pi-crew 0.11.1 → 0.11.4

package/src/runtime/dispatch-batch.ts

@@ -13,12 +13,14 @@ import type { CrewReliabilityConfig } from "../config/config.ts";
 import { CrewError, ErrorCode } from "../errors.ts";
 import { appendHookEvent, executeHook } from "../hooks/registry.ts";
 import { childCorrelation, withCorrelation } from "../observability/correlation.ts";
+import { TEAM_TERMINAL_RUN_STATUSES } from "../state/contracts.ts";
 import { withRunLockSync } from "../state/coordination/locks.ts";
 import { appendEventAsync, appendEventBuffered } from "../state/event-log/event-log.ts";
 import { loadRunManifestById, saveRunManifest, saveRunTasks, saveRunTasksAsync, updateRunStatus } from "../state/stores/state-store.ts";
 import type { TaskAttemptState, TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
+import { isDelegateShadowTask } from "./broker/delegate/shadow-lifecycle.ts";
 import { readCrewAgents, recordFromTask, saveCrewAgents } from "./crew-agent-records.ts";
 import { appendDeadletter } from "./deadletter.ts";
 import { classifyHeartbeat, DEFAULT_GRADIENT_THRESHOLDS } from "./heartbeat/heartbeat-gradient.ts";
@@ -316,6 +318,26 @@ export function shouldUseRetry(reliability: CrewReliabilityConfig | undefined):
 	return reliability?.autoRetry !== false;
 }
 
+/**
+ * T9d cancel-race fix (2026-09-23, live battery finding 7): a retry attempt must
+ * re-queue ONLY the task's OWN terminal failure (status "failed") while the run is
+ * still active. Previously ANY non-queued/running status was re-queued — including
+ * "cancelled", so a cross-session cancel landing between attempt 1's hard-kill and
+ * attempt 2's start (measured live: cancel 16:46:22.987 → task.started 16:46:23.948,
+ * replacement worker then ran 47s post-cancel) silently resurrected the task.
+ * External terminal decisions (task cancelled/completed, or a terminal RUN manifest)
+ * are respected. Exported for unit testing.
+ */
+export function shouldRequeueForRetry(input: {
+	attempt: number;
+	taskStatus: TeamTaskState["status"];
+	manifestStatus: TeamRunManifest["status"];
+}): boolean {
+	if (input.attempt <= 1) return false;
+	if (TEAM_TERMINAL_RUN_STATUSES.has(input.manifestStatus)) return false;
+	return input.taskStatus === "failed";
+}
+
 function failedTaskFrom(result: { tasks: TeamTaskState[] }, taskId: string): TeamTaskState | undefined {
 	return result.tasks.find((item) => item.id === taskId && item.status === "failed");
 }
@@ -328,6 +350,13 @@ function failedTaskFrom(result: { tasks: TeamTaskState[] }, taskId: string): Tea
 function dagReadyTaskIds(tasks: TeamTaskState[], completedIds: Set<string>): string[] | null {
 	const hasExplicitDeps = tasks.some((t) => t.dependsOn.length > 0);
 	if (!hasExplicitDeps) return null;
+	// RR-012 (adjacent scheduler risk — proven reachable): exclude
+	// delegate-broker shadow records from the DAG. They are managed by the
+	// external grandchild spawner, not this scheduler: (1) as WAVE members a
+	// running shadow would gate dependent waves / trigger markBlocked although
+	// it is never in ctx.pendingUnits; (2) getDagReadyTasks below ignores both
+	// status AND graph, so a queued OR running shadow surfaces as ready.
+	const workflowTasks = tasks.filter((t) => !isDelegateShadowTask(t));
 	// FIX (goal-wrap runtime test): task.dependsOn stores STEP IDs (e.g. "execute"), not
 	// task IDs (e.g. "02_execute"). The DAG scheduler compares deps against completedIds
 	// (which are task IDs), so step-ID deps would never match → dependent tasks stuck blocked
@@ -335,10 +364,10 @@ function dagReadyTaskIds(tasks: TeamTaskState[], completedIds: Set<string>): str
 	// task-graph-scheduler.ts which handles this via stepToTaskId). buildDagExecutionPlan +
 	// getDagReadyTasks then work on consistent task IDs.
 	const stepToTaskId = new Map<string, string>();
-	for (const t of tasks) {
+	for (const t of workflowTasks) {
 		if (t.stepId) stepToTaskId.set(t.stepId, t.id);
 	}
-	const nodes: TaskNode[] = tasks.map((t) => ({
+	const nodes: TaskNode[] = workflowTasks.map((t) => ({
 		id: t.id,
 		dependsOn: t.dependsOn.map((dep) => stepToTaskId.get(dep) ?? dep),
 		phase: t.adaptive?.phase ?? t.stepId,
@@ -410,7 +439,15 @@ export async function selectDispatchBatch(ctx: SchedulerContext): Promise<Schedu
 	// existing task-graph-scheduler when no explicit deps exist (backward compat).
 	const completedIds = new Set(ctx.tasks.filter((t) => t.status === "completed" || t.status === "needs_attention").map((t) => t.id));
 	const dagReady = dagReadyTaskIds(ctx.tasks, completedIds);
-	const readyBeforeFilter = dagReady ?? snapshot.ready;
+	// RR-012 (adjacent scheduler risk — proven reachable): belt-and-braces
+	// selection guard. dagReadyTaskIds already excludes shadow records from the
+	// DAG; this filter also covers the snapshot fallback (a graphed queued
+	// shadow would resolve to queue "ready"). A shadow in a batch makes
+	// findStep() throw ResourceNotFound (task.stepId === undefined) — the run
+	// aborts (pre-warm site) or the record is force-failed by the synthesized
+	// unit error. Shadow records stay visible in snapshots / team status.
+	const shadowTaskIds = new Set(ctx.tasks.filter(isDelegateShadowTask).map((t) => t.id));
+	const readyBeforeFilter = (dagReady ?? snapshot.ready).filter((taskId) => !shadowTaskIds.has(taskId));
 
 	// Workflow phase precondition check (non-blocking: log warnings only).
 	if (ctx.wfMachine.currentPhaseIndex < ctx.wfMachine.phases.length) {
@@ -777,8 +814,25 @@ export async function dispatchBatch(ctx: SchedulerContext, decision: DispatchBat
 					// NOTE: no withRunLock — best-effort only; concurrent writes may cause inconsistency
 					const fresh = loadRunManifestById(ctx.manifest.cwd, ctx.manifest.runId);
 					const freshManifest = fresh?.manifest ?? ctx.manifest;
-					const freshTasks = fresh?.tasks ?? ctx.tasks;
-					const freshTask = freshTasks.find((item) => item.id === task.id) ?? task;
+					let freshTasks = fresh?.tasks ?? ctx.tasks;
+					let freshTask = freshTasks.find((item) => item.id === task.id) ?? task;
+					// US-003 (2026-09-22) — RETRY-NOOP BUG, found while wiring the dead-letter
+					// integration test: a retry (attempt > 1) only happens because OUR previous
+					// attempt THREW — i.e. we ourselves persisted the terminal failure (e.g.
+					// model-exhausted marks the task failed before the throw). The terminal-state
+					// early-return below then treated OUR OWN failure as "nothing to do" and
+					// returned it as SUCCESS: executeWithRetry never re-ran the task, never
+					// exhausted, and the onRetryGivenUp dead-letter never fired — autoRetry was
+					// silently a single attempt for every failure that persists task state.
+					// Fix: on a retry, re-queue OUR OWN terminal failure so the retry actually
+					// re-runs. Attempt 1 keeps the original guard (externally-terminal task =
+					// someone else's decision; external cancellation exits via the signal).
+					// 2026-09-23 (finding 7): re-queue ONLY own failures on an ACTIVE run —
+					// cancelled/completed tasks and terminal manifests must never resurrect.
+					if (shouldRequeueForRetry({ attempt, taskStatus: freshTask.status, manifestStatus: freshManifest.status })) {
+						freshTask = { ...freshTask, status: "queued", error: undefined, finishedAt: undefined };
+						freshTasks = freshTasks.map((item) => (item.id === task.id ? freshTask : item));
+					}
 					if (freshTask.status !== "queued" && freshTask.status !== "running")
 						return {
 							manifest: freshManifest,
@@ -855,6 +909,15 @@ export async function dispatchBatch(ctx: SchedulerContext, decision: DispatchBat
 					},
 					onRetryGivenUp: (attempts, error, info) => {
 						lastAttemptId = info.attemptId;
+						// US-003: aborts are NOT exhaustion — executeWithRetry also fires this
+						// hook on its cancelled exit, which previously deadlettered cancelled
+						// tasks as "max-retries" (false positive; keep the signal high).
+						if (runController.signal.aborted) return;
+						// US-003: richer entry (agent/role/modelAttempts/runStatus) so the
+						// project-level index is self-sufficient after the run dir is pruned.
+						// Prefer the FAILED attempt's final task state over the pre-run snapshot.
+						const failedTask = lastFailed?.tasks.find((item) => item.id === task.id);
+						const deadletterTask = failedTask ?? task;
 						appendDeadletter(ctx.manifest, {
 							runId: ctx.manifest.runId,
 							taskId: task.id,
@@ -863,6 +926,10 @@ export async function dispatchBatch(ctx: SchedulerContext, decision: DispatchBat
 							attemptId: info.attemptId,
 							lastError: error.message,
 							timestamp: new Date().toISOString(),
+							agent: deadletterTask.agent,
+							role: deadletterTask.role,
+							modelAttempts: deadletterTask.modelAttempts?.length,
+							runStatus: ctx.manifest.status,
 						});
 						input.metricRegistry
 							?.counter("crew.task.deadletter_total", "Deadletter triggers by reason")

package/src/runtime/goal-workflow/dynamic-workflow-context.ts

@@ -906,67 +906,87 @@ function describeSchemaShape(schema: unknown, depth: number): string {
  * reject is checked first because a review can mention both "correctly" (describing existing code)
  * AND "critical bug" (the verdict) — the verdict signal must win.
  */
+// Precompiled review-outcome signals (module scope — compiled once, not per call).
+// RR-021 WI-1.1: these were previously string literals like "\baccept\b" compiled
+// per call — and "\b" in a TS string literal is a BACKSPACE character (U+0008),
+// so those two signals never matched anything. Regex literals here give real word
+// boundaries. No /g flags → no shared lastIndex state across .test() calls.
+const REJECT_SIGNAL_REGEXES: readonly RegExp[] = [
+	/\breject\b/,
+	/fundamentally/,
+	/completely broken/,
+	/totally broken/,
+	/critical bug/,
+	/critical issue/,
+	/critical flaw/,
+	/security vulnerability/,
+	/does not work/,
+	/doesn't work/,
+	/will not work/,
+	/fails to/,
+	/unacceptable/,
+	/must not be merged/,
+	/do not merge/,
+	/wrong approach/,
+	/logically incorrect/,
+	/incorrectly implements/,
+	/returns the opposite/,
+	/subtraction instead of addition/,
+	/opposite of its intended/,
+];
+const ACCEPT_SIGNAL_REGEXES: readonly RegExp[] = [
+	/\baccept\b/,
+	/looks good/,
+	/well done/,
+	/no issues/,
+	/no real issues/,
+	/no problems/,
+	/no concerns/,
+	/nothing to change/,
+	/ready to merge/,
+	/lgtm/,
+	/ship it/,
+	/correctly implements/,
+	/correctly returns/,
+	/works as expected/,
+	/works correctly/,
+	/no bugs/,
+	/no defects/,
+	/meets all requirements/,
+	/all requirements met/,
+	/passes all/,
+	/is correct/,
+	/are correct/,
+	/no changes needed/,
+	/no changes required/,
+	/no further changes/,
+	/nothing more to/,
+	/complete and correct/,
+	/sound implementation/,
+];
+// RR-021 WI-1.1 negation guard: phrases that NEGATE the bare "accept" signal.
+// "I cannot accept this" is a complaint, not approval — the accept hit must be
+// discarded so the outcome falls through to changes_requested (or reject if a
+// reject signal is also present).
+const NEGATED_ACCEPT_REGEXES: readonly RegExp[] = [
+	/\bcannot\s+accept\b/,
+	/\bcan'?t\s+accept\b/,
+	/\bdon'?t\s+accept\b/,
+	/\bwon'?t\s+accept\b/,
+	/\bdo\s+not\s+accept\b/,
+	/\bwill\s+not\s+accept\b/,
+	/\bunable\s+to\s+accept\b/,
+	/\bnot\s+accept(?:ed|ing|able)?\b/,
+];
+
 export function classifyReviewOutcome(prose: string): "accept" | "reject" | "changes_requested" {
 	const text = prose.toLowerCase();
-	// Strong negative signals → reject. These indicate fundamental/critical problems.
-	const rejectSignals = [
-		"\breject\b",
-		"fundamentally",
-		"completely broken",
-		"totally broken",
-		"critical bug",
-		"critical issue",
-		"critical flaw",
-		"security vulnerability",
-		"does not work",
-		"doesn't work",
-		"will not work",
-		"fails to",
-		"unacceptable",
-		"must not be merged",
-		"do not merge",
-		"wrong approach",
-		"logically incorrect",
-		"incorrectly implements",
-		"returns the opposite",
-		"subtraction instead of addition",
-		"opposite of its intended",
-	];
-	// Acceptance signals → accept. These indicate explicit approval with no real issues.
-	const acceptSignals = [
-		"\baccept\b",
-		"looks good",
-		"well done",
-		"no issues",
-		"no real issues",
-		"no problems",
-		"no concerns",
-		"nothing to change",
-		"ready to merge",
-		"lgtm",
-		"ship it",
-		"correctly implements",
-		"correctly returns",
-		"works as expected",
-		"works correctly",
-		"no bugs",
-		"no defects",
-		"meets all requirements",
-		"all requirements met",
-		"passes all",
-		"is correct",
-		"are correct",
-		"no changes needed",
-		"no changes required",
-		"no further changes",
-		"nothing more to",
-		"complete and correct",
-		"sound implementation",
-	];
-	const hasReject = rejectSignals.some((sig) => new RegExp(sig).test(text));
-	const hasAccept = acceptSignals.some((sig) => new RegExp(sig).test(text));
+	// Reject-first precedence: a review can mention both "correctly" (describing
+	// existing code) AND "critical bug" (the verdict) — the verdict signal must win.
+	const hasReject = REJECT_SIGNAL_REGEXES.some((re) => re.test(text));
 	if (hasReject) return "reject";
-	if (hasAccept) return "accept";
+	const hasAccept = ACCEPT_SIGNAL_REGEXES.some((re) => re.test(text));
+	if (hasAccept && !NEGATED_ACCEPT_REGEXES.some((re) => re.test(text))) return "accept";
 	return "changes_requested";
 }
 

package/src/runtime/goal-workflow/dynamic-workflow-runner.ts

@@ -18,8 +18,8 @@
  */
 
 import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import { join } from "node:path";
-import { transformSync } from "esbuild";
 import { getCrewEnv } from "../../config/env-vars.ts";
 import { appendEvent } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
@@ -33,6 +33,18 @@ import { assertDeterministicScript, isDeterminismCheckEnabled } from "../determi
 import { DwfStore } from "../dwf-state-store.ts";
 import { getWorkflowFinalResult, getWorkflowPhaseState, makeWorkflowCtx } from "./dynamic-workflow-context.ts";
 
+// RR-021 WI-2.1: esbuild is a heavy native dep (~35ms+ cold load) but is only
+// needed when a .dwf.ts script actually executes. Lazy-load via a synchronous
+// createRequire shim on first use (model: ui/syntax-highlight.ts) — call sites
+// stay sync. esbuild remains external in the bundle and resolves through here.
+const nodeRequire = createRequire(import.meta.url);
+type EsbuildModule = typeof import("esbuild");
+let cachedEsbuild: EsbuildModule | undefined;
+function esbuild(): EsbuildModule {
+	if (!cachedEsbuild) cachedEsbuild = nodeRequire("esbuild") as EsbuildModule;
+	return cachedEsbuild;
+}
+
 export interface RunDynamicWorkflowInput {
 	manifest: TeamRunManifest;
 	workflow: DynamicWorkflowConfig;
@@ -119,7 +131,7 @@ async function loadWorkflowModule(scriptPath: string): Promise<DynamicWorkflowSc
 		// DISC-1: acorn can only parse JavaScript, not TypeScript. Real .dwf.ts files
 		// contain type annotations/imports that cause a silent parse error, so the
 		// determinism check never runs. Transpile to JS via esbuild first.
-		const js = transformSync(scriptSource, { loader: "ts", format: "esm" }).code;
+		const js = esbuild().transformSync(scriptSource, { loader: "ts", format: "esm" }).code;
 		assertDeterministicScript(js);
 	}
 	// jiti is the same loader async-runner.ts uses (resolveTypeScriptLoader). We require it

package/src/runtime/goal-workflow/goal-loop-runner.ts

@@ -23,12 +23,13 @@ import { effectiveRunConfig } from "../../extension/team-tool/config-patch.ts";
 import { appendEventBuffered } from "../../state/event-log/event-log.ts";
 import { registerActiveRun, unregisterActiveRun } from "../../state/stores/active-run-registry.ts";
 import { collectRunMetrics } from "../../state/stores/run-metrics.ts";
-import { createRunManifest, saveRunTasks } from "../../state/stores/state-store.ts";
+import { createRunManifest, loadRunManifestById, saveRunTasks, updateRunStatus } from "../../state/stores/state-store.ts";
 import type { GoalLoopState, GoalLoopStatus, GoalVerdict, TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import type { TeamConfig } from "../../teams/team-config.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import type { WorkflowConfig } from "../../workflows/workflow-config.ts";
 import { resolveCrewRuntime } from "../model/runtime-resolver.ts";
+import { registryFromModelContext } from "../model/session-model.ts";
 import { executeTeamRun } from "../team-runner.ts";
 import { compareSnapshot, snapshotManifests } from "../verification/verification-integrity.ts";
 import { acquireWorkspaceLock, type WorkspaceLockHandle } from "../workspace-lock.ts";
@@ -39,6 +40,17 @@ import { GoalStore } from "./goal-state-store.ts";
 export interface GoalLoopRuntimeDeps {
 	/** Resolve the agent configs reachable from cwd (used for executeTeamRun's agents arg). */
 	discoverAgents: (cwd: string) => AgentConfig[];
+	/**
+	 * SR-01 test seam: override the per-turn config/runtime resolution. When
+	 * provided, it replaces the loadConfig/effectiveRunConfig/resolveCrewRuntime
+	 * chain — a test can throw here to exercise the pre-executeTeamRun failure
+	 * path deterministically (the alternative, monkey-patching modules, is
+	 * flaky). Production never sets it.
+	 */
+	resolveTurnConfig?: (cwd: string) => {
+		executedConfig: ReturnType<typeof effectiveRunConfig>;
+		runtime: Awaited<ReturnType<typeof resolveCrewRuntime>>;
+	};
 }
 
 export interface RunGoalLoopInput {
@@ -54,6 +66,29 @@ export interface RunGoalLoopResult {
 	goalState: GoalLoopState;
 }
 
+/**
+ * Finding #1 (battery 2026-09-29): re-hydrate the model routing inputs the
+ * OUTER goal-loop manifest persisted at dispatch time (captureRunModelContext
+ * in goal.ts / goal-wrap.ts). The detached goal-loop runs in the background
+ * runner with no ExtensionContext — without this, every turn's executeTeamRun
+ * resolves the DEFAULT chain (live: minimax/MiniMax-M3 402 while the parent
+ * session ran zai/glm-5.3). Mirrors background-runner's restoredModelRouting().
+ */
+function restoredTurnModelRouting(manifest: TeamRunManifest): {
+	modelOverride?: string;
+	parentModel?: string;
+	modelRegistry?: { getAvailable: () => unknown[] };
+} {
+	const context = manifest.modelContext;
+	if (!context) return {};
+	const modelRegistry = registryFromModelContext(context);
+	return {
+		...(context.override ? { modelOverride: context.override } : {}),
+		...(context.parentModel ? { parentModel: context.parentModel } : {}),
+		...(modelRegistry ? { modelRegistry } : {}),
+	};
+}
+
 /**
  * The placeholder evaluator for P0: always returns {achieved:false}.
  * Kept for unit tests of the loop's max_turns exit path. The production loop
@@ -619,6 +654,10 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 				workspaceMode: "single",
 				ownerSessionId: goal.ownerSessionId,
 				runKind: "team-run", // §0a v2 note: turns are normal team-runs; the OUTER loop is goal-loop
+				// Finding #1: turns execute in the detached process — carry the outer
+				// manifest's model routing snapshot onto each turn manifest too, so
+				// status/resume paths see the same routing the turn was dispatched with.
+				...(manifest.modelContext ? { modelContext: manifest.modelContext } : {}),
 			});
 			goal =
 				store.patch(
@@ -657,9 +696,17 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 				// multi-step workflows (fast-fix, implementation) work correctly. Without these, the
 				// team-runner's DAG scheduler / runtime resolution can throw unhandled rejections on
 				// the second batch, which the background-runner's rejection guard catches → silent exit.
-				const turnConfig = loadConfig(goal.cwd);
-				const turnExecutedConfig = effectiveRunConfig(turnConfig.config, {});
-				const turnRuntime = await resolveCrewRuntime(turnExecutedConfig);
+				let turnExecutedConfig: ReturnType<typeof effectiveRunConfig>;
+				let turnRuntime: Awaited<ReturnType<typeof resolveCrewRuntime>>;
+				if (input.deps.resolveTurnConfig) {
+					const resolved = input.deps.resolveTurnConfig(goal.cwd);
+					turnExecutedConfig = resolved.executedConfig;
+					turnRuntime = resolved.runtime;
+				} else {
+					const turnConfig = loadConfig(goal.cwd);
+					turnExecutedConfig = effectiveRunConfig(turnConfig.config, {});
+					turnRuntime = await resolveCrewRuntime(turnExecutedConfig);
+				}
 				turnResult = await executeTeamRun({
 					manifest: created.manifest,
 					tasks: created.tasks,
@@ -670,10 +717,37 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 					limits: turnExecutedConfig.limits,
 					runtime: turnRuntime,
 					runtimeConfig: turnExecutedConfig.runtime,
+					// Finding #1: restore the dispatch-time model routing (see
+					// restoredTurnModelRouting) — executeTeamRun in THIS process has no
+					// ExtensionContext to inherit the session model from.
+					...restoredTurnModelRouting(manifest),
 					reliability: turnExecutedConfig.reliability,
 					workspaceId: goal.ownerSessionId ?? goal.cwd,
 					signal,
 				});
+			} catch (error) {
+				// SR-01 (GL-1b part C, 2026-09-22): a throw between turn creation and
+				// executeTeamRun's own try (config resolution, runtime resolution, or
+				// executeTeamRun's PRE-try section) escaped with the turn manifest stuck
+				// at "queued" — a turn that is long dead still reported as in-flight, so
+				// `team status <turnId>` lied and a resume could double-run it. Mark it
+				// failed before re-throwing; the outer catch (GL-1b part B) then persists
+				// lastTurnError at the goal level.
+				//
+				// Guarded on status === "queued" so we never overwrite a status the
+				// executor already set (executeTeamRunCore failures already write failed
+				// themselves — no double-write). Best-effort: a failure to persist must
+				// not mask the original error.
+				const message = error instanceof Error ? error.message : String(error);
+				try {
+					const loaded = loadRunManifestById(goal.cwd, created.manifest.runId);
+					if (loaded && loaded.manifest.status === "queued") {
+						updateRunStatus(loaded.manifest, "failed", `pre-execute failure: ${message}`);
+					}
+				} catch (persistError) {
+					logInternalError("goal-loop.markTurnFailed", persistError, `turnRunId=${created.manifest.runId}`);
+				}
+				throw error;
 			} finally {
 				unregisterActiveRun(created.manifest.runId);
 			}
@@ -689,6 +763,18 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 			// Previously the loop continued to evaluateGoal on blocked/failed turns, burning maxTurns.
 			const turnStatus = turnResult.manifest.status;
 			if (turnStatus === "blocked" || turnStatus === "failed") {
+				// GL-1b (2026-09-22 diagnosability): the failure reason previously lived
+				// ONLY inside the turn-run dir (manifest.summary + run.failed event) —
+				// auto-prune (keep=10, session start) deletes turn dirs, making blocked
+				// goals undiagnosable afterwards. Persist the reason into the goal state
+				// (never pruned), carry it on the terminal event, and clear the stale
+				// currentRunId — the turn is over.
+				const turnError = turnResult.manifest.summary ?? `turn ${turnIndex} ended ${turnStatus}`;
+				try {
+					goal = store.patch(goal.goalId, { lastTurnError: turnError, currentRunId: undefined }, eventsPath) ?? goal;
+				} catch (error) {
+					logInternalError("goal-loop.persistTurnError", error, `goalId=${goal.goalId}`);
+				}
 				goal = safeSetStatus(store, goal.goalId, "blocked", goal, eventsPath);
 				appendEventBuffered(eventsPath, {
 					type: "goal.turn_terminal_status",
@@ -698,6 +784,7 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 						turn: turnIndex,
 						turnRunId: created.manifest.runId,
 						turnStatus,
+						reason: turnError,
 					},
 				}).catch((e) => logInternalError("goal-loop.buffered", e, "type=goal.turn_terminal_status"));
 				break;
@@ -805,6 +892,20 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 		}
 	} catch (error) {
 		logInternalError("goal-loop.run", error, `goalId=${goal.goalId}`);
+		// GL-1b: this catch previously only console-errored (logInternalError) —
+		// loop-level failures left NO persisted trace. Mirror the turn-level fix:
+		// persist the message into the goal state + event log.
+		const loopError = error instanceof Error ? error.message : String(error);
+		try {
+			goal = store.patch(goal.goalId, { lastTurnError: loopError, currentRunId: undefined }, eventsPath) ?? goal;
+		} catch {
+			/* best-effort — status transition below still runs */
+		}
+		appendEventBuffered(eventsPath, {
+			type: "goal.loop_error",
+			runId: manifest.runId,
+			data: { goalId: goal.goalId, error: loopError },
+		}).catch((e) => logInternalError("goal-loop.buffered", e, "type=goal.loop_error"));
 		goal = safeSetStatus(store, goal.goalId, "blocked", goal, eventsPath);
 	} finally {
 		// P1g: release the workspace lock (held since loop start).

package/src/runtime/group-join.ts

@@ -59,9 +59,17 @@ export function deliverGroupJoin(input: {
 }): CrewGroupJoinDelivery | undefined {
 	if (!shouldGroupJoin(input.mode, input.batch)) return undefined;
 	const taskIds = input.batch.map((task) => task.id);
-	const latest = taskIds
-		.map((id) => input.allTasks.find((task) => task.id === id))
-		.filter((task): task is TeamTaskState => Boolean(task));
+	// RR-021 WI-4.3d: first-wins Map — the old taskIds.map(id => allTasks.find())
+	// was O(batch×allTasks). NOT a raw input.batch pass-through: callers may
+	// hold stale batch snapshots, and the only audited production caller
+	// (team-runner closeout) passes fresh references — but the Map keeps the
+	// exact `.find` first-match semantics for every caller (incl. tests) while
+	// staying O(n+m). Batch order is preserved (map follows taskIds).
+	const taskById = new Map<string, TeamTaskState>();
+	for (const task of input.allTasks) {
+		if (!taskById.has(task.id)) taskById.set(task.id, task);
+	}
+	const latest = taskIds.map((id) => taskById.get(id)).filter((task): task is TeamTaskState => Boolean(task));
 	const completed = statusList(latest, "completed");
 	const failed = statusList(latest, "failed");
 	const skipped = statusList(latest, "skipped");

package/src/runtime/heartbeat/heartbeat-watcher.ts

@@ -98,6 +98,13 @@ export class HeartbeatWatcher {
 			if (loaded.manifest.status !== "running") continue;
 			for (const task of loaded.tasks) {
 				if (task.status !== "running") continue;
+				// Guest-child tasks (delegate subagents, agent === "delegate") have NO
+				// heartbeat channel: they never write task.heartbeat/agentProgress —
+				// their lifecycle is tracked by delegate.requested/admitted/completed
+				// broker events. Watching them here classified every guest as "dead"
+				// within one poll (52ms after admit, run team_20260926033657_2b6c6d2610b26d9d,
+				// 2026-09-26 battery) and enqueued false "stuck worker" ambients.
+				if (task.agent === "delegate") continue;
 				const key = `${run.runId}:${task.id}`;
 				activeKeys.add(key);
 				this.lastSeen.set(key, now);

package/src/runtime/live-session/live-session-runtime.ts

@@ -96,7 +96,7 @@ let liveSessionModulePromise: Promise<LiveSessionModule> | undefined;
 let experimentalWarned = false;
 function loadLiveSessionModule(): Promise<LiveSessionModule> {
 	if (!liveSessionModulePromise) {
-		liveSessionModulePromise = import("@earendil-works/pi-coding-agent") as unknown as Promise<LiveSessionModule>;
+		liveSessionModulePromise = import("@earendil-works/pi-coding-agent") as unknown as Promise<LiveSessionModule>; // LAZY: defer pi-coding-agent live-session module until first use
 	}
 	return liveSessionModulePromise;
 }

package/src/runtime/model/model-fallback.ts

@@ -70,6 +70,20 @@ function modelInfoFromUnknown(value: unknown): AvailableModelInfo | undefined {
 	};
 }
 
+// US-012 (2026-09-22): cache the registry-derived model list. The registry is
+// config/env-derived and invariant per session, but `availableModelInfosFromRegistry`
+// is called on EVERY model resolution / worker spawn (a 4-worker team = 4
+// rebuilds). Keyed on the registry object identity (WeakMap) so a new registry
+// instance (config reload) gets a fresh entry automatically, and invalidated by
+// the getAvailable() array identity so a mutated-in-place list is not served
+// stale. WeakMap → no leak when a session's registry is dropped.
+const registryModelCache = new WeakMap<object, { raw: unknown[]; infos: AvailableModelInfo[] }>();
+
+/** @internal — test introspection. */
+export function __test__registryModelCacheHas(registry: object): boolean {
+	return registryModelCache.has(registry);
+}
+
 export function availableModelInfosFromRegistry(registry: unknown): AvailableModelInfo[] | undefined {
 	if (!registry || typeof registry !== "object" || Array.isArray(registry)) return undefined;
 	const candidate = registry as ModelRegistryLike;
@@ -80,7 +94,13 @@ export function availableModelInfosFromRegistry(registry: unknown): AvailableMod
 				? candidate.getAll()
 				: undefined;
 	if (!Array.isArray(raw)) return undefined;
-	return raw.map(modelInfoFromUnknown).filter((entry): entry is AvailableModelInfo => entry !== undefined);
+	// Serve from cache only when the SAME array instance is returned — a
+	// rebuilt/refreshed list (different identity) must be re-normalized.
+	const cached = registryModelCache.get(registry as object);
+	if (cached && cached.raw === raw) return cached.infos;
+	const infos = raw.map(modelInfoFromUnknown).filter((entry): entry is AvailableModelInfo => entry !== undefined);
+	registryModelCache.set(registry as object, { raw, infos });
+	return infos;
 }
 
 export function modelStringFromUnknown(model: unknown): string | undefined {

package/src/runtime/model/pi-args.ts

@@ -3,7 +3,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentConfig } from "../../agents/agent-config.ts";
 import { atomicWriteFile } from "../../state/atomic-write.ts";
-import { packageRoot, userPiRoot } from "../../utils/paths.ts";
+import { hasRunStateLayout, packageRoot, userPiRoot } from "../../utils/paths.ts";
 
 const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
 // FIX (2026-07-02): use packageRoot() instead of import.meta.url-relative path.
@@ -629,16 +629,14 @@ export function cleanupLegacyOrphanTempDirs(
 				continue;
 			}
 			if (lstat.isSymbolicLink()) continue;
-			// Skip dirs containing active run state — those are handled by
+			// Skip dirs containing pi-crew run state — those are handled by
 			// reconcileOrphanedTempWorkspaces which has run-state semantics.
-			const crewDir = path.join(dir, ".crew");
-			let crewDirLstat: fs.Stats | undefined;
-			try {
-				crewDirLstat = fs.lstatSync(crewDir);
-			} catch {
-				// doesn't exist
-			}
-			if (crewDirLstat && !crewDirLstat.isSymbolicLink()) continue;
+			// RR-020 Fix 3: recognise BOTH supported layouts — `<dir>/.crew/` and
+			// the `.pi`-based `<dir>/.pi/teams/`. Only `.crew` used to be checked,
+			// so a temp workspace with live `.pi/teams` run state was deleted as
+			// debris. Symlinked layout dirs still do NOT protect the dir (the
+			// scanner keeps rejecting symlinks instead of trusting them).
+			if (hasRunStateLayout(dir)) continue;
 			// Skip dirs currently tracked by this process (defense in depth:
 			// with 8ba270d the Set should never contain /tmp/ paths, but
 			// future code or external callers might).

package/src/runtime/model/runtime-warmup.ts

@@ -124,6 +124,7 @@ export function startRuntimeWarmup(): void {
 		for (const spec of HOT_MODULE_SPECIFIERS) {
 			imports.push(
 				import(new URL(spec, import.meta.url).href).catch(() => {
+					// LAZY: best-effort warmup import, failures tolerated
 					// swallow — never block registration on a warmup failure
 				}),
 			);
@@ -131,6 +132,7 @@ export function startRuntimeWarmup(): void {
 		for (const dep of HOT_PEER_DEPS) {
 			imports.push(
 				import(dep).catch(() => {
+					// LAZY: best-effort warmup import, failures tolerated
 					// peer dep may be absent (optional dep) — swallow
 				}),
 			);