pi-crew 0.11.21 → 0.11.22

package/src/ui/inline-panel/agent-transcript.ts

@@ -13,8 +13,8 @@
  * detached spawner, so a memory feed would show an empty pane for exactly the
  * runs users background. Disk works for both with one parser.
  *
- * Per task, a module-level ring buffer accumulates parsed items across reads
- * (cursor + persisted parse state), mirroring pi-subtask's `fork.transcript`.
+ * Per run::task (F3), a module-level ring buffer accumulates parsed items across
+ * reads (cursor + persisted parse state), mirroring pi-subtask's `fork.transcript`.
  * This matters for two reasons the naive delta-read gets wrong:
  *  - tool `start`/`end` events can straddle a read boundary, so the
  *    unmatched-start map must survive between reads;
@@ -83,13 +83,20 @@ export type CrewTranscriptItem =
 
 type PendingTool = CrewTranscriptItem & { type: "tool" };
 
-/** Per-task parse state, persisted across reads. */
+/** Per-run::task parse state, persisted across reads (F3: keyed by run —
+ *  task ids are positional per run, so a taskId-only key would let the same
+ *  task name in a LATER run reuse the earlier run's cursor/buffer). */
 const buffers = new Map<string, CrewTranscriptItem[]>();
 const pendingByTask = new Map<string, Map<string, PendingTool>>();
 const cursors = new Map<string, number>();
-/** Tasks whose worker prompt has been prepended to the buffer. */
+/** Run::task keys whose worker prompt has been prepended to the buffer. */
 const promptSeeded = new Set<string>();
 
+/** F3 (DR-02 wave 2): module-state key — `${runId}::${taskId}`. */
+function transcriptStateKey(runId: string | undefined, taskId: string): string {
+	return `${runId ?? ""}::${taskId}`;
+}
+
 /**
  * The child pi never logs its INITIAL user message (input is not an event),
  * so the transcript would open on the first assistant message — unlike a
@@ -287,14 +294,15 @@ function matchPending(
  * cursor skips re-parse and the existing buffer is returned as-is.
  */
 export function readAgentTranscript(manifest: TeamRunManifest, taskId: string): CrewTranscriptItem[] {
-	const sinceSeq = cursors.get(taskId) ?? 0;
+	const key = transcriptStateKey(manifest.runId, taskId);
+	const sinceSeq = cursors.get(key) ?? 0;
 	const { events, nextSeq } = readCrewAgentEventsCursor(manifest, taskId, { sinceSeq });
-	if (nextSeq > sinceSeq) cursors.set(taskId, nextSeq);
+	if (nextSeq > sinceSeq) cursors.set(key, nextSeq);
 
-	let buffer = buffers.get(taskId) ?? [];
+	let buffer = buffers.get(key) ?? [];
 	if (events.length > 0) {
-		const pending = pendingByTask.get(taskId) ?? new Map<string, PendingTool>();
-		pendingByTask.set(taskId, pending);
+		const pending = pendingByTask.get(key) ?? new Map<string, PendingTool>();
+		pendingByTask.set(key, pending);
 
 		for (const record of events) {
 			const parsed = asRecord(record);
@@ -302,26 +310,29 @@ export function readAgentTranscript(manifest: TeamRunManifest, taskId: string):
 			buffer.push(...parseEventRecord(parsed, pending));
 		}
 	}
-	if (buffer.length > 0 && !promptSeeded.has(taskId)) {
+	if (buffer.length > 0 && !promptSeeded.has(key)) {
 		const prompt = readWorkerPrompt(manifest, taskId);
 		if (prompt !== undefined) {
-			promptSeeded.add(taskId);
+			promptSeeded.add(key);
 			buffer.unshift({ type: "user", text: prompt, seq: 0 });
 		}
 	}
 	if (buffer.length > MAX_TRANSCRIPT_ITEMS) {
 		buffer = buffer.slice(buffer.length - MAX_TRANSCRIPT_ITEMS);
 	}
-	buffers.set(taskId, buffer);
+	buffers.set(key, buffer);
 	return buffer;
 }
 
-/** Drop everything learned about a task (used when the pane switches agents). */
-export function resetAgentTranscriptCursor(taskId: string): void {
-	cursors.delete(taskId);
-	buffers.delete(taskId);
-	pendingByTask.delete(taskId);
-	promptSeeded.delete(taskId);
+/** Drop everything learned about a run's task (used when the pane switches
+ *  agents or runs — F3: scoped to the run so switching runs never leaves the
+ *  old run's ring buffer reachable under the new one's key). */
+export function resetAgentTranscriptCursor(runId: string, taskId: string): void {
+	const key = transcriptStateKey(runId, taskId);
+	cursors.delete(key);
+	buffers.delete(key);
+	pendingByTask.delete(key);
+	promptSeeded.delete(key);
 }
 
 /** Clear all per-task state (session teardown / test isolation). */
@@ -332,7 +343,8 @@ export function resetAllAgentTranscriptCursors(): void {
 	promptSeeded.clear();
 }
 
-/** Test-only: whether the module currently holds state for a task. */
-export function __hasAgentTranscriptState(taskId: string): boolean {
-	return buffers.has(taskId) || cursors.has(taskId) || pendingByTask.has(taskId);
+/** Test-only: whether the module currently holds state for a run's task. */
+export function __hasAgentTranscriptState(runId: string, taskId: string): boolean {
+	const key = transcriptStateKey(runId, taskId);
+	return buffers.has(key) || cursors.has(key) || pendingByTask.has(key);
 }

package/src/ui/inline-panel/agent-view-overlay.ts

@@ -37,11 +37,25 @@ export interface CrewAgentOverlayOptions {
 const INPUT_PROMPT = " ❯ ";
 
 /** Printable single keypress or paste chunk: no control bytes, no ESC
- *  sequences (arrow keys etc. must not land in the steer text). */
-function isPrintableInput(data: string): boolean {
+ *  sequences (arrow keys etc. must not land in the steer text).
+ *
+ *  R7-14 (DR-04): shared with mailbox-compose-overlay — its free-text
+ *  passthrough previously accepted only single chars, so a multi-char
+ *  bracketed-paste chunk ("hello world") was dropped. */
+export function isPrintableInput(data: string): boolean {
 	return data.length > 0 && !data.startsWith("\x1b") && !/[\x00-\x1f\x7f]/.test(data);
 }
 
+/** O-4 (DR-04): surrogate-safe backspace for editors that edit at
+ *  end-of-value. When the LAST UTF-16 unit is a low surrogate it completes a
+ *  pair — remove BOTH units so astral characters (emoji) never split into a
+ *  stray high surrogate / U+FFFD. Shared with mailbox-compose-overlay. */
+export function backspaceChar(text: string): string {
+	const last = text.length > 0 ? text.charCodeAt(text.length - 1) : 0;
+	if (last >= 0xdc00 && last <= 0xdfff && text.length >= 2) return text.slice(0, -2);
+	return text.slice(0, -1);
+}
+
 export class CrewAgentOverlay {
 	/** The transcript core; exposed so the host can wire scroll/steer keys. */
 	readonly pane: CrewAgentPane;
@@ -136,7 +150,8 @@ export class CrewAgentOverlay {
 			} else if (matchesKey(data, "return")) {
 				this.sendSteer();
 			} else if (matchesKey(data, "backspace")) {
-				this.inputText = this.inputText.slice(0, -1);
+				// O-4: astral-safe backspace (shared helper).
+				this.inputText = backspaceChar(this.inputText);
 			} else if (data === "\x03") {
 				// ctrl+c inside steer input cancels the input, not the view.
 				this.inputMode = false;

package/src/ui/inline-panel/index.ts

@@ -47,6 +47,13 @@ const PANE_LIVE_TICK_MS = 700;
 
 let livePane: CrewAgentPane | undefined;
 let liveOverlay: CrewAgentOverlay | undefined;
+/** O-6 (DR-04 R7): double-mount guard — true between the `ctx.ui.custom()`
+ *  call and the moment its factory actually runs (or the call rejects). A
+ *  second openPane in exactly that window (key-mash, dock re-entry, rapid
+ *  `/crew-view`) would otherwise mount a SECOND full-screen overlay on top
+ *  of the first. Cleared by the factory (overlay live), by rejection (state
+ *  reset below) and on the custom() promise settling (overlay closed). */
+let paneMounting = false;
 let paneTickTimer: ReturnType<typeof setInterval> | undefined;
 let editorInstalled = false;
 /** Guards the one-time per-process event hooks. */
@@ -124,7 +131,8 @@ function notifyResult(ctx: ExtensionContext, result: PiTeamsToolResult): void {
  */
 function openPane(ctx: ExtensionContext, target: PanelTarget): void {
 	setViewedAgent(target);
-	if (!liveOverlay) {
+	if (!liveOverlay && !paneMounting) {
+		paneMounting = true;
 		try {
 			void ctx.ui
 				.custom(
@@ -145,6 +153,9 @@ function openPane(ctx: ExtensionContext, target: PanelTarget): void {
 						});
 						liveOverlay = overlay;
 						livePane = overlay.pane;
+						// O-6: the factory ran — the mount window is over; from here on
+						// the `!liveOverlay` check alone owns re-entry.
+						paneMounting = false;
 						return overlay as never;
 					},
 					{
@@ -152,10 +163,17 @@ function openPane(ctx: ExtensionContext, target: PanelTarget): void {
 						overlayOptions: { width: "100%", margin: 0, maxHeight: "100%", anchor: "top-left" },
 					},
 				)
+				.then(() => {
+					// Resolves when the host tears the overlay down (done()) — the
+					// mount window is definitely over (belt and braces for a host
+					// that never invoked the factory).
+					paneMounting = false;
+				})
 				.catch((error) => {
 					// Factory throw or the host tearing the overlay down: drop the
 					// view state so the dock does not point at a view that no
 					// longer exists.
+					paneMounting = false;
 					liveOverlay = undefined;
 					livePane = undefined;
 					setViewedAgent(undefined);
@@ -163,6 +181,7 @@ function openPane(ctx: ExtensionContext, target: PanelTarget): void {
 					logInternalError("view.openOverlay", error, target.taskId);
 				});
 		} catch (error) {
+			paneMounting = false;
 			// A stale ctx (session replaced between keypress and here) drops the
 			// overlay spawn; the fallback editor path still closes cleanly.
 			logInternalError("view.openPane", error, target.taskId);
@@ -326,6 +345,7 @@ export function installInlinePanel(pi: ExtensionAPI, ctx: ExtensionContext, uiCo
 export function __resetInlinePanelForTest(): void {
 	editorInstalled = false;
 	liveOverlay = undefined;
+	paneMounting = false;
 	stopPaneTicker();
 }
 

package/src/ui/live-run-sidebar.ts

@@ -117,9 +117,10 @@ export class LiveRunSidebar {
 		agents: ReturnType<typeof readCrewAgents>,
 		waitingCount: number,
 		snapshot?: RunUiSnapshot,
+		countdownBucket = "",
 	): string {
 		const animation = agents.some((agent) => agent.status === "running") ? `:spin=${spinnerBucket()}` : "";
-		if (snapshot) return `${snapshot.signature}:${waitingCount}${animation}`;
+		if (snapshot) return `${snapshot.signature}:${waitingCount}${animation}${countdownBucket}`;
 		const taskSig = tasks
 			.map(
 				(task) =>
@@ -143,7 +144,17 @@ export class LiveRunSidebar {
 				].join(":"),
 			)
 			.join("|");
-		return `${manifestStatus}|${agents.length}|${waitingCount}|${taskSig}|${agentSig}${animation}`;
+		return `${manifestStatus}|${agents.length}|${waitingCount}|${taskSig}|${agentSig}${animation}${countdownBucket}`;
+	}
+
+	/** F5 (DR-02 wave 2): while the terminal auto-close countdown is armed, a
+	 *  coarse per-second bucket joins the render signature — the base signature
+	 *  only changes on state, so the countdown line used to freeze inside
+	 *  cachedLines until some OTHER state changed. The close timer itself is
+	 *  untouched (L4 fixed-deadline semantics stay exactly as they were). */
+	private autoCloseSignatureFragment(): string {
+		if (this.hasAutoClosed || this.autoCloseDeadline === undefined) return "";
+		return `:close=${Math.ceil(Math.max(0, this.autoCloseDeadline - Date.now()) / 1000)}`;
 	}
 
 	private colorLine(line: string): string {
@@ -231,7 +242,7 @@ export class LiveRunSidebar {
 		const active = agents.filter((agent) => agent.status === "running");
 		const completed = agents.filter((agent) => agent.status !== "running").slice(-5);
 		const waiting = tasks.filter((task) => task.status === "queued");
-		const signature = this.buildSignature(run.updatedAt, tasks, agents, waiting.length, snapshot);
+		const signature = this.buildSignature(run.updatedAt, tasks, agents, waiting.length, snapshot, this.autoCloseSignatureFragment());
 		if (signature !== this.cachedSignature || w !== this.cachedWidth) {
 			// RAIL (§2.E): the rounded `╭─╮│╰─╯` box is retired — the surface is a
 			// `┏ LIVE ▸ <run8>` canopy, `┃` body rows, `┣ SECTION` headers and a

package/src/ui/overlays/mailbox-compose-overlay.ts

@@ -26,6 +26,7 @@
 import * as piTui from "@earendil-works/pi-tui";
 import type { MailboxDirection } from "../../state/coordination/mailbox.ts";
 import { pad, sanitizeLine, truncate } from "../../utils/visual.ts";
+import { backspaceChar, isPrintableInput } from "../inline-panel/agent-view-overlay.ts";
 import { overlayActionForKey } from "../keybinding-map.ts";
 import { CURSOR, canopyLine, formatHint, RAIL, railLine, railRaw } from "../rail.ts";
 import { asCrewTheme, type CrewTheme } from "../theme-adapter.ts";
@@ -169,7 +170,9 @@ export class MailboxComposeOverlay {
 		if (field === "direction") return;
 		this.fields = {
 			...this.fields,
-			[field]: (this.fields[field] ?? "").slice(0, -1),
+			// O-4: astral-safe backspace (shared helper) — a trailing surrogate
+			// pair is one code point and must leave together.
+			[field]: backspaceChar(this.fields[field] ?? ""),
 		};
 	}
 
@@ -244,8 +247,11 @@ export class MailboxComposeOverlay {
 				else this.activeField = (this.activeField + 1) % FIELD_ORDER.length;
 				return;
 		}
-		// Free-text passthrough (unchanged): any other printable char is typed
-		// into the active field.
-		if (data.length === 1 && data >= " ") this.appendText(data);
+		// Free-text passthrough (R7-14): any other PRINTABLE input is typed into
+		// the active field — single chars AND multi-char paste chunks (the old
+		// `data.length === 1` guard dropped pasted "hello world" entirely).
+		// Shares the agent-view-overlay classifier: no control bytes, no ESC
+		// sequences, so arrow keys still never land in the field.
+		if (isPrintableInput(data)) this.appendText(data);
 	}
 }

package/src/ui/powerbar-publisher.ts

@@ -12,6 +12,7 @@ import { readJsonFileCoalesced } from "../utils/file-coalescer.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { extractSessionId } from "../utils/session-utils.ts";
 import { allWorkflows, discoverWorkflows } from "../workflows/discover-workflows.ts";
+import { truncLine } from "./format-helpers.ts";
 import { RenderCoalescer } from "./render-coalescer.ts";
 import type { RunSnapshotCache, RunUiSnapshot } from "./snapshot-types.ts";
 import { notificationBadge } from "./widget/widget-formatters.ts";
@@ -158,7 +159,9 @@ export function buildStepsPayload(active: ActiveItem[], allTasks: TeamTaskState[
 		const parts = current.phases.map((phase) => {
 			const status = phase.status === "done" ? "completed" : statusOf(phase.itemIds);
 			const icon = status === "completed" ? "✓" : status === "running" ? "→" : "○";
-			const name = phase.title.length > 10 ? `${phase.title.slice(0, 9)}…` : phase.title;
+			// O-5 (DR-04): grapheme-aware truncation — the ad-hoc slice(0, 9)
+			// split surrogate pairs (emoji phase titles → stray U+FFFD).
+			const name = truncLine(phase.title, 10);
 			return `${icon}${name}`;
 		});
 		if (parts.length) {
@@ -196,8 +199,8 @@ export function buildStepsPayload(active: ActiveItem[], allTasks: TeamTaskState[
 	for (const step of workflow.steps) {
 		const status = stepStatus.get(step.id) ?? "pending";
 		const icon = status === "completed" ? "✓" : status === "running" ? "→" : "○";
-		// Shorten long step names
-		const stepName = step.id.length > 10 ? step.id.slice(0, 9) + "…" : step.id;
+		// Shorten long step names (O-5: grapheme-aware — slice(0, 9) split emoji).
+		const stepName = truncLine(step.id, 10);
 		stepParts.push(`${icon}${stepName}`);
 	}
 	const stepsText = stepParts.join(" › ");

package/src/ui/rail.ts

@@ -107,7 +107,12 @@ export function shortId(id: string | undefined): string {
 
 export type RailSlot = "border" | "borderAccent" | "success" | "error" | "warning";
 
-/** Status → rail colour. One mapping for every surface (was: per-surface maps). */
+/** Status → rail colour. One mapping for every surface (was: per-surface maps).
+ *  F4 (DR-02 wave 2): "blocked" joins the warning tier — parity with
+ *  status-colors.ts (colorForStatus("blocked") === "warning"), so the rail no
+ *  longer falls to the neutral border while the glyph next to it is painted
+ *  warning. "planning" stays in the default border tier (informational/dim —
+ *  same tier status-colors assigns it). */
 export function statusSlot(status: string | undefined): RailSlot {
 	switch (status) {
 		case "completed":
@@ -128,6 +133,7 @@ export function statusSlot(status: string | undefined): RailSlot {
 			return "borderAccent";
 		case "waiting":
 		case "needs_attention":
+		case "blocked":
 		case "stale":
 		case "pending":
 			return "warning";

package/src/ui/render-scheduler.ts

@@ -28,6 +28,16 @@ export interface RenderSchedulerOptions {
 	 * count and re-arms the loop. Defaults to 8.
 	 */
 	maxIdleFallbackRenders?: number;
+	/**
+	 * R7-12 (DR-04): maximum time (ms) a PENDING render may be starved by a
+	 * sustained event stream. While events keep arriving faster than
+	 * `debounceMs`, every schedule() re-arms the debounce timer and the flush
+	 * would otherwise be postponed forever. At the cap the pending batch is
+	 * force-flushed — from schedule() itself and, as a safety net, from the
+	 * fallback loop. Defaults to `max(3 × debounceMs, 250)`, floored at 250 so
+	 * an explicit small override can never disable the cap entirely.
+	 */
+	maxDelayMs?: number;
 }
 
 const DEFAULT_EVENTS = [
@@ -61,6 +71,8 @@ export class RenderScheduler {
 	private readonly fallbackMs: number;
 	private readonly invalidateCoalesceMs: number;
 	private readonly maxIdleFallbackRenders: number;
+	/** R7-12: pending-starvation cap — see {@link RenderSchedulerOptions.maxDelayMs}. */
+	private readonly maxDelayMs: number;
 	private debounceTimer: ReturnType<typeof setTimeout> | undefined;
 	private fallbackTimer: ReturnType<typeof setTimeout> | undefined;
 	private invalidateTimer: ReturnType<typeof setTimeout> | undefined;
@@ -74,6 +86,9 @@ export class RenderScheduler {
 	private idleFallbackRenders = 0;
 	/** R4: consecutive re-entrancy cap-hits — drives exponential backoff. */
 	private consecutiveCapHits = 0;
+	/** R7-12: when the CURRENT pending batch was first scheduled (undefined =
+	 *  nothing pending). Reset whenever a flush actually renders. */
+	private pendingSince: number | undefined;
 	private readonly unsubs: Array<() => void> = [];
 
 	constructor(events: RenderSchedulerEventBus | undefined, render: () => void, options: RenderSchedulerOptions = {}) {
@@ -85,6 +100,7 @@ export class RenderScheduler {
 		this.fallbackMs = typeof fallback === "number" ? fallback : 750;
 		this.invalidateCoalesceMs = options.invalidateCoalesceMs ?? 50;
 		this.maxIdleFallbackRenders = options.maxIdleFallbackRenders ?? 8;
+		this.maxDelayMs = Math.max(options.maxDelayMs ?? 3 * this.debounceMs, 250);
 		for (const event of options.events ?? DEFAULT_EVENTS) this.subscribe(events, event);
 		this.fallbackTimer = setTimeout(() => this.fallbackLoop(), this.currentFallbackMs());
 		this.fallbackTimer.unref();
@@ -118,6 +134,15 @@ export class RenderScheduler {
 		if (Date.now() - this.lastEventAt < fallbackMs) {
 			// A real external event arrived recently — not idle. Keep polling.
 			this.idleFallbackRenders = 0;
+			// R7-12: BUT a sustained stream (events faster than debounceMs) keeps
+			// re-arming the debounce and the pending render starves. When the
+			// pending batch has waited past the max-delay cap, flush it HERE —
+			// this loop is the safety net for exactly that starvation (it used
+			// to refuse to render while any event was recent).
+			if (this.pendingSince !== undefined && Date.now() - this.pendingSince >= this.maxDelayMs) {
+				this.cancelDebounce();
+				this.flush();
+			}
 			this.fallbackTimer = setTimeout(() => this.fallbackLoop(), fallbackMs);
 			this.fallbackTimer.unref();
 			return;
@@ -145,7 +170,17 @@ export class RenderScheduler {
 		this.idleFallbackRenders = 0;
 		this.consecutiveCapHits = 0;
 		this.invalidate(payload);
-		this.armDebouncedRender();
+		// R7-12: mark when the CURRENT pending batch started (first schedule
+		// since the last actual render).
+		if (this.pendingSince === undefined) this.pendingSince = this.lastEventAt;
+		if (this.lastEventAt - this.pendingSince >= this.maxDelayMs) {
+			// Force flush NOW, even mid-burst: cancel the pending debounce timer
+			// (its render would be redundant) and render synchronously.
+			this.cancelDebounce();
+			this.flush();
+		} else {
+			this.armDebouncedRender();
+		}
 		// R1: if the fallback loop stopped itself after a sustained idle period,
 		// a real event means activity resumed — re-arm the safety-net loop.
 		if (!this.fallbackTimer) {
@@ -169,6 +204,13 @@ export class RenderScheduler {
 		this.debounceTimer.unref();
 	}
 
+	/** R7-12: cancel a pending debounce flush (its render would be redundant
+	 *  next to a force-flush). Does not touch lastEventAt or pendingSince. */
+	private cancelDebounce(): void {
+		if (this.debounceTimer) clearTimeout(this.debounceTimer);
+		this.debounceTimer = undefined;
+	}
+
 	/**
 	 * 1.9: forward `onInvalidate` immediately when the payload has no `runId`
 	 * (we cannot dedup it). When it carries a runId, buffer the latest payload
@@ -229,6 +271,10 @@ export class RenderScheduler {
 		}
 		this.rendering = true;
 		this.pendingRender = false;
+		// R7-12: this flush satisfies the current pending batch — the next
+		// starvation window starts at the NEXT schedule() (set after this, so a
+		// render() that synchronously schedules() still marks a fresh batch).
+		this.pendingSince = undefined;
 		let iterations = 0;
 		try {
 			do {
@@ -254,6 +300,12 @@ export class RenderScheduler {
 			} else {
 				this.consecutiveCapHits = 0;
 			}
+			// R7-12 note: the backoff drain above arms a LONG debounce while
+			// pendingRender is still true, but it never sets pendingSince — only
+			// real events (schedule()) do. Pathological render() re-entrancy
+			// without external events therefore still backs off undisturbed (R4
+			// invariant); the max-delay cap only bounds waits caused by real
+			// incoming events.
 		}
 	}
 

package/src/ui/run-action-dispatcher.ts

@@ -13,11 +13,14 @@ async function handleTeamTool(
 }
 
 import { isToolError, textFromToolResult } from "../extension/tool-result.ts";
+import { isRunLockBusyError } from "../runtime/broker/protocol/lock-busy.ts";
 import { readCrewAgents } from "../runtime/crew-agent-records.ts";
 import { exportDiagnostic } from "../runtime/diagnostic-export.ts";
+import { withRunLockSync } from "../state/coordination/locks.ts";
 import type { MailboxDirection, MailboxMessage } from "../state/coordination/mailbox.ts";
 import { appendEventBuffered } from "../state/event-log/event-log.ts";
 import { loadRunManifestById, saveRunTasks } from "../state/stores/state-store.ts";
+import type { TeamTaskState } from "../state/types.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { formatCount } from "./format-helpers.ts";
 
@@ -120,35 +123,80 @@ export function dispatchHealthRecovery(ctx: ExtensionContext, runId: string): Pr
 	});
 }
 
+/** Staleness window for the kill-stale sweep (R4-6). */
+const KILL_STALE_HEARTBEAT_MS = 60_000;
+
+/**
+ * R4-6 (DR-02 Wave 2 Cluster C): pure RMW core of the kill-stale sweep —
+ * mark running/queued tasks whose heartbeat is older than `staleMs` dead.
+ * Exported so the locked dispatcher body stays unit-testable without a
+ * harness (repo seam pattern; see state-helpers-cas-contention.test.ts).
+ * Predicate is byte-identical to the previous inline map.
+ */
+export function markStaleWorkerHeartbeatsDead(
+	tasks: readonly TeamTaskState[],
+	currentMs: number,
+	staleMs: number = KILL_STALE_HEARTBEAT_MS,
+): { tasks: TeamTaskState[]; count: number } {
+	const now = new Date(currentMs).toISOString();
+	let count = 0;
+	const updated = tasks.map((task) => {
+		if ((task.status !== "running" && task.status !== "queued") || !task.heartbeat || task.heartbeat.alive === false) return task;
+		const lastSeenMs = Date.parse(task.heartbeat.lastSeenAt);
+		if (!Number.isFinite(lastSeenMs) || currentMs - lastSeenMs <= staleMs) return task;
+		count += 1;
+		return {
+			...task,
+			heartbeat: { ...task.heartbeat, alive: false, lastSeenAt: now },
+		};
+	});
+	return { tasks: updated, count };
+}
+
 export async function dispatchKillStaleWorkers(ctx: ExtensionContext, runId: string): Promise<RunActionResult> {
 	try {
-		const loaded = loadRunManifestById(ctx.cwd, runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency;
+		const loaded = loadRunManifestById(ctx.cwd, runId);
 		if (!loaded) return { ok: false, message: `Run '${runId}' not found.` };
-		const currentMs = Date.now();
-		const staleMs = 60_000;
-		const now = new Date(currentMs).toISOString();
-		let count = 0;
-		const tasks = loaded.tasks.map((task) => {
-			if ((task.status !== "running" && task.status !== "queued") || !task.heartbeat || task.heartbeat.alive === false) return task;
-			const lastSeenMs = Date.parse(task.heartbeat.lastSeenAt);
-			if (!Number.isFinite(lastSeenMs) || currentMs - lastSeenMs <= staleMs) return task;
-			count += 1;
-			return {
-				...task,
-				heartbeat: { ...task.heartbeat, alive: false, lastSeenAt: now },
-			};
-		});
-		saveRunTasks(loaded.manifest, tasks);
+		// R4-6 (DR-02 Wave 2 Cluster C): this sweep used to be an UNLOCKED
+		// load→map→save (":125 no withRunLock - best-effort") — a cross-process
+		// writer holding the run lock (leader heartbeats, task claims, delegate
+		// flushes) could land a fresh tasks.json between our read and write and
+		// get clobbered by the STALE array. Now a run-locked RMW with the fresh
+		// re-read INSIDE the lock (R13-S1 canonical pattern, team-tool/api/heartbeat.ts).
+		// Best-effort semantics are preserved on contention: the UI never blocks —
+		// the sweep is skipped with a warn, never a stale write.
+		let applied: { tasks: TeamTaskState[]; count: number } | undefined;
+		try {
+			applied = withRunLockSync(loaded.manifest, () => {
+				const fresh = loadRunManifestById(loaded.manifest.cwd, loaded.manifest.runId);
+				if (!fresh) return undefined;
+				const result = markStaleWorkerHeartbeatsDead(fresh.tasks, Date.now());
+				// count=0 → nothing changed; skip the identical-content rewrite.
+				if (result.count > 0) saveRunTasks(fresh.manifest, result.tasks);
+				return result;
+			});
+		} catch (error) {
+			if (isRunLockBusyError(error)) {
+				logInternalError("run-action-dispatcher.killStale", error, `runId=${runId} skipped: run lock busy`, "warn");
+				return {
+					ok: false,
+					message: `Skipped kill-stale for run '${runId}': another operation holds the run lock. Try again in a moment.`,
+				};
+			}
+			throw error;
+		}
+		if (!applied) return { ok: false, message: `Run '${runId}' not found.` };
+		const message = `Marked ${applied.count} stale worker heartbeat(s) dead.`;
 		appendEventBuffered(loaded.manifest.eventsPath, {
 			type: "worker.kill_stale",
 			runId,
-			message: `Marked ${count} stale worker heartbeat(s) dead.`,
-			data: { count },
+			message,
+			data: { count: applied.count },
 		}).catch((e) => logInternalError("run_action_dispatcher.buffered", e, "type=worker.kill_stale"));
 		return {
 			ok: true,
-			message: `Marked ${count} stale worker heartbeat(s) dead.`,
-			data: { count },
+			message,
+			data: { count: applied.count },
 		};
 	} catch (error) {
 		return err(error);

package/src/ui/status-colors.ts

@@ -19,6 +19,11 @@ export function colorForStatus(status: RunStatus): CrewThemeColor {
 			return "accent";
 		case "waiting":
 			return "muted";
+		// F4 (DR-02 wave 2): "planning" was missing from BOTH palettes — it
+		// fell through to this default, which was correct-by-luck but unsigned.
+		// Informational/dim, same tier as queued's default fall-through.
+		case "planning":
+			return "dim";
 		case "completed":
 			return "success";
 		case "failed":
@@ -52,6 +57,10 @@ export function iconForStatus(status: RunStatus, options?: { runningGlyph?: stri
 			return "⏳";
 		case "queued":
 			return "◦";
+		case "planning":
+			// F4: informational — the dim dot already used for unknown-but-known
+			// states; kept in the colorizeStatusGlyphs vocabulary (dim tier).
+			return "·";
 		case "blocked":
 			return "⏸";
 		case "needs_attention":

package/src/utils/env-filter.ts

@@ -60,6 +60,14 @@ export function providerEnvKeys(modelId: string | undefined): string[] {
  * Build a scoped allowlist that includes system vars + only the provider keys
  * relevant to the assigned model (and its fallback chain).
  *
+ * R6-8 (DR-03 round-6) contract note: callers SHOULD pass the task's full
+ * candidate chain (primary + fallbacks) — child-pi-spawn.ts threads it from
+ * the executor's attempt chain. Bare model ids (no "provider/" prefix)
+ * contribute ZERO keys here (providerEnvKeys returns [] for them); scoping is
+ * never widened to all-providers to compensate — instead the spawn layer warns
+ * when a truly-bare single model resolves zero provider keys (see
+ * child-pi-spawn.ts R6-8 warn; auth.json users are unaffected).
+ *
  * @param baseAllowList - Non-provider system vars to always include
  * @param models - Model IDs to include provider keys for (primary + fallbacks)
  * @returns Combined allowlist with scoped provider keys