pi-crew 0.11.20 → 0.11.22

package/src/runtime/goal-workflow/dynamic-workflow-context.ts

@@ -33,15 +33,16 @@ import type { TeamRunManifest } from "../../state/types.ts";
 import type { TeamConfig } from "../../teams/team-config.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { safeAbort } from "../../utils/safe-abort.ts";
+import { countTokens } from "../../utils/token-counter.ts";
 import { cleanupAgentWorktreeAsync, prepareAgentWorktreeAsync } from "../../worktree/worktree-manager.ts";
-import type { DwfCheckpointState } from "../dwf-state-store.ts";
-import { parsePiJsonOutput } from "../output/pi-json-output.ts";
+import type { ChildPiRunResult } from "../child-pi/child-pi.ts";
+import { DWF_CHECKPOINT_VERSION, type DwfCheckpointState } from "../dwf-state-store.ts";
+import { type ParsedPiJsonOutput, parsePiJsonOutput } from "../output/pi-json-output.ts";
 import { extractStructuredResult } from "../output/result-extractor.ts";
 import { executeWithRetry } from "../recovery/retry-executor.ts";
 import { runWorker } from "../run-worker.ts";
 import { mapConcurrent } from "../scheduling/parallel-utils.ts";
 import { Semaphore } from "../scheduling/semaphore.ts";
-import { estimateTokens } from "../task-runner/prompt-builder.ts";
 import { renderPlanTemplate } from "./plan-templates.ts";
 
 export interface AgentCallOpts {
@@ -132,6 +133,45 @@ export class DwfAgentCallCapError extends Error {
 	}
 }
 
+/** R6-10 (DR-03 round-6, 2026-10-16): typed bridge error thrown INSIDE ctx.retry()
+ *  when ctx.agent() resolves ok:false. executeWithRetry retries THROWN errors
+ *  only, so an ok:false result previously flowed straight out of ctx.retry —
+ *  a 1-attempt "retry" for every failure class except DwfAgentCallCapError.
+ *  Throwing this wrapper makes the failure retryable; ctx.retry catches it after
+ *  exhaustion and returns the CARRIED AgentResult, so ctx.retry's public return
+ *  type/shape is unchanged. DwfAgentCallCapError keeps its passthrough semantics
+ *  (the cap must terminate the workflow, never be retried into silence). */
+export class DwfRetryFailure extends Error {
+	/** The ok:false AgentResult the failed attempt produced. */
+	readonly result: AgentResult;
+	constructor(result: AgentResult) {
+		super(result.error ?? "dynamic workflow retry: agent call returned ok:false");
+		this.name = "DwfRetryFailure";
+		this.result = result;
+	}
+}
+
+/** R6-7 (DR-03 round-6, 2026-10-16): DWF empty-settle gate WITH the sibling
+ *  exemptions the task-runner's attemptErrorFor (child-executor.ts:428-431) has
+ *  but ctx.agent()'s inline gate lacked. Returns the structured 429-style error
+ *  string when the worker settled without a final answer AND the exemptions do
+ *  NOT apply, else undefined (gate passes):
+ *  - patches are real work: coder roles may legitimately end patch-only
+ *    (empty final assistant message is fine when the diff already landed);
+ *  - cancelled/aborted attempts are excluded so an abort never surfaces as an
+ *    upstream-rate-limit failure (and never burns fallback/retry budget on it).
+ *  Mirrors child-executor.ts exactly — extracted so the exemptions are unit-testable
+ *  at this seam (the mock-fixture layer cannot synthesise patch/cancelled shapes). */
+export function dwfSettledWithoutAnswerFailure(
+	childResult: Pick<ChildPiRunResult, "exitStatus">,
+	parsed: Pick<ParsedPiJsonOutput, "settledWithoutAnswer" | "patches">,
+): string | undefined {
+	if (parsed.settledWithoutAnswer !== true) return undefined;
+	if ((parsed.patches?.length ?? 0) > 0) return undefined;
+	if (childResult.exitStatus?.cancelled) return undefined;
+	return "Model settled without a final answer (empty final assistant message; upstream rate-limit/429 exhaustion)";
+}
+
 export interface WorkflowCtx {
 	cwd: string;
 	runId: string;
@@ -313,6 +353,14 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 			}
 		: { currentPhase: undefined, phases: [] };
 	let phaseCapWarned = false;
+	// R6-12 (DR-03 round-6): phases already recorded in the hydrated checkpoint.
+	// ctx.phase() does NOT re-emit phase_started/phase_completed for these on a
+	// resumed run — the script re-executes from the top and re-walks its phase
+	// history; without this guard every replayed phase title re-emitted its events
+	// (duplicated phase boundaries in events.jsonl). Empty on a fresh run, so the
+	// guard is resume-only: a fresh script may still legitimately re-enter a title
+	// later (e.g. phase("review") rounds) and get its events.
+	const hydratedPhases = new Set<string>(opts.resumedState?.phases ?? []);
 	// round-14 P1-2/P1-3/P1-5: closure-scoped runtime state shared by budget/log/args.
 	// Mirrors the pi-dynamic-workflows RuntimeState pattern (workflow.ts:state).
 	// round-18 P2-3: hydrate spent/logs from a resumed checkpoint (backward compatible when unset).
@@ -323,9 +371,10 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 	};
 	// PERS-1: per-agent-call idempotency cache. Hydrated from resumedState so a DWF
 	// resume skips already-completed agent calls (avoids duplicating artifacts/mailbox/tokens).
-	// Uses Record (not Map) for JSON serialization safety.
-	const completedAgentCalls: Record<string, { text: string; usage?: { input: number; output: number } }> =
-		opts.resumedState?.completedAgentCalls ?? {};
+	// Uses Record (not Map) for JSON serialization safety. R6-3 (DR-03 round-6):
+	// values are the FULL AgentResult (text + usage + structured + artifactPath +
+	// actual durationMs) so replay does not drop structured output / artifact linkage.
+	const completedAgentCalls: Record<string, AgentResult> = opts.resumedState?.completedAgentCalls ?? {};
 	// round-14 P1-2: frozen budget surface. The closures read wfState.spent so the
 	// object stays live after Object.freeze(ctx). total is a snapshot primitive.
 	const budget = Object.freeze({
@@ -348,17 +397,19 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 			let worktreePath: string | undefined;
 			let worktreeBranch: string | undefined;
 			// BDG-2 + G14 (SDD-3): content-based reserve estimate — replaces the flat
-			// ESTIMATE=4096. estimateTokens() (chars/4, the in-tree heuristic exported
-			// from runtime/task-runner/prompt-builder.ts — the same estimator
-			// pre-execution.ts uses) runs over the call's prompt + optional
-			// systemPrompt override, floored at 512 tokens for the fixed per-call
-			// overhead (schema/JSON directive, artifact headers) not present in the
-			// prompt string. Short calls stop over-reserving; very long prompts
-			// reserve proportionally so N concurrent calls cannot blow past the
-			// budget between reserve and the post-run adjust. Every BDG-2 site
-			// below (check/reserve/un-reserve/adjust/refund) uses THIS value, so
-			// refund always matches what was reserved.
-			const estimate = Math.max(512, estimateTokens((call.prompt?.length ?? 0) + (call.systemPrompt?.length ?? 0)));
+			// ESTIMATE=4096. countTokens() (R5-7, DR-02 round-5: the in-tree
+			// CJK-aware estimator from utils/token-counter.ts — replaces the chars/4
+			// estimateTokens call, which under-counted CJK/Vietnamese-diacritic
+			// prompts ~2-3x and could let N concurrent calls blow past the budget)
+			// runs over the call's prompt + optional systemPrompt override, floored
+			// at 512 tokens for the fixed per-call overhead (schema/JSON directive,
+			// artifact headers) not present in the prompt string. Short calls stop
+			// over-reserving; very long prompts reserve proportionally so N
+			// concurrent calls cannot blow past the budget between reserve and the
+			// post-run adjust. Every BDG-2 site below (check/reserve/un-reserve/
+			// adjust/refund) uses THIS value, so refund always matches what was
+			// reserved.
+			const estimate = Math.max(512, countTokens(`${call.prompt ?? ""}${call.systemPrompt ?? ""}`));
 			let reserved = false;
 			try {
 				// SDD-3 W-C G13: agent-call cap — the structured bound for no-budget runs.
@@ -393,21 +444,20 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				// from the call arguments and check if this call was already completed
 				// (e.g. during a previous run before a crash). If so, return the cached
 				// result without re-spawning the agent.
-				const callId = JSON.stringify({
-					role: call.role,
-					agent: call.agent,
-					prompt: call.prompt,
-					model: call.model,
-					schema: call.schema ? "yes" : "no",
-				});
+				// R6-3 (DR-03 round-6, HIGH): the key now covers ALL call-shaping fields
+				// (inputs/systemPrompt/disableTools/maxTurns/graceTurns/worktree/skill/…
+				// and the schema BY VALUE) — previously only {role,agent,prompt,model,
+				// schema:"yes"/"no"}, so two DIFFERENT calls sharing those 5 fields hit the
+				// same cache entry on EVERY call (e.g. same prompt with different inputs
+				// returned the first call's result — inputs provably alter the dispatched
+				// task via composeAgentTask). See computeCallId for the normalization.
+				const callId = computeCallId(call);
 				const cached = completedAgentCalls[callId];
 				if (cached) {
-					return {
-						ok: true,
-						text: cached.text,
-						usage: cached.usage,
-						durationMs: 0,
-					};
+					// Full-result replay (R6-3): structured + artifactPath survive the
+					// round-trip through the checkpoint. ok is forced true — only successful
+					// results are cached, and legacy (pre-R6-3) hydrated records lack the field.
+					return { ...cached, ok: true };
 				}
 
 				// BDG-2: reserve-then-adjust budget. Before spawning, estimate the cost and
@@ -490,18 +540,32 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 					runId: manifest.runId,
 					role: call.role ?? call.agent,
 				});
-				if (childResult.exitCode !== 0 || childResult.error) {
+				const parsed = parsePiJsonOutput(childResult.stdout);
+				// DR-01 P0 completeness (DWF): the attemptErrorFor empty-settle branch
+				// lives in the task-runner attempt loop, which ctx.agent() bypasses
+				// (runWorker is called directly here). Without this gate a
+				// 429-exhausted worker (exit 0, empty final assistant message) passes
+				// the exitCode/error check and its rawFinalText/finalText — an early
+				// opening sentence — becomes the step's "result": a false-green DWF
+				// step. See run team_20261014082741 for the live stdio shape.
+				// R6-7 (DR-03 round-6): the settledWithoutAnswer term now carries the
+				// sibling exemptions (patches = real work; cancelled ≠ 429) via
+				// dwfSettledWithoutAnswerFailure — mirroring child-executor.ts:428-431
+				// exactly, so DWF and the task-runner classify the same transcript the
+				// same way (a patch-only coder step or an aborted attempt no longer fails
+				// as rate-limit exhaustion here while passing there).
+				const settledFailure = dwfSettledWithoutAnswerFailure(childResult, parsed);
+				if (childResult.exitCode !== 0 || childResult.error || settledFailure !== undefined) {
 					// BDG-2: un-reserve the estimate on spawn failure.
 					wfState.spent -= estimate;
 					reserved = false;
 					return {
 						ok: false,
 						text: "",
-						error: childResult.error ?? `exit ${childResult.exitCode}`,
+						error: childResult.error ?? settledFailure ?? `exit ${childResult.exitCode}`,
 						durationMs: Date.now() - started,
 					};
 				}
-				const parsed = parsePiJsonOutput(childResult.stdout);
 				// round-14 P1-2: accumulate this run's token usage into the workflow budget.
 				// BDG-2: adjust the reserve — subtract the estimate, add the actual usage.
 				// This correctly reduces spent when actualUsage < estimate.
@@ -539,10 +603,16 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 						durationMs: Date.now() - started,
 					};
 				}
-				// PERS-1: cache the successful result for idempotency on resume.
+				// PERS-1: cache the FULL successful result for idempotency on resume
+				// (R6-3: structured + artifactPath + actual durationMs included, so
+				// replay returns the same payload a live call would have).
 				completedAgentCalls[callId] = {
+					ok: true,
 					text,
-					usage: { input: parsed.usage?.input ?? 0, output: parsed.usage?.output ?? 0 },
+					structured: extracted.structured ? extracted.data : undefined,
+					usage: parsed.usage,
+					artifactPath: artifact.path,
+					durationMs: Date.now() - started,
 				};
 				return {
 					ok: true,
@@ -567,23 +637,17 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 					durationMs: Date.now() - started,
 				};
 			} finally {
-				// round-17 P2-4: clean up the worktree after the agent completes (success
-				// OR failure). Captures the diff as an artifact before removal. Best-effort
-				// — a leak must never crash the workflow.
-				if (worktreePath) {
-					try {
-						await cleanupAgentWorktreeAsync(manifest, worktreePath, worktreeBranch);
-					} catch (cleanupError) {
-						logInternalError("dynamic-workflow-context.worktree-cleanup", cleanupError, `worktreePath=${worktreePath}`);
-					}
-				}
-				// round-18 P2-3: checkpoint AFTER the agent completes (success or fail) so a
-				// crash between agent calls leaves durable state to resume from. The counter is
-				// incremented here (after the call) so the checkpoint reflects the call that ran.
+				// R6-12 (DR-03 round-6): CHECKPOINT BEFORE CLEANUP. agentCount++ and
+				// onCheckpoint must land BEFORE the worktree-cleanup await — previously
+				// the checkpoint ran after it, so a crash/hang during cleanup lost the
+				// just-completed call from the durable checkpoint and resume re-spawned
+				// the same agent (duplicate work/tokens). Cleanup is best-effort and
+				// idempotent-ish (a leaked worktree is recoverable; a lost call is not).
 				agentCount++;
 				if (opts.onCheckpoint) {
 					try {
 						opts.onCheckpoint({
+							version: DWF_CHECKPOINT_VERSION,
 							runId: manifest.runId,
 							vars: ctx.vars,
 							phases: phaseState.phases,
@@ -598,6 +662,17 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 						logInternalError("dynamic-workflow-context.checkpoint", checkpointError, `runId=${manifest.runId}`);
 					}
 				}
+				// round-17 P2-4: clean up the worktree after the agent completes (success
+				// OR failure). Captures the diff as an artifact before removal. Best-effort
+				// — a leak must never crash the workflow. R6-12: runs AFTER the checkpoint
+				// (see above) — ordering is the fix.
+				if (worktreePath) {
+					try {
+						await cleanupAgentWorktreeAsync(manifest, worktreePath, worktreeBranch);
+					} catch (cleanupError) {
+						logInternalError("dynamic-workflow-context.worktree-cleanup", cleanupError, `worktreePath=${worktreePath}`);
+					}
+				}
 				semaphore.release();
 			}
 		},
@@ -718,19 +793,35 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 			};
 		},
 		async retry(taskId: string, retryOpts?: { feedback?: string }): Promise<AgentResult> {
-			return executeWithRetry(
-				async () =>
-					ctx.agent({
-						role: "executor",
-						prompt: `Re-do task '${taskId}'.${retryOpts?.feedback ? ` Feedback: ${retryOpts.feedback}` : ""}`,
-					}),
-				{
-					maxAttempts: 3,
-					backoffMs: 0,
-					jitterRatio: 0,
-					exponentialFactor: 1,
-				},
-			);
+			// R6-10 (DR-03 round-6): executeWithRetry retries THROWN errors only, but
+			// ctx.agent() returns {ok:false} for every failure class except
+			// DwfAgentCallCapError — so the previous pass-through never retried an
+			// ok:false attempt (a 1-attempt "retry"). Bridge: throw DwfRetryFailure
+			// (typed, carries the AgentResult) on !ok so executeWithRetry retries it;
+			// after exhaustion catch it and return the CARRIED result (public return
+			// type/shape unchanged). DwfAgentCallCapError is not wrapped — it keeps
+			// its terminate-the-workflow semantics and propagates untouched.
+			try {
+				return await executeWithRetry(
+					async () => {
+						const res = await ctx.agent({
+							role: "executor",
+							prompt: `Re-do task '${taskId}'.${retryOpts?.feedback ? ` Feedback: ${retryOpts.feedback}` : ""}`,
+						});
+						if (!res.ok) throw new DwfRetryFailure(res);
+						return res;
+					},
+					{
+						maxAttempts: 3,
+						backoffMs: 0,
+						jitterRatio: 0,
+						exponentialFactor: 1,
+					},
+				);
+			} catch (error) {
+				if (error instanceof DwfRetryFailure) return error.result;
+				throw error;
+			}
 		},
 		mail(
 			to: string,
@@ -778,6 +869,13 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 			}
 			// Idempotency: same phase title → no event, no state change.
 			if (title === phaseState.currentPhase) return;
+			// R6-12 (DR-03 round-6): phase no-dup on resume. A phase already recorded
+			// in the hydrated checkpoint is NOT re-emitted — the resumed script
+			// re-walks its phase history and would otherwise duplicate phase_started/
+			// phase_completed events in events.jsonl. Resume-only guard: hydratedPhases
+			// is empty on a fresh run, so legitimate same-title re-entry later in a
+			// fresh script still emits (see the fresh-run counter-pin test).
+			if (hydratedPhases.has(title)) return;
 			// Close out the previous open phase BEFORE the new one opens.
 			// U2 (2026-10-10): kept SYNC — ctx closures are exercised DIRECTLY by
 			// unit tests that readEvents() synchronously right after the call
@@ -921,6 +1019,8 @@ export function getWorkflowCheckpoint(ctx: WorkflowCtx): DwfCheckpointState {
 	const phaseState = getWorkflowPhaseState(ctx);
 	const logs = getWorkflowLogs(ctx);
 	return {
+		// R6-12: snapshot carries the format version (mirrors the onCheckpoint payload).
+		version: DWF_CHECKPOINT_VERSION,
 		runId: ctx.runId,
 		vars: ctx.vars,
 		phases: phaseState?.phases ?? [],
@@ -928,13 +1028,41 @@ export function getWorkflowCheckpoint(ctx: WorkflowCtx): DwfCheckpointState {
 		logs: logs ?? [],
 		spent: ctx.budget.spent(),
 		agentCount: (ctx as unknown as { __agentCount?: number }).__agentCount ?? 0,
-		completedAgentCalls:
-			(ctx as unknown as { __completedAgentCalls?: Record<string, { text: string; usage?: { input: number; output: number } }> })
-				.__completedAgentCalls ?? {},
+		completedAgentCalls: (ctx as unknown as { __completedAgentCalls?: Record<string, AgentResult> }).__completedAgentCalls ?? {},
 		updatedAt: new Date().toISOString(),
 	};
 }
 
+/**
+ * R6-3 (DR-03 round-6, HIGH): deterministic PERS-1 cache key over ALL
+ * call-shaping AgentCallOpts fields — the JSON of the resolved call object
+ * with stable ordering:
+ *  - object keys sorted (two identical calls built with different literal key
+ *    orders still share a cache entry);
+ *  - top-level array fields (inputs, skill) keyed as a SORTED copy — the same
+ *    set in a different order is the same call;
+ *  - undefined fields dropped;
+ *  - the schema is included BY VALUE (a structural change to the expected
+ *    output shape changes the dispatched task and must miss the cache — the
+ *    old "yes"/"no" placeholder collided different schemas).
+ * Previously the key was {role, agent, prompt, model, schema:"yes"/"no"} only,
+ * omitting inputs/systemPrompt/disableTools/maxTurns/graceTurns/worktree/skill
+ * — e.g. the same prompt with DIFFERENT inputs (which provably alter the
+ * dispatched task via composeAgentTask) hit the first call's cache entry on
+ * EVERY call and returned the wrong call's result (lead-verified :398-412).
+ * Note: fields that do NOT shape the call (description) are included anyway —
+ * over-keying only costs a cache miss (a fresh spawn), never correctness.
+ */
+function computeCallId(call: AgentCallOpts): string {
+	const normalized: Record<string, unknown> = {};
+	for (const key of Object.keys(call).sort()) {
+		const value: unknown = call[key as keyof AgentCallOpts];
+		if (value === undefined) continue;
+		normalized[key] = Array.isArray(value) ? [...(value as unknown[])].sort() : value;
+	}
+	return JSON.stringify(normalized);
+}
+
 /** Compose the agent task: prompt + optional dependency-input context block. */
 function composeAgentTask(call: AgentCallOpts): string {
 	let base = call.prompt;

package/src/runtime/goal-workflow/goal-loop-runner.ts

@@ -20,6 +20,8 @@ import { createRequire } from "node:module";
 import type { AgentConfig } from "../../agents/agent-config.ts";
 import { loadConfig } from "../../config/config.ts";
 import { effectiveRunConfig } from "../../extension/team-tool/config-patch.ts";
+import { isTerminalTaskStatus } from "../../state/contracts.ts";
+import { withRunLockSync } from "../../state/coordination/locks.ts";
 import { appendEventBuffered } from "../../state/event-log/event-log.ts";
 import { registerActiveRun, unregisterActiveRun } from "../../state/stores/active-run-registry.ts";
 import { collectRunMetrics } from "../../state/stores/run-metrics.ts";
@@ -28,14 +30,52 @@ import type { GoalLoopState, GoalLoopStatus, GoalVerdict, TeamRunManifest, TeamT
 import type { TeamConfig } from "../../teams/team-config.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import type { WorkflowConfig } from "../../workflows/workflow-config.ts";
+import { isRunLockBusyError } from "../broker/protocol/lock-busy.ts";
 import { resolveCrewRuntime } from "../model/runtime-resolver.ts";
 import { registryFromModelContext } from "../model/session-model.ts";
 import { executeTeamRun } from "../team-runner.ts";
 import { compareSnapshot, snapshotManifests } from "../verification/verification-integrity.ts";
-import { acquireWorkspaceLock, type WorkspaceLockHandle } from "../workspace-lock.ts";
+import { acquireWorkspaceLock, refreshWorkspaceLockHeartbeat, type WorkspaceLockHandle } from "../workspace-lock.ts";
 import { bundleEvidence, evaluateGoal } from "./goal-evaluator.ts";
 import { GoalStore } from "./goal-state-store.ts";
 
+/**
+ * D5 (DR-02 Wave 2 Cluster C): merge the turn's FINAL task states onto a
+ * FRESH tasks.json read. The turn owns exactly the terminal-evidence fields
+ * its executor wrote (status/finishedAt/resultArtifact/error/exitCode);
+ * everything else on the fresh task (heartbeat/lastSeenAt, claim, delegate
+ * state, usage…) may be NEWER than the turn's in-memory snapshot and must
+ * never be regressed by the post-turn persist.
+ *
+ * Terminal-preserve: a task that is ALREADY terminal in the fresh read (an
+ * external decision — operator cancel, crash-recovery, the async-died
+ * notifier) keeps its fresh state entirely; the turn must not resurrect or
+ * re-decide it (same guard class as heartbeat.ts R13-S1). Turn tasks missing
+ * from the fresh read are appended — the turn created them and the
+ * budget/audit reads this persist exists for expect them on disk.
+ */
+export function mergeTurnFinalTasksOntoFresh(freshTasks: readonly TeamTaskState[], turnTasks: readonly TeamTaskState[]): TeamTaskState[] {
+	const freshById = new Map(freshTasks.map((task) => [task.id, task]));
+	const turnById = new Map(turnTasks.map((task) => [task.id, task]));
+	const merged = freshTasks.map((freshTask) => {
+		const turnTask = turnById.get(freshTask.id);
+		if (!turnTask) return freshTask;
+		if (isTerminalTaskStatus(freshTask.status)) return freshTask;
+		return {
+			...freshTask,
+			status: turnTask.status,
+			...(turnTask.finishedAt !== undefined ? { finishedAt: turnTask.finishedAt } : {}),
+			...(turnTask.resultArtifact !== undefined ? { resultArtifact: turnTask.resultArtifact } : {}),
+			...(turnTask.error !== undefined ? { error: turnTask.error } : {}),
+			...(turnTask.exitCode !== undefined ? { exitCode: turnTask.exitCode } : {}),
+		};
+	});
+	for (const turnTask of turnTasks) {
+		if (!freshById.has(turnTask.id)) merged.push(turnTask);
+	}
+	return merged;
+}
+
 /** Required minimal shape for the worker + agents discovery (P0 uses the goal's workerAgent). */
 export interface GoalLoopRuntimeDeps {
 	/** Resolve the agent configs reachable from cwd (used for executeTeamRun's agents arg). */
@@ -538,6 +578,48 @@ export function deriveTranscriptPath(artifactsRoot: string, tasks: import("../..
 	return undefined;
 }
 
+/** Interval (ms) between workspace-lock heartbeat refreshes while a goal loop runs (WI-2 / DR-02 R4-3). 15s = 4x margin under the 60s staleness threshold. */
+export const WORKSPACE_LOCK_HEARTBEAT_REFRESH_MS = 15_000;
+
+export interface StartWorkspaceLockHeartbeatRefreshOptions {
+	/** Test injection: override the refresh interval (ms). */
+	refreshMs?: number;
+	/** Test injection: override the refresh implementation (default: refreshWorkspaceLockHeartbeat). */
+	refresh?: (lockPath: string, goalId: string) => boolean;
+}
+
+/**
+ * Start the periodic workspace-lock heartbeat refresh for a lock acquired by
+ * runGoalLoop (WI-2 / DR-02 R4-3).
+ *
+ * Without refresh, workspace-lock isLockStale clause (b) marks the lock stale
+ * after 60s REGARDLESS of holder pid liveness — a goal whose turn takes >60s
+ * gets its workspace lock force-stolen by a second goal on the same cwd
+ * (multi-goal clobber). This timer keeps the heartbeat young for the whole
+ * loop lifetime. It is unref()-ed (must not keep the background process
+ * alive) and the returned stop() MUST be called in the same finally that
+ * releases the lock. Refresh failures are logged as warn and swallowed — a
+ * heartbeat miss must never throw into the goal loop.
+ */
+export function startWorkspaceLockHeartbeatRefresh(
+	handle: Pick<WorkspaceLockHandle, "lockPath" | "goalId">,
+	opts: StartWorkspaceLockHeartbeatRefreshOptions = {},
+): { stop: () => void } {
+	const refreshMs = opts.refreshMs ?? WORKSPACE_LOCK_HEARTBEAT_REFRESH_MS;
+	const refresh = opts.refresh ?? refreshWorkspaceLockHeartbeat;
+	const timer = setInterval(() => {
+		try {
+			refresh(handle.lockPath, handle.goalId);
+		} catch (error) {
+			// Never throw into the loop (interval callbacks crashing node:test aside,
+			// an escaping throw here would kill the background goal process).
+			logInternalError("goal-loop.workspaceLockHeartbeat", error, `goalId=${handle.goalId} lockPath=${handle.lockPath}`, "warn");
+		}
+	}, refreshMs);
+	timer.unref(); // the refresh timer must not keep the detached goal-loop process alive
+	return { stop: () => clearInterval(timer) };
+}
+
 /**
  * Run the autonomous goal loop. Returns {manifest, tasks, goalState} — the OUTER
  * manifest is the synthetic goal-loop manifest (runKind:"goal-loop"); per-turn
@@ -575,10 +657,18 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 	// the background-process boundary. `goal start` / `goal resume` pre-check via isWorkspaceBusy
 	// for a good error message; this acquisition is the authoritative claim.
 	let workspaceLock: WorkspaceLockHandle | undefined;
+	// WI-2 (DR-02 R4-3): periodic heartbeat refresh for the lock above — stopped
+	// in the same finally that releases it (see startWorkspaceLockHeartbeatRefresh).
+	let lockHeartbeat: { stop: () => void } | undefined;
 	try {
 		workspaceLock = await acquireWorkspaceLock(goal.cwd, goal.goalId, {
 			signal,
 		});
+		// WI-2 (DR-02 R4-3): keep the heartbeat young for the whole loop lifetime —
+		// without this, isLockStale clause (b) force-steals the lock after 60s even
+		// though this pid is alive (multi-goal clobber). Started immediately after
+		// acquire; the timer is unref()-ed and never throws into the loop.
+		lockHeartbeat = startWorkspaceLockHeartbeatRefresh(workspaceLock);
 	} catch (error) {
 		logInternalError("goal-loop.workspaceLock", error, `goalId=${goal.goalId} cwd=${goal.cwd}`);
 		goal = safeSetStatus(store, goal.goalId, "blocked", goal, eventsPath);
@@ -753,10 +843,41 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 			}
 
 			// Persist final task states for budget/audit reads.
+			// D5 (DR-02 Wave 2 Cluster C): the bare saveRunTasks(turnResult.tasks) was
+			// an UNLOCKED write of the executor's in-memory snapshot (goal-loop-runner.ts
+			// ":757") — it clobbered any NEWER state written under the run lock between
+			// the executor's last persist and this save (worker heartbeats/lastSeenAt,
+			// task claims, delegate statuses). Now a run-locked RMW: fresh re-read inside
+			// the lock, then a field-level merge — the turn re-decides only the fields it
+			// owns and never regresses fresh heartbeat/claim/delegate data.
 			try {
-				saveRunTasks(turnResult.manifest, turnResult.tasks);
+				withRunLockSync(turnResult.manifest, () => {
+					const fresh = loadRunManifestById(turnResult.manifest.cwd, turnResult.manifest.runId);
+					if (!fresh) {
+						logInternalError(
+							"goal-loop.saveTurnTasks",
+							new Error(`turn run '${turnResult.manifest.runId}' vanished before the final task persist — skipped`),
+							"best-effort",
+							"warn",
+						);
+						return;
+					}
+					saveRunTasks(fresh.manifest, mergeTurnFinalTasksOntoFresh(fresh.tasks, turnResult.tasks));
+				});
 			} catch (error) {
-				logInternalError("goal-loop.saveTurnTasks", error, `turnRunId=${created.manifest.runId}`);
+				if (isRunLockBusyError(error)) {
+					// Best-effort persist: the executor already persisted terminal task
+					// states during the turn — this merge is belt-and-suspenders for
+					// budget/audit reads, so contention skips it with a warn.
+					logInternalError(
+						"goal-loop.saveTurnTasks",
+						error,
+						`turnRunId=${created.manifest.runId} run lock busy — skipped final task merge`,
+						"warn",
+					);
+				} else {
+					logInternalError("goal-loop.saveTurnTasks", error, `turnRunId=${created.manifest.runId}`);
+				}
 			}
 
 			// GL-1: if the turn ended in blocked/failed status, stop the loop without spawning the judge.
@@ -908,6 +1029,12 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 		}).catch((e) => logInternalError("goal-loop.buffered", e, "type=goal.loop_error"));
 		goal = safeSetStatus(store, goal.goalId, "blocked", goal, eventsPath);
 	} finally {
+		// WI-2: stop the heartbeat refresh BEFORE releasing the lock it was keeping alive.
+		try {
+			lockHeartbeat?.stop();
+		} catch {
+			/* best-effort */
+		}
 		// P1g: release the workspace lock (held since loop start).
 		try {
 			workspaceLock?.release();

package/src/runtime/heartbeat/heartbeat-watcher.ts

@@ -231,6 +231,11 @@ export class HeartbeatWatcher {
 			if (!activeKeys.has(key) && ts < cutoff) {
 				this.lastLevel.delete(key);
 				this.consecutiveDead.delete(key);
+				// M-8 (2026-10-16): also drop the deadletter cooldown marker —
+				// before this the map leaked one entry per vanished run:taskId key
+				// and a stale cooldown timestamp could suppress a legitimate
+				// re-trigger after the same task reappeared.
+				this.lastDeadletterTriggerAt.delete(key);
 				this.lastSeen.delete(key);
 			}
 		}
@@ -242,5 +247,7 @@ export class HeartbeatWatcher {
 		this.lastLevel.clear();
 		this.consecutiveDead.clear();
 		this.lastSeen.clear();
+		// M-8: clear the deadletter cooldown map too (was leaked before).
+		this.lastDeadletterTriggerAt.clear();
 	}
 }

package/src/runtime/live-session/embedded-tier.ts

@@ -908,7 +908,9 @@ export function admitEmbeddedSession(input: {
 	});
 	// Raced against the prompt; a pre-race rejection must not surface as an
 	// unhandled rejection (which would trip our own process guard).
-	escapeSignal.catch(() => {});
+	escapeSignal.catch(() => {
+		/* intentional UR-guard — see comment above */
+	});
 	let tornDown = false;
 	registerEmbeddedSessionGuard(
 		input.agentId,