pi-crew 0.11.2 → 0.11.5

package/src/extension/registration/observability.ts

@@ -71,7 +71,11 @@ export interface ObservabilityDeps {
 	 * newer session. Reuse this counter — do not invent a parallel one.
 	 */
 	getSessionGeneration: () => number;
-	reconcileStaleRuns: (cwd: string, cache: ReturnType<ObservabilityDeps["getManifestCache"]>, currentSessionId?: string) => unknown[];
+	reconcileStaleRuns: (
+		cwd: string,
+		cache: ReturnType<ObservabilityDeps["getManifestCache"]>,
+		currentSessionId?: string,
+	) => unknown[] | Promise<unknown[] | undefined>;
 	reconcileOrphanedTempWorkspaces: (now: number, opts: { cleanupOrphanedTempDirs?: boolean }) => unknown;
 	cleanupOrphanTempDirs: () => { cleaned: number; scanned: number; failed: number };
 	cleanupLegacyOrphanTempDirs: () => { cleaned: number; scanned: number; failed: number };
@@ -253,26 +257,31 @@ async function configureObservabilityInternal(ctx: ExtensionContext, state: Obse
 	if (autoRepairIntervalMs > 0) {
 		state.autoRepairTimer = setInterval(() => {
 			if (deps.isCleanedUp()) return;
-			try {
-				const staleResults = deps.reconcileStaleRuns(ctx.cwd, deps.getManifestCache(ctx.cwd), extractSessionId(ctx));
-				if (Array.isArray(staleResults) && staleResults.length > 0) {
-					for (const result of staleResults) {
-						const repaired = (result as { repaired?: boolean }).repaired;
-						if (repaired) {
-							deps.notifyOperator({
-								id: `auto_repair_${(result as { runId: string }).runId}`,
-								severity: "info",
-								source: "auto-repair",
-								runId: (result as { runId: string }).runId,
-								title: `Auto-repaired stale run`,
-								body: (result as { detail?: string }).detail ?? "",
-							});
+			// RR-021 WI-1.5: reconcileStaleRuns may be async (mapConcurrent) —
+			// settle the result before inspecting, keep errors inside the log.
+			void (async () => {
+				try {
+					const settled = await deps.reconcileStaleRuns(ctx.cwd, deps.getManifestCache(ctx.cwd), extractSessionId(ctx));
+					const staleResults = Array.isArray(settled) ? settled : [];
+					if (staleResults.length > 0) {
+						for (const result of staleResults) {
+							const repaired = (result as { repaired?: boolean }).repaired;
+							if (repaired) {
+								deps.notifyOperator({
+									id: `auto_repair_${(result as { runId: string }).runId}`,
+									severity: "info",
+									source: "auto-repair",
+									runId: (result as { runId: string }).runId,
+									title: `Auto-repaired stale run`,
+									body: (result as { detail?: string }).detail ?? "",
+								});
+							}
 						}
 					}
+				} catch (error) {
+					logInternalError("register.autoRepair", error);
 				}
-			} catch (error) {
-				logInternalError("register.autoRepair", error);
-			}
+			})();
 		}, autoRepairIntervalMs);
 		state.autoRepairTimer.unref();
 

package/src/extension/registration/team-tool.ts

@@ -2,7 +2,7 @@ import { statSync } from "node:fs";
 import type { ExtensionAPI, ExtensionContext, ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import type { TObject } from "@sinclair/typebox";
-import { Value } from "@sinclair/typebox/value";
+import { TypeCompiler } from "@sinclair/typebox/compiler";
 import { loadConfig } from "../../config/config.ts";
 import { findClosestKey } from "../../config/suggestions.ts";
 import type { MetricRegistry } from "../../observability/metric-registry.ts";
@@ -36,6 +36,12 @@ import { withSessionId } from "../team-tool/context.ts";
 import { formatTeamToolParamError } from "../team-tool/param-error.ts";
 import { toolResult } from "../tool-result.ts";
 
+// RR-021 WI-4.3g: compile the team-tool schema ONCE. Value.Check re-walks the
+// whole (large) schema object on every tool call; TypeCompiler.Compile (STATIC
+// method on @sinclair/typebox/compiler) builds a specialized checker at module
+// load. The error formatter keeps using the schema + Value.Errors (cold path).
+const compiledTeamToolParams = TypeCompiler.Compile(TeamToolParams);
+
 /**
  * Normalize model-generated tool params before schema validation.
  *
@@ -228,7 +234,8 @@ export function registerTeamTool(pi: ExtensionAPI, deps: RegisterTeamToolDeps):
 				// validation so strict unions/patterns accept "unset" as omitted.
 				const normalized = normalizeTeamParams(params);
 				// Defense-in-depth: validate params at runtime even though Pi framework already does
-				if (!Value.Check(TeamToolParams, normalized)) {
+				// (RR-021 WI-4.3g: precompiled checker — same semantics as Value.Check.)
+				if (!compiledTeamToolParams.Check(normalized)) {
 					return toolResult(formatTeamToolParamError(TeamToolParams, normalized), { action: "list", status: "error" }, true);
 				}
 				// EXT-1: additionalProperties:true lets unknown (typo'd) keys slip past

package/src/extension/registration/wire-cross-extension.ts

@@ -28,6 +28,7 @@ export function installCrossExtensionWiring(pi: ExtensionAPI, ctx: RegistrationC
 	// in the entire runtime chain) out of the cold-start module graph. EXT-9:
 	// the registry now lives in module-scoped state, not globalThis.
 	void import("../team-tool.ts").then(({ installCrewGlobalRegistry }) => {
+		// LAZY: defer team-tool until cross-extension wiring fires
 		const manifestCacheForRegistry = ctx.getManifestCache(ctx.currentCtx?.cwd ?? process.cwd());
 		installCrewGlobalRegistry({
 			manifestCache: manifestCacheForRegistry,
@@ -57,6 +58,7 @@ export function refreshCrossExtensionWiringForSession(pi: ExtensionAPI, ctx: Reg
 		return;
 	}
 	void import("../team-tool.ts").then(({ installCrewGlobalRegistry }) => {
+		// LAZY: defer team-tool until cross-extension wiring fires
 		installCrewGlobalRegistry({
 			manifestCache: ctx.getManifestCache(ctx.currentCtx?.cwd ?? process.cwd()),
 			cwdProvider: () => ctx.currentCtx?.cwd ?? process.cwd(),

package/src/extension/team-manager-command.ts

@@ -1,5 +1,5 @@
 import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
-import { listRuns } from "./run-index.ts";
+import { listRecentRuns } from "./run-index.ts";
 // Lazy-loaded: team-tool.ts pulls in entire runtime chain.
 import type { handleTeamTool as HandleTeamToolFn } from "./team-tool.ts";
 
@@ -122,7 +122,8 @@ export async function handleTeamManagerCommand(_args: string, ctx: ExtensionComm
 		return;
 	}
 
-	const runs = listRuns(ctx.cwd).slice(0, 20);
+	// RR-021 WI-4.1: bounded recent-runs read instead of a full index scan.
+	const runs = listRecentRuns(ctx.cwd, 20);
 	if (runs.length === 0) {
 		ctx.ui.notify("No pi-crew runs found.", "info");
 		return;

package/src/extension/team-tool/dispatch/index.ts

@@ -7,8 +7,8 @@
  *
  * 54→5 mapping:
  *   run     (9):  run, parallel, plan, orchestrate, resume, retry, wait, steer, goal
- *   status  (16): status, list, get, events, artifacts, summary, graph, search,
- *                 health, worktrees, checkpoint, cache, explain, onboard, recommend, help
+ *   status  (17): status, list, get, events, artifacts, breakdown, summary, graph,
+ *                 search, health, worktrees, checkpoint, cache, explain, onboard, recommend, help
  *   control (7):  cancel, invalidate, respond, cleanup, prune, forget, doctor
  *   manage  (17): create, update, delete, init, config, validate, autonomy, settings,
  *                 workflow-create/get/list/save/delete, import, imports, export, compare
@@ -36,12 +36,13 @@ const ACTION_TO_DOMAIN: Record<string, TeamDomain> = {
 	steer: "run",
 	goal: "run",
 
-	// status domain (16)
+	// status domain (17)
 	status: "status",
 	list: "status",
 	get: "status",
 	events: "status",
 	artifacts: "status",
+	breakdown: "status",
 	summary: "status",
 	graph: "status",
 	search: "status",

package/src/extension/team-tool/dispatch/status.ts

@@ -1,8 +1,9 @@
 /**
  * API-5 facade dispatch — Status domain router.
  *
- * Actions: status, list, get, events, artifacts, summary, graph, search,
- * health, worktrees, checkpoint, cache, explain, onboard, recommend, help.
+ * Actions: status, list, get, events, artifacts, breakdown, summary, graph,
+ * search, health, worktrees, checkpoint, cache, explain, onboard, recommend,
+ * help.
  *
  * Inline cases (graph, search, onboard, explain, cache, checkpoint, recommend,
  * help) are moved verbatim from the former handleTeamTool switch.
@@ -28,7 +29,7 @@ import type { PiTeamsToolResult } from "../../tool-result.ts";
 import { result, type TeamContext } from "../context.ts";
 import { handleExplain } from "../explain.ts";
 import { handleHealthMonitor } from "../health-monitor.ts";
-import { handleArtifacts, handleEvents, handleSummary } from "../inspect.ts";
+import { handleArtifacts, handleBreakdown, handleEvents, handleSummary } from "../inspect.ts";
 import { handleWorktrees } from "../lifecycle-actions.ts";
 import { handleStatus } from "../status.ts";
 
@@ -45,6 +46,7 @@ export const STATUS_DOMAIN_ACTIONS = [
 	"get",
 	"events",
 	"artifacts",
+	"breakdown",
 	"summary",
 	"graph",
 	"search",
@@ -73,6 +75,8 @@ export async function handleStatusDomain(params: TeamToolParamsValue, ctx: TeamC
 			return handleEvents(params, ctx);
 		case "artifacts":
 			return handleArtifacts(params, ctx);
+		case "breakdown":
+			return handleBreakdown(params, ctx);
 		case "worktrees":
 			return handleWorktrees(params, ctx);
 		case "summary":

package/src/extension/team-tool/goal-wrap.ts

@@ -21,6 +21,7 @@ import { loadConfig } from "../../config/config.ts";
 import type { GoalWrapWorkflowConfig } from "../../config/types.ts";
 import { spawnBackgroundTeamRun } from "../../runtime/async-runner.ts";
 import { GoalStore } from "../../runtime/goal-workflow/goal-state-store.ts";
+import { captureRunModelContext } from "../../runtime/model/session-model.ts";
 import { snapshotManifests } from "../../runtime/verification/verification-integrity.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { atomicWriteJson } from "../../state/atomic-write.ts";
@@ -248,6 +249,11 @@ export async function startGoalWrappedRun(
 		store.save(goalState);
 
 		const paths = createRunPaths(cwd, goalId);
+		// Finding #1 (battery 2026-09-29): persist the parent session's model
+		// routing on the goal-loop manifest — the DETACHED runner re-loads this
+		// manifest and has no ExtensionContext to re-resolve it. Without it,
+		// goal-wrap turns silently default-chain (minimax 402 family).
+		const modelContext = captureRunModelContext(ctx, typeof params.model === "string" ? params.model : undefined);
 		const goalLoopManifest: TeamRunManifest = {
 			schemaVersion: 1,
 			runId: goalId,
@@ -267,6 +273,7 @@ export async function startGoalWrappedRun(
 			artifacts: [],
 			ownerSessionId,
 			runKind: "goal-loop",
+			...(modelContext ? { modelContext } : {}),
 		};
 		await saveRunManifestAsync(goalLoopManifest);
 		await appendEventAsync(paths.eventsPath, {

package/src/extension/team-tool/goal.ts

@@ -16,6 +16,7 @@
 
 import { spawnBackgroundTeamRun } from "../../runtime/async-runner.ts";
 import { GoalStore } from "../../runtime/goal-workflow/goal-state-store.ts";
+import { captureRunModelContext } from "../../runtime/model/session-model.ts";
 import { snapshotManifests } from "../../runtime/verification/verification-integrity.ts";
 import { isWorkspaceBusy } from "../../runtime/workspace-lock.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
@@ -173,6 +174,12 @@ async function handleStart(input: GoalSubActionInput): Promise<ReturnType<typeof
 		// runs/<goalId>/ → "Run not found" → silent death. (Review #2 F1.)
 		const paths = createRunPaths(cwd, goalId);
 		const now2 = new Date().toISOString();
+		// Finding #1 (battery 2026-09-29): the goal-loop manifest is loaded by the
+		// DETACHED background-runner (no ExtensionContext). Persist the parent
+		// session's model routing so goal-loop turns restore it instead of falling
+		// back to the default chain (minimax 402 incident family). goalState keeps
+		// workerModel/evaluatorModel as the explicit per-role picks.
+		const modelContext = captureRunModelContext(ctx, typeof params.model === "string" ? params.model : undefined);
 		const goalLoopManifest: TeamRunManifest = {
 			schemaVersion: 1,
 			runId: goalId, // paths.runId === goalId by construction
@@ -192,6 +199,7 @@ async function handleStart(input: GoalSubActionInput): Promise<ReturnType<typeof
 			artifacts: [],
 			ownerSessionId,
 			runKind: "goal-loop",
+			...(modelContext ? { modelContext } : {}),
 		};
 		await saveRunManifestAsync(goalLoopManifest);
 		await appendEventAsync(paths.eventsPath, {
@@ -449,6 +457,9 @@ async function handleResume(input: GoalSubActionInput): Promise<ReturnType<typeo
 	// Re-spawn the background loop. The loop checks goal.state === "running" before each
 	// turn; since we just set it to running, it proceeds.
 	try {
+		// Finding #1: re-capture at resume time (same battery) — the resuming
+		// session's live model is authoritative for subsequent turns.
+		const modelContext = captureRunModelContext(ctx, typeof params.model === "string" ? params.model : undefined);
 		const manifest: TeamRunManifest = {
 			schemaVersion: 1,
 			runId: goalId,
@@ -468,6 +479,7 @@ async function handleResume(input: GoalSubActionInput): Promise<ReturnType<typeo
 			artifacts: [],
 			ownerSessionId: existing.ownerSessionId,
 			runKind: "goal-loop",
+			...(modelContext ? { modelContext } : {}),
 		};
 		const spawned = await spawnBackgroundTeamRun(manifest);
 		return result(

package/src/extension/team-tool/inspect.ts

@@ -1,3 +1,5 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { readEventsCursor } from "../../state/event-log/event-log.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
@@ -110,3 +112,91 @@ export function handleSummary(params: TeamToolParamsValue, ctx: TeamContext): Pi
 		artifactsRoot: loaded.manifest.artifactsRoot,
 	});
 }
+
+// ─── G18 (SDD 2026-09-30 WI-3): prompt-token breakdown surface ──────────────
+
+/** File suffix of the per-task breakdown artifact written by pre-execution
+ *  (`metadata/<taskId>.prompt-breakdown.json`) when PI_CREW_PROMPT_BREAKDOWN=1. */
+const BREAKDOWN_FILE_SUFFIX = ".prompt-breakdown.json";
+
+/** Shape of one section entry in a prompt-breakdown JSON artifact
+ *  (see writeArtifact call in src/runtime/task-runner/pre-execution.ts). */
+interface PromptBreakdownSection {
+	chars: number;
+	estTokens: number;
+}
+
+/**
+ * G18: read the opt-in per-task prompt-token breakdown artifacts of a run and
+ * surface per-task totals + the top-5 largest sections. Consumers: the leader
+ * prompt (future W-F token decisions, G15/G17) and humans debugging prompt
+ * bloat. The artifacts exist only when the host session was started with
+ * PI_CREW_PROMPT_BREAKDOWN=1 (default off — zero cost when off, SR-02).
+ * Mirrors the handleArtifacts pattern: resolve run → read the manifest
+ * artifacts index → filter kind=metadata breakdown entries → read files.
+ */
+export function handleBreakdown(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+	if (!params.runId)
+		return result(
+			paramRequired("breakdown", "runId", "{ action: 'breakdown', runId: 'team_...' }"),
+			{ action: "breakdown", status: "error" },
+			true,
+		);
+	const runCwd = locateRunCwd(params.runId, ctx.cwd);
+	if (!runCwd) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "breakdown", status: "error" }, true);
+	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
+	if (!loaded) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "breakdown", status: "error" }, true);
+	// Index-driven lookup (no disk scan): the manifest artifacts index carries
+	// one metadata entry per task with a prompt breakdown.
+	const breakdownArtifacts = loaded.manifest.artifacts.filter(
+		(artifact) => artifact.kind === "metadata" && path.basename(artifact.path).endsWith(BREAKDOWN_FILE_SUFFIX),
+	);
+	const perTask: Array<{
+		taskId: string;
+		totalEstTokens: number;
+		topSections: Array<{ section: string; estTokens: number; chars: number }>;
+	}> = [];
+	for (const artifact of breakdownArtifacts) {
+		const taskId = path.basename(artifact.path).slice(0, -BREAKDOWN_FILE_SUFFIX.length);
+		if (params.taskId && taskId !== params.taskId) continue;
+		let sections: Record<string, PromptBreakdownSection>;
+		try {
+			sections = JSON.parse(fs.readFileSync(artifact.path, "utf-8")) as Record<string, PromptBreakdownSection>;
+		} catch {
+			continue; // unreadable/corrupt breakdown JSON — skip rather than fail the whole action
+		}
+		const entries = Object.entries(sections).filter((entry): entry is [string, PromptBreakdownSection] => {
+			const value = entry[1];
+			return value !== null && typeof value === "object" && typeof value.estTokens === "number";
+		});
+		const totalEstTokens = entries.reduce((sum, [, value]) => sum + value.estTokens, 0);
+		const topSections = [...entries]
+			.sort((a, b) => b[1].estTokens - a[1].estTokens)
+			.slice(0, 5)
+			.map(([section, value]) => ({ section, estTokens: value.estTokens, chars: value.chars ?? 0 }));
+		perTask.push({ taskId, totalEstTokens, topSections });
+	}
+	if (perTask.length === 0) {
+		const scope = params.taskId ? ` for task '${params.taskId}'` : "";
+		return result(
+			`No prompt-breakdown artifacts${scope} for ${loaded.manifest.runId}. Breakdown capture is opt-in: start the host Pi session with PI_CREW_PROMPT_BREAKDOWN=1 and re-run to record per-section token estimates.`,
+			{ action: "breakdown", status: "ok", runId: loaded.manifest.runId, data: { runTotal: 0, perTask: [] } },
+		);
+	}
+	const runTotal = perTask.reduce((sum, task) => sum + task.totalEstTokens, 0);
+	const lines = [
+		`Prompt-token breakdown for ${loaded.manifest.runId}:`,
+		...perTask.flatMap((task) => [
+			`- ${task.taskId}: ~${task.totalEstTokens} tokens`,
+			...task.topSections.map((section) => `    - ${section.section}: ~${section.estTokens} tokens (${section.chars} chars)`),
+		]),
+		`Run total: ~${runTotal} tokens`,
+	];
+	return result(lines.join("\n"), {
+		action: "breakdown",
+		status: "ok",
+		runId: loaded.manifest.runId,
+		artifactsRoot: loaded.manifest.artifactsRoot,
+		data: { runTotal, perTask },
+	});
+}

package/src/extension/team-tool/parallel-dispatch.ts

@@ -10,6 +10,7 @@ import { discoverAgents } from "../../agents/discover-agents.ts";
 import { loadConfig } from "../../config/config.ts";
 import { spawnBackgroundTeamRun } from "../../runtime/async-runner.ts";
 import { resolveCrewRuntime } from "../../runtime/model/runtime-resolver.ts";
+import { captureRunModelContext } from "../../runtime/model/session-model.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { createRunManifest } from "../../state/stores/state-store.ts";
@@ -66,13 +67,23 @@ export async function handleParallel(params: TeamToolParamsValue, ctx: TeamConte
 
 	const runtime = await resolveCrewRuntime(config.config);
 
+	// Finding #1 (full battery 2026-09-29): parallel-dispatched runs re-enter
+	// through the detached background-runner, which has no ExtensionContext.
+	// Without a persisted modelContext, restoredModelRouting() returns {} and
+	// every worker silently falls back to the DEFAULT chain (live: 3 runs died
+	// on minimax/MiniMax-M3 402 while the parent session ran zai/glm-5.3).
+	// Captured ONCE here (in the parent session's process) so resolveParentModel()
+	// sees the live session model; undefined when nothing is worth persisting
+	// (older manifests stay byte-identical).
+	const modelContext = captureRunModelContext(ctx, typeof params.model === "string" ? params.model : undefined);
+
 	const launched: Array<{ runId: string; goal: string; agent: string }> = [];
 	const errors: Array<{ goal: string; error: string }> = [];
 
 	// C1: Enforce concurrency limit with batched spawning
 	for (let batchStart = 0; batchStart < tasksParam.length; batchStart += concurrency) {
 		const batch = tasksParam.slice(batchStart, batchStart + concurrency);
-		const batchPromises = batch.map((task) => spawnSingleTask(task, ctx, allAgentsList, team, workflow, runtime));
+		const batchPromises = batch.map((task) => spawnSingleTask(task, ctx, allAgentsList, team, workflow, runtime, modelContext));
 		const batchResults = await Promise.allSettled(batchPromises);
 		for (const res of batchResults) {
 			if (res.status === "fulfilled" && res.value.ok) {
@@ -121,6 +132,7 @@ async function spawnSingleTask(
 	team: TeamConfig,
 	workflow: WorkflowConfig,
 	runtime: { available: boolean; kind: string },
+	modelContext: ReturnType<typeof captureRunModelContext>,
 ): Promise<SpawnResult> {
 	try {
 		const taskRec = task as Record<string, unknown>;
@@ -163,6 +175,9 @@ async function spawnSingleTask(
 			// skipped and any session can cancel/retry parallel-dispatched runs.
 			ownerSessionId: ctx.sessionId,
 			runKind: "team-run",
+			// Finding #1: persist the parent session's model routing so the detached
+			// runner restores it instead of default-chaining (see handleParallel).
+			modelContext,
 		});
 
 		await appendEventAsync(created.manifest.eventsPath, {

package/src/extension/team-tool/run-intent.ts

@@ -73,7 +73,7 @@ const MAX_ANALYSIS_BYTES = 100_000;
 var crewInitPromise: Promise<typeof import("../../state/crew-init.ts")> | undefined;
 function loadCrewInit(): Promise<typeof import("../../state/crew-init.ts")> {
 	if (!crewInitPromise) {
-		crewInitPromise = import("../../state/crew-init.ts");
+		crewInitPromise = import("../../state/crew-init.ts"); // LAZY: defer crew-init until first run intent
 	}
 	return crewInitPromise;
 }

package/src/extension/team-tool/run.ts

@@ -61,7 +61,7 @@ import type { RuntimeResolutionState, TeamRunManifest, TeamTaskState } from "../
 var crewInitPromise: Promise<typeof import("../../state/crew-init.ts")> | undefined;
 function loadCrewInit(): Promise<typeof import("../../state/crew-init.ts")> {
 	if (!crewInitPromise) {
-		crewInitPromise = import("../../state/crew-init.ts");
+		crewInitPromise = import("../../state/crew-init.ts"); // LAZY: defer crew-init until first run intent
 	}
 	return crewInitPromise;
 }

package/src/runtime/async-runner.ts

@@ -240,6 +240,16 @@ export const BACKGROUND_RUNNER_ENV_ALLOWLIST: string[] = [
 	"HERDR_SOCKET_PATH",
 	"HERDR_WORKSPACE_ID",
 	"HERDR_PING_TIMEOUT_MS",
+	// Model-selection control vars (Finding #1, full battery 2026-09-29): the
+	// detached runner resolves subagent model routing from env (PI_CREW_MODEL →
+	// resolveDefaultSubagentModel; PI_CREW_MODEL_FALLBACK_ORDER →
+	// resolveModelFallbackPolicy) for manifests without a persisted modelContext
+	// (older manifests) and as a user override channel. Stripping them made
+	// every async run silently fall back to the DEFAULT chain (live: 3 parallel
+	// runs died on minimax/MiniMax-M3 402 while the parent ran zai/glm-5.3).
+	// PI_CREW_MODEL_REQUIRE_CREDENTIALS is NOT here — see forwardModelControlEnv.
+	"PI_CREW_MODEL",
+	"PI_CREW_MODEL_FALLBACK_ORDER",
 ];
 
 /**
@@ -256,6 +266,29 @@ export function buildBackgroundRunnerEnv(env: NodeJS.ProcessEnv): NodeJS.Process
 	return { ...env, PI_CREW_ASYNC_RUN: "1" };
 }
 
+/**
+ * Model-selection control vars that CANNOT live on
+ * {@link BACKGROUND_RUNNER_ENV_ALLOWLIST}: isSecretKey() matches the
+ * "_CREDENTIALS" suffix of PI_CREW_MODEL_REQUIRE_CREDENTIALS (keyword
+ * "credential"), and sanitizeEnvSecrets THROWS on secret-looking allowlist
+ * entries that are absent from the spawning env — so allowlisting it would
+ * break EVERY async spawn whenever the flag is unset. It is a declared
+ * control flag (config/env-vars.ts, read by resolveModelFallbackPolicy),
+ * never a secret, so we forward it explicitly when set instead.
+ * Exported pure so tests pin the contract (async-runner.test.ts).
+ */
+export const MODEL_CONTROL_ENV_EXPLICIT: readonly string[] = ["PI_CREW_MODEL_REQUIRE_CREDENTIALS"];
+
+/** Copy the explicitly-forwarded model control vars (set ones only). */
+export function forwardModelControlEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+	const forwarded: NodeJS.ProcessEnv = {};
+	for (const key of MODEL_CONTROL_ENV_EXPLICIT) {
+		const value = env[key];
+		if (value !== undefined) forwarded[key] = value;
+	}
+	return forwarded;
+}
+
 /** F4 v2: the ONE line written to the background-runner's stdin carrying
  * PER-TASK compound broker tokens (see stdin-handshake.ts for why compound —
  * ADR-0 item 6 rejects bare-runId tokens for wait.*). Kept pure + exported so
@@ -377,6 +410,9 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 	const childEnv = buildBackgroundRunnerEnv({
 		...(peerDepDir ? { ...filteredEnv, [PEER_DEP_DIR_ENV]: peerDepDir } : filteredEnv),
 		PI_CREW_BACKGROUND_RUNNER_ENTRY: "1",
+		// Finding #1: model control vars that cannot ride the allowlist (see
+		// forwardModelControlEnv). Copied from the ORIGINAL env, post-sanitize.
+		...forwardModelControlEnv(process.env),
 	});
 
 	const loader = resolveTypeScriptLoader();