pi-crew 0.11.1 → 0.11.2

package/src/state/coordination/locks.ts

@@ -80,7 +80,11 @@ function isLockHolderAlive(filePath: string): boolean {
  *
  * Returns `{ canSteal: true }` if the lock is stale OR the holder is dead
  * (safe to forcibly remove); `{ canSteal: false }` if it is fresh AND held by
- * a live process (must keep waiting).
+ * a live process (must keep waiting). RR-011 additionally reports
+ * `heldByLiveInProcess: true` when the stored token belongs to a run-lock
+ * acquisition of THIS process that is still inside its critical section — the
+ * async acquire loop then WAITS (timer-based retry) instead of throwing or
+ * stealing.
  *
  * ## EPERM Handling (Accepted Risk)
  *
@@ -105,7 +109,11 @@ function isLockHolderAlive(filePath: string): boolean {
  *
  * See also: SECURITY-ISSUES.md SEC-008 for documented acceptance.
  */
-function readLockSnapshot(filePath: string, staleMs: number, options?: { treatOwnPidAsStealable?: boolean }): { canSteal: boolean } {
+function readLockSnapshot(
+	filePath: string,
+	staleMs: number,
+	options?: { treatOwnPidAsStealable?: boolean; activeHolderTokens?: ReadonlySet<string> },
+): { canSteal: boolean; heldByLiveInProcess: boolean } {
 	const treatOwnPidAsStealable = options?.treatOwnPidAsStealable === true;
 	let stat: fs.Stats | undefined;
 	let raw: string | undefined;
@@ -119,21 +127,23 @@ function readLockSnapshot(filePath: string, staleMs: number, options?: { treatOw
 		// "locked" error.
 		const code = (error as NodeJS.ErrnoException).code;
 		if (code === "ENOENT") {
-			return { canSteal: true };
+			return { canSteal: true, heldByLiveInProcess: false };
 		}
 		// Transient I/O error — be conservative (don't steal, retry the read on
 		// next attempt).
-		return { canSteal: false };
+		return { canSteal: false, heldByLiveInProcess: false };
 	}
 	// Staleness from a single snapshot.
 	let createdAt = parseCreatedAtFromLock(raw);
 	if (createdAt === undefined) createdAt = stat.mtimeMs;
 	const isStale = Date.now() - createdAt > staleMs;
 	let holderPid: number | undefined;
+	let holderToken: string | undefined;
 	let isAlive = true;
 	try {
-		const parsed = JSON.parse(raw) as { pid?: unknown };
+		const parsed = JSON.parse(raw) as { pid?: unknown; token?: unknown };
 		holderPid = typeof parsed.pid === "number" ? parsed.pid : undefined;
+		holderToken = typeof parsed.token === "string" ? parsed.token : undefined;
 	} catch {
 		/* malformed payload — keep isAlive=true */
 	}
@@ -151,9 +161,28 @@ function readLockSnapshot(filePath: string, staleMs: number, options?: { treatOw
 	// (used by withRunLock* which is single-process — a fresh lock with our pid
 	// between acquisitions is just a leftover from a previous call that
 	// releaseOwnLock didn't get to delete yet; safe to steal).
+	//
+	// RR-011 (F02): "our own pid" alone can no longer authorize a steal for the
+	// async run-lock path — a lock CURRENTLY HELD by another async context of
+	// this process also carries our pid while its holder is merely awaiting
+	// inside the critical section. The on-disk token disambiguates: a token in
+	// `activeHolderTokens` (runLockHeldTokens — every live acquisition of this
+	// process registers its token) means the holder is ALIVE in-process → the
+	// own-pid steal branch is suppressed (see acquireLockWithRetryAsync: such a
+	// holder WAITS instead of stealing/throwing). A token-less payload (legacy
+	// lock file) or a token not in the set is a leftover corpse → still stealable,
+	// preserving the anti-CI-flake behaviour the flag was added for.
+	// NOTE (trap, design.md §4.2): comparing the stored token to the CURRENT
+	// acquisition's token would be WRONG — each acquisition mints a fresh
+	// randomUUID, so a live holder's token always differs from ours and the
+	// predicate would steal anyway. Only a lookup into the LIVE-token set is
+	// correct.
 	const isOurOwnHolder = holderPid === process.pid;
+	const holderIsLiveInProcess = holderToken !== undefined && (options?.activeHolderTokens?.has(holderToken) ?? false);
+	const ownPidStealable = treatOwnPidAsStealable && isOurOwnHolder && !holderIsLiveInProcess;
 	return {
-		canSteal: isStale || !isAlive || (treatOwnPidAsStealable && isOurOwnHolder),
+		canSteal: isStale || !isAlive || ownPidStealable,
+		heldByLiveInProcess: holderIsLiveInProcess,
 	};
 }
 
@@ -239,25 +268,82 @@ function timingSafeTokenMatch(a: string, b: string): boolean {
 }
 
 /**
- * Release the lock we (this process) just acquired. Unlike releaseLock, this is
- * used in the `finally` blocks of withRunLock and withRunLockSync so the file was
- * created earlier in the SAME call. Within the same process the new acquire uses
- * a fresh randomUUID token, so token matching would falsely fail and leak the
- * file across releases.
+ * Release the lock we (this process) just acquired. Used in the `finally` blocks
+ * of withRunLock and withRunLockSync, so the file was created earlier in the SAME
+ * call and carries OUR token.
  *
  * LOCK-1 (Round 2): PID-guarded release. Previously this deleted
  * UNCONDITIONALLY — if our critical section exceeded staleMs, another process
  * could steal our lock (overwrite the file with its own pid); our finally would
- * then DELETE THE STEALER's lock, breaking mutual exclusion. We now verify the
- * lock file still records OUR pid before removing; if it records a different pid
- * the lock was stolen and the current holder owns it. Same-process re-acquire is
- * preserved (pid matches → delete). Mirrors the proven pattern in event-log.ts
- * (Round 26, BUG 5).
+ * then DELETE THE STEALER's lock, breaking mutual exclusion. We therefore verify
+ * the lock file still records OUR pid before removing; if it records a different
+ * pid the lock was stolen and the current holder owns it.
+ *
+ * RR-011 (F02): within one process, PID equality no longer identifies "our" lock
+ * — two same-process async holders are distinguished ONLY by token. A finishing
+ * context must not delete another acquisition's lock (verification probe 2: the
+ * lock file was ENOENT while the second holder was still inside its critical
+ * section). So after the pid check, the stored token must also match ours. A
+ * token-less payload (legacy lock file from an older release) keeps the
+ * PID-only behaviour so old files are still cleaned up.
  *
  * Symlink guard is preserved: if a symlink appeared since our writeLockFile, we
  * don't rm it (defense against attacker-planted symlinks).
  */
-export function releaseOwnLock(filePath: string, _token: string): void {
+/**
+ * US-002 (2026-09-22): structured, safe, idempotent sweep of stale run locks.
+ *
+ * Locks whose holder died without releasing (kill -9, crash) previously lingered
+ * until some future acquirer hit the stale-steal path. This gives the
+ * stale-reconciler an explicit pass.
+ *
+ * IMPORTANT — the sweep predicate is STRICTER than acquire-time `canSteal`:
+ * acquire steals on `stale OR holder-dead` (deliberate: a stale lock must not
+ * block a live run forever), but a SWEEP must only remove a lock whose holder is
+ * provably DEAD. Removing a stale-but-live holder's lock would let two processes
+ * enter the critical section. So: stale AND (no pid OR pid dead). A live pid is
+ * never swept, no matter how old.
+ *
+ * Returns the lock files it removed. Idempotent: a second sweep finds nothing.
+ */
+export function sweepStaleLocks(lockFiles: readonly string[], options: RunLockOptions = {}): { removed: string[] } {
+	const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+	const removed: string[] = [];
+	for (const filePath of lockFiles) {
+		try {
+			if (!fs.existsSync(filePath)) continue;
+			if (!isLockStale(filePath, staleMs)) continue; // fresh → leave alone
+			// Stale. Remove ONLY when no live holder owns it.
+			if (isLockHolderAlive(filePath)) continue;
+			fs.rmSync(filePath, { force: true });
+			removed.push(filePath);
+		} catch (error) {
+			logInternalError("locks.sweep-stale", error, `path=${filePath}`);
+		}
+	}
+	return { removed };
+}
+
+/**
+ * US-002: discover every `run.lock` under a runs root
+ * (`<runsRoot>/<runId>/run.lock`), bounded, for sweepStaleLocks. Missing → empty.
+ */
+export function discoverRunLockFiles(runsRoot: string, maxDirs = 500): string[] {
+	try {
+		if (!fs.existsSync(runsRoot)) return [];
+		return fs
+			.readdirSync(runsRoot, { withFileTypes: true })
+			.filter((e) => e.isDirectory())
+			.slice(0, maxDirs)
+			.map((e) => path.join(runsRoot, e.name, "run.lock"))
+			.filter((p) => fs.existsSync(p));
+	} catch (error) {
+		logInternalError("locks.discover-run-locks", error, `runsRoot=${runsRoot}`);
+		return [];
+	}
+}
+
+export function releaseOwnLock(filePath: string, token: string): void {
 	try {
 		const stat = fs.lstatSync(filePath);
 		if (stat.isSymbolicLink()) return;
@@ -266,11 +352,20 @@ export function releaseOwnLock(filePath: string, _token: string): void {
 	}
 	try {
 		const raw = fs.readFileSync(filePath, "utf-8");
-		const holderPid = (JSON.parse(raw) as { pid?: unknown })?.pid;
-		if (holderPid === process.pid) {
-			fs.rmSync(filePath, { force: true });
+		const parsed = JSON.parse(raw) as { pid?: unknown; token?: unknown };
+		const holderPid = parsed.pid;
+		const storedToken = typeof parsed.token === "string" ? parsed.token : undefined;
+		if (holderPid !== process.pid) {
+			// holderPid !== process.pid → lock stolen by another process; do NOT touch.
+			return;
 		}
-		// holderPid !== process.pid → lock stolen by another process; do NOT touch.
+		if (storedToken !== undefined && storedToken !== token) {
+			// RR-011 (F02): same process, different token → the lock now belongs to
+			// another acquisition of THIS process (steal window / superseded holder).
+			// Do not delete it — the current holder owns it.
+			return;
+		}
+		fs.rmSync(filePath, { force: true });
 	} catch (error) {
 		const code = (error as NodeJS.ErrnoException).code;
 		if (code !== "ENOENT") {
@@ -322,6 +417,25 @@ function isLockContention(code: string | undefined): boolean {
 	return code === "EEXIST" || code === "EPERM" || code === "EBUSY";
 }
 
+// RR-011 (F02): tokens of run-lock acquisitions that are CURRENTLY HELD in this
+// process. It answers exactly one question — "is this holder still alive
+// in-process?" — and NOTHING else:
+//   - Re-entrance (bypass) decisions stay in `lockCtx` (per async context). This
+//     set must NEVER be consulted for bypass — that is the H-1 bug class.
+//   - The async steal predicate consults it (via readLockSnapshot's
+//     activeHolderTokens) so a SECOND independent async context can no longer
+//     steal a lock whose holder is merely awaiting inside its critical section.
+//
+// INVARIANT: a token is added synchronously right after a successful acquire
+// (no await between acquire returning and the add) and deleted in the
+// acquisition's `finally` BEFORE releaseOwnLock runs — so a token in this set
+// always corresponds to a live critical section, and a leftover lock file from
+// a finished acquisition (token no longer in the set, or a legacy token-less
+// payload) remains stealable, preserving the CI-flake fix that
+// treatOwnPidAsStealable was added for. If a `finally` were ever skipped, the
+// leaked entry is inert: future lock files always mint a fresh randomUUID.
+const runLockHeldTokens = new Set<string>();
+
 function acquireLockWithRetry(filePath: string, staleMs: number, kind: LockKind = "file"): string {
 	let attempt = 0;
 	const deadline = Date.now() + staleMs * 2;
@@ -381,10 +495,48 @@ async function acquireLockWithRetryAsync(filePath: string, staleMs: number, kind
 			// file still exists with our own pid. Stealing it avoids spurious 'locked'
 			// errors. The sync file-lock path (withFileLockSync) above uses false to
 			// preserve the multi-process safety guarantee.
-			const { canSteal } = readLockSnapshot(filePath, staleMs, { treatOwnPidAsStealable: true });
-			if (!canSteal) {
+			// RR-011 (F02): the steal now consults runLockHeldTokens — a lock whose
+			// stored token belongs to a LIVE acquisition of this process is NOT a
+			// leftover corpse and must not be stolen (that broke async↔async mutual
+			// exclusion: two independent async contexts entered the critical section
+			// together). Token-less legacy files are still stolen (CI-flake fix).
+			const verdict = readLockSnapshot(filePath, staleMs, {
+				treatOwnPidAsStealable: true,
+				activeHolderTokens: runLockHeldTokens,
+			});
+			if (!verdict.canSteal && verdict.heldByLiveInProcess) {
+				// RR-011 (F02): the holder is a LIVE acquisition in THIS process (another
+				// async context awaiting inside its critical section). It releases in its
+				// `finally` on this same event loop — WAIT via a timer (never sleepSync:
+				// blocking the event loop would starve the very holder we are waiting
+				// for, the v0.9.26 deadlock class) and retry the create. The loop deadline
+				// above plus the staleMs check in readLockSnapshot bound the wait, so a
+				// hung holder eventually becomes stale-stealable and this can never
+				// block indefinitely.
+				const delay = Math.min(250, 25 * 2 ** attempt);
+				await sleep(delay);
+				attempt++;
+				continue;
+			}
+			if (!verdict.canSteal) {
 				throw new Error(`Run '${path.basename(filePath)}' is locked by another operation.`);
 			}
+			if (verdict.heldByLiveInProcess) {
+				// Review MAJOR 2: the staleMs backstop is stealing a lock whose holder
+				// is STILL a live acquisition of this process (its critical section
+				// legitimately exceeded staleMs — fsync stalls, loaded machine). The
+				// steal is the documented design (ADR 2026-09-17-run-lock-async-
+				// ownership) but mutual exclusion is about to be violated knowingly,
+				// so it must be observable, never silent — production holders are
+				// ms-scale; seeing this warn means the invariant "critical section <
+				// staleMs" was broken and the budget should be revisited.
+				logInternalError(
+					"locks.steal-live-holder",
+					new Error(`staleMs steal of a lock held by a LIVE in-process acquisition (staleMs=${staleMs})`),
+					filePath,
+					"warn",
+				);
+			}
 			// Stale or dead holder — forcibly remove the lock.
 			try {
 				fs.rmSync(filePath, { force: true });
@@ -622,6 +774,10 @@ export function withRunLockSync<T>(manifest: TeamRunManifest, fn: () => T, optio
 	}
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	const token = acquireLockWithRetry(filePath, staleMs, "run");
+	// RR-011 (F02): register the hold so async contenders of this process see a
+	// LIVE holder (wait) instead of a stealable corpse. Sync here too, keeping the
+	// invariant uniform for every run-lock acquisition of this process.
+	runLockHeldTokens.add(token);
 	const prevHeld = lockCtx.getStore() ?? new Set<string>();
 	const newHeld = new Set(prevHeld);
 	newHeld.add(filePath);
@@ -632,14 +788,11 @@ export function withRunLockSync<T>(manifest: TeamRunManifest, fn: () => T, optio
 		try {
 			return fn();
 		} finally {
-			// FIX (CI flake): releaseLock uses token matching to prevent the
-			// "losing contender wipes winner's lock" race in multi-process scenarios.
-			// But within withRunLockSync/withRunLock (same process), the new acquire
-			// uses a FRESH random token — the previous stored token doesn't match the
-			// current token — and the lock file is never removed. Repeat acquisitions
-			// then keep failing with EEXIST because the file lingers.
-			// Since withRunLock* is always single-process, unconditionally delete
-			// (symlink guard is still applied for safety).
+			// RR-011 (F02): unregister BEFORE releasing (see runLockHeldTokens
+			// invariant) — the token must not linger as "live" once the hold ends.
+			// releaseOwnLock is token-guarded: if our lock was superseded in the
+			// meantime, the current holder's file is left untouched.
+			runLockHeldTokens.delete(token);
 			releaseOwnLock(filePath, token);
 		}
 	});
@@ -654,6 +807,10 @@ export async function withRunLock<T>(manifest: TeamRunManifest, fn: () => Promis
 	}
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
 	const token = await acquireLockWithRetryAsync(filePath, staleMs, "run");
+	// RR-011 (F02): register the hold IMMEDIATELY (no await between the acquire
+	// returning and this add — otherwise a concurrent contender could observe the
+	// fresh on-disk token as a stealable corpse). Deleted in the finally below.
+	runLockHeldTokens.add(token);
 	const prevHeld = lockCtx.getStore() ?? new Set<string>();
 	const newHeld = new Set(prevHeld);
 	newHeld.add(filePath);
@@ -664,8 +821,9 @@ export async function withRunLock<T>(manifest: TeamRunManifest, fn: () => Promis
 		try {
 			return await fn();
 		} finally {
-			// FIX (CI flake): see withRunLockSync above — use releaseOwnLock for
-			// unconditional deletion of the lock file we created (same process).
+			// RR-011 (F02): see withRunLockSync above — unregister the live token
+			// BEFORE the token-guarded releaseOwnLock (runLockHeldTokens invariant).
+			runLockHeldTokens.delete(token);
 			releaseOwnLock(filePath, token);
 		}
 	});

package/src/state/coordination/mailbox.ts

@@ -467,19 +467,20 @@ function readAllInboxMessages(manifest: TeamRunManifest): MailboxMessage[] {
 // FIND-01: in-process delivery cache to avoid O(N²) re-reads on every append.
 // Keyed by delivery file path; invalidated by mtime check on read + updated on
 // write. Team-runner is single-process so in-process caching is sufficient.
-const deliveryCache = new Map<string, { mtimeMs: number; state: MailboxDeliveryState }>();
+const deliveryCache = new Map<string, { mtimeMs: number; size: number; state: MailboxDeliveryState }>();
 const MAX_DELIVERY_CACHE_ENTRIES = 256;
 // R1 review fix: setDeliveryCacheEntry stores an immutable snapshot (deep
 // copy of `messages`) so callers mutating the returned state cannot corrupt
 // the cache (TOCTOU race), and bounds the map size with FIFO eviction to
 // prevent unbounded growth across runs.
-function setDeliveryCacheEntry(filePath: string, entry: { mtimeMs: number; state: MailboxDeliveryState }): void {
+function setDeliveryCacheEntry(filePath: string, entry: { mtimeMs: number; size: number; state: MailboxDeliveryState }): void {
 	if (deliveryCache.size >= MAX_DELIVERY_CACHE_ENTRIES) {
 		const oldest = deliveryCache.keys().next().value;
 		if (oldest !== undefined) deliveryCache.delete(oldest);
 	}
 	deliveryCache.set(filePath, {
 		mtimeMs: entry.mtimeMs,
+		size: entry.size,
 		state: { ...entry.state, messages: { ...entry.state.messages } },
 	});
 }
@@ -497,7 +498,7 @@ export function readDeliveryState(manifest: TeamRunManifest): MailboxDeliverySta
 		return { messages: {}, updatedAt: new Date().toISOString() };
 	}
 	const cached = deliveryCache.get(filePath);
-	if (cached && cached.mtimeMs === stat.mtimeMs) {
+	if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) {
 		// R2 review fix: return a copy so callers mutating the result cannot
 		// leak into the cached snapshot (residual TOCTOU: the cache holds the
 		// snapshot until the next write replaces it; without this copy, a
@@ -517,7 +518,7 @@ export function readDeliveryState(manifest: TeamRunManifest): MailboxDeliverySta
 			messages,
 			updatedAt: typeof obj.updatedAt === "string" ? obj.updatedAt : new Date().toISOString(),
 		};
-		setDeliveryCacheEntry(filePath, { mtimeMs: stat.mtimeMs, state });
+		setDeliveryCacheEntry(filePath, { mtimeMs: stat.mtimeMs, size: stat.size, state });
 		return state;
 	} catch (error) {
 		// NEW-R4: a corrupt delivery.json was previously swallowed silently, returning
@@ -543,22 +544,146 @@ export function readDeliveryState(manifest: TeamRunManifest): MailboxDeliverySta
 	}
 }
 
+const MAX_DELIVERY_MESSAGES = 10000;
+
+/**
+ * F09 (RR-016): an `acknowledged` delivery entry is the ONLY durable record
+ * that a message was handled — the inbox line keeps `status: "queued"` forever
+ * (nothing writes the ack back to the message), so `replayPendingMailboxMessages`
+ * keys on the delivery map. The old prune sorted `queued(0) < delivered(1) <
+ * acknowledged(2)` and kept `slice(0, MAX)`, i.e. it evicted ACKNOWLEDGED entries
+ * FIRST — the moment the cap was crossed, an acked message became replayable
+ * again, and it never self-healed (replay only writes "delivered"), so it was
+ * re-delivered on EVERY resume.
+ *
+ * Fix: the prune may only drop an acknowledged entry when the message it refers
+ * to is provably no longer replayable (absent from the whole replayable history:
+ * live inbox files + retained archives — the exact set `replayPendingMailboxMessages`
+ * reads). Non-acknowledged entries keep the previous eviction semantics
+ * (queued → delivered → acknowledged, oldest-inserted first within a tier).
+ *
+ * Acknowledged entries are tiny (`"<id>":"acknowledged"`), but they must not
+ * grow without bound either: a sweep that drops the PROVABLY-dead acks is run
+ * once the ack set is large enough to matter, and at most once per
+ * ACK_SWEEP_MIN_INTERVAL_MS (the sweep reads the mailbox history, so it is
+ * throttled rather than run on every append).
+ */
+const ACK_SWEEP_MIN_ACKS = 1000;
+const ACK_SWEEP_FORCE_ACKS = 5000;
+const ACK_SWEEP_MIN_INTERVAL_MS = 30_000;
+// Bounded FIFO (the asyncAgentReaderCache pattern) so a long-running process
+// cannot accumulate one timestamp per run ever seen.
+const ACK_SWEEP_TIMESTAMP_MAX_ENTRIES = 256;
+const lastAckSweepAt = new Map<string, number>();
+
+function recordAckSweep(filePath: string, at: number): void {
+	if (lastAckSweepAt.has(filePath)) lastAckSweepAt.delete(filePath);
+	lastAckSweepAt.set(filePath, at);
+	while (lastAckSweepAt.size > ACK_SWEEP_TIMESTAMP_MAX_ENTRIES) {
+		const oldest = lastAckSweepAt.keys().next().value;
+		if (oldest === undefined) break;
+		lastAckSweepAt.delete(oldest);
+	}
+}
+
+/** Ids of every message `replayPendingMailboxMessages` could return (live inbox
+ *  files + retained archives, run-level and per-task). Returns `undefined` when
+ *  the history could not be READ (fail-closed, review MAJOR 1): an unreadable
+ *  history must never be conflated with an empty one — the sweep treats an
+ *  empty set as "every ack is dead" and would delete all acknowledged entries,
+ *  replaying already-processed messages (the F09 bug class). */
+function collectReplayableInboxIds(manifest: TeamRunManifest): Set<string> | undefined {
+	const ids = new Set<string>();
+	try {
+		for (const message of readAllInboxMessages(manifest)) ids.add(message.id);
+	} catch (error) {
+		logInternalError("mailbox.collect-replayable-ids", error, `runId=${manifest.runId}`);
+		return undefined;
+	}
+	return ids;
+}
+
+/** Drop acknowledged entries whose message can no longer be replayed. Returns
+ *  the number of entries dropped. Never drops an entry whose message is still
+ *  in the replayable history. FAIL-CLOSED (review MAJOR 1): if the replayable
+ *  history cannot be read, the sweep aborts dropping NOTHING and does not
+ *  consume the throttle window (`recordAckSweep` is only recorded after a
+ *  successful read), so the next prune retries once the FS is readable. */
+function sweepDeadAcknowledgements(manifest: TeamRunManifest, state: MailboxDeliveryState): number {
+	const ackedIds = Object.entries(state.messages)
+		.filter(([, status]) => status === "acknowledged")
+		.map(([id]) => id);
+	if (ackedIds.length === 0) return 0;
+	const filePath = deliveryFile(manifest, true);
+	const now = Date.now();
+	const last = lastAckSweepAt.get(filePath) ?? 0;
+	// The sweep reads the whole replayable history, so it is time-throttled:
+	// at most once per ACK_SWEEP_MIN_INTERVAL_MS below ACK_SWEEP_FORCE_ACKS,
+	// and immediately above it so the ack set cannot grow unbounded.
+	const shouldSweep =
+		ackedIds.length >= ACK_SWEEP_FORCE_ACKS || (ackedIds.length >= ACK_SWEEP_MIN_ACKS && now - last >= ACK_SWEEP_MIN_INTERVAL_MS);
+	if (!shouldSweep) return 0;
+	const replayable = collectReplayableInboxIds(manifest);
+	if (replayable === undefined) return 0; // unreadable history → abort, keep every ack
+	recordAckSweep(filePath, now);
+	let dropped = 0;
+	for (const id of ackedIds) {
+		if (replayable.has(id)) continue;
+		delete state.messages[id];
+		dropped++;
+	}
+	return dropped;
+}
+
+function pruneDeliveryMessages(manifest: TeamRunManifest, state: MailboxDeliveryState): void {
+	const entries = Object.entries(state.messages);
+	const ackedCount = entries.reduce((count, [, status]) => (status === "acknowledged" ? count + 1 : count), 0);
+	if (ackedCount > ACK_SWEEP_MIN_ACKS) sweepDeadAcknowledgements(manifest, state);
+	const remaining = Object.entries(state.messages);
+	if (remaining.length <= MAX_DELIVERY_MESSAGES) return;
+	// Stable sort: within a status tier the previous insertion order (which is
+	// the order entries were first written) is preserved, so the eviction choice
+	// for non-acknowledged entries is unchanged from before this fix.
+	const sorted = [...remaining].sort(([, a], [, b]) => {
+		const order = { queued: 0, delivered: 1, acknowledged: 2 };
+		return (order[a] ?? 3) - (order[b] ?? 3);
+	});
+	const ackedAfterSweep = sorted.filter(([, status]) => status === "acknowledged").length;
+	if (ackedAfterSweep > MAX_DELIVERY_MESSAGES) {
+		// Pathological: more acks than the cap and every one of them still refers
+		// to a replayable message. Correctness (an acked message must never
+		// replay) wins over the memory bound — keep them and make it visible.
+		logInternalError(
+			"mailbox.delivery-ack-over-cap",
+			new Error(`delivery.json holds ${ackedAfterSweep} acknowledged entries for replayable messages (cap ${MAX_DELIVERY_MESSAGES})`),
+			`runId=${manifest.runId}`,
+			"warn",
+		);
+	}
+	const keptIds = new Set<string>();
+	let evictableBudget = Math.max(0, MAX_DELIVERY_MESSAGES - ackedAfterSweep);
+	for (const [id, status] of sorted) {
+		if (status === "acknowledged") {
+			keptIds.add(id);
+			continue;
+		}
+		if (evictableBudget > 0) {
+			keptIds.add(id);
+			evictableBudget--;
+		}
+	}
+	// Filter the ORIGINAL entry order so surviving entries keep their positions.
+	state.messages = Object.fromEntries(remaining.filter(([id]) => keptIds.has(id)));
+}
+
 function writeDeliveryState(
 	manifest: TeamRunManifest,
 	state: MailboxDeliveryState,
 	options?: { durability?: "full" | "best-effort" },
 ): void {
 	ensureRunMailbox(manifest);
-	// Prune oldest entries if capped
-	const MAX_DELIVERY_MESSAGES = 10000;
-	if (Object.keys(state.messages).length > MAX_DELIVERY_MESSAGES) {
-		const sorted = Object.entries(state.messages).sort(([, a], [, b]) => {
-			const order = { queued: 0, delivered: 1, acknowledged: 2 };
-			return (order[a] ?? 3) - (order[b] ?? 3);
-		});
-		const trimmed = sorted.slice(0, MAX_DELIVERY_MESSAGES);
-		state.messages = Object.fromEntries(trimmed);
-	}
+	// Prune oldest entries if capped (F09: acknowledged entries are protected).
+	pruneDeliveryMessages(manifest, state);
 	// F4: mailbox delivery is informational — accept losing the very last write on
 	// a hard crash (the next message will overwrite it on disk). Cheaper fsync on
 	// the hot path; terminal/reply paths still pass full durability below.
@@ -572,7 +697,7 @@ function writeDeliveryState(
 		// setDeliveryCacheEntry stores an immutable snapshot (deep copy of
 		// messages) so subsequent read-modify-write callers mutating the
 		// returned state cannot corrupt the cache.
-		setDeliveryCacheEntry(filePath, { mtimeMs: postStat.mtimeMs, state });
+		setDeliveryCacheEntry(filePath, { mtimeMs: postStat.mtimeMs, size: postStat.size, state });
 	} catch {
 		deliveryCache.delete(filePath);
 	}

package/src/state/crew-init.ts

@@ -13,10 +13,20 @@
  * The `node:path` import is retained as a *fallback* (only used when the
  * binding is healthy). Don't add new dependencies on other pi-crew modules.
  *
+ * TWO sanctioned exceptions (RR-020):
+ *   - `node:os` — a builtin like fs/path, used ONLY inside try/catch so a
+ *     jiti namespace race degrades to "no home/tmp boundary" (the pre-RR-020
+ *     walk) instead of crashing ensureCrewDirectory.
+ *   - `../utils/project-markers.ts` — a zero-import module of plain string
+ *     literals, so it cannot itself suffer the namespace race and it keeps
+ *     this resolver from drifting away from `src/utils/paths.ts`.
+ *
  * See: https://github.com/baphuongna/pi-crew/issues/28
  */
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
+import { PROJECT_DIR_MARKERS, PROJECT_FILE_MARKERS } from "../utils/project-markers.ts";
 import { atomicWriteFile } from "./atomic-write.ts";
 import { updateGitignore } from "./gitignore-manager.ts";
 
@@ -164,29 +174,94 @@ function safeResolve(p: string, pathDep?: typeof path): string {
 }
 
 function findProjectRoot(start: string, pathDep?: typeof path): string | undefined {
-	const dirMarkers = [".git", ".hg", ".svn"];
-	const fileMarkers = ["package.json", "pyproject.toml", "Cargo.toml", "go.mod"];
-	// Use `parseRoot` (inlined above) to avoid `path.parse` for the critical
-	// termination root — fixes the jiti namespace race in issue #28.
-	const root = parseRoot(start);
+	// Marker lists come from src/utils/project-markers.ts (RR-020 Fix 1) so this
+	// resolver can never drift from src/utils/paths.ts:computeRepoRoot again —
+	// the drift resolved `parent/subproject` (.pi) to `parent/.crew` here while
+	// paths.ts resolved the same cwd to `subproject/.pi/teams` (two roots).
+	// The module has NO imports of its own, so it is safe under the jiti
+	// namespace race documented at the top of this file.
+	// RR-020 hardening (cold-verify round 2): the marker arrays are the ONE
+	// critical-path dependency on a static import binding. Under the jiti
+	// namespace race (issue #28) a binding can arrive undefined — degrade to the
+	// narrow `.git`-only probe (findProjectRoot then returns undefined more
+	// often, so computeCrewRoot anchors the crew root at the cwd — the same
+	// fallback paths.ts uses) instead of throwing inside ensureCrewDirectory,
+	// the very function hardened for #28. Mirrors the defensive style of
+	// safeJoin/safeDirname/parseRoot and the lazy updateGitignore import.
+	function markerLists(): { dirs: string[]; files: string[] } {
+		try {
+			if (Array.isArray(PROJECT_DIR_MARKERS) && Array.isArray(PROJECT_FILE_MARKERS)) {
+				return { dirs: PROJECT_DIR_MARKERS as string[], files: PROJECT_FILE_MARKERS as string[] };
+			}
+		} catch {
+			// namespace unavailable — fall through to the narrow probe
+		}
+		return { dirs: [".git"], files: [] };
+	}
+	const markers = markerLists();
+	const hasMarker = (dir: string): boolean =>
+		markers.dirs.some((marker) => fs.existsSync(safeJoin(dir, marker))) ||
+		markers.files.some((marker) => fs.existsSync(safeJoin(dir, marker)));
 	let current = safeResolve(start, pathDep);
+	// RR-020 cold-verify follow-up: match findRepoRoot (paths.ts) which
+	// realpaths the start BEFORE walking, so the boundary comparisons below
+	// compare canonical-to-canonical (macOS /var -> /private/var). Best-effort:
+	// ENOENT keeps the lexical path, exactly like findRepoRoot's fallback.
+	try {
+		current = fs.realpathSync(current);
+	} catch {
+		// keep the lexical resolution
+	}
+	// Use `parseRoot` (inlined above) to avoid `path.parse` for the critical
+	// termination root — fixes the jiti namespace race in issue #28. Computed
+	// from the RESOLVED `current` (post-realpath) so a root-prefix change
+	// through a symlink cannot desync `current !== root` (paths.ts computes
+	// path.parse on the realpath'd start for the same reason).
+	const root = parseRoot(current);
+	// RR-020 cold-verify follow-up (bug-029 parity): home/tmp boundary STOP.
+	// computeRepoRoot (paths.ts) refuses to check markers at $HOME or the temp
+	// root; this walk did not, so once the marker lists were unified onto the
+	// wide set, `$HOME/.pi` (created by userPiRoot()) became a marker HERE — a
+	// MARKERLESS cwd under $HOME resolved crew-init to $HOME (⇒
+	// $HOME/.pi/teams) while projectCrewRoot resolved to <cwd>/.crew: the
+	// two-roots bug Fix 1 was meant to kill, in a new shape. `os` access is
+	// defensive: under the jiti namespace race (issue #28) the binding can be
+	// undefined — degrade to "no boundary" (the pre-RR-020 walk), never crash.
+	let home: string | undefined;
+	let tempRoot: string | undefined;
+	try {
+		home = canonicalBoundary(os.homedir());
+		tempRoot = canonicalBoundary(os.tmpdir());
+	} catch {
+		home = undefined;
+		tempRoot = undefined;
+	}
+	const atBoundary = (dir: string): boolean => (home !== undefined && dir === home) || (tempRoot !== undefined && dir === tempRoot);
 	// Walk up to find project root
 	while (current !== root) {
-		for (const marker of dirMarkers) {
-			if (fs.existsSync(safeJoin(current, marker))) return current;
-		}
-		for (const marker of fileMarkers) {
-			if (fs.existsSync(safeJoin(current, marker))) return current;
-		}
+		// Stop walking before checking markers at home or temp root.
+		if (atBoundary(current)) return undefined;
+		if (hasMarker(current)) return current;
 		const parent = safeDirname(current);
 		if (parent === current) break;
 		current = parent;
 	}
 	// Check root as fallback
-	if (dirMarkers.some((m) => fs.existsSync(safeJoin(root, m)))) return root;
+	if (atBoundary(root)) return undefined;
+	if (hasMarker(root)) return root;
 	return undefined;
 }
 
+/** Canonicalize a boundary dir for comparison with the (realpath'd) walk.
+ *  Best-effort: an unresolvable path stays lexical. */
+function canonicalBoundary(p: string): string {
+	try {
+		return fs.realpathSync(p);
+	} catch {
+		return p;
+	}
+}
+
 /**
  * Compute the crew root directory for a given working directory.
  * Matches src/utils/paths.ts:projectCrewRoot() logic.