oldest === undefined) break;
+			runs.delete(oldest);
+		}
+	}
+
+	/** tool_result side: returns warning content to append, if any. */
+	function onToolResult(tool: string, args: unknown, output: unknown): LoopGuardResultAppend[] {
+		const toolLower = tool.toLowerCase();
+		if (toolLower === WAIT_TOOL) {
+			waitRunCount += 1;
+			if (waitRunCount === WAIT_GUARD_WARN_AT) return [{ type: "text", text: WAIT_GUARD_WARNING }];
+			return [];
+		}
+		// Any completed non-ask tool call ends the "turn" for the wait guard.
+		waitRunCount = 0;
+
+		if (LOOP_GUARD_EXEMPT[tool]) return [];
+
+		const fp = fingerprint(tool, args);
+		const outputKey = stableStringify(output);
+		const state = runs.get(fp) ?? { runCount: 0, lastOutput: null };
+
+		if (fp !== lastFingerprint) {
+			// A different call intervened: this starts a fresh run for this fp.
+			state.runCount = 0;
+		}
+		if (state.lastOutput === outputKey) {
+			state.runCount += 1;
+		} else {
+			// New information: never accumulates toward a block.
+			state.runCount = 1;
+			state.lastOutput = outputKey;
+		}
+		runs.set(fp, state);
+		evictIfNeeded();
+		lastFingerprint = fp;
+
+		if (state.runCount === LOOP_GUARD_WARN_AT) {
+			return [{ type: "text", text: LOOP_GUARD_WARNING }];
+		}
+		return [];
+	}
+
+	/** tool_call side: returns a block verdict for degenerate repeats. */
+	function onToolCall(tool: string, args: unknown): LoopGuardCallVerdict {
+		const toolLower = tool.toLowerCase();
+		if (toolLower === WAIT_TOOL) {
+			if (waitRunCount >= WAIT_GUARD_BLOCK_AT) {
+				return {
+					block: true,
+					reason: `pi-crew loop guard: \`ask\` called ${waitRunCount} times this turn — its contract is to wait. End your turn; the reply arrives as a separate message.`,
+				};
+			}
+			return {};
+		}
+		if (LOOP_GUARD_EXEMPT[tool]) return {};
+		if (!LOOP_GUARD_BLOCK_TOOLS[toolLower]) return {};
+
+		const fp = fingerprint(tool, args);
+		const state = runs.get(fp);
+		if (state && state.runCount >= LOOP_GUARD_BLOCK_AT) {
+			return {
+				block: true,
+				reason: `pi-crew loop guard: this exact ${tool} call (identical arguments) has returned identical results ${state.runCount} times in a row. Make a DIFFERENT call (different path, pattern, or tool), or produce your final answer.`,
+			};
+		}
+		return {};
+	}
+
+	function reset(): void {
+		runs.clear();
+		lastFingerprint = null;
+		waitRunCount = 0;
+	}
+
+	return { onToolResult, onToolCall, reset };
+}
+
+/**
+ * Install the loop guard on a Pi instance. Both hooks are best-effort:
+ * older Pi versions without these events are tolerated (same pattern as
+ * installResourcesDiscoverHook).
+ */
+export function installToolLoopGuard(pi: ExtensionAPI): void {
+	const state = createLoopGuardState();
+	try {
+		pi.on("tool_call", async (event: { toolName: string; input?: unknown }) => {
+			const verdict = state.onToolCall(event.toolName, event.input);
+			if (verdict.block) {
+				return { block: true as const, reason: verdict.reason };
+			}
+			return undefined;
+		});
+	} catch {
+		/* older Pi without tool_call events */
+	}
+	try {
+		pi.on("tool_result", (event: { toolName: string; input?: unknown; content?: unknown }) => {
+			const appends = state.onToolResult(event.toolName, event.input, event.content);
+			if (appends.length === 0) return undefined;
+			const existing = Array.isArray(event.content) ? event.content : [];
+			return { content: [...existing, ...appends] };
+		});
+	} catch {
+		/* older Pi without tool_result events */
+	}
+}

package/src/extension/team-tool/handle-settings.ts

@@ -51,6 +51,11 @@ const EFFECTIVE_DEFAULTS: Record<string, unknown> = {
 	"reliability.autoRetry": false,
 	"reliability.autoRecover": false,
 	"reliability.cleanupOrphanedTempDirs": true,
+	"reliability.loopGuard": true,
+	"reliability.perWriteValidation": true,
+	"reliability.ambientStatusInjection": true,
+	"reliability.forcePreflight": false,
+	"reliability.scopeModels": false,
 	"telemetry.enabled": false,
 	"notifications.enabled": false,
 };
@@ -216,6 +221,11 @@ const KNOWN_KEYS = new Set([
 	"reliability.autoRetry",
 	"reliability.autoRecover",
 	"reliability.cleanupOrphanedTempDirs",
+	"reliability.loopGuard",
+	"reliability.perWriteValidation",
+	"reliability.ambientStatusInjection",
+	"reliability.forcePreflight",
+	"reliability.scopeModels",
 	"reliability.deadletterThreshold",
 	"reliability.retryPolicy.maxAttempts",
 	"reliability.retryPolicy.backoffMs",

package/src/extension/team-tool/run.ts

@@ -71,7 +71,7 @@ import * as path from "node:path";
 import { t } from "../../i18n.ts";
 import { hasAsyncStartMarker } from "../../runtime/async-marker.ts";
 import { checkProcessLiveness, isActiveRunStatus } from "../../runtime/process-status.ts";
-import { waitForRun } from "../../runtime/run-tracker.ts";
+import { registerRunPromise, waitForRun } from "../../runtime/run-tracker.ts";
 import { collectRunMetrics } from "../../state/stores/run-metrics.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
 import { effectiveRunConfig } from "./config-patch.ts";
@@ -710,6 +710,13 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	if (executeWorkers && ctx.startForegroundRun) {
 		// CORE-8: unified deadline — resolves params > config > 1h default.
 		const fgDeadline = resolveRunDeadline(ctx, params, executedConfig);
+		// F1 register/await race fix (2026-09-12): the waitForRun below runs
+		// immediately after startForegroundRun returns (void), while
+		// executeTeamRunCore registers its promise only after several awaits —
+		// the waiter could land on the polling path and MISS the broker's
+		// waiting-push. Pre-register here so the medium path is guaranteed;
+		// registerRunPromise is idempotent (the core's later call is a no-op).
+		registerRunPromise(updatedManifest.runId);
 		ctx.onRunStarted?.(updatedManifest.runId);
 		const fgSignal = fgDeadline.signal;
 		let fgAbortListener: (() => void) | undefined;
@@ -770,6 +777,40 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		// Wait for the foreground run to complete and return actual results.
 		try {
 			const completed = await waitForRun(updatedManifest.runId, resolvedCtx.cwd, { timeoutMs: fgDeadline.deadlineMs });
+			if (completed.waiting) {
+				// F1 (2026-09-12 live battery): a task parked on `ask` released this
+				// waiter — return the QUESTION so the leader can answer inline
+				// instead of blocking until the response watchdog kills the
+				// parked worker. Run keeps executing in the foreground-run lane.
+				const w = completed.waiting;
+				const secondsLeft = Math.max(0, Math.round((w.deadline - Date.now()) / 1000));
+				const lines = [
+					`pi-crew run WAITING for your answer: ${updatedManifest.runId}`,
+					`Team: ${team.name} · Workflow: ${workflow.name}`,
+					`Task ${w.taskId} (${w.questionId.substring(0, 8)}) parked on ask — ${secondsLeft}s until the deadline (then the worker proceeds with best judgment):`,
+					"",
+					`Q: ${w.question}`,
+				];
+				if (w.options?.length) {
+					lines.push("", "Options:", ...w.options.map((o, i) => `  ${i + 1}. ${o}`));
+				}
+				lines.push(
+					"",
+					"Answer now (run keeps executing):",
+					`  team action='respond' taskId='${w.taskId}' message='<your answer>'`,
+					"then re-block until the run finishes:",
+					`  team action='wait' runId='${updatedManifest.runId}'`,
+				);
+				return result(lines.join("\n"), {
+					action: "run",
+					status: "ok",
+					runId: updatedManifest.runId,
+					artifactsRoot: updatedManifest.artifactsRoot,
+					taskId: w.taskId,
+					questionId: w.questionId,
+					waiting: true,
+				});
+			}
 			if (completed.detached) {
 				// The waiter was released so this turn can settle (agent view
 				// switch); the run keeps executing and reports on completion.

package/src/extension/team-tool-types.ts

@@ -23,6 +23,12 @@ export interface TeamToolDetails {
 		durationMs?: number;
 		consistencyScore?: number;
 	};
+	/** F1 (2026-09-12): set when a run returned early because a task parked on
+	 * `ask` — the tool result carries the question; answer via respond then
+	 * re-block via wait. */
+	taskId?: string;
+	questionId?: string;
+	waiting?: boolean;
 	/** Structured data for programmatic consumption (e.g. TUI widgets). */
 	data?: Record<string, unknown>;
 }

package/src/prompt/prompt-runtime.ts

@@ -224,7 +224,7 @@ export function rewriteTeamWorkerPrompt(prompt: string, options: { inheritProjec
 
 // ── WP-2/R2 (ADR-0 2026-08-17-waiting-producer-ask): worker-side `ask` tool ──
 // Binding ADR items 1, 4, 5:
-//   1. `ask({ question, options?, timeoutSec? = 600 })` — the SERVER clamps
+//   1. `ask({ question, options?, timeoutSec? = 480 })` — the SERVER clamps
 //      timeoutSec ≤ 3600 (P2-7); the client mirrors the clamp defensively.
 //   4. Option-(b) delivery: poll the run mailbox stream
 //      (<PI_CREW_STATE_ROOT>/mailbox via readAllMailboxMessages) every 500ms
@@ -282,8 +282,22 @@ export function effectiveSteeringInterval(realtimeActive: boolean): number {
 	return realtimeActive ? STEER_POLL_ACTIVE_MS : STEER_POLL_IDLE_MS;
 }
 
-const ASK_TIMEOUT_SEC_DEFAULT = 600;
+// F2 (2026-09-12 live battery): 480, NOT 600 — a parked worker emits no
+// output, so the 600s response watchdog counts the whole park; at 600==600
+// the kill raced the wake (team_20260912014448). 480s leaves 120s grace for
+// the worker to wake, answer its fallback, and finish the turn. This client
+// default must stay in lockstep with the server default
+// (WAIT_REQUEST_TIMEOUT_SEC_DEFAULT) — an explicit value here overrides the
+// server default, so fixing only the broker side changed nothing.
+const ASK_TIMEOUT_SEC_DEFAULT = 480;
 const ASK_TIMEOUT_SEC_MAX = 3600;
+/** F2 live-probe follow-up (2026-09-12, team_20260912053049): the model may
+ * pass an EXPLICIT timeoutSec (it passed 600, racing the watchdog again
+ * despite the 480 default). The EFFECTIVE deadline is clamped to this
+ * ceiling regardless of what the model asks for — a parked worker emits no
+ * output, so any deadline ≥ the 600s response watchdog is a guaranteed kill.
+ * Must stay strictly below RESPONSE_TIMEOUT_MS/1000 (child-pi-constants). */
+const ASK_TIMEOUT_SEC_CEILING = 480;
 /** Client-side mirrors of the broker's parseWaitRequestParams bounds — the
  *  typebox schema below enforces them at the tool-call boundary so an
  *  out-of-bounds ask fails validation BEFORE a park is attempted. */
@@ -684,16 +698,21 @@ export function createAskTool(deps: AskToolDeps = {}): AskToolDefinition {
 					"[ask] unavailable: no broker connection (PI_CREW_BROKER_SOCKET / PI_CREW_BROKER_TOKEN / PI_CREW_BROKER_RUN_ID / PI_CREW_STATE_ROOT absent — scaffold or mock mode) — proceed with best judgment; do not call ask again.",
 				);
 			}
-			// Client-side mirror of the server clamp (P2-7): the broker clamps
-			// again, so this only shortens the park window the model believes in.
-			const timeoutSec = Math.min(Math.max(1, Math.floor(params.timeoutSec ?? ASK_TIMEOUT_SEC_DEFAULT)), ASK_TIMEOUT_SEC_MAX);
+			// Client-side mirror of the server clamp (P2-7) + the F2 ceiling: the
+			// broker clamps ≤3600 again, but the CEILING here is the one that keeps
+			// the park window strictly inside the 600s response watchdog — an
+			// explicit model value (observed: 600) must NOT override it.
+			const timeoutSec = Math.min(Math.max(1, Math.floor(params.timeoutSec ?? ASK_TIMEOUT_SEC_DEFAULT)), ASK_TIMEOUT_SEC_CEILING);
 			const client = deps.makeBrokerClient
 				? deps.makeBrokerClient({ runId, taskId, socketPath, token })
 				: new CrewBrokerClient({ runId, taskId, socketPath, token });
 			try {
 				const requestParams: Record<string, unknown> = { to: taskId, question: params.question, timeoutSec };
 				if (params.options) requestParams.options = params.options;
-				const parked = await client.request("wait.request", requestParams);
+				// F5: cap the RPC itself at the ask deadline + 5s grace — a response
+				// frame lost on a half-dead socket must not outlive the deadline the
+				// worker is prepared to wait anyway (fallback notice → proceed).
+				const parked = await client.request("wait.request", requestParams, { timeoutMs: timeoutSec * 1000 + 5_000 });
 				if (!parked.ok) {
 					// Policy rejection, auth failure, connect failure — all fast-fail.
 					const code = parked.errorCode ?? "request-failed";