pi-crew 0.11.0 → 0.11.2

package/src/runtime/scheduling/scheduler.ts

@@ -24,6 +24,7 @@ export type ScheduleChangeEvent =
 	| { type: "removed"; jobId: string; spawnedRunIds?: string[] }
 	| { type: "updated"; job: ScheduledJob }
 	| { type: "fired"; jobId: string; agentId: string; name: string }
+	| { type: "skipped"; jobId: string; reason: string }
 	| { type: "error"; jobId: string; error: string };
 
 export interface CrewSchedulerOptions {
@@ -152,19 +153,29 @@ export class CrewScheduler {
 	private arm(job: ScheduledJob): void {
 		if (this.timers.has(job.id)) return;
 		if (job.scheduleType === "interval" && job.intervalMs) {
-			const t = setInterval(() => this.fire(job.id), job.intervalMs);
-			t.unref();
-			this.timers.set(job.id, t);
+			// 2026-09-22 spawn-storm root cause: this branch used
+			// setInterval(fire, intervalMs). Node timers are 32-bit — a LEGAL long
+			// interval (e.g. 90d = 7,776,000,000ms > 2^31-1) overflows and Node
+			// silently sets the delay to 1ms (TimeoutOverflowWarning): the job then
+			// fired every millisecond, and each
+			// tick dispatched another run (measured live: ~104 garbage runs + 50+
+			// node processes from ONE registered 90-day interval job). armCron()
+			// already clamps its hops below the same ceiling — the interval branch
+			// was missed. Reuse the identical chained-hop treatment: schedule toward
+			// now+intervalMs, clamped; cronTick fires on arrival (its
+			// advanceCronNextRun is a cron-only no-op here), and fire()'s internal
+			// update() → disarm→arm lifecycle re-arms the next interval.
+			const targetMs = this.now().getTime() + job.intervalMs;
+			this.setCronTimeout(job.id, targetMs);
 		} else if (job.scheduleType === "once") {
 			const target = new Date(job.schedule).getTime();
 			const delay = target - this.now().getTime();
 			if (delay > 0) {
-				const t = setTimeout(() => {
-					this.fire(job.id);
-					this.update(job.id, { enabled: false });
-				}, delay);
-				t.unref();
-				this.timers.set(job.id, t);
+				// Same 32-bit ceiling as the interval branch above: a once job armed
+				// > 2^31-1 ms out (e.g. "+30d" — a LEGAL relative spec — or a far ISO
+				// timestamp) overflowed setTimeout to a 1ms PREMATURE fire. Chained hops
+				// instead; cronTick self-disables once-jobs on arrival (below).
+				this.setCronTimeout(job.id, target);
 			} else {
 				this.update(job.id, { enabled: false, lastStatus: "error" });
 				this.emit?.({
@@ -219,6 +230,9 @@ export class CrewScheduler {
 		// hop that just fired is dead, so no timer doubles up.
 		this.fire(jobId);
 		this.advanceCronNextRun(jobId);
+		// once-semantics (was inline in arm()'s removed setTimeout): consume the
+		// job after its single arrival fire so a re-arm cannot fire it again.
+		if (job.scheduleType === "once") this.update(jobId, { enabled: false });
 	}
 
 	/** After a cron fire, advance the persisted nextRun to the next occurrence
@@ -265,6 +279,18 @@ export class CrewScheduler {
 		const job = this.jobs.get(id);
 		if (!job || !this.executor) return;
 		if (!job.enabled && !force) return;
+		// In-flight guard (2026-09-22, storm follow-up): the executor dispatches
+		// asynchronously and resets lastStatus (success/error) only on completion,
+		// so `running` marks the in-flight window. Without backpressure here, any
+		// interval shorter than the run duration stacks one overlapping run per
+		// tick (the 1ms overflow loop was the extreme case; fixed below/above).
+		// Skips emit a "skipped" event (visible to pi.events consumers; the toast
+		// bridge stays silent — a slow executor + short interval would spam).
+		// `force` (run-now) is the explicit escape hatch.
+		if (job.lastStatus === "running" && !force) {
+			this.emit?.({ type: "skipped", jobId: id, reason: "previous dispatch still in flight" });
+			return;
+		}
 		this.update(id, { lastStatus: "running" });
 		let agentId: string;
 		try {
@@ -297,10 +323,15 @@ export class CrewScheduler {
 				normalized: new Date(Date.now() + ms).toISOString(),
 			};
 		}
-		// Interval: 5m
-		const ivl = trimmed.match(/^(\d+)(s|m|h|d)$/);
+		// Interval: 5m — "ms" MUST be accepted: handle-schedule builds
+		// `${params.interval}ms` from the schema-level numeric `interval` param
+		// (ms number), so without an ms unit here every interval schedule died in
+		// the parser ("Invalid schedule …") — found live 2026-09-21 when
+		// `team action='schedule' interval=3600000` was impossible to satisfy.
+		const ivl = trimmed.match(/^(\d+)(ms|s|m|h|d)$/);
 		if (ivl) {
-			const ms = parseInt(ivl[1], 10) * { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 }[ivl[2] as "s" | "m" | "h" | "d"];
+			const ms =
+				parseInt(ivl[1], 10) * { ms: 1, s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 }[ivl[2] as "ms" | "s" | "m" | "h" | "d"];
 			return { type: "interval", intervalMs: ms, normalized: trimmed };
 		}
 		// ISO timestamp
@@ -329,13 +360,18 @@ function parseIntervalMs(s: string): number | undefined {
 	let ms = 0;
 	let remaining = s;
 	const unitMs: Record<string, number> = {
+		// "ms" MUST be first in the regex alternation below and present here:
+		// handle-schedule builds `${params.interval}ms` from the numeric interval
+		// param, so without an ms unit every interval schedule failed to parse
+		// (found live 2026-09-21 — `interval=3600000` was unsatisfiable).
+		ms: 1,
 		s: 1000,
 		m: 60_000,
 		h: 3_600_000,
 		d: 86_400_000,
 	};
 	while (remaining.length > 0) {
-		const m = remaining.match(/^(\d+)(s|m|h|d)/);
+		const m = remaining.match(/^(\d+)(ms|s|m|h|d)/);
 		if (!m) return undefined;
 		ms += parseInt(m[1], 10) * unitMs[m[2]];
 		remaining = remaining.slice(m[0].length);

package/src/runtime/scheduling/semaphore.ts

@@ -3,11 +3,92 @@
  *
  * Adapted from oh-my-pi's `parallel.ts` Semaphore class and
  * `mapWithConcurrencyLimit` implementation. Provides:
- * - Explicit acquire/release Semaphore for concurrency control
- * - Fail-fast on first error (via Promise.race)
- * - AbortSignal support for graceful cancellation
- * - Partial results on abort
+ * - Explicit acquire/release Semaphore for concurrency control, with an
+ *   OPTIONAL AbortSignal on acquire() (RR-014 / F15: a queued waiter settles
+ *   promptly when its signal fires — it never waits out the current slot
+ *   holder, and never consumes a slot once cancelled)
+ * - Fail-fast on first error (via Promise.race) — mapWithFailFast below
+ * - AbortSignal support for graceful cancellation — mapWithFailFast below
+ * - Partial results on abort — mapWithFailFast below
+ *
+ * RR-014 / F15 defect history: acquire() previously took NO AbortSignal, so a
+ * cancelled waiter stayed pending until the slot holder released, and then
+ * "received" a slot it could never use (verified probe: acquire() returned
+ * with signal.aborted === true). The signal-aware acquire below closes that:
+ * aborted waiters are eagerly removed from the queue and REJECT with
+ * SemaphoreAbortedError; #current never changes for an aborted acquire.
+ */
+
+/**
+ * Rejection reason for {@link Semaphore.acquire} when the caller's AbortSignal
+ * fires before a slot is granted (RR-014 / F15). Distinguishable via
+ * `name === "SemaphoreAbortedError"` — an aborted acquire never bare-resolves.
+ */
+export class SemaphoreAbortedError extends Error {
+	constructor() {
+		super("Semaphore acquire aborted: the caller's AbortSignal fired before a slot was granted");
+		this.name = "SemaphoreAbortedError";
+	}
+}
+
+/** Lifecycle outcome of a queued waiter. */
+type WaiterOutcome = "granted" | "aborted";
+
+/**
+ * Queue entry WITH identity (RR-014 / F15). The pre-fix queue stored bare
+ * resolve functions: an aborted waiter could not be referenced or removed, so
+ * it stayed pending until a release() handed it a slot it could never use.
+ * A record with an idempotent settle() can detach itself from its abort
+ * listener exactly once no matter how the abort↔handoff race resolves.
+ */
+interface Waiter {
+	/** Resolves on "granted"; rejects with SemaphoreAbortedError on "aborted". */
+	readonly promise: Promise<void>;
+	/** Whether settle() already ran (first call wins). */
+	readonly settled: boolean;
+	/**
+	 * Settle this waiter exactly once and detach its abort listener.
+	 * - "granted" → resolve: the waiter now OWNS a slot and must release().
+	 * - "aborted" → reject: the waiter never owned a slot.
+	 */
+	settle(kind: WaiterOutcome): void;
+}
+
+/**
+ * Create a waiter and attach its abort listener on the CALLER'S signal
+ * (never on a derived signal — a listener on AbortSignal.any() cannot be
+ * removed from the original). `onAbort` runs synchronously when the signal
+ * fires; the semaphore uses it to remove the waiter from the queue eagerly.
  */
+function createWaiter(signal: AbortSignal | undefined, onAbort: () => void): Waiter {
+	let resolve!: () => void;
+	let reject!: (error: Error) => void;
+	const promise = new Promise<void>((res, rej) => {
+		resolve = res;
+		reject = rej;
+	});
+	let isSettled = false;
+	let detachListener: (() => void) | undefined;
+	if (signal) {
+		const listener = () => onAbort();
+		signal.addEventListener("abort", listener, { once: true });
+		detachListener = () => signal.removeEventListener("abort", listener);
+	}
+	return {
+		promise,
+		get settled() {
+			return isSettled;
+		},
+		settle(kind: WaiterOutcome) {
+			if (isSettled) return;
+			isSettled = true;
+			detachListener?.();
+			detachListener = undefined;
+			if (kind === "granted") resolve();
+			else reject(new SemaphoreAbortedError());
+		},
+	};
+}
 
 /**
  * Simple counting semaphore for limiting concurrency across independently-scheduled async work.
@@ -15,7 +96,7 @@
 export class Semaphore {
 	#max: number;
 	#current = 0;
-	#queue: Array<() => void> = [];
+	#queue: Waiter[] = [];
 	// FIX (Round 15): Cap the waiter queue to prevent unbounded memory growth
 	// if the semaphore is held for a long period and many tasks accumulate.
 	static readonly MAX_QUEUE = 10_000;
@@ -24,9 +105,44 @@ export class Semaphore {
 		this.#max = Math.max(1, max);
 	}
 
-	async acquire(): Promise<void> {
+	/**
+	 * Acquire a slot, optionally abortable (RR-014 / F15).
+	 *
+	 * - No signal → unchanged semantics: blocks until a slot frees.
+	 * - Signal already aborted at entry → rejects immediately (fail-closed):
+	 *   no slot taken, nothing enqueued. Abort listeners never re-fire for an
+	 *   already-aborted signal, so such a waiter could never be removed later.
+	 * - Signal fires while WAITING → the waiter is removed from the queue
+	 *   EAGERLY (synchronously inside the abort listener) and rejects with
+	 *   SemaphoreAbortedError. It never consumes a slot: #current is untouched.
+	 *
+	 * Abort↔handoff race resolves to exactly one consistent state because
+	 * every #queue/#current mutation is synchronous (no await between them)
+	 * and settle() is idempotent (first call wins, and it detaches the abort
+	 * listener):
+	 * - abort wins → the waiter was spliced out of the queue, so release()
+	 *   cannot hand it a slot; the freed slot reaches the next ALIVE waiter
+	 *   (or decrements #current). Capacity intact.
+	 * - grant wins → settle("granted") detached the listener, so a later
+	 *   abort is a no-op at semaphore level; the caller observes
+	 *   signal.aborted and releases normally (runChildPi's pre-spawn guard
+	 *   returns kind "aborted" without spawning, so withWorkerSlot's finally
+	 *   releases the slot within a microtask of the grant).
+	 */
+	async acquire(signal?: AbortSignal): Promise<void> {
+		if (signal?.aborted) {
+			return Promise.reject(new SemaphoreAbortedError());
+		}
 		if (this.#current < this.#max) {
 			this.#current++;
+			// Re-check the abort↔grant window before resolving. The path above
+			// is synchronous so the flag cannot flip today; this guards against
+			// a future await being inserted here (belt-and-braces — concurrency
+			// primitive). Never resolve a granted acquire for an aborted signal.
+			if (signal?.aborted) {
+				this.#current--;
+				return Promise.reject(new SemaphoreAbortedError());
+			}
 			return;
 		}
 		// FIX (Round 15): Reject when the waiter queue is full. The previous
@@ -38,23 +154,35 @@ export class Semaphore {
 				new Error(`Semaphore queue full: ${this.#queue.length} waiters (max ${Semaphore.MAX_QUEUE}); cannot acquire slot`),
 			);
 		}
-		const { promise, resolve } = (() => {
-			let res: () => void;
-			const p = new Promise<void>((r) => {
-				res = r;
-			});
-			return { promise: p, resolve: res! };
-		})();
-		this.#queue.push(resolve);
-		return promise;
+		const waiter = createWaiter(signal, () => {
+			// Eager removal, synchronously inside the abort listener: the waiter
+			// leaves the queue BEFORE settling. A release() that already
+			// shift()ed it (grant won the race) finds settle() idempotent; a
+			// release() that has not cannot hand a slot to a dead waiter.
+			// #current is untouched — this waiter never owned a slot.
+			const index = this.#queue.indexOf(waiter);
+			if (index >= 0) this.#queue.splice(index, 1);
+			waiter.settle("aborted");
+		});
+		this.#queue.push(waiter);
+		return waiter.promise;
 	}
 
 	release(): void {
-		const next = this.#queue.shift();
-		if (next) {
-			next();
-		} else if (this.#current > 0) {
-			this.#current--;
+		// Hand the freed slot to the first ALIVE waiter (FIFO). A settled entry
+		// still sitting in the queue is impossible with eager removal but is
+		// skipped defensively — a slot must never burn on a dead waiter. Handoff
+		// TRANSFERS ownership: #current is NOT decremented; only when no alive
+		// waiter remains does it decrement.
+		while (true) {
+			const next = this.#queue.shift();
+			if (next === undefined) {
+				if (this.#current > 0) this.#current--;
+				return;
+			}
+			if (next.settled) continue;
+			next.settle("granted");
+			return;
 		}
 		// Guard: over-release is a no-op to prevent #current going negative
 	}

package/src/runtime/scratchpad/README.md

@@ -125,7 +125,7 @@ attempt N+1 worker (scratchpad-lifecycle.ts)
   is a Phase 2.5/3 hardening if artifacts ever land in a shared location.
 
 > **REMOVED (2026-08-12):** `src/runtime/scratchpad/snapshot-hmac.ts` and its
-> test were deleted. Decision (P3 of `docs/rlm-fixes-implementation-plan.md`):
+> test were deleted. Decision (P3 of `docs/archive/rlm-fixes-implementation-plan.md`):
 > the HMAC threat is double-conditional — it only materializes when scratchpad
 > has adoption (>0 cells; today: 0/83 runs) AND snapshots move to a
 > shared/networked store (today: same-uid dev-machine). Hardening a

package/src/runtime/scratchpad/protocol.ts

@@ -46,7 +46,7 @@ export interface GuestToHost {
 	};
 	pong: { type: "pong"; id: string };
 	host_request: {
-		// RESERVED for future host bridge (rlm-deep-review-2026-08-12.md §5.2F /
+		// RESERVED for future host bridge (docs/archive/rlm-deep-review-2026-08-12.md §5.2F /
 		// J2): guest-side cells would request host services (tools.read,
 		// tools.grep) so data enters the namespace WITHOUT crossing the
 		// transcript — pi-rlm's core token-saving value proposition. Declared

package/src/runtime/settings-store.ts

@@ -112,7 +112,7 @@ function readSettingsFile(filePath: string): CrewSettings {
  * API — never this function. Kept exported for back-compat reads/tests;
  * adding a new consumer that writes into loadedConfig re-introduces the
  * fixed P1 bypass (see docs/decisions/2026-08-15-schema-driven-sanitize.md
- * and the Wave 2B execution log in docs/refactor-plan.md).
+ * and the Wave 2B execution log in docs/archive/refactor-plan.md).
  */
 export function loadCrewSettings(cwd: string = process.cwd(), globalFile: string = globalPath()): CrewSettings {
 	return {

package/src/runtime/skill-instructions.ts

@@ -7,6 +7,7 @@ import { packageRoot } from "../utils/paths.ts";
 import { isSafePathId, resolveRealContainedPath } from "../utils/safe-paths.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
 import { CONFIDENCE_THRESHOLDS, getWeightedSkillsForRole, registerSkillEffectivenessHooks } from "./skill-effectiveness.ts";
+import { promptSkillMode } from "./task-runner/prompt-builder.ts";
 
 const PACKAGE_SKILLS_DIR = path.join(packageRoot(), "skills");
 
@@ -324,6 +325,10 @@ export function renderSkillInstructions(
 	const names = allNames.slice(0, MAX_SELECTED_SKILLS);
 	const overflowCount = Math.max(0, allNames.length - names.length);
 	if (names.length === 0) return { names, paths: [], block: "" };
+	// SR-02 phase 2: "index" mode (default) injects compact entries instead of
+	// full skill bodies — skills were 40-50% of measured worker prompts while a
+	// Path pointer + read tool gives the worker the SAME information on demand.
+	const mode = promptSkillMode();
 	const sections: string[] = [];
 	const skillPaths: string[] = [];
 	let total = 0;
@@ -379,6 +384,23 @@ export function renderSkillInstructions(
 		]
 			.filter(Boolean)
 			.join("\n");
+		if (mode === "index") {
+			// Index entry: the description (frontmatter) says WHEN the skill
+			// applies; the Path says WHERE to read it. The worker loads the full
+			// SKILL.md only when the task matches — same information, on demand.
+			const entry = [
+				`## ${safeName}`,
+				description ? `Description: ${description}${confidenceNote}` : undefined,
+				`Source: ${source}`,
+				`Path: ${path.dirname(loaded.path)}`,
+				// biome-ignore lint/suspicious/noTemplateCurlyInString: ${Path} refers to the Path field printed above, not a JS interpolation
+				"When this skill matches your task, FIRST read ${Path}/SKILL.md and follow it.",
+			]
+				.filter(Boolean)
+				.join("\n");
+			if (!pushSection(entry)) omittedCount += 1;
+			continue;
+		}
 		const rawContent = loaded.compacted;
 		// Wrap skill content with provenance markers to help LLMs distinguish skill instructions
 		const wrappedContent = `<!-- skill: ${safeName} -->\n${rawContent}\n<!-- end-skill: ${safeName} -->`;

package/src/runtime/stale-reconciler.ts

@@ -1,17 +1,29 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { getCrewEnv } from "../config/env-vars.ts";
 import { errors } from "../errors.ts";
 import { atomicWriteFile, atomicWriteJson } from "../state/atomic-write.ts";
 import { getCurrentPlanRecord } from "../state/stores/plan-store.ts";
 import { loadManifestWithRecovery, loadTasksWithRecovery, saveRunManifest } from "../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { logInternalError } from "../utils/internal-error.ts";
+import { findRunStateDir } from "../utils/paths.ts";
 import { recordFromTask, upsertCrewAgent } from "./crew-agent-records.ts";
 import { checkProcessLiveness } from "./process-status.ts";
 
 /** Age threshold for orphaned temp directory cleanup: 1 hour. */
 const ORPHAN_TEMP_DIR_AGE_THRESHOLD_MS = 60 * 60 * 1000;
+/** A `.cleanup-in-progress` sentinel older than this is abandoned — its owner
+ * died mid-cleanup (session kill between sentinel-create and dir-delete) and
+ * without reclamation the workspace is frozen out of the cleanup cycle
+ * FOREVER (EEXIST → skip, no TTL). Live 2026-09-26: 42 frozen workspaces. */
+const SENTINEL_STALE_RECLAIM_MS = 10 * 60 * 1000;
+/** Assumed production cadence of the temp-workspace reconcile tick (60s —
+ * see observability.ts tempReconcileTimer). Only used to derive the
+ * stateless round-robin batch index; a different real cadence still cycles
+ * through every batch, just with different pacing. */
+const ORPHAN_RECONCILE_TICK_MS = 60_000;
 /** Defense-in-depth: cap the number of /tmp/pi-crew-* entries processed per
  * reconcile tick. With a few thousand accumulated dirs, processing them all
  * synchronously can block the main thread for many seconds, causing the
@@ -284,7 +296,7 @@ function isTaskHeartbeatStale(task: TeamTaskState, now: number): boolean {
 	const taskPid = task.heartbeat?.pid ?? task.checkpoint?.childPid;
 	const pidAlive = taskPid ? checkProcessLiveness(taskPid).alive : false;
 	if (taskPid && pidAlive) return false;
-	if (process.env.PI_CREW_DEBUG_STALE === "1") {
+	if (getCrewEnv("PI_CREW_DEBUG_STALE") === "1") {
 		// F1 forensic (battery 2026-09-10): sidecar log of every STALE verdict so
 		// live repros can show exactly what the reconciler saw (pid present? alive?
 		// elapsed?) — the reconciler may run in ANY host process, hence a fixed
@@ -568,18 +580,38 @@ export function reconcileOrphanedTempWorkspaces(
 		const scanBatch = options?.scanBatchSize ?? ORPHAN_TEMP_SCAN_BATCH_SIZE;
 		const candidates = entries
 			.filter((e) => e.isDirectory() && e.name.startsWith("pi-crew-"))
-			.sort((a, b) => a.name.localeCompare(b.name))
-			.slice(0, scanBatch);
-		for (const entry of candidates) {
+			.sort((a, b) => a.name.localeCompare(b.name));
+		// STATELESS ROUND-ROBIN across ticks (Bug B, live 2026-09-26): the old
+		// `slice(0, scanBatch)` visited only the alphabetically-first batch, so a
+		// cluster of uncleanable dirs (frozen sentinels / fresh sentinels /
+		// waiting runs) starved everything behind it — 42 frozen sentinels in the
+		// `agent-stale-wakeup-test-*` cluster (alphabetically first) blocked ~3.4k
+		// dirs from EVER being scanned. Each tick now takes the NEXT slice,
+		// derived deterministically from `now` (production cadence is 60s/tick —
+		// see observability.ts tempReconcileTimer), so every batch is visited
+		// within `batches` ticks without any persisted state. Deterministic under
+		// the injected `now` that tests already use.
+		const batches = Math.max(1, Math.ceil(candidates.length / scanBatch));
+		const batchIdx = Math.floor(now / ORPHAN_RECONCILE_TICK_MS) % batches;
+		const selected = candidates.slice(batchIdx * scanBatch, batchIdx * scanBatch + scanBatch);
+		for (const entry of selected) {
 			if (!entry.isDirectory() || !entry.name.startsWith("pi-crew-")) continue;
 			const workspaceDir = path.join(tmpDir, entry.name);
-			const crewDir = path.join(workspaceDir, ".crew");
-			if (!fs.existsSync(crewDir)) continue;
-			const stateRunsDir = path.join(crewDir, "state", "runs");
-			if (!fs.existsSync(stateRunsDir)) continue;
+			// RR-020 Fix 3: accept BOTH supported run-state layouts — `<dir>/.crew/
+			// state/runs` and the `.pi`-based `<dir>/.pi/teams/state/runs`. Only the
+			// `.crew` layout used to be seen here, so a temp workspace with live
+			// `.pi/teams` run state was invisible to the reconciler (and then
+			// deleted as debris by the legacy cleanup sweep).
+			const stateRunsDir = findRunStateDir(workspaceDir);
+			if (!stateRunsDir) continue;
 			let hasRunning = false;
 			try {
-				for (const runDir of fs.readdirSync(stateRunsDir)) {
+				// Cold-verify F-2: Dirent.isDirectory() is FALSE for a symlink-to-dir
+				// (withFileTypes does not follow), so a planted `runs/<runId>` symlink
+				// is skipped instead of being read/written out-of-tree.
+				for (const entry of fs.readdirSync(stateRunsDir, { withFileTypes: true })) {
+					if (!entry.isDirectory()) continue;
+					const runDir = entry.name;
 					const manifestPath = path.join(stateRunsDir, runDir, "manifest.json");
 					const tasksPath = path.join(stateRunsDir, runDir, "tasks.json");
 					if (!fs.existsSync(manifestPath) || !fs.existsSync(tasksPath)) continue;
@@ -700,14 +732,50 @@ export function reconcileOrphanedTempWorkspaces(
 					fs.closeSync(sentinelFd);
 					atomicWriteFile(sentinelPath, JSON.stringify({ startedAt: now }));
 				} catch {
-					// Sentinel already exists (another cleanup in progress) — skip
-					canCleanup = false;
+					// Sentinel already exists. Either another cleanup is genuinely in
+					// progress (it holds the sentinel for seconds at most) OR a previous
+					// process died mid-cleanup and ABANDONED it — the frozen-workspace
+					// bug (no TTL on the skip). Reclaim sentinels older than
+					// SENTINEL_STALE_RECLAIM_MS and retry the exclusive create once;
+					// losing the retry race means someone else reclaimed first — skip.
+					let sentinelAgeMs = Number.NaN;
+					try {
+						sentinelAgeMs = now - fs.statSync(sentinelPath).mtimeMs;
+					} catch {
+						/* sentinel vanished — retry create below */
+					}
+					if (Number.isFinite(sentinelAgeMs) && sentinelAgeMs <= SENTINEL_STALE_RECLAIM_MS) {
+						canCleanup = false; // fresh sentinel — a live cleanup owns it
+					} else {
+						try {
+							fs.unlinkSync(sentinelPath); // stale/absent — reclaim
+						} catch {
+							/* already gone */
+						}
+						try {
+							const retryFd = fs.openSync(sentinelPath, "wx");
+							fs.closeSync(retryFd);
+							atomicWriteFile(sentinelPath, JSON.stringify({ startedAt: now, reclaimedFromStale: true }));
+						} catch {
+							canCleanup = false; // lost the reclaim race — skip
+						}
+					}
 				}
 			}
 			if (canCleanup) {
 				if (fs.existsSync(stateRunsDir)) {
 					try {
-						for (const runDir of fs.readdirSync(stateRunsDir)) {
+						// Cold-verify round 5 (E1): a string readdir FOLLOWS a symlinked
+						// `<runId>` entry, and loadManifestWithRecovery on a corrupt manifest
+						// then QUARANTINES it — renameSync resolves through the symlinked
+						// dir and renamed a file OUTSIDE the scanned tree (reproduced even
+						// with cleanupOrphanedTempDirs:false, fired by the production
+						// tempReconcileTimer every session). Dirent.isDirectory() is false
+						// for a symlink-to-dir, so planted entries are skipped. Deletion
+						// itself was already safe (rmSync unlinks symlinks, never follows).
+						for (const entry of fs.readdirSync(stateRunsDir, { withFileTypes: true })) {
+							if (!entry.isDirectory()) continue;
+							const runDir = entry.name;
 							const manifestPath = path.join(stateRunsDir, runDir, "manifest.json");
 							if (!fs.existsSync(manifestPath)) continue;
 							const manifest = loadManifestWithRecovery(manifestPath, runDir);
@@ -733,7 +801,11 @@ export function reconcileOrphanedTempWorkspaces(
 					let stillClean = true;
 					if (fs.existsSync(stateRunsDir)) {
 						try {
-							for (const runDir of fs.readdirSync(stateRunsDir)) {
+							// Cold-verify round 5 (E1): same Dirent guard as the first gate —
+							// quarantine-rename through a symlinked `<runId>` wrote outside.
+							for (const entry of fs.readdirSync(stateRunsDir, { withFileTypes: true })) {
+								if (!entry.isDirectory()) continue;
+								const runDir = entry.name;
 								const manifestPath = path.join(stateRunsDir, runDir, "manifest.json");
 								if (!fs.existsSync(manifestPath)) continue;
 								const manifest = loadManifestWithRecovery(manifestPath, runDir);

package/src/runtime/task-display.ts

@@ -47,6 +47,6 @@ export function formatTaskGraphLines(tasks: TeamTaskState[]): string[] {
 								? "⚠"
 								: "◦";
 		const wait = waitingReason(task, tasks);
-		return `- ${icon} ${task.id} [${task.status}] ${task.role}->${task.agent}${wait && wait !== "ready" ? ` (${wait})` : ""}`;
+		return `- ${icon} ${task.id} [${task.status}] ${task.role}▸${task.agent}${wait && wait !== "ready" ? ` (${wait})` : ""}`;
 	});
 }

package/src/runtime/task-runner/pre-execution.ts

@@ -38,7 +38,7 @@ import { buildTaskPacket } from "../task-packet.ts";
 // this module at runtime; we only need the TaskRunnerInput type here).
 import type { TaskRunnerInput } from "../task-runner.ts";
 import { DEFAULT_YIELD_CONFIG } from "../yield-handler.ts";
-import { coordinationBridgeInstructions, renderTaskPrompt } from "./prompt-builder.ts";
+import { coordinationBridgeInstructions, estimateTokens, promptBreakdownEnabled, renderTaskPrompt } from "./prompt-builder.ts";
 import { checkpointTask, persistSingleTaskUpdate, updateTask } from "./state-helpers.ts";
 
 /** The stream bridge handle created by registerStreamBridge. */
@@ -324,7 +324,7 @@ export async function prepareTaskExecutionContext(
 		}
 	}
 
-	const promptResult = await renderTaskPrompt(manifest, input.step, task, input.agent, skillBlock);
+	const promptResult = await renderTaskPrompt(manifest, input.step, task, input.agent, skillBlock, undefined, skillNames ?? []);
 	let prompt = promptResult.full;
 
 	// Inject deterministic pre-step output into prompt
@@ -340,6 +340,30 @@ export async function prepareTaskExecutionContext(
 		content: `${prompt}\n`,
 		producer: task.id,
 	});
+	// SR-02 phase 1: per-section breakdown artifact (opt-in via
+	// PI_CREW_PROMPT_BREAKDOWN=1). Adds the SYSTEM-side pieces the prompt
+	// builder cannot see (agent definition, skills, pre-step output).
+	if (promptBreakdownEnabled()) {
+		const sections: Record<string, number> = {
+			"system.agentDefinition": input.agent?.systemPrompt?.length ?? 0,
+			...(promptResult.sections ?? {}),
+			"dynamic.preStepOutput": preStepOutput?.length ?? 0,
+		};
+		writeArtifact(manifest.artifactsRoot, {
+			kind: "metadata",
+			relativePath: `metadata/${task.id}.prompt-breakdown.json`,
+			content: `${JSON.stringify(
+				Object.fromEntries(
+					Object.entries(sections)
+						.filter(([, chars]) => chars > 0)
+						.map(([name, chars]) => [name, { chars, estTokens: estimateTokens(chars) }]),
+				),
+				null,
+				2,
+			)}\n`,
+			producer: "prompt-breakdown",
+		});
+	}
 
 	const collectedJsonEvents: Record<string, unknown>[] | undefined = collectYieldEvents ? [] : undefined;