pi-crew 0.11.21 → 0.11.22

package/src/state/event-log/event-log.ts

@@ -7,7 +7,7 @@ import { emitFromTeamEvent } from "../../ui/run-event-bus.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { redactSecrets } from "../../utils/redaction.ts";
 import { sleep, sleepSync } from "../../utils/sleep.ts";
-import { applyCompactionUnlocked, needsRotation, prepareCompaction, rotateEventLogUnlocked } from "./event-log-rotation.ts";
+import { applyCompactionAppendGuarded, needsRotation, prepareCompaction, rotateEventLogUnlocked } from "./event-log-rotation.ts";
 import {
 	advanceSequenceCounter,
 	persistSequenceMonotonic,
@@ -219,6 +219,125 @@ export function withEventLogLockSync<T>(eventsPath: string, fn: () => T, options
 	}
 }
 
+/**
+ * R4-2 (DR-02 Wave 2, 2026-10-15): SYNC-mode acquisition of the ASYNC family's
+ * `.alock` lock dir (`${eventsPath}.alock`). Mirrors the `withEventLogLockSync`
+ * protocol exactly — `fs.mkdirSync` (O_EXCL semantics on POSIX), pid file via
+ * `openSync(pidFile, "wx")` + plain write, mtime-stale reclaim checked FIRST for
+ * every holder (Round 26 BUG 4 pattern), dead-pid secondary fast-path that only
+ * WAITS (never steals a fresh lock), `sleepSync(50)` bounded retry loop, and a
+ * PID-guarded release that never deletes a stealer's dir (Round 26 BUG 5).
+ *
+ * WHY this exists: the async append family (`withEventLogLockAsync` →
+ * `appendEventAsync`) holds `.alock` ACROSS await gaps — notably between
+ * `fs.promises.open(eventsPath, "a")` and `fd.appendFile(...)`. Compaction's
+ * `applyCompactionUnlocked` replaces the events file via `atomicWriteFile`
+ * (temp+rename → new inode). When compaction ran under `.mkdirlock` only, an
+ * fd opened by a mid-gap async append kept pointing at the OLD inode, which the
+ * rename orphaned → the append was silently lost (C2 recovery only re-splices
+ * events in the `kept` window). Acquiring `.alock` around the compaction write
+ * phase closes that window: the rename can no longer interleave with an
+ * in-flight async-family append, cross-process included (same on-disk dir +
+ * pid-file protocol as the async acquirer).
+ *
+ * LOCK ORDER: strictly `.mkdirlock` → `.alock`. The async family NEVER takes
+ * `.mkdirlock` (its bodies call the unlocked compaction/rotation variants and
+ * the short `.seqlock` only), so a sync caller holding `.mkdirlock` may safely
+ * acquire this — but NEVER the reverse, and never call this from INSIDE
+ * `withEventLogLockAsync` (the dir would be our own — the retry loop would
+ * sleepSync-starve the very holder that must release it → guaranteed timeout).
+ *
+ * IN-PROCESS HAZARD (same rationale as the two-family split): if a SAME-PROCESS
+ * async-family holder is mid-await-gap on this `.alock`, this sync acquirer's
+ * `sleepSync` retry blocks the event loop the async holder needs to finish —
+ * the acquire can only end in the bounded timeout (throw), never in a steal.
+ * That is why the only in-tree caller is `compactPreparedEventLog`
+ * (event-log-rotation.ts), whose callers are cross-process / maintenance / test
+ * entry points, NOT the in-process append paths (those already hold `.alock`
+ * or call the unlocked variants directly).
+ */
+export function withEventLogAppendLockSync<T>(eventsPath: string, fn: () => T, options?: { timeoutMs?: number; staleMs?: number }): T {
+	// Ensure parent directory exists before attempting lock (mirrors the sync family).
+	fs.mkdirSync(path.dirname(eventsPath), { recursive: true });
+	const lockDir = `${eventsPath}.alock`;
+	const pidFile = path.join(lockDir, "pid");
+	const start = Date.now();
+	const timeout = options?.timeoutMs ?? 5000;
+	const staleMs = options?.staleMs ?? 10000;
+	let acquired = false;
+	while (true) {
+		try {
+			fs.mkdirSync(lockDir);
+			try {
+				// Same disposable pid file as both existing families: "wx" open +
+				// plain write — the lock dir itself is the mutex; the pid file only
+				// feeds the stale/dead detection and the guarded release.
+				const pidFd = fs.openSync(pidFile, "wx");
+				try {
+					fs.writeSync(pidFd, String(process.pid));
+				} finally {
+					fs.closeSync(pidFd);
+				}
+			} catch {
+				/* best-effort — e.g. EEXIST under a re-taken dir; stale pid is mtime-detected */
+			}
+			acquired = true;
+			break;
+		} catch {
+			if (Date.now() - start > timeout) {
+				throw errors.eventLogLockTimeout(eventsPath, timeout);
+			}
+			// Mtime-stale reclaim FIRST, independent of the pid file (Round 26 BUG 3
+			// pattern): a holder that crashed between mkdir and the pid write has no
+			// pid file — only an aged mtime can reclaim its dir.
+			try {
+				const dirStat = fs.statSync(lockDir);
+				if (Date.now() - dirStat.mtimeMs > staleMs) {
+					fs.rmSync(lockDir, { recursive: true, force: true });
+					continue;
+				}
+			} catch {
+				/* dir vanished — let loop retry */
+			}
+			// Dead-pid secondary fast-path (Round 26 BUG 4 pattern): mtime already
+			// handled above for ALL holders; a provably-dead pid that is not stale
+			// yet only makes us keep waiting — never steal a fresh lock on a pid
+			// lookup race.
+			try {
+				const raw = fs.readFileSync(pidFile, "utf-8").trim();
+				const ownerPid = Number.parseInt(raw, 10);
+				if (!Number.isNaN(ownerPid) && ownerPid !== process.pid) {
+					try {
+						process.kill(ownerPid, 0);
+					} catch {
+						/* dead — but mtime not stale yet, keep waiting */
+					}
+				}
+			} catch {
+				/* no pid file — mtime check above already handles it */
+			}
+			sleepSync(50);
+		}
+	}
+	try {
+		return fn();
+	} finally {
+		if (acquired) {
+			// PID-guarded release (Round 26 BUG 5 pattern): only remove the dir if
+			// the pid file still records OUR pid — if our fn outlived staleMs and a
+			// stealer re-took the dir, the stealer owns it now.
+			try {
+				const currentPid = fs.readFileSync(pidFile, "utf-8").trim();
+				if (currentPid === String(process.pid)) {
+					fs.rmSync(lockDir, { recursive: true, force: true });
+				}
+			} catch {
+				/* lock stolen or already gone — do not touch */
+			}
+		}
+	}
+}
+
 export function computeEventFingerprint(event: Pick<TeamEvent, "type" | "runId" | "taskId" | "data">): string {
 	return createHash("sha256")
 		.update(
@@ -306,8 +425,12 @@ async function drainAsyncQueues(): Promise<void> {
  *
  *  NOT re-entrant: callers inside this lock must use unlocked compaction
  *  variants (prepareCompaction + applyCompactionUnlocked, rotateEventLogUnlocked)
- *  to avoid self-deadlock. */
-async function withEventLogLockAsync<T>(
+ *  to avoid self-deadlock.
+ *
+ *  R4-2 note (2026-10-15): exported so tests (and future async callers) can pin
+ *  the `.alock` family's mutual exclusion against the sync-mode acquirer
+ *  `withEventLogAppendLockSync` used by the compaction path. */
+export async function withEventLogLockAsync<T>(
 	eventsPath: string,
 	fn: () => Promise<T>,
 	options?: { timeoutMs?: number; staleMs?: number },
@@ -520,7 +643,11 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
 				overflowHandled = true;
 				try {
 					const prepared = prepareCompaction(eventsPath);
-					if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+					// R7-2 (DR-04): LOCK STATE — `.alock` HELD. We are inside
+					// doAppendUnderLock, which runs under withEventLogLockAsync
+					// (appendEventAsync). The lock is NOT re-entrant, so the guarded
+					// apply must NOT re-acquire it — tail-merge only.
+					if (prepared) applyCompactionAppendGuarded(eventsPath, prepared, { holdsAppendLock: true });
 				} catch (error) {
 					logInternalError("event-log.immediate-compact", error, `eventsPath=${eventsPath}`);
 				}
@@ -624,7 +751,11 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
 		if (tickAppendCounter(eventsPath) && needsRotation(eventsPath)) {
 			try {
 				const prepared = prepareCompaction(eventsPath);
-				if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+				// R7-2 (DR-04): LOCK STATE — `.alock` HELD. Same scope as the
+				// immediate-compact site above: doAppendUnderLock runs under
+				// withEventLogLockAsync (appendEventAsync). Tail-merge only; the
+				// sync-family bytes appended since the prepare-read are spliced.
+				if (prepared) applyCompactionAppendGuarded(eventsPath, prepared, { holdsAppendLock: true });
 			} catch (error) {
 				logInternalError("event-log.rotation", error, `eventsPath=${eventsPath}`);
 			}
@@ -706,8 +837,17 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
  * buffered write path, which is the entire point of buffering — the previous
  * per-event fsync made buffer coalescing useless and added ~30ms/event on
  * tmpfs.
+ *
+ * R7-2 (DR-04, 2026-10-16): `locks.holdsAppendLock` declares the CALLING
+ * family's lock state so the inline overflow compaction below can pick the
+ * right guarded-apply mode — see the site comment and
+ * `applyCompactionAppendGuarded` (event-log-rotation.ts).
  */
-async function appendEventBatchInsideLock(eventsPath: string, queue: BufferedAppend[]): Promise<void> {
+async function appendEventBatchInsideLock(
+	eventsPath: string,
+	queue: BufferedAppend[],
+	locks?: { holdsAppendLock?: boolean },
+): Promise<void> {
 	if (queue.length === 0) return;
 	// P0-2: keep the per-path counter honest for cross-path rotation sampling.
 	tickAppendCounter(eventsPath, queue.length);
@@ -732,7 +872,14 @@ async function appendEventBatchInsideLock(eventsPath: string, queue: BufferedApp
 			if (preStat.size > MAX_EVENTS_BYTES) {
 				try {
 					const prepared = prepareCompaction(eventsPath);
-					if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+					// R7-2 (DR-04): LOCK STATE — MIXED, declared by the CALLER. This
+					// function is entered from BOTH families: the async flush
+					// (flushOneEventLogBuffer, inside withEventLogLockAsync → `.alock`
+					// HELD → holdsAppendLock: true, re-acquiring would self-timeout)
+					// and the EL-2 sync flush (flushBufferedQueuesSync, inside
+					// withEventLogLockSync → only `.mkdirlock` held → the helper
+					// must acquire `.alock` itself, nested in the R4-2 order).
+					if (prepared) applyCompactionAppendGuarded(eventsPath, prepared, locks);
 				} catch (error) {
 					logInternalError("event-log.batch-immediate-compact", error, `eventsPath=${eventsPath}`);
 				}
@@ -926,7 +1073,14 @@ function appendEventInsideLock(eventsPath: string, event: AppendTeamEvent): Team
 			// unbounded log growth → events silently dropped past 50MB).
 			try {
 				const prepared = prepareCompaction(eventsPath);
-				if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+				// R7-2 (DR-04): LOCK STATE — `.mkdirlock` HELD, `.alock` NOT held.
+				// appendEventInsideLock runs under withEventLogLockSync (appendEvent,
+				// :366). The guarded apply acquires `.alock` nested under our
+				// `.mkdirlock` (R4-2 lock order) so the inode-replacing write cannot
+				// interleave with an in-flight async appender parked between open()
+				// and appendFile(); the tail-merge splices sync-family bytes that
+				// landed after the prepare-read.
+				if (prepared) applyCompactionAppendGuarded(eventsPath, prepared);
 			} catch (error) {
 				logInternalError("event-log.immediate-compact", error, `eventsPath=${eventsPath}`);
 			}
@@ -1017,9 +1171,12 @@ function appendEventInsideLock(eventsPath: string, event: AppendTeamEvent): Team
 		// locked compactEventLog would deadlock → 5s timeout → compaction never
 		// ran → unbounded log growth → events silently dropped past 50MB. Use the
 		// unlocked apply path instead (lock already held).
+		// R7-2 (DR-04): LOCK STATE — `.mkdirlock` HELD, `.alock` NOT held (same
+		// scope as the immediate-compact site above). applyCompactionAppendGuarded
+		// acquires `.alock` itself (nested R4-2 order) + tail-merges.
 		try {
 			const prepared = prepareCompaction(eventsPath);
-			if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+			if (prepared) applyCompactionAppendGuarded(eventsPath, prepared);
 		} catch (error) {
 			logInternalError("event-log.rotation", error, `eventsPath=${eventsPath}`);
 		}
@@ -1136,7 +1293,9 @@ async function flushOneEventLogBuffer(eventsPath: string): Promise<void> {
 		// turning 100 buffered events into 100 fsyncs (~3s on tmpfs). Now we do
 		// 1 appendFileSync + 1 fsync + 1 persistSequence for the whole batch.
 		await withEventLogLockAsync(eventsPath, async () => {
-			await appendEventBatchInsideLock(eventsPath, queue);
+			// R7-2 (DR-04): `.alock` HELD here (async family) — the batch's inline
+			// compaction must not re-acquire it.
+			await appendEventBatchInsideLock(eventsPath, queue, { holdsAppendLock: true });
 		});
 	} catch (error) {
 		// Lock acquire failed — fail every queued item so callers can fall back.
@@ -1176,6 +1335,9 @@ export function flushBufferedQueuesSync(): void {
 				// synchronous (fs.appendFileSync + fs.fsyncSync + persistSequence,
 				// no awaits). Invoking without await runs the body synchronously and
 				// returns a resolved Promise that we discard.
+				// R7-2 (DR-04): only `.mkdirlock` is held here (sync family) — the
+				// batch's inline compaction acquires `.alock` itself via the helper
+				// (nested in the R4-2 lock order).
 				void appendEventBatchInsideLock(eventsPath, queue);
 			});
 		} catch (error) {
@@ -1193,8 +1355,15 @@ export function flushBufferedQueuesSync(): void {
 // this hook lets T2 assert the fsync gate directly. Both production call paths
 // (async flush via withEventLogLockAsync and the EL-2 sync flush via
 // withEventLogLockSync) route through appendEventBatchInsideLock.
-export function __test__appendBatchForUnitTest(eventsPath: string, queue: BufferedAppend[]): Promise<void> {
-	return appendEventBatchInsideLock(eventsPath, queue);
+export function __test__appendBatchForUnitTest(
+	eventsPath: string,
+	queue: BufferedAppend[],
+	locks?: { holdsAppendLock?: boolean },
+): Promise<void> {
+	// R7-2 (DR-04): `locks` mirrors the production flush paths' declarations for
+	// tests that reproduce a specific family's lock context (default = no lock
+	// held, matching a bare direct call — the helper then acquires `.alock`).
+	return appendEventBatchInsideLock(eventsPath, queue, locks);
 }
 
 /**

package/src/state/stores/active-run-registry.ts

@@ -336,8 +336,11 @@ function filterAliveEntries(entries: ActiveRunRegistryEntry[]): {
 				} catch (err) {
 					// Only treat "process does not exist" as dead (ESRCH/ENOENT).
 					// EPERM means process is alive but protected; treat as alive.
+					// R7-15 (2026-10-16): both branches previously `return false`d,
+					// contradicting the comment and silently dropping live EPERM
+					// entries from the registry.
 					const code = (err as NodeJS.ErrnoException).code;
-					if (code !== "ESRCH" && code !== "ENOENT") return false;
+					if (code !== "ESRCH" && code !== "ENOENT") return true;
 					return false;
 				}
 				// FIX Issue 2: Async runs older than the staleness horizon are stale even if
@@ -437,8 +440,12 @@ export function activeRunEntries(): ActiveRunRegistryEntry[] {
 			if (manifest.async?.pid) {
 				try {
 					process.kill(manifest.async.pid, 0);
-				} catch {
-					continue;
+				} catch (err) {
+					// R7-15 (2026-10-16): only ESRCH/ENOENT mean the process is gone.
+					// EPERM (or any other code) means it exists but we cannot signal
+					// it — keep the entry, mirroring filterAliveEntries.
+					const code = (err as NodeJS.ErrnoException).code;
+					if (code === "ESRCH" || code === "ENOENT") continue;
 				}
 			}
 			// Stale non-async run: live-session/scaffold runs older than 30 min

package/src/state/types.ts

@@ -43,6 +43,11 @@ export interface VerificationEvidence {
 	satisfied: boolean;
 	commands: VerificationCommandResult[];
 	notes?: string;
+	/** R4-5 (DR-02 wave 2): true when the contract REQUIRES a green level but
+	 *  configures zero verification commands — satisfaction can then only come
+	 *  from self-attestation (allowManualEvidence). Surfacing flag only: the
+	 *  satisfied logic and defaultVerificationContract are unchanged. */
+	decorative?: boolean;
 }
 
 export interface TaskOutputSchema {
@@ -162,7 +167,10 @@ export type PolicyDecisionReason =
 	| "review_rejected"
 	| "branch_stale"
 	| "scope_mismatch"
-	| "ineffective_worker";
+	| "ineffective_worker"
+	/** R4-4 (DR-02 wave 2): task terminalised needs_attention without ever
+	 *  submitting a result (surface-lost / no-yield paths). Notify-level only. */
+	| "task_needs_attention";
 
 export interface PolicyDecision {
 	action: PolicyDecisionAction;

package/src/ui/agents-jobs-browser.ts

@@ -266,7 +266,9 @@ export class AgentsJobsBrowser {
 	/** Transient header notice (e.g. why `p` did nothing) — auto-expires. */
 	private notice: { text: string; until: number } | undefined;
 	private pollTimer: ReturnType<typeof setInterval> | undefined;
-	private readonly manifests = new Map<string, TeamRunManifest | null>();
+	/** Manifest reads, cached until the next force refresh (R5-3: misses are
+	 *  never stored — see manifestFor). */
+	private readonly manifests = new Map<string, TeamRunManifest>();
 	/** U7: committed-state caches (default data path only). */
 	private readonly manifestCache?: ManifestCache;
 	private readonly snapshotCache?: RunSnapshotCache;
@@ -361,6 +363,10 @@ export class AgentsJobsBrowser {
 
 	/** Reload the merged list when the TTL expired (or `force`). */
 	refreshData(force = false): void {
+		// R5-3 (DR-02 wave 2): a force refresh invalidates the manifest cache too
+		// — manifests used to live for the browser's whole lifetime, so a manifest
+		// created/renamed while the overlay was open never became visible.
+		if (force) this.manifests.clear();
 		const ttl = this.options.refreshTtlMs ?? REFRESH_TTL_MS_DEFAULT;
 		const at = this.nowMs();
 		if (!force && ttl > 0 && at - this.cachedAt < ttl) return;
@@ -519,16 +525,21 @@ export class AgentsJobsBrowser {
 	}
 
 	private manifestFor(runId: string): TeamRunManifest | null {
-		if (this.manifests.has(runId)) return this.manifests.get(runId) ?? null;
-		let manifest: TeamRunManifest | null = null;
+		const cached = this.manifests.get(runId);
+		if (cached) return cached;
+		// R5-3 (DR-02 wave 2): a miss (manifest not found / transient read
+		// failure — loadRunManifestById takes no run lock, so a read can race a
+		// write) is NEVER cached: returning null without touching the map makes
+		// the next call retry instead of pinning the miss for the overlay's
+		// lifetime. Successful loads still cache until the next force refresh.
 		try {
 			const loaded = loadRunManifestById(this.options.cwd, runId); // NOTE: no run lock — best-effort read, mirrors viewers.ts
-			manifest = loaded ? loaded.manifest : null;
+			if (!loaded) return null;
+			this.manifests.set(runId, loaded.manifest);
+			return loaded.manifest;
 		} catch {
-			manifest = null;
+			return null;
 		}
-		this.manifests.set(runId, manifest);
-		return manifest;
 	}
 
 	private recordFor(runId: string, taskId: string): CrewAgentRecord | undefined {
@@ -559,7 +570,10 @@ export class AgentsJobsBrowser {
 			return lines;
 		}
 		const record = entry.record ?? this.recordFor(entry.runId, entry.taskId);
-		const manifest = this.manifestFor(entry.runId);
+		// R5-3: prefer the FRESH entry.manifest the list pipeline already
+		// carries (re-read on every refresh tick) — manifestFor is the fallback
+		// for provider-based entries without one.
+		const manifest = entry.manifest ?? this.manifestFor(entry.runId);
 		if (!record || !manifest) {
 			return [
 				`▸ ${entry.taskId ?? "?"} (${entry.role ?? "?"})`,

package/src/ui/dashboard-panes/agents-pane.ts

@@ -2,7 +2,7 @@ import type { CrewAgentRecord } from "../../runtime/crew-agent-runtime.ts";
 import { type LiveAgentHandle, listLiveAgents, listLiveAgentsByWorkspace } from "../../runtime/live-session/live-agent-manager.ts";
 import { formatCost } from "../../state/usage.ts";
 import { visibleWidth } from "../../utils/visual.ts";
-import { formatCount, formatDuration } from "../format-helpers.ts";
+import { formatCount, formatDuration, truncLine } from "../format-helpers.ts";
 import { computeLiveDurationMs } from "../live-duration.ts";
 import { overflowHint, statusIcon } from "../rail.ts";
 import type { RunDashboardOptions } from "../run-dashboard.ts";
@@ -99,7 +99,10 @@ function describeActivity(handle: LiveAgentHandle): string {
 				.split("\n")
 				.find((l) => l.trim())
 				?.trim() ?? "";
-		return line.length > 40 ? line.slice(0, 40) + "…" : line;
+		// O-5 (DR-04): grapheme-aware truncation at the original budget (≤40
+		// content columns + 1 ellipsis column) — the ad-hoc slice(0, 40) split
+		// surrogate pairs (emoji → stray U+FFFD).
+		return truncLine(line, 41);
 	}
 	return "thinking…";
 }

package/src/ui/events-state-source.ts

@@ -120,6 +120,19 @@ interface SourceInternals {
 	forceDispose(): void;
 }
 
+/** O-7 (0.11.22): a scan result of "empty" only counts as a committed compaction
+ *  when the path is a genuine regular file. A directory (or any non-regular
+ *  object) that some readers tolerate into an empty cursor must be treated as a
+ *  FAILED scan so the guard behaves identically on POSIX and Windows. Returns
+ *  false when statSync throws (missing file shares the same transient policy). */
+function isRegularFile(eventsPath: string): boolean {
+	try {
+		return fs.statSync(eventsPath).isFile();
+	} catch {
+		return false;
+	}
+}
+
 function createEventsStateSource(
 	runId: string,
 	eventsPath: string,
@@ -153,8 +166,11 @@ function createEventsStateSource(
 	}
 
 	/** STORAGE SCAN (spec U7): one parse of the (tail-capped) log to the
-	 *  current seq. No event replay — the root is rebuilt from storage. */
-	function rootBuild(): void {
+	 *  current seq. No event replay — the root is rebuilt from storage.
+	 *  O-7 (DR-04 R7): returns whether the scan SUCCEEDED — on failure the
+	 *  committed state, the inode/size stamps AND `resynced`/`version` are all
+	 *  left untouched so the next poll re-detects the rewrite and retries. */
+	function rootBuild(): boolean {
 		let scanned: TeamEvent[] | undefined;
 		let scannedSeq = 0;
 		try {
@@ -171,14 +187,23 @@ function createEventsStateSource(
 			scanned.length === 0 &&
 			scannedSeq === 0 &&
 			(seq > 0 || events.length > 0) &&
-			!fs.existsSync(eventsPath)
+			!isRegularFile(eventsPath)
 		) {
 			// readEventsCursor reports a MISSING log as an empty cursor — but a
-			// log that carried committed events a beat ago and now does not exist
-			// is a transient disappearance (run dir moving / the rename→wx-create
-			// window of rotation), NOT a compaction to empty. Keep the committed
-			// state — same policy as poll()'s miss-file branch — and keep the inode
-			// stamp so the next poll re-detects the rewrite and retries the resync.
+			// log that carried committed events a beat ago and now is not a
+			// readable regular file is a transient disappearance (run dir moving /
+			// the rename→wx-create window of rotation) OR an unreadable anomaly
+			// (a directory/torn state some readers tolerate into an empty result),
+			// NOT a compaction to empty. Keep the committed state — same policy as
+			// poll()'s miss-file branch — and keep the inode stamp so the next poll
+			// re-detects the rewrite and retries the resync.
+			//
+			// O-7 platform parity (0.11.22 CI): this guard used `!fs.existsSync`,
+			// which is TRUE for a directory — Windows' reader tolerates an EISDIR
+			// open into an empty cursor while POSIX throws, so the same replacement
+			// committed an empty root on Windows and returned false on Linux.
+			// Requiring a regular file makes the failed-scan verdict OS-uniform
+			// while a genuine compaction-to-empty (regular empty file) still commits.
 			scanned = undefined;
 		}
 		// Stamp the inode/size the root was built from so the FIRST poll after
@@ -186,30 +211,43 @@ function createEventsStateSource(
 		// instead of learning the inode one poll late. Stamp ONLY on a successful
 		// scan — on a failed scan keep the previous stamp so the next poll
 		// re-detects the rewrite and RETRIES the resync.
-		if (scanned !== undefined) {
-			try {
-				const stat = fs.statSync(eventsPath);
-				lastIno = stat.ino;
-				lastSize = stat.size;
-			} catch {
-				lastIno = -1;
-				lastSize = -1;
-			}
-			events = scanned.slice(-windowSize);
-			seq = scannedSeq;
+		if (scanned === undefined) {
+			// O-7: failed scan — do NOT claim a fresh root: `resynced`/`version`
+			// stay untouched and no resync frame is emitted (see resyncAttempt).
+			return false;
+		}
+		try {
+			const stat = fs.statSync(eventsPath);
+			lastIno = stat.ino;
+			lastSize = stat.size;
+		} catch {
+			lastIno = -1;
+			lastSize = -1;
 		}
+		events = scanned.slice(-windowSize);
+		seq = scannedSeq;
 		resynced = true;
 		version += 1;
+		return true;
 	}
 
-	function resync(): EventsStateSnapshot {
-		const fromSeq = seq;
-		rootBuild();
+	/** Root-replace and emit ONE resync frame. Returns false (state untouched,
+	 *  no frame) when the storage scan failed — O-7: a failed resync must not
+	 *  count as a committed frame. `stats.resyncs` counts ATTEMPTS either way
+	 *  (MINOR-1 contract: "the resync attempt still counts"). */
+	function resyncAttempt(): boolean {
 		stats.resyncs += 1;
+		const fromSeq = seq;
+		if (!rootBuild()) return false;
 		stats.frames += 1;
 		const frame: EventsStateFrame = { fromSeq, toSeq: seq, events: [...events], version, resync: true };
 		stats.eventsDelivered += frame.events.length;
 		emit(frame);
+		return true;
+	}
+
+	function resync(): EventsStateSnapshot {
+		resyncAttempt();
 		return snapshot();
 	}
 
@@ -224,10 +262,11 @@ function createEventsStateSource(
 		try {
 			const stat = fs.statSync(eventsPath);
 			if (lastIno !== -1 && (stat.ino !== lastIno || stat.size < lastSize)) {
-				lastIno = stat.ino;
-				lastSize = stat.size;
-				resync();
-				return 1;
+				// O-7: do NOT stamp the NEW inode/size before the resync — if the
+				// scan inside fails, the OLD stamps are exactly what makes the
+				// next poll re-detect the rewrite and retry it. rootBuild()
+				// stamps after a successful scan.
+				return resyncAttempt() ? 1 : 0;
 			}
 			lastIno = stat.ino;
 			lastSize = stat.size;
@@ -262,8 +301,8 @@ function createEventsStateSource(
 					backlog = false;
 				}
 				if (backlog) {
-					resync();
-					return committed + 1;
+					// O-7: count the resync frame only when the root scan succeeded.
+					return committed + (resyncAttempt() ? 1 : 0);
 				}
 				break;
 			}

package/src/ui/inline-panel/agent-pane.ts

@@ -86,6 +86,9 @@ export class CrewAgentPane {
 	private readonly paneOptions: CrewAgentPaneOptions | undefined;
 	/** Current agent target, read fresh from the panel store each render. */
 	private currentTaskId: string | undefined;
+	/** Run of {@link currentTaskId} — F3: the pane's switch guard is run-scoped
+	 *  so the same-named task in another run resets the transcript state. */
+	private currentRunId: string | undefined;
 	/** Cached manifest for the current run, to avoid re-reading on every tick. */
 	private cachedRunId: string | undefined;
 	private cachedManifest: TeamRunManifest | undefined;
@@ -294,11 +297,15 @@ export class CrewAgentPane {
 		const viewed = getViewedAgent();
 		if (!viewed) return [];
 
-		// Detect agent switch: reset the transcript cursor so the pane shows
-		// the new agent's full history instead of continuing from the old cursor.
-		if (this.currentTaskId !== viewed.taskId) {
-			resetAgentTranscriptCursor(viewed.taskId);
+		// Detect agent switch (F3: run OR task — task ids are positional per
+		// run, so a taskId-only guard let a same-named task in another run
+		// reuse the stale cursor/buffer): reset the transcript cursor so the
+		// pane shows the new agent's full history instead of continuing from
+		// the old cursor.
+		if (this.currentTaskId !== viewed.taskId || this.currentRunId !== viewed.runId) {
+			resetAgentTranscriptCursor(viewed.runId, viewed.taskId);
 			this.currentTaskId = viewed.taskId;
+			this.currentRunId = viewed.runId;
 			this.scrollBack = 0;
 			this.lastItems = [];
 			this.lastTranscriptReadAt = 0;
@@ -371,8 +378,8 @@ export class CrewAgentPane {
 		this.unsubscribePanel();
 		this.cachedManifest = undefined;
 		this.cachedRunId = undefined;
-		// Free the per-task transcript ring buffer (≤500 items with full
+		// Free the per-run::task transcript ring buffer (≤500 items with full
 		// message bodies) instead of retaining it for process lifetime.
-		if (this.currentTaskId) resetAgentTranscriptCursor(this.currentTaskId);
+		if (this.currentRunId && this.currentTaskId) resetAgentTranscriptCursor(this.currentRunId, this.currentTaskId);
 	}
 }