pi-crew 0.11.21 → 0.11.23

package/src/ui/events-state-source.ts

@@ -120,6 +120,19 @@ interface SourceInternals {
 	forceDispose(): void;
 }
 
+/** O-7 (0.11.22): a scan result of "empty" only counts as a committed compaction
+ *  when the path is a genuine regular file. A directory (or any non-regular
+ *  object) that some readers tolerate into an empty cursor must be treated as a
+ *  FAILED scan so the guard behaves identically on POSIX and Windows. Returns
+ *  false when statSync throws (missing file shares the same transient policy). */
+function isRegularFile(eventsPath: string): boolean {
+	try {
+		return fs.statSync(eventsPath).isFile();
+	} catch {
+		return false;
+	}
+}
+
 function createEventsStateSource(
 	runId: string,
 	eventsPath: string,
@@ -153,8 +166,11 @@ function createEventsStateSource(
 	}
 
 	/** STORAGE SCAN (spec U7): one parse of the (tail-capped) log to the
-	 *  current seq. No event replay — the root is rebuilt from storage. */
-	function rootBuild(): void {
+	 *  current seq. No event replay — the root is rebuilt from storage.
+	 *  O-7 (DR-04 R7): returns whether the scan SUCCEEDED — on failure the
+	 *  committed state, the inode/size stamps AND `resynced`/`version` are all
+	 *  left untouched so the next poll re-detects the rewrite and retries. */
+	function rootBuild(): boolean {
 		let scanned: TeamEvent[] | undefined;
 		let scannedSeq = 0;
 		try {
@@ -171,14 +187,23 @@ function createEventsStateSource(
 			scanned.length === 0 &&
 			scannedSeq === 0 &&
 			(seq > 0 || events.length > 0) &&
-			!fs.existsSync(eventsPath)
+			!isRegularFile(eventsPath)
 		) {
 			// readEventsCursor reports a MISSING log as an empty cursor — but a
-			// log that carried committed events a beat ago and now does not exist
-			// is a transient disappearance (run dir moving / the rename→wx-create
-			// window of rotation), NOT a compaction to empty. Keep the committed
-			// state — same policy as poll()'s miss-file branch — and keep the inode
-			// stamp so the next poll re-detects the rewrite and retries the resync.
+			// log that carried committed events a beat ago and now is not a
+			// readable regular file is a transient disappearance (run dir moving /
+			// the rename→wx-create window of rotation) OR an unreadable anomaly
+			// (a directory/torn state some readers tolerate into an empty result),
+			// NOT a compaction to empty. Keep the committed state — same policy as
+			// poll()'s miss-file branch — and keep the inode stamp so the next poll
+			// re-detects the rewrite and retries the resync.
+			//
+			// O-7 platform parity (0.11.22 CI): this guard used `!fs.existsSync`,
+			// which is TRUE for a directory — Windows' reader tolerates an EISDIR
+			// open into an empty cursor while POSIX throws, so the same replacement
+			// committed an empty root on Windows and returned false on Linux.
+			// Requiring a regular file makes the failed-scan verdict OS-uniform
+			// while a genuine compaction-to-empty (regular empty file) still commits.
 			scanned = undefined;
 		}
 		// Stamp the inode/size the root was built from so the FIRST poll after
@@ -186,30 +211,43 @@ function createEventsStateSource(
 		// instead of learning the inode one poll late. Stamp ONLY on a successful
 		// scan — on a failed scan keep the previous stamp so the next poll
 		// re-detects the rewrite and RETRIES the resync.
-		if (scanned !== undefined) {
-			try {
-				const stat = fs.statSync(eventsPath);
-				lastIno = stat.ino;
-				lastSize = stat.size;
-			} catch {
-				lastIno = -1;
-				lastSize = -1;
-			}
-			events = scanned.slice(-windowSize);
-			seq = scannedSeq;
+		if (scanned === undefined) {
+			// O-7: failed scan — do NOT claim a fresh root: `resynced`/`version`
+			// stay untouched and no resync frame is emitted (see resyncAttempt).
+			return false;
+		}
+		try {
+			const stat = fs.statSync(eventsPath);
+			lastIno = stat.ino;
+			lastSize = stat.size;
+		} catch {
+			lastIno = -1;
+			lastSize = -1;
 		}
+		events = scanned.slice(-windowSize);
+		seq = scannedSeq;
 		resynced = true;
 		version += 1;
+		return true;
 	}
 
-	function resync(): EventsStateSnapshot {
-		const fromSeq = seq;
-		rootBuild();
+	/** Root-replace and emit ONE resync frame. Returns false (state untouched,
+	 *  no frame) when the storage scan failed — O-7: a failed resync must not
+	 *  count as a committed frame. `stats.resyncs` counts ATTEMPTS either way
+	 *  (MINOR-1 contract: "the resync attempt still counts"). */
+	function resyncAttempt(): boolean {
 		stats.resyncs += 1;
+		const fromSeq = seq;
+		if (!rootBuild()) return false;
 		stats.frames += 1;
 		const frame: EventsStateFrame = { fromSeq, toSeq: seq, events: [...events], version, resync: true };
 		stats.eventsDelivered += frame.events.length;
 		emit(frame);
+		return true;
+	}
+
+	function resync(): EventsStateSnapshot {
+		resyncAttempt();
 		return snapshot();
 	}
 
@@ -224,10 +262,11 @@ function createEventsStateSource(
 		try {
 			const stat = fs.statSync(eventsPath);
 			if (lastIno !== -1 && (stat.ino !== lastIno || stat.size < lastSize)) {
-				lastIno = stat.ino;
-				lastSize = stat.size;
-				resync();
-				return 1;
+				// O-7: do NOT stamp the NEW inode/size before the resync — if the
+				// scan inside fails, the OLD stamps are exactly what makes the
+				// next poll re-detect the rewrite and retry it. rootBuild()
+				// stamps after a successful scan.
+				return resyncAttempt() ? 1 : 0;
 			}
 			lastIno = stat.ino;
 			lastSize = stat.size;
@@ -262,8 +301,8 @@ function createEventsStateSource(
 					backlog = false;
 				}
 				if (backlog) {
-					resync();
-					return committed + 1;
+					// O-7: count the resync frame only when the root scan succeeded.
+					return committed + (resyncAttempt() ? 1 : 0);
 				}
 				break;
 			}

package/src/ui/inline-panel/agent-pane.ts

@@ -86,6 +86,9 @@ export class CrewAgentPane {
 	private readonly paneOptions: CrewAgentPaneOptions | undefined;
 	/** Current agent target, read fresh from the panel store each render. */
 	private currentTaskId: string | undefined;
+	/** Run of {@link currentTaskId} — F3: the pane's switch guard is run-scoped
+	 *  so the same-named task in another run resets the transcript state. */
+	private currentRunId: string | undefined;
 	/** Cached manifest for the current run, to avoid re-reading on every tick. */
 	private cachedRunId: string | undefined;
 	private cachedManifest: TeamRunManifest | undefined;
@@ -294,11 +297,15 @@ export class CrewAgentPane {
 		const viewed = getViewedAgent();
 		if (!viewed) return [];
 
-		// Detect agent switch: reset the transcript cursor so the pane shows
-		// the new agent's full history instead of continuing from the old cursor.
-		if (this.currentTaskId !== viewed.taskId) {
-			resetAgentTranscriptCursor(viewed.taskId);
+		// Detect agent switch (F3: run OR task — task ids are positional per
+		// run, so a taskId-only guard let a same-named task in another run
+		// reuse the stale cursor/buffer): reset the transcript cursor so the
+		// pane shows the new agent's full history instead of continuing from
+		// the old cursor.
+		if (this.currentTaskId !== viewed.taskId || this.currentRunId !== viewed.runId) {
+			resetAgentTranscriptCursor(viewed.runId, viewed.taskId);
 			this.currentTaskId = viewed.taskId;
+			this.currentRunId = viewed.runId;
 			this.scrollBack = 0;
 			this.lastItems = [];
 			this.lastTranscriptReadAt = 0;
@@ -371,8 +378,8 @@ export class CrewAgentPane {
 		this.unsubscribePanel();
 		this.cachedManifest = undefined;
 		this.cachedRunId = undefined;
-		// Free the per-task transcript ring buffer (≤500 items with full
+		// Free the per-run::task transcript ring buffer (≤500 items with full
 		// message bodies) instead of retaining it for process lifetime.
-		if (this.currentTaskId) resetAgentTranscriptCursor(this.currentTaskId);
+		if (this.currentRunId && this.currentTaskId) resetAgentTranscriptCursor(this.currentRunId, this.currentTaskId);
 	}
 }

package/src/ui/inline-panel/agent-transcript.ts

@@ -13,8 +13,8 @@
  * detached spawner, so a memory feed would show an empty pane for exactly the
  * runs users background. Disk works for both with one parser.
  *
- * Per task, a module-level ring buffer accumulates parsed items across reads
- * (cursor + persisted parse state), mirroring pi-subtask's `fork.transcript`.
+ * Per run::task (F3), a module-level ring buffer accumulates parsed items across
+ * reads (cursor + persisted parse state), mirroring pi-subtask's `fork.transcript`.
  * This matters for two reasons the naive delta-read gets wrong:
  *  - tool `start`/`end` events can straddle a read boundary, so the
  *    unmatched-start map must survive between reads;
@@ -83,13 +83,20 @@ export type CrewTranscriptItem =
 
 type PendingTool = CrewTranscriptItem & { type: "tool" };
 
-/** Per-task parse state, persisted across reads. */
+/** Per-run::task parse state, persisted across reads (F3: keyed by run —
+ *  task ids are positional per run, so a taskId-only key would let the same
+ *  task name in a LATER run reuse the earlier run's cursor/buffer). */
 const buffers = new Map<string, CrewTranscriptItem[]>();
 const pendingByTask = new Map<string, Map<string, PendingTool>>();
 const cursors = new Map<string, number>();
-/** Tasks whose worker prompt has been prepended to the buffer. */
+/** Run::task keys whose worker prompt has been prepended to the buffer. */
 const promptSeeded = new Set<string>();
 
+/** F3 (DR-02 wave 2): module-state key — `${runId}::${taskId}`. */
+function transcriptStateKey(runId: string | undefined, taskId: string): string {
+	return `${runId ?? ""}::${taskId}`;
+}
+
 /**
  * The child pi never logs its INITIAL user message (input is not an event),
  * so the transcript would open on the first assistant message — unlike a
@@ -287,14 +294,15 @@ function matchPending(
  * cursor skips re-parse and the existing buffer is returned as-is.
  */
 export function readAgentTranscript(manifest: TeamRunManifest, taskId: string): CrewTranscriptItem[] {
-	const sinceSeq = cursors.get(taskId) ?? 0;
+	const key = transcriptStateKey(manifest.runId, taskId);
+	const sinceSeq = cursors.get(key) ?? 0;
 	const { events, nextSeq } = readCrewAgentEventsCursor(manifest, taskId, { sinceSeq });
-	if (nextSeq > sinceSeq) cursors.set(taskId, nextSeq);
+	if (nextSeq > sinceSeq) cursors.set(key, nextSeq);
 
-	let buffer = buffers.get(taskId) ?? [];
+	let buffer = buffers.get(key) ?? [];
 	if (events.length > 0) {
-		const pending = pendingByTask.get(taskId) ?? new Map<string, PendingTool>();
-		pendingByTask.set(taskId, pending);
+		const pending = pendingByTask.get(key) ?? new Map<string, PendingTool>();
+		pendingByTask.set(key, pending);
 
 		for (const record of events) {
 			const parsed = asRecord(record);
@@ -302,26 +310,29 @@ export function readAgentTranscript(manifest: TeamRunManifest, taskId: string):
 			buffer.push(...parseEventRecord(parsed, pending));
 		}
 	}
-	if (buffer.length > 0 && !promptSeeded.has(taskId)) {
+	if (buffer.length > 0 && !promptSeeded.has(key)) {
 		const prompt = readWorkerPrompt(manifest, taskId);
 		if (prompt !== undefined) {
-			promptSeeded.add(taskId);
+			promptSeeded.add(key);
 			buffer.unshift({ type: "user", text: prompt, seq: 0 });
 		}
 	}
 	if (buffer.length > MAX_TRANSCRIPT_ITEMS) {
 		buffer = buffer.slice(buffer.length - MAX_TRANSCRIPT_ITEMS);
 	}
-	buffers.set(taskId, buffer);
+	buffers.set(key, buffer);
 	return buffer;
 }
 
-/** Drop everything learned about a task (used when the pane switches agents). */
-export function resetAgentTranscriptCursor(taskId: string): void {
-	cursors.delete(taskId);
-	buffers.delete(taskId);
-	pendingByTask.delete(taskId);
-	promptSeeded.delete(taskId);
+/** Drop everything learned about a run's task (used when the pane switches
+ *  agents or runs — F3: scoped to the run so switching runs never leaves the
+ *  old run's ring buffer reachable under the new one's key). */
+export function resetAgentTranscriptCursor(runId: string, taskId: string): void {
+	const key = transcriptStateKey(runId, taskId);
+	cursors.delete(key);
+	buffers.delete(key);
+	pendingByTask.delete(key);
+	promptSeeded.delete(key);
 }
 
 /** Clear all per-task state (session teardown / test isolation). */
@@ -332,7 +343,8 @@ export function resetAllAgentTranscriptCursors(): void {
 	promptSeeded.clear();
 }
 
-/** Test-only: whether the module currently holds state for a task. */
-export function __hasAgentTranscriptState(taskId: string): boolean {
-	return buffers.has(taskId) || cursors.has(taskId) || pendingByTask.has(taskId);
+/** Test-only: whether the module currently holds state for a run's task. */
+export function __hasAgentTranscriptState(runId: string, taskId: string): boolean {
+	const key = transcriptStateKey(runId, taskId);
+	return buffers.has(key) || cursors.has(key) || pendingByTask.has(key);
 }

package/src/ui/inline-panel/agent-view-overlay.ts

@@ -37,11 +37,25 @@ export interface CrewAgentOverlayOptions {
 const INPUT_PROMPT = " ❯ ";
 
 /** Printable single keypress or paste chunk: no control bytes, no ESC
- *  sequences (arrow keys etc. must not land in the steer text). */
-function isPrintableInput(data: string): boolean {
+ *  sequences (arrow keys etc. must not land in the steer text).
+ *
+ *  R7-14 (DR-04): shared with mailbox-compose-overlay — its free-text
+ *  passthrough previously accepted only single chars, so a multi-char
+ *  bracketed-paste chunk ("hello world") was dropped. */
+export function isPrintableInput(data: string): boolean {
 	return data.length > 0 && !data.startsWith("\x1b") && !/[\x00-\x1f\x7f]/.test(data);
 }
 
+/** O-4 (DR-04): surrogate-safe backspace for editors that edit at
+ *  end-of-value. When the LAST UTF-16 unit is a low surrogate it completes a
+ *  pair — remove BOTH units so astral characters (emoji) never split into a
+ *  stray high surrogate / U+FFFD. Shared with mailbox-compose-overlay. */
+export function backspaceChar(text: string): string {
+	const last = text.length > 0 ? text.charCodeAt(text.length - 1) : 0;
+	if (last >= 0xdc00 && last <= 0xdfff && text.length >= 2) return text.slice(0, -2);
+	return text.slice(0, -1);
+}
+
 export class CrewAgentOverlay {
 	/** The transcript core; exposed so the host can wire scroll/steer keys. */
 	readonly pane: CrewAgentPane;
@@ -136,7 +150,8 @@ export class CrewAgentOverlay {
 			} else if (matchesKey(data, "return")) {
 				this.sendSteer();
 			} else if (matchesKey(data, "backspace")) {
-				this.inputText = this.inputText.slice(0, -1);
+				// O-4: astral-safe backspace (shared helper).
+				this.inputText = backspaceChar(this.inputText);
 			} else if (data === "\x03") {
 				// ctrl+c inside steer input cancels the input, not the view.
 				this.inputMode = false;

package/src/ui/inline-panel/index.ts

@@ -47,6 +47,13 @@ const PANE_LIVE_TICK_MS = 700;
 
 let livePane: CrewAgentPane | undefined;
 let liveOverlay: CrewAgentOverlay | undefined;
+/** O-6 (DR-04 R7): double-mount guard — true between the `ctx.ui.custom()`
+ *  call and the moment its factory actually runs (or the call rejects). A
+ *  second openPane in exactly that window (key-mash, dock re-entry, rapid
+ *  `/crew-view`) would otherwise mount a SECOND full-screen overlay on top
+ *  of the first. Cleared by the factory (overlay live), by rejection (state
+ *  reset below) and on the custom() promise settling (overlay closed). */
+let paneMounting = false;
 let paneTickTimer: ReturnType<typeof setInterval> | undefined;
 let editorInstalled = false;
 /** Guards the one-time per-process event hooks. */
@@ -124,7 +131,8 @@ function notifyResult(ctx: ExtensionContext, result: PiTeamsToolResult): void {
  */
 function openPane(ctx: ExtensionContext, target: PanelTarget): void {
 	setViewedAgent(target);
-	if (!liveOverlay) {
+	if (!liveOverlay && !paneMounting) {
+		paneMounting = true;
 		try {
 			void ctx.ui
 				.custom(
@@ -145,6 +153,9 @@ function openPane(ctx: ExtensionContext, target: PanelTarget): void {
 						});
 						liveOverlay = overlay;
 						livePane = overlay.pane;
+						// O-6: the factory ran — the mount window is over; from here on
+						// the `!liveOverlay` check alone owns re-entry.
+						paneMounting = false;
 						return overlay as never;
 					},
 					{
@@ -152,10 +163,17 @@ function openPane(ctx: ExtensionContext, target: PanelTarget): void {
 						overlayOptions: { width: "100%", margin: 0, maxHeight: "100%", anchor: "top-left" },
 					},
 				)
+				.then(() => {
+					// Resolves when the host tears the overlay down (done()) — the
+					// mount window is definitely over (belt and braces for a host
+					// that never invoked the factory).
+					paneMounting = false;
+				})
 				.catch((error) => {
 					// Factory throw or the host tearing the overlay down: drop the
 					// view state so the dock does not point at a view that no
 					// longer exists.
+					paneMounting = false;
 					liveOverlay = undefined;
 					livePane = undefined;
 					setViewedAgent(undefined);
@@ -163,6 +181,7 @@ function openPane(ctx: ExtensionContext, target: PanelTarget): void {
 					logInternalError("view.openOverlay", error, target.taskId);
 				});
 		} catch (error) {
+			paneMounting = false;
 			// A stale ctx (session replaced between keypress and here) drops the
 			// overlay spawn; the fallback editor path still closes cleanly.
 			logInternalError("view.openPane", error, target.taskId);
@@ -326,6 +345,7 @@ export function installInlinePanel(pi: ExtensionAPI, ctx: ExtensionContext, uiCo
 export function __resetInlinePanelForTest(): void {
 	editorInstalled = false;
 	liveOverlay = undefined;
+	paneMounting = false;
 	stopPaneTicker();
 }
 

package/src/ui/live-run-sidebar.ts

@@ -117,9 +117,10 @@ export class LiveRunSidebar {
 		agents: ReturnType<typeof readCrewAgents>,
 		waitingCount: number,
 		snapshot?: RunUiSnapshot,
+		countdownBucket = "",
 	): string {
 		const animation = agents.some((agent) => agent.status === "running") ? `:spin=${spinnerBucket()}` : "";
-		if (snapshot) return `${snapshot.signature}:${waitingCount}${animation}`;
+		if (snapshot) return `${snapshot.signature}:${waitingCount}${animation}${countdownBucket}`;
 		const taskSig = tasks
 			.map(
 				(task) =>
@@ -143,7 +144,17 @@ export class LiveRunSidebar {
 				].join(":"),
 			)
 			.join("|");
-		return `${manifestStatus}|${agents.length}|${waitingCount}|${taskSig}|${agentSig}${animation}`;
+		return `${manifestStatus}|${agents.length}|${waitingCount}|${taskSig}|${agentSig}${animation}${countdownBucket}`;
+	}
+
+	/** F5 (DR-02 wave 2): while the terminal auto-close countdown is armed, a
+	 *  coarse per-second bucket joins the render signature — the base signature
+	 *  only changes on state, so the countdown line used to freeze inside
+	 *  cachedLines until some OTHER state changed. The close timer itself is
+	 *  untouched (L4 fixed-deadline semantics stay exactly as they were). */
+	private autoCloseSignatureFragment(): string {
+		if (this.hasAutoClosed || this.autoCloseDeadline === undefined) return "";
+		return `:close=${Math.ceil(Math.max(0, this.autoCloseDeadline - Date.now()) / 1000)}`;
 	}
 
 	private colorLine(line: string): string {
@@ -231,7 +242,7 @@ export class LiveRunSidebar {
 		const active = agents.filter((agent) => agent.status === "running");
 		const completed = agents.filter((agent) => agent.status !== "running").slice(-5);
 		const waiting = tasks.filter((task) => task.status === "queued");
-		const signature = this.buildSignature(run.updatedAt, tasks, agents, waiting.length, snapshot);
+		const signature = this.buildSignature(run.updatedAt, tasks, agents, waiting.length, snapshot, this.autoCloseSignatureFragment());
 		if (signature !== this.cachedSignature || w !== this.cachedWidth) {
 			// RAIL (§2.E): the rounded `╭─╮│╰─╯` box is retired — the surface is a
 			// `┏ LIVE ▸ <run8>` canopy, `┃` body rows, `┣ SECTION` headers and a

package/src/ui/overlays/mailbox-compose-overlay.ts

@@ -26,6 +26,7 @@
 import * as piTui from "@earendil-works/pi-tui";
 import type { MailboxDirection } from "../../state/coordination/mailbox.ts";
 import { pad, sanitizeLine, truncate } from "../../utils/visual.ts";
+import { backspaceChar, isPrintableInput } from "../inline-panel/agent-view-overlay.ts";
 import { overlayActionForKey } from "../keybinding-map.ts";
 import { CURSOR, canopyLine, formatHint, RAIL, railLine, railRaw } from "../rail.ts";
 import { asCrewTheme, type CrewTheme } from "../theme-adapter.ts";
@@ -169,7 +170,9 @@ export class MailboxComposeOverlay {
 		if (field === "direction") return;
 		this.fields = {
 			...this.fields,
-			[field]: (this.fields[field] ?? "").slice(0, -1),
+			// O-4: astral-safe backspace (shared helper) — a trailing surrogate
+			// pair is one code point and must leave together.
+			[field]: backspaceChar(this.fields[field] ?? ""),
 		};
 	}
 
@@ -244,8 +247,11 @@ export class MailboxComposeOverlay {
 				else this.activeField = (this.activeField + 1) % FIELD_ORDER.length;
 				return;
 		}
-		// Free-text passthrough (unchanged): any other printable char is typed
-		// into the active field.
-		if (data.length === 1 && data >= " ") this.appendText(data);
+		// Free-text passthrough (R7-14): any other PRINTABLE input is typed into
+		// the active field — single chars AND multi-char paste chunks (the old
+		// `data.length === 1` guard dropped pasted "hello world" entirely).
+		// Shares the agent-view-overlay classifier: no control bytes, no ESC
+		// sequences, so arrow keys still never land in the field.
+		if (isPrintableInput(data)) this.appendText(data);
 	}
 }

package/src/ui/powerbar-publisher.ts

@@ -12,6 +12,7 @@ import { readJsonFileCoalesced } from "../utils/file-coalescer.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { extractSessionId } from "../utils/session-utils.ts";
 import { allWorkflows, discoverWorkflows } from "../workflows/discover-workflows.ts";
+import { truncLine } from "./format-helpers.ts";
 import { RenderCoalescer } from "./render-coalescer.ts";
 import type { RunSnapshotCache, RunUiSnapshot } from "./snapshot-types.ts";
 import { notificationBadge } from "./widget/widget-formatters.ts";
@@ -158,7 +159,9 @@ export function buildStepsPayload(active: ActiveItem[], allTasks: TeamTaskState[
 		const parts = current.phases.map((phase) => {
 			const status = phase.status === "done" ? "completed" : statusOf(phase.itemIds);
 			const icon = status === "completed" ? "✓" : status === "running" ? "→" : "○";
-			const name = phase.title.length > 10 ? `${phase.title.slice(0, 9)}…` : phase.title;
+			// O-5 (DR-04): grapheme-aware truncation — the ad-hoc slice(0, 9)
+			// split surrogate pairs (emoji phase titles → stray U+FFFD).
+			const name = truncLine(phase.title, 10);
 			return `${icon}${name}`;
 		});
 		if (parts.length) {
@@ -196,8 +199,8 @@ export function buildStepsPayload(active: ActiveItem[], allTasks: TeamTaskState[
 	for (const step of workflow.steps) {
 		const status = stepStatus.get(step.id) ?? "pending";
 		const icon = status === "completed" ? "✓" : status === "running" ? "→" : "○";
-		// Shorten long step names
-		const stepName = step.id.length > 10 ? step.id.slice(0, 9) + "…" : step.id;
+		// Shorten long step names (O-5: grapheme-aware — slice(0, 9) split emoji).
+		const stepName = truncLine(step.id, 10);
 		stepParts.push(`${icon}${stepName}`);
 	}
 	const stepsText = stepParts.join(" › ");

package/src/ui/rail.ts

@@ -107,7 +107,12 @@ export function shortId(id: string | undefined): string {
 
 export type RailSlot = "border" | "borderAccent" | "success" | "error" | "warning";
 
-/** Status → rail colour. One mapping for every surface (was: per-surface maps). */
+/** Status → rail colour. One mapping for every surface (was: per-surface maps).
+ *  F4 (DR-02 wave 2): "blocked" joins the warning tier — parity with
+ *  status-colors.ts (colorForStatus("blocked") === "warning"), so the rail no
+ *  longer falls to the neutral border while the glyph next to it is painted
+ *  warning. "planning" stays in the default border tier (informational/dim —
+ *  same tier status-colors assigns it). */
 export function statusSlot(status: string | undefined): RailSlot {
 	switch (status) {
 		case "completed":
@@ -128,6 +133,7 @@ export function statusSlot(status: string | undefined): RailSlot {
 			return "borderAccent";
 		case "waiting":
 		case "needs_attention":
+		case "blocked":
 		case "stale":
 		case "pending":
 			return "warning";

package/src/ui/render-scheduler.ts

@@ -28,6 +28,16 @@ export interface RenderSchedulerOptions {
 	 * count and re-arms the loop. Defaults to 8.
 	 */
 	maxIdleFallbackRenders?: number;
+	/**
+	 * R7-12 (DR-04): maximum time (ms) a PENDING render may be starved by a
+	 * sustained event stream. While events keep arriving faster than
+	 * `debounceMs`, every schedule() re-arms the debounce timer and the flush
+	 * would otherwise be postponed forever. At the cap the pending batch is
+	 * force-flushed — from schedule() itself and, as a safety net, from the
+	 * fallback loop. Defaults to `max(3 × debounceMs, 250)`, floored at 250 so
+	 * an explicit small override can never disable the cap entirely.
+	 */
+	maxDelayMs?: number;
 }
 
 const DEFAULT_EVENTS = [
@@ -61,6 +71,8 @@ export class RenderScheduler {
 	private readonly fallbackMs: number;
 	private readonly invalidateCoalesceMs: number;
 	private readonly maxIdleFallbackRenders: number;
+	/** R7-12: pending-starvation cap — see {@link RenderSchedulerOptions.maxDelayMs}. */
+	private readonly maxDelayMs: number;
 	private debounceTimer: ReturnType<typeof setTimeout> | undefined;
 	private fallbackTimer: ReturnType<typeof setTimeout> | undefined;
 	private invalidateTimer: ReturnType<typeof setTimeout> | undefined;
@@ -74,6 +86,9 @@ export class RenderScheduler {
 	private idleFallbackRenders = 0;
 	/** R4: consecutive re-entrancy cap-hits — drives exponential backoff. */
 	private consecutiveCapHits = 0;
+	/** R7-12: when the CURRENT pending batch was first scheduled (undefined =
+	 *  nothing pending). Reset whenever a flush actually renders. */
+	private pendingSince: number | undefined;
 	private readonly unsubs: Array<() => void> = [];
 
 	constructor(events: RenderSchedulerEventBus | undefined, render: () => void, options: RenderSchedulerOptions = {}) {
@@ -85,6 +100,7 @@ export class RenderScheduler {
 		this.fallbackMs = typeof fallback === "number" ? fallback : 750;
 		this.invalidateCoalesceMs = options.invalidateCoalesceMs ?? 50;
 		this.maxIdleFallbackRenders = options.maxIdleFallbackRenders ?? 8;
+		this.maxDelayMs = Math.max(options.maxDelayMs ?? 3 * this.debounceMs, 250);
 		for (const event of options.events ?? DEFAULT_EVENTS) this.subscribe(events, event);
 		this.fallbackTimer = setTimeout(() => this.fallbackLoop(), this.currentFallbackMs());
 		this.fallbackTimer.unref();
@@ -118,6 +134,15 @@ export class RenderScheduler {
 		if (Date.now() - this.lastEventAt < fallbackMs) {
 			// A real external event arrived recently — not idle. Keep polling.
 			this.idleFallbackRenders = 0;
+			// R7-12: BUT a sustained stream (events faster than debounceMs) keeps
+			// re-arming the debounce and the pending render starves. When the
+			// pending batch has waited past the max-delay cap, flush it HERE —
+			// this loop is the safety net for exactly that starvation (it used
+			// to refuse to render while any event was recent).
+			if (this.pendingSince !== undefined && Date.now() - this.pendingSince >= this.maxDelayMs) {
+				this.cancelDebounce();
+				this.flush();
+			}
 			this.fallbackTimer = setTimeout(() => this.fallbackLoop(), fallbackMs);
 			this.fallbackTimer.unref();
 			return;
@@ -145,7 +170,17 @@ export class RenderScheduler {
 		this.idleFallbackRenders = 0;
 		this.consecutiveCapHits = 0;
 		this.invalidate(payload);
-		this.armDebouncedRender();
+		// R7-12: mark when the CURRENT pending batch started (first schedule
+		// since the last actual render).
+		if (this.pendingSince === undefined) this.pendingSince = this.lastEventAt;
+		if (this.lastEventAt - this.pendingSince >= this.maxDelayMs) {
+			// Force flush NOW, even mid-burst: cancel the pending debounce timer
+			// (its render would be redundant) and render synchronously.
+			this.cancelDebounce();
+			this.flush();
+		} else {
+			this.armDebouncedRender();
+		}
 		// R1: if the fallback loop stopped itself after a sustained idle period,
 		// a real event means activity resumed — re-arm the safety-net loop.
 		if (!this.fallbackTimer) {
@@ -169,6 +204,13 @@ export class RenderScheduler {
 		this.debounceTimer.unref();
 	}
 
+	/** R7-12: cancel a pending debounce flush (its render would be redundant
+	 *  next to a force-flush). Does not touch lastEventAt or pendingSince. */
+	private cancelDebounce(): void {
+		if (this.debounceTimer) clearTimeout(this.debounceTimer);
+		this.debounceTimer = undefined;
+	}
+
 	/**
 	 * 1.9: forward `onInvalidate` immediately when the payload has no `runId`
 	 * (we cannot dedup it). When it carries a runId, buffer the latest payload
@@ -229,6 +271,10 @@ export class RenderScheduler {
 		}
 		this.rendering = true;
 		this.pendingRender = false;
+		// R7-12: this flush satisfies the current pending batch — the next
+		// starvation window starts at the NEXT schedule() (set after this, so a
+		// render() that synchronously schedules() still marks a fresh batch).
+		this.pendingSince = undefined;
 		let iterations = 0;
 		try {
 			do {
@@ -254,6 +300,12 @@ export class RenderScheduler {
 			} else {
 				this.consecutiveCapHits = 0;
 			}
+			// R7-12 note: the backoff drain above arms a LONG debounce while
+			// pendingRender is still true, but it never sets pendingSince — only
+			// real events (schedule()) do. Pathological render() re-entrancy
+			// without external events therefore still backs off undisturbed (R4
+			// invariant); the max-delay cap only bounds waits caused by real
+			// incoming events.
 		}
 	}