pi-crew 0.11.21 → 0.11.23

package/src/runtime/child-pi/child-pi-spawn.ts

@@ -21,7 +21,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { childPiBaseAllowlist } from "../../config/env-allowlist-registry.ts";
 import { isScratchpadEnabledForRole } from "../../config/role-tools.ts";
-import { buildScopedAllowList, sanitizeEnvSecrets } from "../../utils/env-filter.ts";
+import { buildScopedAllowList, providerEnvKeys, sanitizeEnvSecrets } from "../../utils/env-filter.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
 import { buildPiWorkerArgs, createSafeTempDir, getPiTempBase } from "../model/pi-args.ts";
@@ -48,8 +48,23 @@ export const BASE_ALLOWLIST: string[] = childPiBaseAllowlist();
  *   4. Add PI_CREW_PARENT_PID for the child-side parent-guard (consumed by the
  *      reactive zombie-scanner + background-runner parent-guard; unused only by
  *      the pi dist binary — see note at the PI_CREW_PARENT_PID assignment below).
+ *
+ * R6-8 (DR-03 round-6): `modelChain` threads the task's model CANDIDATE CHAIN
+ * (primary + fallbacks, e.g. modelRouting.candidates) so the allowlist is
+ * scoped to the UNION of the chain's providers. Previously only the single
+ * current model was passed: a bare-id primary (no "provider/" prefix)
+ * resolved to ZERO provider env keys → the child failed auth with a
+ * non-retryable /api key/i error → the loop broke even though qualified
+ * fallbacks were queued (the env-filter.ts doc contract already promised
+ * "primary + fallbacks"). Scoping is NEVER weakened by this: keys stay
+ * limited to the chain's providers ONLY — never all-providers.
  */
-export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv, model?: string): SpawnOptions {
+export function buildChildPiSpawnOptions(
+	cwd: string,
+	env: NodeJS.ProcessEnv,
+	model?: string,
+	modelChain?: (string | undefined)[],
+): SpawnOptions {
 	// SECURITY FIX (Issue #1): Validate cwd before passing to spawn.
 	// If cwd comes from an untrusted source (user input, workspace config), a malicious cwd
 	// could cause the child process to operate in an attacker-controlled directory,
@@ -81,9 +96,33 @@ export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv, mo
 	// Bug #12 fix: essential env vars (PATH, HOME, etc.) are always preserved so child can find npm/node.
 	//
 	// PER-TASK KEY SCOPING: when a model is provided, only the env keys for that
-	// provider are injected (via buildScopedAllowList). When no model is given,
-	// only BASE_ALLOWLIST system vars pass through — no provider keys leak.
-	const allowList = model ? buildScopedAllowList(BASE_ALLOWLIST, [model]) : BASE_ALLOWLIST;
+	// provider are injected (via buildScopedAllowList). R6-8: when the caller
+	// threads the model CANDIDATE CHAIN (primary + fallbacks), keys are scoped
+	// to the UNION of the chain's providers so a fallback attempt on a second
+	// provider does not spawn keyless. When no model is given, only
+	// BASE_ALLOWLIST system vars pass through — no provider keys leak.
+	const scopeModels: (string | undefined)[] = modelChain && modelChain.length > 0 ? modelChain : model !== undefined ? [model] : [];
+	const allowList = scopeModels.length > 0 ? buildScopedAllowList(BASE_ALLOWLIST, scopeModels) : BASE_ALLOWLIST;
+	// R6-8: warn when the scoped models resolve to ZERO provider env keys AND at
+	// least one is a truly-bare id (no "provider/" prefix) — env-key auth + bare
+	// id means the child worker will very likely fail authentication (observed as
+	// the R6-8 stall: bare id → zero keys → /api key/i non-retryable → chain break
+	// even though qualified fallbacks were queued). NOT an error, and it never
+	// widens the allowlist: users authenticating via auth.json (or custom
+	// providers with non-env credentials) are unaffected — the child reads
+	// auth.json credentials exactly like the parent process does. Qualified
+	// unknown providers ("custom/foo") do not warn: that is a deliberate
+	// custom-provider choice, not a likely misconfiguration.
+	const anyProviderKeys = scopeModels.some((scoped) => providerEnvKeys(scoped).length > 0);
+	const anyBareId = scopeModels.some((scoped) => typeof scoped === "string" && !scoped.includes("/"));
+	if (scopeModels.length > 0 && anyBareId && !anyProviderKeys) {
+		logInternalError(
+			"child-pi-spawn.bare-model-no-provider-keys",
+			undefined,
+			`model "${model ?? scopeModels.find((scoped) => typeof scoped === "string")}" is a bare id (no provider prefix) and resolved zero provider env keys — the child worker gets no provider API key via env; env-key users should qualify the model id (e.g. "openai/<id>") or configure a fallback chain (auth.json users are unaffected)`,
+			"warn",
+		);
+	}
 	const filteredEnv = sanitizeEnvSecrets(env, { allowList });
 	// FIX: Removed delete workarounds — with explicit allowlist, these vars
 	// are no longer auto-leaked. The wildcard approach was fragile.
@@ -192,12 +231,14 @@ export function buildFinalChildPiSpawnOptions(
 	mergedEnv: NodeJS.ProcessEnv,
 	builtEnv: Record<string, string | undefined>,
 	model?: string,
+	modelChain?: (string | undefined)[],
 ): SpawnOptions {
 	// (a) Canary: builtEnv must contain ONLY PI_CREW_*/PI_TEAMS_* keys.
 	assertOnlyControlEnvKeys(builtEnv);
 	// (b) Build the allowlist-filtered base SpawnOptions (cwd validation, env
 	//     filtering, provider-key scoping when model is set, NODE_PATH guard).
-	const spawnOptions = buildChildPiSpawnOptions(cwd, mergedEnv, model);
+	//     R6-8: modelChain threads the candidate chain for provider-key scoping.
+	const spawnOptions = buildChildPiSpawnOptions(cwd, mergedEnv, model, modelChain);
 	// (c) Spread builtEnv back on top — the allowlist in step (b) intentionally
 	//     strips PI_CREW_*/PI_TEAMS_* keys, so without this spread the child
 	//     process would never see steering file, kind, role, or broker creds.
@@ -395,6 +436,3 @@ export function prepareSpawnContext(
 		},
 	};
 }
-
-// Silence unused-import warning for logInternalError if not consumed by future helpers.
-void logInternalError;

package/src/runtime/child-pi/child-pi.ts

@@ -170,6 +170,18 @@ export interface ChildPiRunInput {
 	task: string;
 	agent: AgentConfig;
 	model?: string;
+	/**
+	 * R6-8 (DR-03 round-6): the task's model CANDIDATE CHAIN (primary +
+	 * fallbacks, e.g. modelRouting.candidates / the executor's attemptModels)
+	 * for provider env-key scoping in buildChildPiSpawnOptions. Scopes the
+	 * allowlist to the UNION of the chain's providers — never all-providers —
+	 * so a fallback attempt on a second provider does not spawn keyless, and
+	 * a bare-id primary no longer means zero provider keys when a qualified
+	 * fallback exists. Absent/empty → single-model scoping (previous
+	 * behavior); a truly-bare single model then warns (env-key auth + bare id
+	 * is a likely misconfiguration; auth.json users are unaffected).
+	 */
+	modelChain?: (string | undefined)[];
 	skillPaths?: string[];
 	signal?: AbortSignal;
 	transcriptPath?: string;
@@ -474,7 +486,12 @@ async function trySurfaceBranch(
 			// child's built env whose PI_CREW_DEPTH is parentDepth+1 — layer-1
 			// guard would misfire on our own tier-1 workers.
 			env: depthEnv ?? process.env,
-			workerEnv: buildFinalChildPiSpawnOptions(input.cwd, mergedEnv, builtEnv, input.model).env as Record<string, string>,
+			// R6-8: thread the model candidate chain so the surface pane's worker env
+			// is provider-key scoped to primary + fallbacks (same as the headless path).
+			workerEnv: buildFinalChildPiSpawnOptions(input.cwd, mergedEnv, builtEnv, input.model, input.modelChain).env as Record<
+				string,
+				string
+			>,
 			config: surfaceConfig,
 			role: input.role ?? input.agent.name,
 			livePaneCount: degradeController ? degradeController.livePaneCount() : (surfaceOpts?.livePaneCount ?? 0),
@@ -801,7 +818,8 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 		return await new Promise<ChildPiRunResult>((resolve) => {
 			// Compose the final SpawnOptions: canary + filter + spread are now
 			// owned by buildFinalChildPiSpawnOptions (see child-pi-spawn.ts, BLOCKER 2 / S5).
-			const spawnOptions = buildFinalChildPiSpawnOptions(input.cwd, mergedEnv, builtEnv, input.model);
+			// R6-8: modelChain threads the candidate chain for provider-key scoping.
+			const spawnOptions = buildFinalChildPiSpawnOptions(input.cwd, mergedEnv, builtEnv, input.model, input.modelChain);
 			const child = spawn(spawnSpec.command, spawnSpec.args, spawnOptions);
 			if (child.pid) {
 				registerActiveChild(child.pid, child);

package/src/runtime/child-pi/mock-fixtures.ts

@@ -68,6 +68,29 @@ export async function runMockChildPi(
 		return { exitCode: 0, stdout, stderr: "" };
 	}
 
+	if (mock === "json-429-empty-settle") {
+		// DR-01 P0 test seam: reproduces the live 429-exhaustion shape (runs
+		// team_20261014082741 / team_20261014093334): opening assistant text +
+		// tool results, then EMPTY assistant message_end events between
+		// auto-retry cycles, ending agent_settled — exit 0, NO stopReason error,
+		// and finalText keeps the early opening sentence ("finalText lies").
+		const opening = JSON.stringify({
+			type: "message_end",
+			message: { role: "assistant", content: [{ type: "text", text: `[MOCK] Starting work for ${input.agent.name}` }] },
+		});
+		const toolResult = JSON.stringify({
+			type: "message_end",
+			message: { role: "toolResult", content: [{ type: "text", text: "[MOCK] tool output" }] },
+		});
+		const emptyAssistant = JSON.stringify({
+			type: "message_end",
+			message: { role: "assistant", content: [], usage: { input: 0, output: 0 } },
+		});
+		const stdout = [opening, toolResult, emptyAssistant, emptyAssistant, JSON.stringify({ type: "agent_settled" })].join("\n") + "\n";
+		await observe(input, stdout);
+		return { exitCode: 0, stdout, stderr: "" };
+	}
+
 	if (mock === "json-success" || mock === "adaptive-plan") {
 		const text =
 			mock === "adaptive-plan" && effectiveTask.includes("ADAPTIVE_PLAN_JSON_START")

package/src/runtime/compaction/compact-stages/truncation-stage.ts

@@ -12,6 +12,17 @@
  * their distinct separators. Defaults match `compactString`'s pre-P0-A output
  * exactly so that callers that do not opt into additional stages get
  * bit-identical output (L4 backward-compat safety).
+ *
+ * K6 (DR-03 round-6): budget accounting. The kept important lines are part
+ * of the OUTPUT, so their joined length (+ the "\n" seam) is reserved OUT
+ * of the head+tail budget (`splitWithImportantLines` `reserveChars`). The
+ * composed result therefore fits `maxChars` + {@link TRUNCATION_MARKER_ALLOWANCE}
+ * (marker budget) instead of the pre-K6 ~1.15×maxChars, where head+tail
+ * alone consumed the full budget and the important-line slack stacked on
+ * top unbudgeted. When no important lines are kept, sizing is bit-identical
+ * to the legacy behavior (no reserve). The stage's own monotonic-shrink
+ * invariant is preserved: if the composed result would be ≥ the input, the
+ * input is returned unchanged.
  */
 import type { ICompactStage } from "../compact-pipeline.ts";
 import { splitWithImportantLines } from "../important-line-classifier.ts";
@@ -34,6 +45,15 @@ const DEFAULT_MARKER: TruncationMarkerConfig = {
 	tailSeparator: "\n",
 };
 
+/**
+ * K6 "small constant" = the marker budget: the longest marker template
+ * (with-important-lines variant, 6-digit counters) plus separators plus
+ * digit drift. The head+tail budget absorbs the kept-important-line content
+ * (joined length + seam), so the composed result exceeds `maxChars` by at
+ * most this marker budget — never by the old unbudgeted ~15% slack.
+ */
+export const TRUNCATION_MARKER_ALLOWANCE = 160;
+
 export class TruncationStage implements ICompactStage {
 	readonly id = "truncation";
 	private readonly maxChars: number;
@@ -55,19 +75,41 @@ export class TruncationStage implements ICompactStage {
 	}
 	apply(text: string): string {
 		if (text.length <= this.maxChars) return text;
-		const { head, tail, importantLines, baseDropped } = splitWithImportantLines(text, this.maxChars, {
+		// K6: two-pass budget accounting.
+		// Pass 1 (today's semantics, full-budget split) learns which important
+		// lines are kept — their joined length is part of the OUTPUT and must be
+		// reserved out of the head+tail budget instead of stacking on top.
+		const pass1 = splitWithImportantLines(text, this.maxChars, {
 			preserveImportant: this.preserveImportant,
 		});
+		const joined = pass1.importantLines.join("\n");
+		// Reserve exactly the kept content (+ the "\n" seam between marker and
+		// joined lines). The marker text + separators stay as the tolerated
+		// TRUNCATION_MARKER_ALLOWANCE overhead; when no important lines are
+		// kept the reserve is 0 and sizing is bit-identical to legacy.
+		const reserve = joined.length > 0 ? joined.length + 1 : 0;
+		// Pass 2 re-slices head+tail against the shrunken budget. It is a pure
+		// budgeted slice: preserveImportant:false skips the (already done)
+		// scan, and pass-1's lines are guaranteed to sit inside pass-2's
+		// dropped middle — the pass-2 middle is a superset of pass-1's because
+		// the shrunken head/tail regions are subsets of pass-1's.
+		const { head, tail, baseDropped } = splitWithImportantLines(text, this.maxChars, {
+			preserveImportant: false,
+			reserveChars: reserve,
+		});
+		const importantLines = pass1.importantLines;
 		let result: string;
 		if (importantLines.length === 0) {
 			result = `${head}${this.marker.headSeparator}...[pi-crew ${this.marker.verb} ${baseDropped} ${this.marker.unit}, head+tail preserved]...${this.marker.tailSeparator}${tail}`;
 		} else {
-			const joined = importantLines.join("\n");
 			const remaining = text.length - head.length - tail.length - joined.length;
 			result = `${head}${this.marker.headSeparator}...[pi-crew ${this.marker.verb} ${baseDropped} ${this.marker.unit}, head+tail + ${importantLines.length} important lines preserved, ${remaining} ${this.marker.unit} remaining dropped]...\n${joined}${this.marker.tailSeparator}${tail}`;
 		}
 		// Defense-in-depth: this stage's own monotonic-shrink invariant. The
-		// pipeline gate is a SECOND line of defense.
+		// pipeline gate is a SECOND line of defense. With the K6 budget the
+		// composed result is ≤ maxChars + marker budget, so this guard only
+		// fires for inputs barely over maxChars (where returning the input
+		// verbatim is still within the allowance) or arithmetic bugs.
 		if (result.length >= text.length) return text;
 		return result;
 	}

package/src/runtime/compaction/important-line-classifier.ts

@@ -20,7 +20,55 @@
  *   "compacted ... chars, head+tail preserved") and `readIfSmall` (marker
  *   "truncated ... bytes, head+tail preserved") backward-compatible when no
  *   important lines are present.
+ *
+ * K6/K7 (DR-03 round-6):
+ * - `reserveChars` lets the caller (TruncationStage) subtract the composed
+ *   marker + separator + joined-important-line overhead from the head+tail
+ *   budget, so the FINAL composed result fits `maxChars` + small constant
+ *   instead of stacking unbudgeted overhead on top (~1.15×maxChars).
+ * - Head/tail/middle boundaries are surrogate-pair-safe: a code-unit index
+ *   that would split an astral pair (emoji, CJK extensions) is backed off
+ *   so every emitted part contains only whole code points.
+ */
+
+/** Default fraction of `maxChars` available for important-line content. */
+export const DEFAULT_SLACK_FACTOR = 0.15;
+/** Default cap on candidate lines before slack-budget selection. */
+export const DEFAULT_MAX_IMPORTANT_LINES = 30;
+
+function isHighSurrogateUnit(codeUnit: number): boolean {
+	return codeUnit >= 0xd800 && codeUnit <= 0xdbff;
+}
+
+function isLowSurrogateUnit(codeUnit: number): boolean {
+	return codeUnit >= 0xdc00 && codeUnit <= 0xdfff;
+}
+
+/**
+ * K7: back a head-end boundary off while it would split a surrogate pair.
+ * `value.slice(0, boundary)` must never end on a lone high surrogate — if the
+ * code unit at `boundary - 1` is a high surrogate, its low partner lives at
+ * `boundary` and slicing there would orphan both halves; the boundary walks
+ * back so the whole pair falls into the (dropped) middle instead.
  */
+export function safeHeadBoundary(value: string, end: number): number {
+	let boundary = Math.max(0, Math.min(end, value.length));
+	while (boundary > 0 && isHighSurrogateUnit(value.charCodeAt(boundary - 1))) boundary -= 1;
+	return boundary;
+}
+
+/**
+ * K7: advance a tail-start boundary while it would split a surrogate pair.
+ * `value.slice(boundary)` must never start on a lone low surrogate — if the
+ * code unit at `boundary` is a low surrogate, its high partner lives at
+ * `boundary - 1` and slicing there would orphan both halves; the boundary
+ * walks forward so the whole pair stays in the (dropped) middle instead.
+ */
+export function safeTailBoundary(value: string, start: number): number {
+	let boundary = Math.max(0, Math.min(start, value.length));
+	while (boundary < value.length && isLowSurrogateUnit(value.charCodeAt(boundary))) boundary += 1;
+	return boundary;
+}
 
 /** Diagnostic patterns. Anchored where safe to avoid matching noise. */
 export const IMPORTANT_LINE_PATTERNS: readonly RegExp[] = [
@@ -75,7 +123,9 @@ export interface TruncationSplit {
 	 * fit the slack budget.
 	 */
 	importantLines: string[];
-	/** `value.length - maxChars` — chars dropped if no important lines preserved. */
+	/** `value.length - headTailBudget` — chars dropped if no important lines
+	 * preserved. `headTailBudget` is `maxChars - reserveChars`; with no
+	 * reserve (the default) this equals `value.length - maxChars`. */
 	baseDropped: number;
 }
 
@@ -84,8 +134,19 @@ export interface SplitOptions {
 	preserveImportant?: boolean;
 	/** Hard cap on candidate lines before slack-budget selection. Default 30. */
 	maxImportantLines?: number;
-	/** Fraction of `maxChars` available for important-line content. Default 0.15. */
+	/**
+	 * Fraction of `maxChars` available for important-line content. Default 0.15
+	 * ({@link DEFAULT_SLACK_FACTOR}).
+	 */
 	slackFactor?: number;
+	/**
+	 * K6: code units the CALLER will compose AROUND head+tail (marker text,
+	 * separators, joined important lines). The head+tail budget shrinks by
+	 * this reserve so the caller's final composed result fits `maxChars` +
+	 * small constant instead of stacking unbudgeted overhead on top. Default
+	 * 0 — legacy semantics where head+tail alone consume the full maxChars.
+	 */
+	reserveChars?: number;
 }
 
 /**
@@ -101,24 +162,37 @@ export function splitWithImportantLines(value: string, maxChars: number, opts: S
 	if (value.length <= maxChars) {
 		return { head: value, tail: "", importantLines: [], baseDropped: 0 };
 	}
-	const headLen = Math.floor(maxChars * 0.75);
-	const tailLen = maxChars - headLen;
-	const head = value.slice(0, headLen);
-	const tail = value.slice(value.length - tailLen);
+	// K6: reserve the caller's composed overhead (marker + separators +
+	// joined important lines) out of the head+tail budget. Clamped so at
+	// least one code unit of budget survives even when the reserve exceeds
+	// maxChars (pathologically small budgets — the marker alone dominates).
+	const reserve = Math.max(0, Math.min(Math.floor(opts.reserveChars ?? 0), maxChars - 1));
+	const headTailBudget = Math.max(1, maxChars - reserve);
+	const headLen = Math.floor(headTailBudget * 0.75);
+	const tailLen = headTailBudget - headLen;
+	// K7: surrogate-safe boundaries. Raw code-unit slices previously split
+	// astral pairs at the 75% head boundary and the tail start, emitting
+	// lone surrogates (mojibake) into the compacted output. Back off while
+	// the boundary would split a pair — the whole pair then falls into the
+	// middle (dropped) region instead of being broken across head/tail.
+	const headEnd = safeHeadBoundary(value, headLen);
+	const tailStart = safeTailBoundary(value, value.length - tailLen);
+	const head = value.slice(0, headEnd);
+	const tail = value.slice(tailStart);
 
 	if (opts.preserveImportant === false) {
 		return {
 			head,
 			tail,
 			importantLines: [],
-			baseDropped: value.length - maxChars,
+			baseDropped: value.length - headTailBudget,
 		};
 	}
 
-	const slackFactor = opts.slackFactor ?? 0.15;
+	const slackFactor = opts.slackFactor ?? DEFAULT_SLACK_FACTOR;
 	const slackChars = Math.max(0, Math.floor(maxChars * slackFactor));
-	const maxCandidates = opts.maxImportantLines ?? 30;
-	const middle = value.slice(headLen, value.length - tailLen);
+	const maxCandidates = opts.maxImportantLines ?? DEFAULT_MAX_IMPORTANT_LINES;
+	const middle = value.slice(headEnd, tailStart);
 	const candidates = extractImportantLines(middle, maxCandidates);
 
 	// Greedily pick whole lines that fit in the slack budget.
@@ -135,6 +209,6 @@ export function splitWithImportantLines(value: string, maxChars: number, opts: S
 		head,
 		tail,
 		importantLines: chosen,
-		baseDropped: value.length - maxChars,
+		baseDropped: value.length - headTailBudget,
 	};
 }

package/src/runtime/compaction/tool-output-pruner.ts

@@ -39,6 +39,14 @@ export interface ToolResultEntry {
 	content: string;
 	/** Whether the tool result represents an error. */
 	isError?: boolean;
+	/**
+	 * K8: the tool's REAL exit code when the original result carries one
+	 * (e.g. a bash exit status). Passed through to the digest verbatim
+	 * instead of the historical `isError ? 1 : 0` guess — exit 127 digests
+	 * as `exit=127`. Optional: callers whose source shape has no exit code
+	 * omit it and keep the legacy guess.
+	 */
+	exitCode?: number;
 }
 
 /** A file mutation event (edit/write) that can invalidate earlier reads. */
@@ -102,11 +110,23 @@ function estimateTokens(text: string): number {
 
 const DIGEST_NOTICE_TOKEN_CAP_MULTIPLIER = 1.25;
 
-function firstErrorLine(text: string): string | undefined {
-	return text
-		.split(/\r?\n/)
-		.find((line) => /error|failed|exception|panic/i.test(line))
-		?.trim();
+function firstErrorLine(text: string, isError = false): string | undefined {
+	const lines = text.split(/\r?\n/);
+	const matched = lines.find((line) => /error|failed|exception|panic/i.test(line))?.trim();
+	if (matched !== undefined) return matched;
+	// K8: multi-line stderr/stack whose HEAD carries the diagnostic but no
+	// line matches the keyword patterns (localized messages, shell errors,
+	// stack frames without a keyword). Fall back to the first 3 non-empty
+	// lines of the content head — the head names the failing frame; the old
+	// digest kept only the TAIL line, which for a stack trace is the least
+	// informative frame. Gated on isError so success output never grows a
+	// bogus error= part.
+	if (!isError) return undefined;
+	const head = lines
+		.map((line) => line.trim())
+		.filter((line) => line.length > 0)
+		.slice(0, 3);
+	return head.length > 0 ? head.join(" | ") : undefined;
 }
 
 function truncateField(value: string, maxLength: number): string {
@@ -119,22 +139,26 @@ function truncateField(value: string, maxLength: number): string {
  * Generate a compact digest of a tool result for the digest notice.
  * Supports bash (exit code + tail line), grep/search (match/file counts),
  * and falls back to undefined for tools without a known digest format.
+ *
+ * K8: `exitCode` passes the REAL exit status through when the original
+ * result carries one (exit 127 → `exit=127`, not the hardcoded `exit=1`);
+ * when absent the legacy `isError ? 1 : 0` guess is kept.
  */
-export function resultDigest(toolName: string, content: string, isError?: boolean): string | undefined {
+export function resultDigest(toolName: string, content: string, isError?: boolean, exitCode?: number): string | undefined {
 	const name = toolName.toLowerCase();
 	const text = content ?? "";
 	if (name === "bash") {
-		const exitCode = isError ? 1 : 0;
+		const exitCodeValue = typeof exitCode === "number" && Number.isFinite(exitCode) ? Math.trunc(exitCode) : isError ? 1 : 0;
 		const tail = text.trim().split(/\r?\n/).filter(Boolean).at(-1) ?? "";
-		const error = firstErrorLine(text);
-		return [`exit=${exitCode}`, tail ? `tail=${tail}` : undefined, error ? `error=${error}` : undefined]
+		const error = firstErrorLine(text, isError);
+		return [`exit=${exitCodeValue}`, tail ? `tail=${tail}` : undefined, error ? `error=${error}` : undefined]
 			.filter((part): part is string => part !== undefined)
 			.join("; ");
 	}
 	if (name === "search" || name === "grep") {
 		const match = text.match(/(\d+)\s+matches?/i) ?? text.match(/totalMatches["']?:\s*(\d+)/i);
 		const files = text.match(/(\d+)\s+files?/i) ?? text.match(/filesWithMatches["']?:\s*(\d+)/i);
-		const error = firstErrorLine(text);
+		const error = firstErrorLine(text, isError);
 		return (
 			[match ? `matches=${match[1]}` : undefined, files ? `files=${files[1]}` : undefined, error ? `error=${error}` : undefined]
 				.filter((part): part is string => part !== undefined)
@@ -146,7 +170,7 @@ export function resultDigest(toolName: string, content: string, isError?: boolea
 
 function createPrunedNotice(tokens: number, entry: ToolResultEntry): string {
 	const generic = `[Output pruned — ${tokens} tokens]`;
-	const digest = resultDigest(entry.toolName, entry.content, entry.isError);
+	const digest = resultDigest(entry.toolName, entry.content, entry.isError, entry.exitCode);
 	if (!digest) return generic;
 	const genericTokens = countTokens(generic);
 	const maxTokens = Math.max(genericTokens, Math.floor(genericTokens * DIGEST_NOTICE_TOKEN_CAP_MULTIPLIER));

package/src/runtime/crew-agent-records.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import {
+	atomicWriteFile,
 	atomicWriteJson,
 	atomicWriteJsonCoalesced,
 	cancelPendingCoalescedWriteForPath,
@@ -686,12 +687,32 @@ function readSeqFromSidecar(filePath: string): number | undefined {
 
 function writeSeqToSidecar(filePath: string, seq: number): void {
 	try {
-		fs.writeFileSync(`${filePath}.${AGENT_EVENT_SEQ_SIDECAR}`, String(seq));
+		// D6 (DR-02): tmp+rename so a concurrent reader (nextAgentEventSeq on
+		// another thread/process) never observes a torn or empty .seq.
+		// best-effort durability per F4: the sidecar is only an O(1) lookup
+		// optimization — losing it on a crash costs the O(n) scan fallback,
+		// never correctness. Path and content format unchanged (String(seq)).
+		atomicWriteFile(`${filePath}.${AGENT_EVENT_SEQ_SIDECAR}`, String(seq), { durability: "best-effort" });
 	} catch (error) {
 		logInternalError("crew-agent-records.seq-sidecar", error, `filePath=${filePath}`);
 	}
 }
 
+function scanMaxAgentEventSeq(filePath: string): number {
+	let max = 0;
+	for (const line of fs.readFileSync(filePath, "utf-8").split(/\r?\n/)) {
+		if (!line.trim()) continue;
+		try {
+			const parsed = JSON.parse(line) as { seq?: unknown };
+			if (typeof parsed.seq === "number" && Number.isFinite(parsed.seq)) max = Math.max(max, parsed.seq);
+			else max += 1;
+		} catch {
+			max += 1;
+		}
+	}
+	return max;
+}
+
 function nextAgentEventSeq(filePath: string): number {
 	if (!fs.existsSync(filePath)) {
 		// Clean up stale sidecar when main file is gone.
@@ -708,24 +729,21 @@ function nextAgentEventSeq(filePath: string): number {
 	// FIX: Try sidecar file for O(1) lookup before falling back to O(n) scan.
 	const sidecarSeq = readSeqFromSidecar(filePath);
 	if (sidecarSeq !== undefined) {
+		// FS1 (fix, EL-1 port from event-log sequence-cache.ts): a REGRESSED
+		// sidecar (crash between append and sidecar advance, or lost best-effort
+		// durability) must never re-mint used seqs — trust it only as
+		// max(sidecar, tail-scan), else cursor consumers (seq > sinceSeq)
+		// permanently drop the duplicate-seq events.
+		const safeSeq = Math.max(sidecarSeq, scanMaxAgentEventSeq(filePath));
 		setAgentEventSeqCache(filePath, {
 			size: stat.size,
 			mtimeMs: stat.mtimeMs,
-			seq: sidecarSeq,
+			seq: safeSeq,
 		});
-		return sidecarSeq + 1;
-	}
-	let max = 0;
-	for (const line of fs.readFileSync(filePath, "utf-8").split(/\r?\n/)) {
-		if (!line.trim()) continue;
-		try {
-			const parsed = JSON.parse(line) as { seq?: unknown };
-			if (typeof parsed.seq === "number" && Number.isFinite(parsed.seq)) max = Math.max(max, parsed.seq);
-			else max += 1;
-		} catch {
-			max += 1;
-		}
+		if (safeSeq !== sidecarSeq) writeSeqToSidecar(filePath, safeSeq);
+		return safeSeq + 1;
 	}
+	const max = scanMaxAgentEventSeq(filePath);
 	setAgentEventSeqCache(filePath, {
 		size: stat.size,
 		mtimeMs: stat.mtimeMs,

package/src/runtime/delivery-coordinator.ts

@@ -26,6 +26,12 @@ export interface DeliveryCoordinatorDeps {
 const PENDING_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
 export class DeliveryCoordinator {
+	// DR-02 C3: the queue was TTL-bounded ONLY (24h) — an extension that stays
+	// sessionless while runs keep completing could grow `pending` unboundedly.
+	// Hard count cap with drop-oldest (oldest delivery is the least likely to
+	// still matter); the TTL eviction below stays unchanged. Static (not
+	// module-const) so tests can read/patch it like Semaphore.MAX_QUEUE.
+	static readonly MAX_PENDING = 1_000;
 	private active = false;
 	private generation = 0;
 	private pending: PendingDelivery[] = [];
@@ -36,6 +42,9 @@ export class DeliveryCoordinator {
 	/** The session id passed to the most recent activate(); used by flushQueuedResults
 	 * to park deliveries owned by a different session (vector #12). */
 	private activeSessionId?: string;
+	/** DR-02 C3: set after the first warn of an overflow episode; cleared once
+	 * the queue is back at/below the cap so the NEXT episode warns again. */
+	private pendingOverflowWarned = false;
 
 	constructor(deps: DeliveryCoordinatorDeps) {
 		this.deps = deps;
@@ -215,6 +224,27 @@ export class DeliveryCoordinator {
 			this.ttlTimer.unref();
 		}
 		this.pending.push({ ...delivery, generation: this.generation });
+		// DR-02 C3: count cap — drop-oldest while over cap, warn ONCE per
+		// overflow episode (flag resets once the queue is back under cap, so a
+		// later separate overflow is visible again).
+		if (this.pending.length <= DeliveryCoordinator.MAX_PENDING) {
+			this.pendingOverflowWarned = false;
+			return;
+		}
+		let dropped = 0;
+		while (this.pending.length > DeliveryCoordinator.MAX_PENDING) {
+			if (this.pending.shift() === undefined) break;
+			dropped++;
+		}
+		if (dropped > 0 && !this.pendingOverflowWarned) {
+			this.pendingOverflowWarned = true;
+			logInternalError(
+				"delivery-coordinator.pending-overflow",
+				undefined,
+				`dropped=${dropped} max=${DeliveryCoordinator.MAX_PENDING} remaining=${this.pending.length} runId=${delivery.runId}`,
+				"warn",
+			);
+		}
 	}
 
 	private evictExpired(): void {

package/src/runtime/dispatch-batch.ts

@@ -202,12 +202,15 @@ export async function sweepExpiredWaitingTasks(
 		}
 		try {
 			const existingRuntimes = new Map(readCrewAgents(fresh.manifest).map((a) => [a.taskId, a.runtime]));
-			saveCrewAgents(
-				fresh.manifest,
-				tasks
-					.filter((t) => requeuedTaskIds.includes(t.id))
-					.map((t) => recordFromTask(fresh.manifest, t, existingRuntimes.get(t.id) ?? "child-process")),
-			);
+			// R4-A1 (fix): agents.json is a full-index overwrite — merge the requeued
+			// records into the existing set (team-runner.ts:525 pattern) instead of
+			// persisting the subset alone (siblings incl. RUNNING agents were wiped).
+			const mergedById = new Map(readCrewAgents(fresh.manifest).map((record) => [record.id, record] as const));
+			for (const task of tasks.filter((t) => requeuedTaskIds.includes(t.id))) {
+				const record = recordFromTask(fresh.manifest, task, existingRuntimes.get(task.id) ?? "child-process");
+				mergedById.set(record.id, record);
+			}
+			saveCrewAgents(fresh.manifest, [...mergedById.values()]);
 		} catch (error) {
 			logInternalError("dispatch-batch.ask-timeout.crewAgents", error, `runId=${runId}`);
 		}