pi-crew 0.11.0 → 0.11.2

package/src/extension/registration/lifecycle-handlers.ts

@@ -20,7 +20,12 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 import { loadConfig } from "../../config/config.ts";
 import { DEFAULT_UI } from "../../config/defaults.ts";
 import { getCrewEnv } from "../../config/env-vars.ts";
-import { pruneFinishedRuns, pruneUserLevelRuns } from "../../extension/run-maintenance.ts";
+import {
+	pruneFinishedRuns,
+	pruneUserLevelRuns,
+	resolveAutoPruneAgeFloorMs,
+	resolveAutoPruneKeep,
+} from "../../extension/run-maintenance.ts";
 import { type BrokerSpawnCredentials, setActiveBrokerIssuer, setActiveBrokerRevoker } from "../../runtime/broker/broker-issuer.ts";
 import { CrewBroker } from "../../runtime/broker/crew-broker.ts";
 import { terminateActiveChildPiProcesses } from "../../runtime/child-pi/child-pi.ts";
@@ -37,9 +42,10 @@ import { CrewScheduler, type ScheduledJob } from "../../runtime/scheduling/sched
 import { tryRegisterSessionCleanup } from "../../runtime/session-resources.ts";
 import { createSessionSnapshot } from "../../runtime/session-snapshot.ts";
 import { applyCrewSettingsTiersToConfig, loadCrewSettingsTiers, scheduledJobsHiddenCountOf } from "../../runtime/settings-store.ts";
+import { loadTasksWithRecovery } from "../../state/stores/manifest-io.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
-import { summarizeHeartbeats } from "../../ui/heartbeat-aggregator.ts";
+import { overlayFreshTaskStatuses, summarizeHeartbeats } from "../../ui/heartbeat-aggregator.ts";
 import { installInlinePanel } from "../../ui/inline-panel/index.ts";
 import { clearSessionSwitchInFlight, markSessionSwitchInFlight } from "../../ui/inline-panel/view-session-store.ts";
 import { requestRender, setExtensionWidget, toPiWidgetPlacement } from "../../ui/pi-ui-compat.ts";
@@ -64,8 +70,11 @@ import { notifyActiveRuns } from "../session-summary.ts";
 import { persistScheduledJobUpdate, registerCrewScheduler, stashScheduledJobsHiddenCount } from "../team-tool/handle-schedule.ts";
 import { handleTeamTool } from "../team-tool.ts";
 import { runArtifactCleanup } from "./artifact-cleanup.ts";
+import { healthNotifyFingerprint, recordHealthNotifyDecision, resetHealthNotifyEntry } from "./health-notify-policy.ts";
 import type { RegistrationContext } from "./registration-types.ts";
 import { createScheduleEventNotifier } from "./schedule-toast-bridge.ts";
+import { purgeQueuedAmbientNotifications } from "./subagent-helpers.ts";
+import { refreshCrossExtensionWiringForSession } from "./wire-cross-extension.ts";
 
 /**
  * Register all session-lifecycle handlers on the ExtensionAPI. The caller
@@ -251,6 +260,10 @@ function installSessionStartHandler(pi: ExtensionAPI, ctx: RegistrationContext):
 		// it can issue tokens for child runs in this session. The controller
 		// already gates by flag + root-session; this is a no-op when disabled.
 		ctx.brokerController?.setSessionId(currentSessionId);
+		// F13 (RR-018): RPC wiring is extension-lifetime and survives session
+		// switches; rebind the crew global registry to THIS session's manifest
+		// cache (idempotent — see wire-cross-extension.ts).
+		refreshCrossExtensionWiringForSession(pi, ctx);
 
 		// Defer ALL heavy cleanup to after the session_start handler returns.
 		// These operations involve synchronous directory scanning (readdirSync, readFileSync)
@@ -460,7 +473,12 @@ async function runDeferredSessionCleanup(
 
 	// Auto-prune finished project-level run directories
 	try {
-		const { removed } = pruneFinishedRuns(extensionCtx.cwd, 10);
+		// DP-01: keep + age-floor are env-driven; the age floor means a run
+		// finished <24h ago survives a session restart even beyond top-keep.
+		const { removed } = pruneFinishedRuns(extensionCtx.cwd, resolveAutoPruneKeep(), {
+			ageFloorMs: resolveAutoPruneAgeFloorMs(),
+			intent: "session-start-auto",
+		});
 		if (removed.length > 0) {
 			ctx.notifyOperator({
 				id: `auto_prune_project`,
@@ -476,7 +494,10 @@ async function runDeferredSessionCleanup(
 
 	// Auto-prune finished user-level run directories
 	try {
-		const { removed } = pruneUserLevelRuns(10);
+		const { removed } = pruneUserLevelRuns(resolveAutoPruneKeep(), {
+			ageFloorMs: resolveAutoPruneAgeFloorMs(),
+			intent: "session-start-auto",
+		});
 		if (removed.length > 0) {
 			ctx.notifyOperator({
 				id: `auto_prune_user`,
@@ -648,6 +669,18 @@ export function evictRunFromManifests(manifests: TeamRunManifest[], runId: strin
 	return manifests.filter((m) => m.runId !== runId);
 }
 
+/**
+ * F14 (RR-019): cheap signature of the preloaded-manifest frame. Only a
+ * CHANGED signature lets `backgroundPreload` count as render activity
+ * (`schedule()`); an identical signature means "nothing the widget would
+ * paint differently" and must NOT reset the render scheduler's idle
+ * counters (that defeated the R1 idle stop — see setupRenderLoop). Covers
+ * run identity, status transitions, and updatedAt bumps. Exported for tests.
+ */
+export function manifestsFrameSignature(manifests: TeamRunManifest[]): string {
+	return manifests.map((m) => `${m.runId}:${m.status}:${m.updatedAt}`).join("|");
+}
+
 /**
  * Apply a runEventBus payload to a preloaded-manifest frame: evict the run on
  * terminal events, pass through unchanged otherwise. This is the exact logic
@@ -677,16 +710,24 @@ function setupRenderLoop(
 	let lastPreloadedManifests: TeamRunManifest[] = [];
 	let lastFrameManifestCache: ReturnType<typeof createManifestCache> | undefined;
 	let lastFrameSnapshotCache: ReturnType<typeof createRunSnapshotCache> | undefined;
+	// F14: signature of the last frame backgroundPreload saw — only a change
+	// here counts as render activity.
+	let lastFrameSignature: string | undefined;
 
 	const ownerGeneration = ctx.sessionGeneration;
 
-	const buildFrame = async (): Promise<boolean> => {
-		if (!ctx.currentCtx) return false;
+	const buildFrame = async (): Promise<{ ok: boolean; changed: boolean }> => {
+		if (!ctx.currentCtx) return { ok: false, changed: false };
 		lastPreloadedConfig = loadConfig(ctx.currentCtx.cwd);
 		lastFrameManifestCache = ctx.getManifestCache(ctx.currentCtx.cwd);
 		lastFrameSnapshotCache = ctx.getRunSnapshotCache(ctx.currentCtx.cwd);
 		const manifests = lastFrameManifestCache.list(20);
 		lastPreloadedManifests = manifests;
+		// F14 (RR-019): compute the frame signature BEFORE the preload await so
+		// `changed` reflects what this tick saw, not a mid-preload mutation.
+		const frameSignature = manifestsFrameSignature(manifests);
+		const frameChanged = frameSignature !== lastFrameSignature;
+		lastFrameSignature = frameSignature;
 		// pts/2 hang fix: reconcile per-run watchers against the ACTIVE set only.
 		{
 			const onRunChange = (runId: string): void => {
@@ -718,16 +759,23 @@ function setupRenderLoop(
 		}
 		const runIds = manifests.map((r) => r.runId);
 		await lastFrameSnapshotCache.preloadAllStale(runIds);
-		return true;
+		return { ok: true, changed: frameChanged };
 	};
 
 	const backgroundPreload = (): void => {
 		if (!ctx.currentCtx || preloading) return;
 		preloading = true;
 		buildFrame()
-			.then((ok) => {
+			.then(({ ok, changed }) => {
 				preloading = false;
-				if (ok) ctx.renderScheduler?.schedule();
+				// F14 (RR-019): preload completion is maintenance, NOT user activity.
+				// Only a genuinely CHANGED frame may call schedule() — an unchanged
+				// frame calling schedule() reset `lastEventAt`/`idleFallbackRenders`
+				// and re-armed the fallback loop that fallbackLoop() had just
+				// deliberately stopped (R1), rendering forever while idle. Real
+				// work still animates: runEventBus + fs.watch subscriptions call
+				// schedule() directly on genuine events.
+				if (ok && changed) ctx.renderScheduler?.schedule();
 			})
 			.catch((error: unknown) => {
 				preloading = false;
@@ -796,7 +844,16 @@ function setupRenderLoop(
 		const clearHealthNotifications = (runId: string): void => {
 			for (const kind of ["recovery_dead_workers", "recovery_missing_heartbeat"]) {
 				const key = `${kind}_${runId}`;
-				ctx.autoRecoveryLast.delete(key);
+				// FINDING 6: reset the fire budget (a genuine recurrence after
+				// this clear re-notifies) AND opportunistically purge
+				// still-QUEUED host follow-up copies of the original warning —
+				// the host drains the queue one message per turn boundary, so
+				// stale copies otherwise drip in for hours after the clear
+				// (live: 5h of "missing heartbeat" replays after the 2026-09-23
+				// zombie cleanup). The purge is feature-detected: hosts without
+				// clearQueuedUserMessagesMatching (e.g. 0.87.0) no-op here; the
+				// fire-cap policy bounds the backlog on every host.
+				resetHealthNotifyEntry({ entries: ctx.autoRecoveryLast, maxEntries: ctx.AUTO_RECOVERY_LAST_MAX_ENTRIES }, key);
 				ctx.notifyOperator({
 					id: key,
 					clear: true,
@@ -805,6 +862,10 @@ function setupRenderLoop(
 					runId,
 					title: `Cleared ${kind} for ${runId}`,
 				});
+				purgeQueuedAmbientNotifications(
+					pi,
+					(text) => text.includes(runId) && (text.includes("dead worker") || text.includes("missing heartbeat")),
+				);
 			}
 		};
 		for (const run of sessionManifests) {
@@ -838,29 +899,29 @@ function setupRenderLoop(
 					clearHealthNotifications(run.runId);
 					continue;
 				}
-				const summary = summarizeHeartbeats(snapshot, { now });
+				// GATE 3 (FINDING 5) — task-status truth lives on DISK, not in the
+				// snapshot cache. A worker parked on `ask` writes running → waiting
+				// to tasks.json immediately, but the cached snapshot can lag that
+				// transition; in the window a parked (alive, silent-by-design)
+				// worker counted as active-without-heartbeat and fired a false
+				// "dead worker" (live: team_20260923100114, 01_explore parked on
+				// ask). Overlay FRESH statuses before summarizing; divergence also
+				// invalidates the stale cache entry so the next tick rebuilds it.
+				const freshTasks = loadTasksWithRecovery(freshManifest.tasksPath, freshManifest.eventsPath, run.runId);
+				const overlaid = overlayFreshTaskStatuses(snapshot, freshTasks);
+				if (overlaid !== snapshot) snapshotCache.invalidate(run.runId);
+				const summary = summarizeHeartbeats(overlaid, { now });
+				const fingerprint = healthNotifyFingerprint(summary, overlaid.tasks.length);
 				const maybeNotifyHealth = (kind: string, count: number, title: string, body: string): void => {
 					if (count <= 0) return;
 					const key = `${kind}_${run.runId}`;
-					const previous = ctx.autoRecoveryLast.get(key);
-					if (previous !== undefined && now - previous.lastAccessAt < 5 * 60_000) return;
-					// Defensive cap: evict entry with oldest lastAccessAt before inserting/updating.
-					while (ctx.autoRecoveryLast.size >= ctx.AUTO_RECOVERY_LAST_MAX_ENTRIES) {
-						let oldestKey: string | undefined;
-						let oldestAccess = Infinity;
-						for (const [k, v] of ctx.autoRecoveryLast) {
-							if (v.lastAccessAt < oldestAccess) {
-								oldestAccess = v.lastAccessAt;
-								oldestKey = k;
-							}
-						}
-						if (oldestKey === undefined) break;
-						ctx.autoRecoveryLast.delete(oldestKey);
-					}
-					ctx.autoRecoveryLast.set(key, {
-						insertedAt: now,
-						lastAccessAt: now,
-					});
+					// FINDING 6: bounded re-fire — ≤ MAX_HEALTH_NOTIFY_FIRES per
+					// UNCHANGED fingerprint (5-min cooldown between fires). The
+					// old forever-re-arming cooldown fed the host follow-up queue
+					// duplicates that drained one-per-turn-boundary for hours.
+					// Policy detail + LRU eviction: health-notify-policy.ts.
+					const state = { entries: ctx.autoRecoveryLast, maxEntries: ctx.AUTO_RECOVERY_LAST_MAX_ENTRIES };
+					if (!recordHealthNotifyDecision(state, key, fingerprint, now)) return;
 					ctx.notifyOperator({
 						id: key,
 						severity: "warning",

package/src/extension/registration/lifecycle.ts

@@ -22,6 +22,7 @@ import { projectCrewRoot } from "../../utils/paths.ts";
 import type { AsyncNotifierState } from "../async-notifier.ts";
 import type { NotificationDescriptor, NotificationRouter } from "../notification-router.ts";
 import type { NotificationSink } from "../notification-sink.ts";
+import { createWebhookNotifier } from "../webhook-notify.ts";
 
 /**
  * Mutable state owned by register.ts and read/written by this module.
@@ -59,6 +60,30 @@ export function startLifecycleWatchers(ctx: ExtensionContext, state: LifecycleSt
 	const loadedConfig = loadConfig(ctx.cwd);
 	state.notifierStarted = true;
 	try {
+		// US-030 (docs/specs/US-030.md): outbound webhook sink built from config.
+		// Gated on the notifications master switch (`notifications.enabled !== false`,
+		// same gate as configureNotifications), opt-in per `webhook.url`, and
+		// SSRF-guarded inside the factory. Inactive config → shared no-op
+		// singleton (zero network calls, zero hot-path allocation).
+		const notificationsConfig = loadedConfig.config.notifications;
+		const webhookNotifier =
+			notificationsConfig?.enabled === false
+				? undefined
+				: createWebhookNotifier(
+						{ webhook: notificationsConfig?.webhook, quietHours: notificationsConfig?.quietHours },
+						{
+							onFailure: (failure) => {
+								// Spec: failures surface as a `webhook.failed` event (crew.*-prefixed
+								// pi event, mirroring crew.run.completed / crew.task.overflow).
+								// logInternalError already fired inside the notifier.
+								deps.pi.events?.emit?.("crew.webhook.failed", {
+									runId: failure.runId,
+									attempts: failure.attempts,
+									error: failure.error,
+								});
+							},
+						},
+					);
 		// LAZY: async-notifier pulls in debounce + cron helpers — defer
 		// until the first lifecycle install (deferred import within module).
 		void import("../async-notifier.ts").then(({ startAsyncRunNotifier }) => {
@@ -66,6 +91,7 @@ export function startLifecycleWatchers(ctx: ExtensionContext, state: LifecycleSt
 			startAsyncRunNotifier(ctx, deps.notifierState, loadedConfig.config.notifierIntervalMs ?? DEFAULT_UI.notifierIntervalMs, {
 				generation: deps.ownerGeneration,
 				isCurrent: (generation) => generation === deps.ownerGeneration && deps.isContextCurrent(ctx, deps.ownerGeneration),
+				webhookNotifier,
 			});
 		});
 		return true;
@@ -107,6 +133,13 @@ export interface NotificationsDeps {
 		ctx: ExtensionContext,
 		notificationCount: number,
 	) => void;
+	/**
+	 * F11 (RR-018): ownership predicate — true only while the session that
+	 * started this configure is still current. Checked after every lazy-import
+	 * await boundary before publishing into shared state. Optional for older
+	 * hand-built deps; defaults to "still owner".
+	 */
+	isOwnerSession?: () => boolean;
 }
 
 /**
@@ -117,6 +150,11 @@ export interface NotificationsDeps {
  *  - `config.notifications?.enabled === false` → no-op.
  */
 export async function configureNotifications(ctx: ExtensionContext, state: LifecycleState, deps: NotificationsDeps): Promise<void> {
+	// F11 (RR-018): ownership predicate — re-verified after every await below.
+	// A continuation whose session was cleaned up or superseded must not
+	// publish resources into shared state. Optional so hand-built deps from
+	// older call sites keep working (defaults to "still owner").
+	const stillOwns = deps.isOwnerSession ?? (() => true);
 	state.notificationRouter?.dispose();
 	state.notificationSink?.dispose();
 	state.notificationRouter = undefined;
@@ -126,26 +164,29 @@ export async function configureNotifications(ctx: ExtensionContext, state: Lifec
 
 	// LAZY: notification router — wires events to sinks
 	const { NotificationRouter } = await import("../notification-router.ts");
+	if (!stillOwns()) return;
 	// LAZY: JSONL sink — file-backed notification storage
 	const { createJsonlSink } = await import("../notification-sink.ts");
+	if (!stillOwns()) return;
 	// LAZY: follow-up helpers — shared with subagent handoff
 	const { sendFollowUp } = await import("./subagent-helpers.ts");
+	if (!stillOwns()) return;
 	// LAZY: widget updater — refreshes the TUI status widget
 	const { updateCrewWidget } = await import("../../ui/widget/index.ts");
+	if (!stillOwns()) return;
 
-	if (config.telemetry?.enabled !== false) {
-		state.notificationSink = createJsonlSink(
-			projectCrewRoot(ctx.cwd),
-			config.notifications?.sinkRetentionDays ?? DEFAULT_NOTIFICATIONS.sinkRetentionDays,
-		);
-	}
-	state.notificationRouter = new NotificationRouter(
+	// F11: create into locals — publish only while ownership still holds.
+	const notificationSink =
+		config.telemetry?.enabled !== false
+			? createJsonlSink(projectCrewRoot(ctx.cwd), config.notifications?.sinkRetentionDays ?? DEFAULT_NOTIFICATIONS.sinkRetentionDays)
+			: undefined;
+	const notificationRouter = new NotificationRouter(
 		{
 			dedupWindowMs: config.notifications?.dedupWindowMs ?? DEFAULT_NOTIFICATIONS.dedupWindowMs,
 			batchWindowMs: config.notifications?.batchWindowMs ?? DEFAULT_NOTIFICATIONS.batchWindowMs,
 			quietHours: config.notifications?.quietHours,
 			severityFilter: config.notifications?.severityFilter ?? [...DEFAULT_NOTIFICATIONS.severityFilter],
-			sink: (notification) => state.notificationSink?.write(notification),
+			sink: (notification) => notificationSink?.write(notification),
 		},
 		(notification: NotificationDescriptor) => {
 			if (notification.clear) {
@@ -183,6 +224,15 @@ export async function configureNotifications(ctx: ExtensionContext, state: Lifec
 			}
 		},
 	);
+	if (!stillOwns()) {
+		// F11: ownership lost while suspended — dispose what was just created
+		// instead of publishing (no orphans).
+		notificationRouter.dispose();
+		notificationSink?.dispose();
+		return;
+	}
+	state.notificationSink = notificationSink;
+	state.notificationRouter = notificationRouter;
 }
 
 /** Dispose notification router + sink. */
@@ -200,6 +250,8 @@ export interface DeliveryDeps {
 	notifyOperator: (notification: NotificationDescriptor) => void;
 	sendFollowUp: (pi: ExtensionAPI, message: string) => void;
 	sendAgentWakeUp: (pi: ExtensionAPI, message: string) => void;
+	/** F11 (RR-018): same ownership predicate as NotificationsDeps.isOwnerSession. */
+	isOwnerSession?: () => boolean;
 }
 
 /**
@@ -207,15 +259,19 @@ export interface DeliveryDeps {
  * register.ts as part of H3-L2 (delivery lifecycle service).
  */
 export async function configureDeliveryCoordinator(state: LifecycleState, deps: DeliveryDeps): Promise<void> {
+	// F11: ownership predicate — re-verified after the lazy imports below.
+	const stillOwns = deps.isOwnerSession ?? (() => true);
 	state.deliveryCoordinator?.dispose();
 	state.deliveryCoordinator = undefined;
 	state.overflowTracker?.dispose();
 	state.overflowTracker = undefined;
 	// LAZY: delivery coordinator — batches notification fan-out
 	const { DeliveryCoordinator } = await import("../../runtime/delivery-coordinator.ts");
+	if (!stillOwns()) return;
 	// LAZY: overflow tracker — recovers from backlog overflow
 	const { OverflowRecoveryTracker } = await import("../../runtime/recovery/overflow-recovery.ts");
-	state.deliveryCoordinator = new DeliveryCoordinator({
+	if (!stillOwns()) return;
+	const deliveryCoordinator = new DeliveryCoordinator({
 		emit: (event, data) => {
 			deps.pi.events?.emit?.(event, data);
 		},
@@ -226,7 +282,7 @@ export async function configureDeliveryCoordinator(state: LifecycleState, deps:
 			deps.sendAgentWakeUp(deps.pi, message);
 		},
 	});
-	state.overflowTracker = new OverflowRecoveryTracker({
+	const overflowTracker = new OverflowRecoveryTracker({
 		onPhaseChange: (phaseState, previousPhase) => {
 			if (deps.observabilityState.metricRegistry) {
 				deps.observabilityState.metricRegistry
@@ -254,6 +310,15 @@ export async function configureDeliveryCoordinator(state: LifecycleState, deps:
 			});
 		},
 	});
+	if (!stillOwns()) {
+		// F11: ownership lost while suspended — dispose what was just created
+		// instead of publishing (no orphans).
+		deliveryCoordinator.dispose();
+		overflowTracker.dispose();
+		return;
+	}
+	state.deliveryCoordinator = deliveryCoordinator;
+	state.overflowTracker = overflowTracker;
 }
 
 /** Dispose delivery coordinator + overflow tracker. */

package/src/extension/registration/observability.ts

@@ -49,6 +49,13 @@ export interface ObservabilityState {
 	autoRepairTimer: ReturnType<typeof setInterval> | undefined;
 	tempReconcileTimer: ReturnType<typeof setInterval> | undefined;
 	otlpExporter: OTLPExporterInstance | undefined;
+	/**
+	 * F11 (RR-018): promise of the most recent `configureObservability` run.
+	 * `disposeObservability` settles it deliberately so teardown never races a
+	 * still-suspended init continuation (which re-checks ownership after every
+	 * await and self-disposes its locals when ownership was lost).
+	 */
+	initPromise: Promise<void> | undefined;
 }
 
 /** Dependencies passed in by register.ts so this module stays decoupled. */
@@ -57,6 +64,13 @@ export interface ObservabilityDeps {
 	getManifestCache: (cwd: string) => ReturnType<typeof import("../../runtime/manifest-cache.ts").createManifestCache>;
 	notifyOperator: (notification: NotificationDescriptor) => void;
 	isCleanedUp: () => boolean;
+	/**
+	 * F11 (RR-018): read the RegistrationContext's `sessionGeneration`. The
+	 * generation is bumped by cleanup AND by every session_start/before_switch,
+	 * so unlike `isCleanedUp` it can never be reset back to "still owner" by a
+	 * newer session. Reuse this counter — do not invent a parallel one.
+	 */
+	getSessionGeneration: () => number;
 	reconcileStaleRuns: (cwd: string, cache: ReturnType<ObservabilityDeps["getManifestCache"]>, currentSessionId?: string) => unknown[];
 	reconcileOrphanedTempWorkspaces: (now: number, opts: { cleanupOrphanedTempDirs?: boolean }) => unknown;
 	cleanupOrphanTempDirs: () => { cleaned: number; scanned: number; failed: number };
@@ -94,43 +108,77 @@ async function importOTLPExporter(): Promise<OTLPExporterCtor> {
  *  - `config.reliability?.autoRecover === true` → lazy-imports crash-recovery
  *    on a deferred setTimeout to avoid blocking session_start.
  */
-export async function configureObservability(ctx: ExtensionContext, state: ObservabilityState, deps: ObservabilityDeps): Promise<void> {
+export function configureObservability(ctx: ExtensionContext, state: ObservabilityState, deps: ObservabilityDeps): Promise<void> {
+	// F11: track the init promise so `disposeObservability` can settle it
+	// deliberately instead of racing it. The internal run first awaits any
+	// PREVIOUS init (via disposeObservability), so this assignment can never
+	// self-deadlock — state.initPromise still referenced the old run when the
+	// internal run suspended.
+	const run = configureObservabilityInternal(ctx, state, deps);
+	state.initPromise = run;
+	return run;
+}
+
+async function configureObservabilityInternal(ctx: ExtensionContext, state: ObservabilityState, deps: ObservabilityDeps): Promise<void> {
+	// F11 (RR-018): capture the session generation at configure time. Every
+	// await boundary below re-verifies ownership before touching shared state;
+	// a continuation whose generation no longer matches can never publish —
+	// even when a newer session has already reset `cleanedUp` back to false
+	// (the real ordering: cleanup sets it true, session_start resets it false).
+	const ownerGeneration = deps.getSessionGeneration();
+	const stillOwns = (): boolean => deps.getSessionGeneration() === ownerGeneration && !deps.isCleanedUp();
+
 	// Always start from a clean slate: dispose any prior-session state first.
 	await disposeObservability(state, deps.isCleanedUp());
+	if (!stillOwns()) return;
 
 	const config = loadConfig(ctx.cwd).config;
 	if (config.observability?.enabled === false) return;
 
 	// LAZY: observability stack — only paid for when observability is actually enabled
 	const { createMetricRegistry } = await import("../../observability/metric-registry.ts");
+	if (!stillOwns()) return;
 	// LAZY: event→metric bridge
 	const { wireEventToMetrics } = await import("../../observability/event-to-metric.ts");
+	if (!stillOwns()) return;
 	// LAZY: file-backed metric sink
 	const { createMetricFileSink } = await import("../../observability/metric-sink.ts");
+	if (!stillOwns()) return;
 
-	state.metricRegistry = createMetricRegistry();
-	if (deps.pi.events) {
-		state.eventMetricSub = wireEventToMetrics(deps.pi.events, state.metricRegistry);
-	}
-	if (config.telemetry?.enabled !== false) {
-		state.metricSink = createMetricFileSink({
-			crewRoot: projectCrewRoot(ctx.cwd),
-			registry: state.metricRegistry,
-			retentionDays: config.observability?.metricRetentionDays ?? 7,
-		});
+	// F11: create into LOCALS — shared state is only touched after ownership is
+	// re-verified. If ownership was lost in the gap, everything just created is
+	// disposed right here in the continuation instead of leaking (0 orphans).
+	const metricRegistry = createMetricRegistry();
+	const eventMetricSub = deps.pi.events ? wireEventToMetrics(deps.pi.events, metricRegistry) : undefined;
+	const metricSink =
+		config.telemetry?.enabled !== false
+			? createMetricFileSink({
+					crewRoot: projectCrewRoot(ctx.cwd),
+					registry: metricRegistry,
+					retentionDays: config.observability?.metricRetentionDays ?? 7,
+				})
+			: undefined;
+	if (!stillOwns()) {
+		eventMetricSub?.dispose();
+		metricSink?.dispose();
+		metricRegistry.dispose();
+		return;
 	}
+	state.metricRegistry = metricRegistry;
+	state.eventMetricSub = eventMetricSub;
+	state.metricSink = metricSink;
 
 	// OTLP export is opt-in. Lazy-loaded via dynamic import.
 	if (config.otlp?.enabled === true && config.otlp.endpoint) {
 		const otlpEndpoint = config.otlp.endpoint;
 		const otlpHeaders = config.otlp.headers;
 		const otlpInterval = config.otlp.intervalMs;
-		const owningRegistry = state.metricRegistry;
+		const owningRegistry = metricRegistry;
 		// LAZY: opt-in OTLP export — load the exporter module on first enable.
 		void importOTLPExporter()
 			.then((Ctor) => {
-				if (deps.isCleanedUp() || state.metricRegistry !== owningRegistry || !owningRegistry) return;
-				state.otlpExporter = new Ctor(
+				if (!stillOwns() || state.metricRegistry !== owningRegistry || !owningRegistry) return;
+				const otlpExporter = new Ctor(
 					{
 						endpoint: otlpEndpoint,
 						headers: otlpHeaders,
@@ -138,18 +186,20 @@ export async function configureObservability(ctx: ExtensionContext, state: Obser
 					},
 					owningRegistry,
 				);
-				state.otlpExporter?.start();
+				state.otlpExporter = otlpExporter;
+				otlpExporter.start();
 			})
 			.catch((error: unknown) => logInternalError("register.otlp-lazy-import", error));
 	}
 
 	// LAZY: heartbeat watcher — polled per-session, wires deadletter + metric events.
 	const { HeartbeatWatcher } = await import("../../runtime/heartbeat/heartbeat-watcher.ts");
-	state.heartbeatWatcher = new HeartbeatWatcher({
+	if (!stillOwns()) return;
+	const heartbeatWatcher = new HeartbeatWatcher({
 		cwd: ctx.cwd,
 		pollIntervalMs: config.observability?.pollIntervalMs ?? 5000,
 		manifestCache: deps.getManifestCache(ctx.cwd),
-		registry: state.metricRegistry,
+		registry: metricRegistry,
 		router: {
 			enqueue: (notification) => {
 				deps.notifyOperator(notification);
@@ -173,25 +223,24 @@ export async function configureObservability(ctx: ExtensionContext, state: Obser
 			});
 		},
 	});
-	state.heartbeatWatcher.start();
+	// F11: the watcher is created into a local and only published once
+	// ownership is re-verified — a lost-ownership continuation disposes it
+	// instead of publishing a live poller nobody will tear down.
+	if (!stillOwns()) {
+		heartbeatWatcher.dispose();
+		return;
+	}
+	state.heartbeatWatcher = heartbeatWatcher;
+	heartbeatWatcher.start();
 
 	// RT-F2: opportunistic stale-run reconcile hook.
-	// The .unref()'d setInterval below never fires while the event loop is idle
-	// (e.g. user has the editor open but hasn't sent a turn in an hour). Pair it
-	// with a before_agent_start hook so reconcileAllStaleRuns also fires when
-	// the user actually drives the session — bounded by user activity.
-	try {
-		deps.pi.on?.("before_agent_start", () => {
-			if (deps.isCleanedUp()) return;
-			try {
-				deps.reconcileStaleRuns(ctx.cwd, deps.getManifestCache(ctx.cwd), extractSessionId(ctx));
-			} catch (error) {
-				logInternalError("register.autoRepair.turnHook", error);
-			}
-		});
-	} catch {
-		/* older Pi without before_agent_start — rely on the interval alone */
-	}
+	// F12 (RR-018): the `before_agent_start` hook is NO LONGER registered here.
+	// It is registered exactly ONCE per extension in `lazy-configurers.ts`
+	// (installTurnReconcileHook) and resolves the CURRENT session context at
+	// fire time — per-session registration accumulated one dead hook per
+	// switch (there is no pi.off), and the stale hook re-activated with the
+	// old session's cwd, flipping the shared manifest cache back. The
+	// .unref()'d setInterval below remains the idle-time safety net.
 
 	// Auto-repair timers: stale-run reconcile + orphan-temp cleanup.
 	// RT-F2: default raised from 60_000ms to 5 minutes (300_000ms). The previous
@@ -273,7 +322,7 @@ export async function configureObservability(ctx: ExtensionContext, state: Obser
 		void deps
 			.importCrashRecovery()
 			.then(({ detectInterruptedRuns }) => {
-				if (deps.isCleanedUp()) return;
+				if (!stillOwns()) return;
 				const sid = extractSessionId(ctx);
 				for (const plan of detectInterruptedRuns(cwdSnapshot, cacheSnapshot, 300_000, sid)) {
 					deps.notifyOperator({
@@ -296,6 +345,20 @@ export async function configureObservability(ctx: ExtensionContext, state: Obser
  * gated by the orchestrator's overall cleanup state.
  */
 export async function disposeObservability(state: ObservabilityState, _isCleanedUp: boolean): Promise<void> {
+	// F11 (RR-018): settle any in-flight init BEFORE disposing shared state, so
+	// teardown never races a still-suspended continuation. The continuation
+	// itself re-checks ownership after every await and self-disposes its
+	// locals, so this await only bounds the race window — it never starts new
+	// work and cannot deadlock (the previous init completes on its own).
+	const initPromise = state.initPromise;
+	state.initPromise = undefined;
+	if (initPromise) {
+		try {
+			await initPromise;
+		} catch {
+			/* configureObservabilityImpl logs its own errors */
+		}
+	}
 	state.heartbeatWatcher?.dispose();
 	state.heartbeatWatcher = undefined;
 	if (state.autoRepairTimer) {

package/src/extension/registration/registration-types.ts

@@ -37,12 +37,14 @@ export type AbortControllerMap = Map<AbortKey, AbortController>;
 /**
  * Single auto-recovery cooldown gate entry. Tracked by the render-tick
  * health notifier so the same warning doesn't fire repeatedly within a
- * 5-minute cooldown. Uses LRU-like semantics — see register.ts.
+ * 5-minute cooldown, and (FINDING 6) at most MAX_HEALTH_NOTIFY_FIRES times
+ * per unchanged fingerprint. LRU-like semantics — see register.ts and
+ * health-notify-policy.ts (the authoritative definition; re-exported here
+ * so existing imports keep working).
  */
-export interface AutoRecoveryEntry {
-	insertedAt: number;
-	lastAccessAt: number;
-}
+export type { AutoRecoveryEntry } from "./health-notify-policy.ts";
+
+import type { AutoRecoveryEntry } from "./health-notify-policy.ts";
 
 /**
  * Mutable context bag passed from the orchestrator to every