pi-crew 0.11.21 → 0.11.23

package/src/state/event-log/event-log-rotation.ts

@@ -2,7 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { atomicWriteFile } from "../atomic-write.ts";
-import { type TeamEvent, withEventLogLockSync } from "./event-log.ts";
+import { type TeamEvent, withEventLogAppendLockSync, withEventLogLockSync } from "./event-log.ts";
 import { poisonMarkerPath } from "./poison-marker.ts";
 
 /**
@@ -169,7 +169,11 @@ export interface CompactionResult {
  * 5. If events were lost, append them
  * 6. Return compaction stats
  */
-export function compactEventLog(eventsPath: string, config?: Partial<RotationConfig>): CompactionResult | undefined {
+export function compactEventLog(
+	eventsPath: string,
+	config?: Partial<RotationConfig>,
+	options?: CompactionLockOptions,
+): CompactionResult | undefined {
 	// US-001 (2026-09-22): lock-scope reduction. The expensive part is the READ +
 	// parse of the whole log (prepareCompaction). It is read-only, so it does NOT
 	// need the append lock: hold the lock ONLY for the write+recover phase
@@ -196,7 +200,15 @@ export function compactEventLog(eventsPath: string, config?: Partial<RotationCon
 	// log grew unbounded until events were silently dropped past 50MB).
 	const prepared = prepareCompaction(eventsPath, config);
 	if (!prepared) return undefined;
-	return compactPreparedEventLog(eventsPath, prepared);
+	return compactPreparedEventLog(eventsPath, prepared, options);
+}
+
+/** Options for the locked write phase of compaction. `lock` is forwarded to
+ * `withEventLogAppendLockSync` (and transitively `withEventLogLockSync`) so
+ * callers/tests can bound the wait — the defaults (5s timeout / 10s stale)
+ * mirror both existing lock families. */
+export interface CompactionLockOptions {
+	lock?: { timeoutMs?: number; staleMs?: number };
 }
 
 /**
@@ -212,15 +224,81 @@ export function compactEventLog(eventsPath: string, config?: Partial<RotationCon
  * ones it never saw. So under the lock we read the bytes appended after the
  * snapshot offset and append them to the write. Appenders hold the same lock,
  * so this read is a complete tail snapshot.
+ *
+ * R4-2 (DR-02 Wave 2, 2026-10-15): the write phase now ADDITIONALLY acquires the
+ * async family's `.alock` (sync-mode, via `withEventLogAppendLockSync`) BEFORE
+ * `readTailSince`/the `atomicWriteFile` rename, releasing it only after the C2
+ * recovery check completes. Rationale: async-family appends hold `.alock`
+ * ACROSS await gaps (`open(eventsPath, "a")` → `appendFile`); running the rename
+ * under `.mkdirlock` alone let it interleave with that gap, orphaning the
+ * appender's fd — its event landed on the old inode and was silently lost (C2
+ * only re-splices the `kept` window). Holding `.alock` across the whole write
+ * phase excludes in-flight async appends cross-process (same on-disk lock dir
+ * + pid-file protocol). Lock order stays strictly `.mkdirlock` → `.alock` (the
+ * async family never takes `.mkdirlock`), so no deadlock. NOT archive-style by
+ * lead decision: rotation's rename-to-archive already preserves in-flight fds
+ * (ST-8), so only compaction's inode-replacing write needed the guard.
  */
 export function compactPreparedEventLog(
 	eventsPath: string,
 	prepared: { lines: string; originalSize: number; originalCount: number; kept: TeamEvent[] },
+	options?: CompactionLockOptions,
 ): CompactionResult | undefined {
-	return withEventLogLockSync(eventsPath, () => {
+	// R7-2 (DR-04, 2026-10-16): the write phase is now `applyCompactionAppendGuarded`
+	// (below) — `.alock` nested inside the `.mkdirlock` held here, plus the
+	// mandatory `readTailSince` splice. This wrapper keeps the historical
+	// locked entry point (public API + tests) with identical semantics.
+	return withEventLogLockSync(eventsPath, () => applyCompactionAppendGuarded(eventsPath, prepared, options), options?.lock);
+}
+
+/** R7-2 (DR-04, 2026-10-16): options for `applyCompactionAppendGuarded`.
+ * `lock` is forwarded to `withEventLogAppendLockSync` so callers/tests can
+ * bound the wait; `holdsAppendLock` declares the caller's lock state (see the
+ * helper docblock). */
+export interface ApplyCompactionGuardOptions extends CompactionLockOptions {
+	/** Pass `true` ONLY when the caller ALREADY holds the async family's
+	 * `.alock` (i.e. the guarded apply runs inside `withEventLogLockAsync`).
+	 * The on-disk lock is NOT re-entrant — re-acquiring our own `.alock` in
+	 * sync mode can only end in the bounded timeout (sleepSync starves the
+	 * very in-process holder that must release it). With `true` the helper
+	 * only tail-merges; with `false`/omitted it acquires `.alock` itself. */
+	holdsAppendLock?: boolean;
+}
+
+/**
+ * R7-2 (DR-04, 2026-10-16): the guarded write phase for INLINE compaction
+ * call sites (the overflow/rotation-tick paths inside event-log.ts) that
+ * previously called `prepareCompaction` + `applyCompactionUnlocked` bare —
+ * no `.alock` and no tail-merge, so the inode-replacing write could interleave
+ * with an in-flight async-family append parked between `open()` and
+ * `appendFile()` (its fd kept pointing at the renamed-away inode → silent
+ * loss; C2 recovery only re-splices the `kept` window), and sync-family bytes
+ * appended between the prepare-read and the write were clobbered.
+ *
+ * Contract:
+ *  - ALWAYS merges `readTailSince(eventsPath, prepared.originalSize)` into
+ *    `prepared.lines` before `applyCompactionUnlocked` — sync-family appenders
+ *    never hold `.alock`, so they can land in the prepare→apply window even
+ *    while an async-family caller holds `.alock`; the splice rescues them.
+ *  - `opts.holdsAppendLock === true` (caller is inside `withEventLogLockAsync`):
+ *    tail-merge ONLY — never re-acquire `.alock` (non-reentrant → self-timeout).
+ *  - `opts.holdsAppendLock` false/omitted (caller holds `.mkdirlock` — sync
+ *    family — or no lock): acquire `.alock` in sync mode nested inside the
+ *    held `.mkdirlock`, per the R4-2 lock order (`.mkdirlock` → `.alock`; the
+ *    async family never takes `.mkdirlock`, so no inversion). NEVER call this
+ *    with `false` while `.alock` is already held by this process.
+ */
+export function applyCompactionAppendGuarded(
+	eventsPath: string,
+	prepared: { lines: string; originalSize: number; originalCount: number; kept: TeamEvent[] },
+	options?: ApplyCompactionGuardOptions,
+): CompactionResult | undefined {
+	const applyWithTailMerge = (): CompactionResult | undefined => {
 		const merged = { ...prepared, lines: prepared.lines + readTailSince(eventsPath, prepared.originalSize) };
 		return applyCompactionUnlocked(eventsPath, merged);
-	});
+	};
+	if (options?.holdsAppendLock) return applyWithTailMerge();
+	return withEventLogAppendLockSync(eventsPath, applyWithTailMerge, options?.lock);
 }
 
 /**

package/src/state/event-log/event-log.ts

@@ -7,7 +7,7 @@ import { emitFromTeamEvent } from "../../ui/run-event-bus.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { redactSecrets } from "../../utils/redaction.ts";
 import { sleep, sleepSync } from "../../utils/sleep.ts";
-import { applyCompactionUnlocked, needsRotation, prepareCompaction, rotateEventLogUnlocked } from "./event-log-rotation.ts";
+import { applyCompactionAppendGuarded, needsRotation, prepareCompaction, rotateEventLogUnlocked } from "./event-log-rotation.ts";
 import {
 	advanceSequenceCounter,
 	persistSequenceMonotonic,
@@ -219,6 +219,125 @@ export function withEventLogLockSync<T>(eventsPath: string, fn: () => T, options
 	}
 }
 
+/**
+ * R4-2 (DR-02 Wave 2, 2026-10-15): SYNC-mode acquisition of the ASYNC family's
+ * `.alock` lock dir (`${eventsPath}.alock`). Mirrors the `withEventLogLockSync`
+ * protocol exactly — `fs.mkdirSync` (O_EXCL semantics on POSIX), pid file via
+ * `openSync(pidFile, "wx")` + plain write, mtime-stale reclaim checked FIRST for
+ * every holder (Round 26 BUG 4 pattern), dead-pid secondary fast-path that only
+ * WAITS (never steals a fresh lock), `sleepSync(50)` bounded retry loop, and a
+ * PID-guarded release that never deletes a stealer's dir (Round 26 BUG 5).
+ *
+ * WHY this exists: the async append family (`withEventLogLockAsync` →
+ * `appendEventAsync`) holds `.alock` ACROSS await gaps — notably between
+ * `fs.promises.open(eventsPath, "a")` and `fd.appendFile(...)`. Compaction's
+ * `applyCompactionUnlocked` replaces the events file via `atomicWriteFile`
+ * (temp+rename → new inode). When compaction ran under `.mkdirlock` only, an
+ * fd opened by a mid-gap async append kept pointing at the OLD inode, which the
+ * rename orphaned → the append was silently lost (C2 recovery only re-splices
+ * events in the `kept` window). Acquiring `.alock` around the compaction write
+ * phase closes that window: the rename can no longer interleave with an
+ * in-flight async-family append, cross-process included (same on-disk dir +
+ * pid-file protocol as the async acquirer).
+ *
+ * LOCK ORDER: strictly `.mkdirlock` → `.alock`. The async family NEVER takes
+ * `.mkdirlock` (its bodies call the unlocked compaction/rotation variants and
+ * the short `.seqlock` only), so a sync caller holding `.mkdirlock` may safely
+ * acquire this — but NEVER the reverse, and never call this from INSIDE
+ * `withEventLogLockAsync` (the dir would be our own — the retry loop would
+ * sleepSync-starve the very holder that must release it → guaranteed timeout).
+ *
+ * IN-PROCESS HAZARD (same rationale as the two-family split): if a SAME-PROCESS
+ * async-family holder is mid-await-gap on this `.alock`, this sync acquirer's
+ * `sleepSync` retry blocks the event loop the async holder needs to finish —
+ * the acquire can only end in the bounded timeout (throw), never in a steal.
+ * That is why the only in-tree caller is `compactPreparedEventLog`
+ * (event-log-rotation.ts), whose callers are cross-process / maintenance / test
+ * entry points, NOT the in-process append paths (those already hold `.alock`
+ * or call the unlocked variants directly).
+ */
+export function withEventLogAppendLockSync<T>(eventsPath: string, fn: () => T, options?: { timeoutMs?: number; staleMs?: number }): T {
+	// Ensure parent directory exists before attempting lock (mirrors the sync family).
+	fs.mkdirSync(path.dirname(eventsPath), { recursive: true });
+	const lockDir = `${eventsPath}.alock`;
+	const pidFile = path.join(lockDir, "pid");
+	const start = Date.now();
+	const timeout = options?.timeoutMs ?? 5000;
+	const staleMs = options?.staleMs ?? 10000;
+	let acquired = false;
+	while (true) {
+		try {
+			fs.mkdirSync(lockDir);
+			try {
+				// Same disposable pid file as both existing families: "wx" open +
+				// plain write — the lock dir itself is the mutex; the pid file only
+				// feeds the stale/dead detection and the guarded release.
+				const pidFd = fs.openSync(pidFile, "wx");
+				try {
+					fs.writeSync(pidFd, String(process.pid));
+				} finally {
+					fs.closeSync(pidFd);
+				}
+			} catch {
+				/* best-effort — e.g. EEXIST under a re-taken dir; stale pid is mtime-detected */
+			}
+			acquired = true;
+			break;
+		} catch {
+			if (Date.now() - start > timeout) {
+				throw errors.eventLogLockTimeout(eventsPath, timeout);
+			}
+			// Mtime-stale reclaim FIRST, independent of the pid file (Round 26 BUG 3
+			// pattern): a holder that crashed between mkdir and the pid write has no
+			// pid file — only an aged mtime can reclaim its dir.
+			try {
+				const dirStat = fs.statSync(lockDir);
+				if (Date.now() - dirStat.mtimeMs > staleMs) {
+					fs.rmSync(lockDir, { recursive: true, force: true });
+					continue;
+				}
+			} catch {
+				/* dir vanished — let loop retry */
+			}
+			// Dead-pid secondary fast-path (Round 26 BUG 4 pattern): mtime already
+			// handled above for ALL holders; a provably-dead pid that is not stale
+			// yet only makes us keep waiting — never steal a fresh lock on a pid
+			// lookup race.
+			try {
+				const raw = fs.readFileSync(pidFile, "utf-8").trim();
+				const ownerPid = Number.parseInt(raw, 10);
+				if (!Number.isNaN(ownerPid) && ownerPid !== process.pid) {
+					try {
+						process.kill(ownerPid, 0);
+					} catch {
+						/* dead — but mtime not stale yet, keep waiting */
+					}
+				}
+			} catch {
+				/* no pid file — mtime check above already handles it */
+			}
+			sleepSync(50);
+		}
+	}
+	try {
+		return fn();
+	} finally {
+		if (acquired) {
+			// PID-guarded release (Round 26 BUG 5 pattern): only remove the dir if
+			// the pid file still records OUR pid — if our fn outlived staleMs and a
+			// stealer re-took the dir, the stealer owns it now.
+			try {
+				const currentPid = fs.readFileSync(pidFile, "utf-8").trim();
+				if (currentPid === String(process.pid)) {
+					fs.rmSync(lockDir, { recursive: true, force: true });
+				}
+			} catch {
+				/* lock stolen or already gone — do not touch */
+			}
+		}
+	}
+}
+
 export function computeEventFingerprint(event: Pick<TeamEvent, "type" | "runId" | "taskId" | "data">): string {
 	return createHash("sha256")
 		.update(
@@ -306,8 +425,12 @@ async function drainAsyncQueues(): Promise<void> {
  *
  *  NOT re-entrant: callers inside this lock must use unlocked compaction
  *  variants (prepareCompaction + applyCompactionUnlocked, rotateEventLogUnlocked)
- *  to avoid self-deadlock. */
-async function withEventLogLockAsync<T>(
+ *  to avoid self-deadlock.
+ *
+ *  R4-2 note (2026-10-15): exported so tests (and future async callers) can pin
+ *  the `.alock` family's mutual exclusion against the sync-mode acquirer
+ *  `withEventLogAppendLockSync` used by the compaction path. */
+export async function withEventLogLockAsync<T>(
 	eventsPath: string,
 	fn: () => Promise<T>,
 	options?: { timeoutMs?: number; staleMs?: number },
@@ -520,7 +643,11 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
 				overflowHandled = true;
 				try {
 					const prepared = prepareCompaction(eventsPath);
-					if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+					// R7-2 (DR-04): LOCK STATE — `.alock` HELD. We are inside
+					// doAppendUnderLock, which runs under withEventLogLockAsync
+					// (appendEventAsync). The lock is NOT re-entrant, so the guarded
+					// apply must NOT re-acquire it — tail-merge only.
+					if (prepared) applyCompactionAppendGuarded(eventsPath, prepared, { holdsAppendLock: true });
 				} catch (error) {
 					logInternalError("event-log.immediate-compact", error, `eventsPath=${eventsPath}`);
 				}
@@ -624,7 +751,11 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
 		if (tickAppendCounter(eventsPath) && needsRotation(eventsPath)) {
 			try {
 				const prepared = prepareCompaction(eventsPath);
-				if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+				// R7-2 (DR-04): LOCK STATE — `.alock` HELD. Same scope as the
+				// immediate-compact site above: doAppendUnderLock runs under
+				// withEventLogLockAsync (appendEventAsync). Tail-merge only; the
+				// sync-family bytes appended since the prepare-read are spliced.
+				if (prepared) applyCompactionAppendGuarded(eventsPath, prepared, { holdsAppendLock: true });
 			} catch (error) {
 				logInternalError("event-log.rotation", error, `eventsPath=${eventsPath}`);
 			}
@@ -706,8 +837,17 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
  * buffered write path, which is the entire point of buffering — the previous
  * per-event fsync made buffer coalescing useless and added ~30ms/event on
  * tmpfs.
+ *
+ * R7-2 (DR-04, 2026-10-16): `locks.holdsAppendLock` declares the CALLING
+ * family's lock state so the inline overflow compaction below can pick the
+ * right guarded-apply mode — see the site comment and
+ * `applyCompactionAppendGuarded` (event-log-rotation.ts).
  */
-async function appendEventBatchInsideLock(eventsPath: string, queue: BufferedAppend[]): Promise<void> {
+async function appendEventBatchInsideLock(
+	eventsPath: string,
+	queue: BufferedAppend[],
+	locks?: { holdsAppendLock?: boolean },
+): Promise<void> {
 	if (queue.length === 0) return;
 	// P0-2: keep the per-path counter honest for cross-path rotation sampling.
 	tickAppendCounter(eventsPath, queue.length);
@@ -732,7 +872,14 @@ async function appendEventBatchInsideLock(eventsPath: string, queue: BufferedApp
 			if (preStat.size > MAX_EVENTS_BYTES) {
 				try {
 					const prepared = prepareCompaction(eventsPath);
-					if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+					// R7-2 (DR-04): LOCK STATE — MIXED, declared by the CALLER. This
+					// function is entered from BOTH families: the async flush
+					// (flushOneEventLogBuffer, inside withEventLogLockAsync → `.alock`
+					// HELD → holdsAppendLock: true, re-acquiring would self-timeout)
+					// and the EL-2 sync flush (flushBufferedQueuesSync, inside
+					// withEventLogLockSync → only `.mkdirlock` held → the helper
+					// must acquire `.alock` itself, nested in the R4-2 order).
+					if (prepared) applyCompactionAppendGuarded(eventsPath, prepared, locks);
 				} catch (error) {
 					logInternalError("event-log.batch-immediate-compact", error, `eventsPath=${eventsPath}`);
 				}
@@ -926,7 +1073,14 @@ function appendEventInsideLock(eventsPath: string, event: AppendTeamEvent): Team
 			// unbounded log growth → events silently dropped past 50MB).
 			try {
 				const prepared = prepareCompaction(eventsPath);
-				if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+				// R7-2 (DR-04): LOCK STATE — `.mkdirlock` HELD, `.alock` NOT held.
+				// appendEventInsideLock runs under withEventLogLockSync (appendEvent,
+				// :366). The guarded apply acquires `.alock` nested under our
+				// `.mkdirlock` (R4-2 lock order) so the inode-replacing write cannot
+				// interleave with an in-flight async appender parked between open()
+				// and appendFile(); the tail-merge splices sync-family bytes that
+				// landed after the prepare-read.
+				if (prepared) applyCompactionAppendGuarded(eventsPath, prepared);
 			} catch (error) {
 				logInternalError("event-log.immediate-compact", error, `eventsPath=${eventsPath}`);
 			}
@@ -1017,9 +1171,12 @@ function appendEventInsideLock(eventsPath: string, event: AppendTeamEvent): Team
 		// locked compactEventLog would deadlock → 5s timeout → compaction never
 		// ran → unbounded log growth → events silently dropped past 50MB. Use the
 		// unlocked apply path instead (lock already held).
+		// R7-2 (DR-04): LOCK STATE — `.mkdirlock` HELD, `.alock` NOT held (same
+		// scope as the immediate-compact site above). applyCompactionAppendGuarded
+		// acquires `.alock` itself (nested R4-2 order) + tail-merges.
 		try {
 			const prepared = prepareCompaction(eventsPath);
-			if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+			if (prepared) applyCompactionAppendGuarded(eventsPath, prepared);
 		} catch (error) {
 			logInternalError("event-log.rotation", error, `eventsPath=${eventsPath}`);
 		}
@@ -1136,7 +1293,9 @@ async function flushOneEventLogBuffer(eventsPath: string): Promise<void> {
 		// turning 100 buffered events into 100 fsyncs (~3s on tmpfs). Now we do
 		// 1 appendFileSync + 1 fsync + 1 persistSequence for the whole batch.
 		await withEventLogLockAsync(eventsPath, async () => {
-			await appendEventBatchInsideLock(eventsPath, queue);
+			// R7-2 (DR-04): `.alock` HELD here (async family) — the batch's inline
+			// compaction must not re-acquire it.
+			await appendEventBatchInsideLock(eventsPath, queue, { holdsAppendLock: true });
 		});
 	} catch (error) {
 		// Lock acquire failed — fail every queued item so callers can fall back.
@@ -1176,6 +1335,9 @@ export function flushBufferedQueuesSync(): void {
 				// synchronous (fs.appendFileSync + fs.fsyncSync + persistSequence,
 				// no awaits). Invoking without await runs the body synchronously and
 				// returns a resolved Promise that we discard.
+				// R7-2 (DR-04): only `.mkdirlock` is held here (sync family) — the
+				// batch's inline compaction acquires `.alock` itself via the helper
+				// (nested in the R4-2 lock order).
 				void appendEventBatchInsideLock(eventsPath, queue);
 			});
 		} catch (error) {
@@ -1193,8 +1355,15 @@ export function flushBufferedQueuesSync(): void {
 // this hook lets T2 assert the fsync gate directly. Both production call paths
 // (async flush via withEventLogLockAsync and the EL-2 sync flush via
 // withEventLogLockSync) route through appendEventBatchInsideLock.
-export function __test__appendBatchForUnitTest(eventsPath: string, queue: BufferedAppend[]): Promise<void> {
-	return appendEventBatchInsideLock(eventsPath, queue);
+export function __test__appendBatchForUnitTest(
+	eventsPath: string,
+	queue: BufferedAppend[],
+	locks?: { holdsAppendLock?: boolean },
+): Promise<void> {
+	// R7-2 (DR-04): `locks` mirrors the production flush paths' declarations for
+	// tests that reproduce a specific family's lock context (default = no lock
+	// held, matching a bare direct call — the helper then acquires `.alock`).
+	return appendEventBatchInsideLock(eventsPath, queue, locks);
 }
 
 /**

package/src/state/stores/active-run-registry.ts

@@ -336,8 +336,11 @@ function filterAliveEntries(entries: ActiveRunRegistryEntry[]): {
 				} catch (err) {
 					// Only treat "process does not exist" as dead (ESRCH/ENOENT).
 					// EPERM means process is alive but protected; treat as alive.
+					// R7-15 (2026-10-16): both branches previously `return false`d,
+					// contradicting the comment and silently dropping live EPERM
+					// entries from the registry.
 					const code = (err as NodeJS.ErrnoException).code;
-					if (code !== "ESRCH" && code !== "ENOENT") return false;
+					if (code !== "ESRCH" && code !== "ENOENT") return true;
 					return false;
 				}
 				// FIX Issue 2: Async runs older than the staleness horizon are stale even if
@@ -437,8 +440,12 @@ export function activeRunEntries(): ActiveRunRegistryEntry[] {
 			if (manifest.async?.pid) {
 				try {
 					process.kill(manifest.async.pid, 0);
-				} catch {
-					continue;
+				} catch (err) {
+					// R7-15 (2026-10-16): only ESRCH/ENOENT mean the process is gone.
+					// EPERM (or any other code) means it exists but we cannot signal
+					// it — keep the entry, mirroring filterAliveEntries.
+					const code = (err as NodeJS.ErrnoException).code;
+					if (code === "ESRCH" || code === "ENOENT") continue;
 				}
 			}
 			// Stale non-async run: live-session/scaffold runs older than 30 min

package/src/state/types.ts

@@ -43,6 +43,11 @@ export interface VerificationEvidence {
 	satisfied: boolean;
 	commands: VerificationCommandResult[];
 	notes?: string;
+	/** R4-5 (DR-02 wave 2): true when the contract REQUIRES a green level but
+	 *  configures zero verification commands — satisfaction can then only come
+	 *  from self-attestation (allowManualEvidence). Surfacing flag only: the
+	 *  satisfied logic and defaultVerificationContract are unchanged. */
+	decorative?: boolean;
 }
 
 export interface TaskOutputSchema {
@@ -162,7 +167,10 @@ export type PolicyDecisionReason =
 	| "review_rejected"
 	| "branch_stale"
 	| "scope_mismatch"
-	| "ineffective_worker";
+	| "ineffective_worker"
+	/** R4-4 (DR-02 wave 2): task terminalised needs_attention without ever
+	 *  submitting a result (surface-lost / no-yield paths). Notify-level only. */
+	| "task_needs_attention";
 
 export interface PolicyDecision {
 	action: PolicyDecisionAction;

package/src/ui/agents-jobs-browser.ts

@@ -266,7 +266,9 @@ export class AgentsJobsBrowser {
 	/** Transient header notice (e.g. why `p` did nothing) — auto-expires. */
 	private notice: { text: string; until: number } | undefined;
 	private pollTimer: ReturnType<typeof setInterval> | undefined;
-	private readonly manifests = new Map<string, TeamRunManifest | null>();
+	/** Manifest reads, cached until the next force refresh (R5-3: misses are
+	 *  never stored — see manifestFor). */
+	private readonly manifests = new Map<string, TeamRunManifest>();
 	/** U7: committed-state caches (default data path only). */
 	private readonly manifestCache?: ManifestCache;
 	private readonly snapshotCache?: RunSnapshotCache;
@@ -361,6 +363,10 @@ export class AgentsJobsBrowser {
 
 	/** Reload the merged list when the TTL expired (or `force`). */
 	refreshData(force = false): void {
+		// R5-3 (DR-02 wave 2): a force refresh invalidates the manifest cache too
+		// — manifests used to live for the browser's whole lifetime, so a manifest
+		// created/renamed while the overlay was open never became visible.
+		if (force) this.manifests.clear();
 		const ttl = this.options.refreshTtlMs ?? REFRESH_TTL_MS_DEFAULT;
 		const at = this.nowMs();
 		if (!force && ttl > 0 && at - this.cachedAt < ttl) return;
@@ -519,16 +525,21 @@ export class AgentsJobsBrowser {
 	}
 
 	private manifestFor(runId: string): TeamRunManifest | null {
-		if (this.manifests.has(runId)) return this.manifests.get(runId) ?? null;
-		let manifest: TeamRunManifest | null = null;
+		const cached = this.manifests.get(runId);
+		if (cached) return cached;
+		// R5-3 (DR-02 wave 2): a miss (manifest not found / transient read
+		// failure — loadRunManifestById takes no run lock, so a read can race a
+		// write) is NEVER cached: returning null without touching the map makes
+		// the next call retry instead of pinning the miss for the overlay's
+		// lifetime. Successful loads still cache until the next force refresh.
 		try {
 			const loaded = loadRunManifestById(this.options.cwd, runId); // NOTE: no run lock — best-effort read, mirrors viewers.ts
-			manifest = loaded ? loaded.manifest : null;
+			if (!loaded) return null;
+			this.manifests.set(runId, loaded.manifest);
+			return loaded.manifest;
 		} catch {
-			manifest = null;
+			return null;
 		}
-		this.manifests.set(runId, manifest);
-		return manifest;
 	}
 
 	private recordFor(runId: string, taskId: string): CrewAgentRecord | undefined {
@@ -559,7 +570,10 @@ export class AgentsJobsBrowser {
 			return lines;
 		}
 		const record = entry.record ?? this.recordFor(entry.runId, entry.taskId);
-		const manifest = this.manifestFor(entry.runId);
+		// R5-3: prefer the FRESH entry.manifest the list pipeline already
+		// carries (re-read on every refresh tick) — manifestFor is the fallback
+		// for provider-based entries without one.
+		const manifest = entry.manifest ?? this.manifestFor(entry.runId);
 		if (!record || !manifest) {
 			return [
 				`▸ ${entry.taskId ?? "?"} (${entry.role ?? "?"})`,

package/src/ui/dashboard-panes/agents-pane.ts

@@ -2,7 +2,7 @@ import type { CrewAgentRecord } from "../../runtime/crew-agent-runtime.ts";
 import { type LiveAgentHandle, listLiveAgents, listLiveAgentsByWorkspace } from "../../runtime/live-session/live-agent-manager.ts";
 import { formatCost } from "../../state/usage.ts";
 import { visibleWidth } from "../../utils/visual.ts";
-import { formatCount, formatDuration } from "../format-helpers.ts";
+import { formatCount, formatDuration, truncLine } from "../format-helpers.ts";
 import { computeLiveDurationMs } from "../live-duration.ts";
 import { overflowHint, statusIcon } from "../rail.ts";
 import type { RunDashboardOptions } from "../run-dashboard.ts";
@@ -99,7 +99,10 @@ function describeActivity(handle: LiveAgentHandle): string {
 				.split("\n")
 				.find((l) => l.trim())
 				?.trim() ?? "";
-		return line.length > 40 ? line.slice(0, 40) + "…" : line;
+		// O-5 (DR-04): grapheme-aware truncation at the original budget (≤40
+		// content columns + 1 ellipsis column) — the ad-hoc slice(0, 40) split
+		// surrogate pairs (emoji → stray U+FFFD).
+		return truncLine(line, 41);
 	}
 	return "thinking…";
 }