pi-crew 0.11.21 → 0.11.22

package/src/runtime/recovery/crash-recovery.ts

@@ -213,7 +213,18 @@ export async function applyRecoveryPlan(plan: RecoveryPlan, ctx: Pick<ExtensionC
 			return;
 		}
 
-		const reset = new Set(plan.resumableTasks);
+		// M-4 (2026-10-16): the plan was computed from a pre-hook (stale) snapshot.
+		// Filter the reset set to tasks whose FRESH status is still non-terminal — a
+		// task that completed/failed/... during the run_recovery hook gap must keep
+		// its terminal status and result (mirror of the requeue-eligibility filter
+		// in applyReconcileAtOpenFastPath). Terminal tasks pass through untouched
+		// below, so a stale plan can never requeue finished work.
+		const reset = new Set(
+			plan.resumableTasks.filter((id) => {
+				const task = fresh.tasks.find((t) => t.id === id);
+				return task !== undefined && !isTerminalTask(task);
+			}),
+		);
 		const tasks = fresh.tasks.map((task) =>
 			reset.has(task.id)
 				? {
@@ -238,10 +249,12 @@ export async function applyRecoveryPlan(plan: RecoveryPlan, ctx: Pick<ExtensionC
 			event: {
 				type: "crew.run.resumed",
 				runId: plan.runId,
-				message: `Recovered ${plan.resumableTasks.length} interrupted task(s).`,
+				message: `Recovered ${reset.size} interrupted task(s).`,
 				data: {
 					recoveredFromSeq: plan.lastEventSeq,
-					resumableTasks: plan.resumableTasks,
+					// M-4: report what was ACTUALLY reset from the fresh snapshot
+					// (terminal tasks filtered out), not what the stale plan asked for.
+					resumableTasks: [...reset],
 				},
 			},
 		};
@@ -349,15 +362,10 @@ export function cancelOrphanedRuns(
 		const loaded = loadRunManifestById(cwd, manifest.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 		if (!loaded) continue;
 
-		const hasRecentActivity = loaded.tasks.some((task) => {
-			if (task.status !== "running" && task.status !== "waiting") return false;
-			const heartbeatAt = task.heartbeat?.lastSeenAt ? new Date(task.heartbeat.lastSeenAt).getTime() : Number.NaN;
-			if (task.heartbeat?.alive !== false && Number.isFinite(heartbeatAt) && now - heartbeatAt <= staleThresholdMs) return true;
-			const activityAt = task.agentProgress?.lastActivityAt ? new Date(task.agentProgress.lastActivityAt).getTime() : Number.NaN;
-			return Number.isFinite(activityAt) && now - activityAt <= staleThresholdMs;
-		});
-
-		if (hasRecentActivity) {
+		// R7-1 (2026-10-16): the inline predicate moved to the shared
+		// `hasRecentTaskActivity` helper so purgeStaleActiveRunIndex step 6 can
+		// honor the same task-level life evidence this path has always honored.
+		if (hasRecentTaskActivity(loaded.tasks, now, staleThresholdMs)) {
 			skipped.push(manifest.runId);
 			continue;
 		}
@@ -385,6 +393,27 @@ export function cancelOrphanedRuns(
 				return;
 			}
 
+			// R7-6 (2026-10-16): status is still "running", but that alone is not
+			// revalidation — re-derive EVERY liveness input the cancel decision was
+			// built on from this FRESH snapshot (manifest.updatedAt / heartbeat.json
+			// mtime / async pid / task heartbeats). A `team resume` that adopted the
+			// run between the pre-lock scan and this lock rewrote exactly those inputs;
+			// cancelling here would false-cancel a run that is alive again (and then
+			// terminate its live agents).
+			if (hasFreshLivenessEvidence(fresh, now, staleThresholdMs)) {
+				// U2 (2026-10-10): SYNC append — cancelOrphanedRuns is a sync API with no
+				// await boundary to flush an async append.
+				appendEvent(loaded.manifest.eventsPath, {
+					type: "crew.run.orphan_skip",
+					runId: manifest.runId,
+					message:
+						"Skipped orphan cancellation: fresh liveness evidence observed under the run lock (run re-adopted or still active)",
+					data: { reason: "fresh_liveness_under_lock" },
+				});
+				skipped.push(manifest.runId);
+				return;
+			}
+
 			const now_iso = new Date(now).toISOString();
 			const repairedTasks = fresh.tasks.map((task) => {
 				if (task.status === "running" || task.status === "queued" || task.status === "waiting") {
@@ -516,6 +545,48 @@ function hasRecentLifeEvidence(
 	return false;
 }
 
+/**
+ * R7-1 (2026-10-16): TASK-level life evidence — true when any running/waiting
+ * task has a live heartbeat or agent progress within `staleThresholdMs`.
+ * A DWF-foreground run (run.ts → runDynamicWorkflow) writes NO team-level
+ * heartbeat.json and never touches manifest.updatedAt while a long subagent
+ * step executes, so a fresh task heartbeat can be the ONLY signal proving the
+ * run is alive. Extracted from cancelOrphanedRuns so the purge path
+ * (purgeStaleActiveRunIndex step 6) honors exactly the same evidence.
+ */
+function hasRecentTaskActivity(tasks: TeamTaskState[], now: number, staleThresholdMs: number): boolean {
+	return tasks.some((task) => {
+		if (task.status !== "running" && task.status !== "waiting") return false;
+		const heartbeatAt = task.heartbeat?.lastSeenAt ? new Date(task.heartbeat.lastSeenAt).getTime() : Number.NaN;
+		if (task.heartbeat?.alive !== false && Number.isFinite(heartbeatAt) && now - heartbeatAt <= staleThresholdMs) return true;
+		const activityAt = task.agentProgress?.lastActivityAt ? new Date(task.agentProgress.lastActivityAt).getTime() : Number.NaN;
+		return Number.isFinite(activityAt) && now - activityAt <= staleThresholdMs;
+	});
+}
+
+/**
+ * R7-6 (2026-10-16): under-lock liveness revalidation. Proving
+ * `status === "running"` on the in-lock re-read is NOT enough: a concurrent
+ * `team resume` that adopted the run between the pre-lock scan and lock
+ * acquisition rewrote the very liveness inputs the cancel decision was built
+ * on. Re-derive them from the FRESH snapshot — any ONE of these is sufficient
+ * evidence the run came back to life and the cancel must abort:
+ *   - fresh on-disk `manifest.updatedAt` and/or team `heartbeat.json` mtime
+ *     (the same corroboration `hasRecentLifeEvidence` applies pre-lock),
+ *   - a fresh/repopulated async worker PID that is ALIVE (re-dispatch),
+ *   - fresh task heartbeats / agent progress (DWF-foreground evidence).
+ */
+function hasFreshLivenessEvidence(
+	fresh: { manifest: TeamRunManifest; tasks: TeamTaskState[] },
+	now: number,
+	staleThresholdMs: number,
+): boolean {
+	if (hasRecentLifeEvidence(fresh.manifest, fresh.manifest.updatedAt, now, staleThresholdMs)) return true;
+	const pid = fresh.manifest.async?.pid;
+	if (pid !== undefined && checkProcessLiveness(pid).alive) return true;
+	return hasRecentTaskActivity(fresh.tasks, now, staleThresholdMs);
+}
+
 /**
  * Purge the global active-run-index of entries whose manifest is no longer active.
  *
@@ -628,6 +699,7 @@ export function purgeStaleActiveRunIndex(
 				// repaired-tasks write and the manifest-status flip. terminateLiveAgentsForRun
 				// is fire-and-forget so it stays OUTSIDE the lock to avoid blocking the
 				// critical section on async IPC.
+				let abortedFreshLiveness = false;
 				try {
 					const fullLoaded = loadRunManifestById(entry.cwd, entry.runId);
 					if (fullLoaded) {
@@ -637,6 +709,23 @@ export function purgeStaleActiveRunIndex(
 							const fresh = loadRunManifestById(entry.cwd, entry.runId);
 							if (!fresh) return;
 							if (fresh.manifest.status !== "running") return;
+							// R7-6 (2026-10-16): under-lock liveness revalidation — the pre-lock
+							// gate used inputs read BEFORE the lock; a concurrent `team resume`
+							// adoption may have rewritten them in that window (fresh
+							// manifest.updatedAt / re-populated live pid / fresh task heartbeats).
+							// Fresh evidence → abort WITHOUT cancelling and KEEP the registry
+							// entry (it is the live-claim signal G12 relies on).
+							if (hasFreshLivenessEvidence(fresh, now, staleThresholdMs)) {
+								abortedFreshLiveness = true;
+								appendEvent(fresh.manifest.eventsPath, {
+									type: "crew.run.orphan_skip",
+									runId: entry.runId,
+									message:
+										"Skipped purge cancellation: fresh liveness evidence observed under the run lock (run re-adopted or still active)",
+									data: { reason: "fresh_liveness_under_lock" },
+								});
+								return;
+							}
 							const now_iso = new Date(now).toISOString();
 							const repairedTasks = fresh.tasks.map((task) => {
 								if (task.status === "running" || task.status === "queued" || task.status === "waiting") {
@@ -659,18 +748,29 @@ export function purgeStaleActiveRunIndex(
 							}
 							updateRunStatus(fresh.manifest, "cancelled", "Orphaned run: worker process dead and no recent activity");
 						});
-						void terminateLiveAgentsForRun(
-							fullLoaded.manifest.runId,
-							"cancelled",
-							appendEvent,
-							fullLoaded.manifest.eventsPath,
-						).catch((error) =>
-							logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`, "warn"),
-						);
+						// R7-6: only terminate live agents when the cancel actually landed —
+						// an aborted (fresh-evidence) run is alive; terminating it would kill
+						// the run we just decided to keep.
+						if (!abortedFreshLiveness) {
+							void terminateLiveAgentsForRun(
+								fullLoaded.manifest.runId,
+								"cancelled",
+								appendEvent,
+								fullLoaded.manifest.eventsPath,
+							).catch((error) =>
+								logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`, "warn"),
+							);
+						}
 					}
 				} catch {
 					// Best-effort manifest cleanup
 				}
+				// R7-6: a fresh-evidence abort means the run is alive again — KEEP the
+				// registry entry (live-claim signal) instead of unregistering it.
+				if (abortedFreshLiveness) {
+					kept.push(entry.runId);
+					continue;
+				}
 				unregisterActiveRun(entry.runId);
 				purged.push(entry.runId);
 				continue;
@@ -681,14 +781,44 @@ export function purgeStaleActiveRunIndex(
 		// manifest was never updated to a terminal status after the worker exited.
 		// Uses the same life-evidence corroboration as condition 5; the stateRoot is
 		// kept on cancel so the run stays queryable/resumable with diagnostics.
+		// R7-1 (2026-10-16): step 6 now also honors TASK-level life evidence
+		// (hasRecentTaskActivity), making it symmetric with cancelOrphanedRuns.
+		// A DWF-foreground run (run.ts → runDynamicWorkflow) writes neither
+		// heartbeat.json nor manifest.updatedAt while a long subagent step
+		// executes — only its task heartbeats prove liveness. Without this check
+		// a subagent step longer than staleThresholdMs was false-cancelled
+		// (tasks cancelled + run flipped terminal + registry entry dropped)
+		// while the worker was still running; a later `team resume` then
+		// double-dispatched the live run.
 		if (manifest?.status === "running" && manifest.async === undefined) {
 			if (!hasRecentLifeEvidence(entry, manifest.updatedAt, now, staleThresholdMs)) {
+				let cancelledUnderLock = false;
+				let abortedFreshLiveness = false;
 				try {
 					const fullLoaded = loadRunManifestById(entry.cwd, entry.runId);
 					if (fullLoaded && fullLoaded.manifest.status === "running") {
 						withRunLockSync(fullLoaded.manifest, () => {
 							const fresh = loadRunManifestById(entry.cwd, entry.runId);
 							if (fresh?.manifest.status !== "running") return;
+							// R7-6 (2026-10-16): under-lock liveness revalidation — the pre-lock
+							// gate used inputs read BEFORE the lock; a concurrent `team resume`
+							// adoption may have rewritten them in that window (fresh
+							// manifest.updatedAt / re-populated live pid / fresh task heartbeats).
+							// Fresh evidence → abort WITHOUT cancelling and KEEP the registry
+							// entry (it is the live-claim signal G12 relies on). This ALSO covers
+							// R7-1’s task-heartbeat evidence: hasFreshLivenessEvidence consults
+							// hasRecentTaskActivity on this FRESH in-lock snapshot.
+							if (hasFreshLivenessEvidence(fresh, now, staleThresholdMs)) {
+								abortedFreshLiveness = true;
+								appendEvent(fresh.manifest.eventsPath, {
+									type: "crew.run.orphan_skip",
+									runId: entry.runId,
+									message:
+										"Skipped purge cancellation: fresh liveness evidence observed under the run lock (run re-adopted or still active)",
+									data: { reason: "fresh_liveness_under_lock" },
+								});
+								return;
+							}
 							const now_iso = new Date(now).toISOString();
 							const repairedTasks = fresh.tasks.map((task) => {
 								if (task.status === "running" || task.status === "queued" || task.status === "waiting") {
@@ -716,19 +846,31 @@ export function purgeStaleActiveRunIndex(
 									Math.round(staleThresholdMs / 60000) +
 									" minutes",
 							);
+							cancelledUnderLock = true;
 						});
-						void terminateLiveAgentsForRun(
-							fullLoaded.manifest.runId,
-							"cancelled",
-							appendEvent,
-							fullLoaded.manifest.eventsPath,
-						).catch((error) =>
-							logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`, "warn"),
-						);
+						// R7-1/R7-6: only terminate live agents when the cancel actually landed
+						// under the lock — an aborted (fresh-evidence) run is alive; terminating
+						// it would kill the run we just decided to keep.
+						if (cancelledUnderLock) {
+							void terminateLiveAgentsForRun(
+								fullLoaded.manifest.runId,
+								"cancelled",
+								appendEvent,
+								fullLoaded.manifest.eventsPath,
+							).catch((error) =>
+								logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`, "warn"),
+							);
+						}
 					}
 				} catch {
 					// Best-effort
 				}
+				// R7-1/R7-6: a fresh-evidence abort means the run is alive again — KEEP
+				// the registry entry (live-claim signal) instead of unregistering it.
+				if (abortedFreshLiveness) {
+					kept.push(entry.runId);
+					continue;
+				}
 				unregisterActiveRun(entry.runId);
 				purged.push(entry.runId);
 				continue;

package/src/runtime/rpc/rpc-worker.ts

@@ -127,6 +127,18 @@ export function resolveRpcTurnTimeoutMs(read: (name: string) => number | undefin
 interface SettleTracking {
 	lastAssistantText: string | undefined;
 	settled: boolean;
+	/** DR-01 P0 completeness: an assistant `message_end` was observed at all
+	 *  (guards the empty-settle stamp when a session produced no assistant
+	 *  turn — spawn-level failures have their own error channels). */
+	sawAssistantMessageEnd: boolean;
+	/** DR-01 P0 completeness: true when the LAST assistant `message_end` had
+	 *  non-empty text — mirrors ParsedPiJsonOutput.settledWithoutAnswer for
+	 *  the RPC transport, which has NO transcript file (stdio-only per README
+	 *  "Limitations"), so the attemptErrorFor settledWithoutAnswer branch
+	 *  cannot see this path. Upstream 429 exhaustion ends the turn with EMPTY
+	 *  assistant messages while lastAssistantText keeps an early pre-outage
+	 *  sentence — the same "finalText lies" shape as the stdio false-green. */
+	lastAssistantMessageEndHadText: boolean;
 	/**
 	 * DR5 double-execution guard: true once ANY session event other than
 	 * `agent_settled` (message_start / message_end / extension_error / …)
@@ -165,7 +177,13 @@ function extractAssistantText(message: unknown): string | undefined {
  * (error field), never a throw from the transport itself.
  */
 export async function runRpcWorker(input: RpcWorkerInput): Promise<ChildPiRunResult> {
-	const tracking: SettleTracking = { lastAssistantText: undefined, settled: false, agentStarted: false };
+	const tracking: SettleTracking = {
+		lastAssistantText: undefined,
+		settled: false,
+		sawAssistantMessageEnd: false,
+		lastAssistantMessageEndHadText: false,
+		agentStarted: false,
+	};
 	let settleResolve: (() => void) | undefined;
 	const settledPromise = new Promise<void>((resolve) => {
 		settleResolve = resolve;
@@ -185,6 +203,14 @@ export async function runRpcWorker(input: RpcWorkerInput): Promise<ChildPiRunRes
 			const record = event as { type?: unknown; message?: unknown };
 			if (record?.type === "message_end") {
 				const text = extractAssistantText(record.message);
+				const isAssistant =
+					typeof record.message === "object" &&
+					record.message !== null &&
+					(record.message as { role?: unknown }).role === "assistant";
+				if (isAssistant) {
+					tracking.sawAssistantMessageEnd = true;
+					tracking.lastAssistantMessageEndHadText = text !== undefined;
+				}
 				if (text !== undefined) tracking.lastAssistantText = text;
 			} else if (record?.type === "agent_settled") {
 				tracking.settled = true;
@@ -262,6 +288,23 @@ export async function runRpcWorker(input: RpcWorkerInput): Promise<ChildPiRunRes
 	if (runError) result.error = runError;
 	else if (abortError && !tracking.settled) result.error = `rpc abort failed: ${abortError.message}`;
 	if (tracking.lastAssistantText !== undefined) result.rawFinalText = tracking.lastAssistantText;
+	// DR-01 P0 completeness: empty-settle on the RPC transport. No transcript
+	// file exists here, so the attemptErrorFor settledWithoutAnswer branch
+	// cannot see this path — stamp the same retryable error from live
+	// tracking. Gates: no prior error (spawn/abort precedence), the turn
+	// actually settled, an assistant message_end was observed with EMPTY
+	// text, and the caller did not abort (an aborted turn must not burn a
+	// fallback model). rpcAgentStarted (set below) keeps
+	// isEarlyRpcTransportFailure from falling back to stdio for this error.
+	if (
+		!result.error &&
+		tracking.settled &&
+		tracking.sawAssistantMessageEnd &&
+		!tracking.lastAssistantMessageEndHadText &&
+		!input.signal?.aborted
+	) {
+		result.error = "Model settled without a final answer (rpc: empty final assistant message; upstream rate-limit/429 exhaustion)";
+	}
 	// DR5 bridge: explicit result field (NOT an error-string marker) so the
 	// non-retryable contract is testable and greppable — isEarlyRpcTransportFailure
 	// consults it (run-worker.ts). Set whenever the agent turn had begun.

package/src/runtime/scheduling/run-coalesced-task-group.ts

@@ -4,10 +4,13 @@ import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import { loadRunManifestById, saveRunTasksAsync, updateRunStatus } from "../../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
+import { logInternalError } from "../../utils/internal-error.ts";
 import type { WorkflowStep } from "../../workflows/workflow-config.ts";
+import type { ChildPiRunResult } from "../child-pi/child-pi.ts";
 import { appendDeadletter } from "../deadletter.ts";
 import { createWorkerHeartbeat, touchWorkerHeartbeat } from "../heartbeat/worker-heartbeat.ts";
 import type { CrewRuntimeMode } from "../model/runtime-resolver.ts";
+import { parsePiJsonOutput } from "../output/pi-json-output.ts";
 import type { RetryPolicy } from "../recovery/retry-executor.ts";
 import { DEFAULT_RETRY_POLICY, executeWithRetry } from "../recovery/retry-executor.ts";
 import { permissionForRole } from "../role-permission.ts";
@@ -148,8 +151,17 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 					if (finalWriteStarted) {
 						try {
 							await repairGroupTerminalWrite(manifest, taskIds, updatedTasks);
-						} catch {
-							// best-effort repair — same swallow policy as the heartbeat.
+						} catch (error) {
+							// E1 (DR-02): still best-effort (must not throw into the
+							// interval), but a swallowed failure leaves STALE terminal
+							// status on disk with no trace — surface it at warn so the
+							// tasks.json-vs-events.jsonl divergence is diagnosable.
+							logInternalError(
+								"run-coalesced.repair-terminal-write",
+								error,
+								`runId=${manifest.runId} taskIds=${taskIds.join(",")}`,
+								"warn",
+							);
 						}
 					}
 				}
@@ -191,7 +203,7 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 				timeoutHandle.unref?.();
 			}
 			try {
-				return await runWorker({
+				const workerResult = await runWorker({
 					cwd: firstTask.cwd,
 					task: combinedPrompt,
 					agent,
@@ -209,6 +221,12 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 						workerPid = pid;
 					},
 				});
+				// DR-02 WI-1 (R4-1 audit): gate the 429-empty-settle false-green
+				// PER ATTEMPT (inside runOnce, before the result escapes to the
+				// retry wrapper) so the existing retry machinery applies — see
+				// throwIfSettledWithoutAnswer for why this must throw, not flip.
+				throwIfSettledWithoutAnswer(workerResult);
+				return workerResult;
 			} finally {
 				if (timeoutHandle) clearTimeout(timeoutHandle);
 				if (externalAbortListener && signal) {
@@ -461,6 +479,49 @@ export const __test__persistGroupHeartbeats = persistGroupHeartbeats;
 /** @internal 3.5 R15-3 test export — exercise the terminal repair write directly. */
 export const __test__repairGroupTerminalWrite = repairGroupTerminalWrite;
 
+/**
+ * DR-02 WI-1 (R4-1 audit, 2026-10-15): coalesced dispatch must not
+ * false-green on upstream rate-limit exhaustion.
+ *
+ * Bug: this path calls runWorker directly and never parsed the pi-json event
+ * stream — a 429-exhausted worker (exit 0, NO stopReason error, a chain of
+ * EMPTY assistant message_end events ending agent_settled) sailed through
+ * the legacy success gate (`exitCode === 0 && !error`), while `rawFinalText`
+ * kept a stale opening sentence from BEFORE the outage, so EVERY task in the
+ * group was marked completed with garbage text. The singleton path fixed
+ * this in DR-01 (attemptErrorFor's settledWithoutAnswer branch,
+ * child-executor.ts) and the DWF ctx.agent() path mirrors it
+ * (dynamic-workflow-context.ts) — the coalesced path was the remaining hole.
+ *
+ * Gate (mirrors the DR-01 attemptErrorFor branch): parse the stdout event
+ * stream and THROW when the session settled without a final answer.
+ * parsePiJsonOutput is line-safe on non-JSON output (non-JSON lines are
+ * skipped), so plain-text and json-success outputs leave settledWithoutAnswer
+ * undefined and the healthy path is byte-identical to before. Patches still
+ * count as real work (coder roles may legitimately end patch-only) and
+ * cancelled attempts are excluded, exactly like the DR-01 gate. The message
+ * keeps the DR-01 rate-limit/429 keywords so configured retryableErrors globs
+ * can match it.
+ *
+ * WHY A THROW (not a post-retry success=false flip): executeWithRetry retries
+ * THROWN errors — a returned-but-errored result is never retried — so throwing
+ * per attempt inside runOnce lets the transient 429 burn the existing retry
+ * budget, and exhaustion fires onRetryGivenUp → the US-003 group deadletter.
+ * The final throw lands in the dispatch catch path: success=false, rawOutput
+ * carries this message, and every group task maps to "failed".
+ */
+function throwIfSettledWithoutAnswer(result: ChildPiRunResult): void {
+	if (result.error) return; // a hard error already failed the attempt.
+	if (result.exitStatus?.cancelled) return; // an abort never fails the gate.
+	const parsed = parsePiJsonOutput(result.stdout);
+	if (parsed.settledWithoutAnswer !== true) return; // healthy/undefined: unchanged.
+	if ((parsed.patches?.length ?? 0) > 0) return; // patch-only work is real work.
+	throw new Error("Model settled without a final answer (coalesced: empty final assistant message; upstream rate-limit/429 exhaustion)");
+}
+
+/** @internal DR-02 WI-1 test export — exercise the gate directly. */
+export const __test__throwIfSettledWithoutAnswer = throwIfSettledWithoutAnswer;
+
 async function buildCoalescedPrompt(
 	manifest: TeamRunManifest,
 	step: WorkflowStep,

package/src/runtime/scheduling/scheduler.ts

@@ -397,13 +397,17 @@ const CRON_MONTH_NAMES: Record<string, number> = {
 };
 
 /**
- * Match a single cron field value against a cron field expression.
- * Supports the standard cron grammar: wildcard, single N, range a-b, list a,b,c,
- * step syntax (wildcard-step, range-step, from-step), and named tokens
- * (MON, JAN) when a `names` map is passed. Fixes the prior matcher that
- * rejected step values and named DOW (parseInt returned NaN).
+ * Expand a single cron field expression into the set of values it can
+ * match (clamped to min..max). Returns null when any part fails to parse
+ * (empty part, bad step, unrecognizable token) — callers treat null as
+ * "matches nothing / keep legacy behavior" instead of throwing.
+ *
+ * Supports the standard cron grammar: wildcard, single N, range a-b, list
+ * a,b,c, step syntax (wildcard-step, range-step, from-step), and named tokens
+ * (MON, JAN) when a `names` map is passed. Shared by the per-occurrence
+ * matcher below and the parse-time dom/month feasibility check (I3).
  */
-function cronFieldMatches(value: number, field: string, min: number, max: number, names?: Record<string, number>): boolean {
+function cronFieldCandidates(field: string, min: number, max: number, names?: Record<string, number>): Set<number> | null {
 	let normalized = field.trim().toUpperCase();
 	if (names) {
 		for (const name of Object.keys(names).sort((a, b) => b.length - a.length)) {
@@ -415,10 +419,10 @@ function cronFieldMatches(value: number, field: string, min: number, max: number
 	const matched = new Set<number>();
 	for (const rawPart of normalized.split(",")) {
 		const part = rawPart.trim();
-		if (part === "") return false;
+		if (part === "") return null;
 		const stepMatch = part.match(/^(.*)\/(\d+)$/);
 		const step = stepMatch ? Number.parseInt(stepMatch[2], 10) : 1;
-		if (!Number.isFinite(step) || step < 1) return false;
+		if (!Number.isFinite(step) || step < 1) return null;
 		const rangeStr = stepMatch ? stepMatch[1] : part;
 		let lo: number;
 		let hi: number;
@@ -430,7 +434,7 @@ function cronFieldMatches(value: number, field: string, min: number, max: number
 			hi = stepMatch ? max : lo; // bare `N` = single value; `N/S` = N..max step S
 		} else {
 			const rm = rangeStr.match(/^(\d+)-(\d+)$/);
-			if (!rm) return false;
+			if (!rm) return null;
 			lo = Number.parseInt(rm[1], 10);
 			hi = Number.parseInt(rm[2], 10);
 		}
@@ -438,7 +442,19 @@ function cronFieldMatches(value: number, field: string, min: number, max: number
 			if (v >= min && v <= max) matched.add(v);
 		}
 	}
-	return matched.has(value);
+	return matched;
+}
+
+/**
+ * Match a single cron field value against a cron field expression.
+ * Supports the standard cron grammar: wildcard, single N, range a-b, list
+ * a,b,c, step syntax (wildcard-step, range-step, from-step), and named tokens
+ * (MON, JAN) when a `names` map is passed. Fixes the prior matcher that
+ * rejected step values and named DOW (parseInt returned NaN).
+ */
+function cronFieldMatches(value: number, field: string, min: number, max: number, names?: Record<string, number>): boolean {
+	const candidates = cronFieldCandidates(field, min, max, names);
+	return candidates?.has(value) === true;
 }
 
 function nextCronDate(spec: string, from: Date): Date | { error: string } | null {
@@ -491,6 +507,8 @@ export function parseSchedule(spec: string): ScheduleSpec | { error: string } {
 	}
 	const fields = trimmed.split(/\s+/);
 	if (fields.length >= 5) {
+		const impossible = cronDomMonthImpossible(fields[2], fields[3]);
+		if (impossible) return { error: `Invalid cron expression "${trimmed}": ${impossible}.` };
 		return { kind: "cron", spec: trimmed };
 	}
 	return {
@@ -498,6 +516,47 @@ export function parseSchedule(spec: string): ScheduleSpec | { error: string } {
 	};
 }
 
+/** Day-of-month ceilings per month (index 1..12) for a LEAP year — the
+ * conservative upper bound used by the I3 parse-time feasibility check
+ * (February is granted 29: leap years exist inside the multi-year window,
+ * so Feb-29 specs stay legal at parse). */
+const MONTH_DAY_CEILINGS = [0, 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+/**
+ * I3 (round-6 audit): cheap parse-time rejection of cron specs whose
+ * day-of-month × month combination cannot occur in ANY year — e.g.
+ * `0 0 31 2 *`. nextCronDate only discovers this by scanning
+ * minute-by-minute across its entire 366-day window (~309ms measured) after
+ * which arm-time disables the job; rejecting at parse surfaces the mistake
+ * to the user at schedule-creation time instead of a silent disable later.
+ *
+ * Conservative by design (NOT a full cron validator):
+ *  - dow is ignored: nextCronDate uses AND semantics across fields, so an
+ *    impossible dom/month pair can never match regardless of the dow field;
+ *  - February is granted its leap-day ceiling of 29 (Feb-29 specs remain
+ *    legal; the existing arm-time disableCronForUncomputableNext path owns
+ *    the beyond-search-window case);
+ *  - any unparseable field returns null here and keeps the legacy runtime
+ *    behavior — this adds no new rejection classes beyond provable
+ *    impossibility (empty expansions like inverted ranges count: an empty
+ *    candidate set can never match under the AND-semantics matcher).
+ *
+ * Returns a human-readable reason, or null when the combo is feasible (or
+ * unknowable cheaply).
+ */
+function cronDomMonthImpossible(domStr: string, monthStr: string): string | null {
+	const doms = cronFieldCandidates(domStr, 1, 31);
+	const months = cronFieldCandidates(monthStr, 1, 12, CRON_MONTH_NAMES);
+	if (doms === null || months === null) return null;
+	const feasible = [...months].some((m) => [...doms].some((d) => d >= 1 && d <= MONTH_DAY_CEILINGS[m]));
+	if (feasible) return null;
+	return `day-of-month {${[...doms]
+		.sort((a, b) => a - b)
+		.join(
+			",",
+		)}} never occurs in month {${[...months].sort((a, b) => a - b).join(",")}} — no valid day/month combination exists in any year`;
+}
+
 export function nextRunTime(spec: ScheduleSpec, from: Date = new Date()): Date | { error: string } {
 	if (spec.kind === "once") {
 		const rel = spec.spec.match(/^\+(\d+)(s|m|h|d)$/);
@@ -545,7 +604,11 @@ export function humanizeSchedule(spec: ScheduleSpec): string {
 		return `every ${spec.spec}`;
 	}
 	if (spec.kind === "cron") {
-		return `cron ${spec.spec}`;
+		// I4: cron fields are matched against UTC calendar parts (nextCronDate
+		// reads getUTCMinutes/getUTCHours/getUTCDate/...), so the label says so —
+		// a user in UTC+7 writing `0 9 * * *` otherwise gets 02:00 local with
+		// no hint why.
+		return `cron ${spec.spec} (UTC)`;
 	}
 	return "unknown schedule";
 }

package/src/runtime/scratchpad/engine.ts

@@ -24,6 +24,8 @@ import { dirname } from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 
+import { logInternalError } from "../../utils/internal-error.ts";
+
 /** D6 read-side cap (Checkpoint B, MINOR-2): restoreState refuses a file larger
  *  than this — an independent guard from the lifecycle cap (same value, no
  *  import to keep engine free of a lifecycle cycle). Bounds v8.deserialize
@@ -80,6 +82,10 @@ export interface RestoreResult {
 	path: string;
 	restored: string[];
 	failed: { name: string; reason: string }[];
+	/** P-5 (DR-04 round-7): set when the snapshot was REJECTED before restore —
+	 *  e.g. `unsupported-snapshot-version:<v>`. Distinguishes "restored 0 vars
+	 *  from a valid v1 snapshot" from "refused an unknown format". */
+	reason?: string;
 }
 
 export interface EngineOptions {
@@ -353,7 +359,14 @@ export class EngineManager {
 	 */
 	async dispose(snapshotPath?: string): Promise<void> {
 		if (snapshotPath && this.engineState === "running") {
-			await this.snapshotState(snapshotPath).catch(() => null);
+			await this.snapshotState(snapshotPath).catch((error: unknown) => {
+				// E2 (DR-02): the guest is SIGKILLed below regardless and dispose
+				// must never throw — but silently discarding the FINAL snapshot made
+				// crash-recovery quietly lose engine state. Surface the loss at
+				// warn before dropping it. Keep returning null (no rethrow).
+				logInternalError("scratchpad.final-snapshot-failed", error, `snapshotPath=${snapshotPath}`, "warn");
+				return null;
+			});
 		}
 		await this.kill();
 	}
@@ -620,11 +633,21 @@ export class EngineManager {
 			const st = fstatSync(fd);
 			if (!st.isFile() || st.isSymbolicLink()) return null;
 			if (st.size > SNAPSHOT_MAX_BYTES) return null;
-			// file validated → lazily start the engine, then read+restore via fd.
-			await this.start();
 			const payload = JSON.parse(readFileSync(fd, { encoding: "utf8" })) as {
+				version?: number;
 				vars?: Record<string, string>;
 			};
+			// P-5 (DR-04 round-7): version gate BEFORE starting the engine — an
+			// unknown snapshot format must fail LOUDLY (warn + explicit result with
+			// restored:[] and a reason), not silently fail-open into an empty
+			// namespace (which reads as "nothing to restore" to every caller).
+			if (payload.version !== 1) {
+				const reason = `unsupported-snapshot-version:${String(payload.version)}`;
+				logInternalError("scratchpad.restoreState", new Error(`${reason} (expected 1) — refusing restore`), path, "warn");
+				return { path, restored: [], failed: [], reason };
+			}
+			// file validated → lazily start the engine, then restore.
+			await this.start();
 			const vars = payload.vars ?? {};
 			const reply = await this.request({ type: "restore", id: randomUUID(), vars }, SNAPSHOT_REQUEST_TIMEOUT_MS);
 			if (reply.type !== "restore_result") return null;