pi-crew 0.11.21 → 0.11.23

package/src/runtime/goal-workflow/goal-loop-runner.ts

@@ -20,6 +20,8 @@ import { createRequire } from "node:module";
 import type { AgentConfig } from "../../agents/agent-config.ts";
 import { loadConfig } from "../../config/config.ts";
 import { effectiveRunConfig } from "../../extension/team-tool/config-patch.ts";
+import { isTerminalTaskStatus } from "../../state/contracts.ts";
+import { withRunLockSync } from "../../state/coordination/locks.ts";
 import { appendEventBuffered } from "../../state/event-log/event-log.ts";
 import { registerActiveRun, unregisterActiveRun } from "../../state/stores/active-run-registry.ts";
 import { collectRunMetrics } from "../../state/stores/run-metrics.ts";
@@ -28,14 +30,52 @@ import type { GoalLoopState, GoalLoopStatus, GoalVerdict, TeamRunManifest, TeamT
 import type { TeamConfig } from "../../teams/team-config.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import type { WorkflowConfig } from "../../workflows/workflow-config.ts";
+import { isRunLockBusyError } from "../broker/protocol/lock-busy.ts";
 import { resolveCrewRuntime } from "../model/runtime-resolver.ts";
 import { registryFromModelContext } from "../model/session-model.ts";
 import { executeTeamRun } from "../team-runner.ts";
 import { compareSnapshot, snapshotManifests } from "../verification/verification-integrity.ts";
-import { acquireWorkspaceLock, type WorkspaceLockHandle } from "../workspace-lock.ts";
+import { acquireWorkspaceLock, refreshWorkspaceLockHeartbeat, type WorkspaceLockHandle } from "../workspace-lock.ts";
 import { bundleEvidence, evaluateGoal } from "./goal-evaluator.ts";
 import { GoalStore } from "./goal-state-store.ts";
 
+/**
+ * D5 (DR-02 Wave 2 Cluster C): merge the turn's FINAL task states onto a
+ * FRESH tasks.json read. The turn owns exactly the terminal-evidence fields
+ * its executor wrote (status/finishedAt/resultArtifact/error/exitCode);
+ * everything else on the fresh task (heartbeat/lastSeenAt, claim, delegate
+ * state, usage…) may be NEWER than the turn's in-memory snapshot and must
+ * never be regressed by the post-turn persist.
+ *
+ * Terminal-preserve: a task that is ALREADY terminal in the fresh read (an
+ * external decision — operator cancel, crash-recovery, the async-died
+ * notifier) keeps its fresh state entirely; the turn must not resurrect or
+ * re-decide it (same guard class as heartbeat.ts R13-S1). Turn tasks missing
+ * from the fresh read are appended — the turn created them and the
+ * budget/audit reads this persist exists for expect them on disk.
+ */
+export function mergeTurnFinalTasksOntoFresh(freshTasks: readonly TeamTaskState[], turnTasks: readonly TeamTaskState[]): TeamTaskState[] {
+	const freshById = new Map(freshTasks.map((task) => [task.id, task]));
+	const turnById = new Map(turnTasks.map((task) => [task.id, task]));
+	const merged = freshTasks.map((freshTask) => {
+		const turnTask = turnById.get(freshTask.id);
+		if (!turnTask) return freshTask;
+		if (isTerminalTaskStatus(freshTask.status)) return freshTask;
+		return {
+			...freshTask,
+			status: turnTask.status,
+			...(turnTask.finishedAt !== undefined ? { finishedAt: turnTask.finishedAt } : {}),
+			...(turnTask.resultArtifact !== undefined ? { resultArtifact: turnTask.resultArtifact } : {}),
+			...(turnTask.error !== undefined ? { error: turnTask.error } : {}),
+			...(turnTask.exitCode !== undefined ? { exitCode: turnTask.exitCode } : {}),
+		};
+	});
+	for (const turnTask of turnTasks) {
+		if (!freshById.has(turnTask.id)) merged.push(turnTask);
+	}
+	return merged;
+}
+
 /** Required minimal shape for the worker + agents discovery (P0 uses the goal's workerAgent). */
 export interface GoalLoopRuntimeDeps {
 	/** Resolve the agent configs reachable from cwd (used for executeTeamRun's agents arg). */
@@ -538,6 +578,48 @@ export function deriveTranscriptPath(artifactsRoot: string, tasks: import("../..
 	return undefined;
 }
 
+/** Interval (ms) between workspace-lock heartbeat refreshes while a goal loop runs (WI-2 / DR-02 R4-3). 15s = 4x margin under the 60s staleness threshold. */
+export const WORKSPACE_LOCK_HEARTBEAT_REFRESH_MS = 15_000;
+
+export interface StartWorkspaceLockHeartbeatRefreshOptions {
+	/** Test injection: override the refresh interval (ms). */
+	refreshMs?: number;
+	/** Test injection: override the refresh implementation (default: refreshWorkspaceLockHeartbeat). */
+	refresh?: (lockPath: string, goalId: string) => boolean;
+}
+
+/**
+ * Start the periodic workspace-lock heartbeat refresh for a lock acquired by
+ * runGoalLoop (WI-2 / DR-02 R4-3).
+ *
+ * Without refresh, workspace-lock isLockStale clause (b) marks the lock stale
+ * after 60s REGARDLESS of holder pid liveness — a goal whose turn takes >60s
+ * gets its workspace lock force-stolen by a second goal on the same cwd
+ * (multi-goal clobber). This timer keeps the heartbeat young for the whole
+ * loop lifetime. It is unref()-ed (must not keep the background process
+ * alive) and the returned stop() MUST be called in the same finally that
+ * releases the lock. Refresh failures are logged as warn and swallowed — a
+ * heartbeat miss must never throw into the goal loop.
+ */
+export function startWorkspaceLockHeartbeatRefresh(
+	handle: Pick<WorkspaceLockHandle, "lockPath" | "goalId">,
+	opts: StartWorkspaceLockHeartbeatRefreshOptions = {},
+): { stop: () => void } {
+	const refreshMs = opts.refreshMs ?? WORKSPACE_LOCK_HEARTBEAT_REFRESH_MS;
+	const refresh = opts.refresh ?? refreshWorkspaceLockHeartbeat;
+	const timer = setInterval(() => {
+		try {
+			refresh(handle.lockPath, handle.goalId);
+		} catch (error) {
+			// Never throw into the loop (interval callbacks crashing node:test aside,
+			// an escaping throw here would kill the background goal process).
+			logInternalError("goal-loop.workspaceLockHeartbeat", error, `goalId=${handle.goalId} lockPath=${handle.lockPath}`, "warn");
+		}
+	}, refreshMs);
+	timer.unref(); // the refresh timer must not keep the detached goal-loop process alive
+	return { stop: () => clearInterval(timer) };
+}
+
 /**
  * Run the autonomous goal loop. Returns {manifest, tasks, goalState} — the OUTER
  * manifest is the synthetic goal-loop manifest (runKind:"goal-loop"); per-turn
@@ -575,10 +657,18 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 	// the background-process boundary. `goal start` / `goal resume` pre-check via isWorkspaceBusy
 	// for a good error message; this acquisition is the authoritative claim.
 	let workspaceLock: WorkspaceLockHandle | undefined;
+	// WI-2 (DR-02 R4-3): periodic heartbeat refresh for the lock above — stopped
+	// in the same finally that releases it (see startWorkspaceLockHeartbeatRefresh).
+	let lockHeartbeat: { stop: () => void } | undefined;
 	try {
 		workspaceLock = await acquireWorkspaceLock(goal.cwd, goal.goalId, {
 			signal,
 		});
+		// WI-2 (DR-02 R4-3): keep the heartbeat young for the whole loop lifetime —
+		// without this, isLockStale clause (b) force-steals the lock after 60s even
+		// though this pid is alive (multi-goal clobber). Started immediately after
+		// acquire; the timer is unref()-ed and never throws into the loop.
+		lockHeartbeat = startWorkspaceLockHeartbeatRefresh(workspaceLock);
 	} catch (error) {
 		logInternalError("goal-loop.workspaceLock", error, `goalId=${goal.goalId} cwd=${goal.cwd}`);
 		goal = safeSetStatus(store, goal.goalId, "blocked", goal, eventsPath);
@@ -753,10 +843,41 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 			}
 
 			// Persist final task states for budget/audit reads.
+			// D5 (DR-02 Wave 2 Cluster C): the bare saveRunTasks(turnResult.tasks) was
+			// an UNLOCKED write of the executor's in-memory snapshot (goal-loop-runner.ts
+			// ":757") — it clobbered any NEWER state written under the run lock between
+			// the executor's last persist and this save (worker heartbeats/lastSeenAt,
+			// task claims, delegate statuses). Now a run-locked RMW: fresh re-read inside
+			// the lock, then a field-level merge — the turn re-decides only the fields it
+			// owns and never regresses fresh heartbeat/claim/delegate data.
 			try {
-				saveRunTasks(turnResult.manifest, turnResult.tasks);
+				withRunLockSync(turnResult.manifest, () => {
+					const fresh = loadRunManifestById(turnResult.manifest.cwd, turnResult.manifest.runId);
+					if (!fresh) {
+						logInternalError(
+							"goal-loop.saveTurnTasks",
+							new Error(`turn run '${turnResult.manifest.runId}' vanished before the final task persist — skipped`),
+							"best-effort",
+							"warn",
+						);
+						return;
+					}
+					saveRunTasks(fresh.manifest, mergeTurnFinalTasksOntoFresh(fresh.tasks, turnResult.tasks));
+				});
 			} catch (error) {
-				logInternalError("goal-loop.saveTurnTasks", error, `turnRunId=${created.manifest.runId}`);
+				if (isRunLockBusyError(error)) {
+					// Best-effort persist: the executor already persisted terminal task
+					// states during the turn — this merge is belt-and-suspenders for
+					// budget/audit reads, so contention skips it with a warn.
+					logInternalError(
+						"goal-loop.saveTurnTasks",
+						error,
+						`turnRunId=${created.manifest.runId} run lock busy — skipped final task merge`,
+						"warn",
+					);
+				} else {
+					logInternalError("goal-loop.saveTurnTasks", error, `turnRunId=${created.manifest.runId}`);
+				}
 			}
 
 			// GL-1: if the turn ended in blocked/failed status, stop the loop without spawning the judge.
@@ -908,6 +1029,12 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 		}).catch((e) => logInternalError("goal-loop.buffered", e, "type=goal.loop_error"));
 		goal = safeSetStatus(store, goal.goalId, "blocked", goal, eventsPath);
 	} finally {
+		// WI-2: stop the heartbeat refresh BEFORE releasing the lock it was keeping alive.
+		try {
+			lockHeartbeat?.stop();
+		} catch {
+			/* best-effort */
+		}
 		// P1g: release the workspace lock (held since loop start).
 		try {
 			workspaceLock?.release();

package/src/runtime/heartbeat/heartbeat-watcher.ts

@@ -231,6 +231,11 @@ export class HeartbeatWatcher {
 			if (!activeKeys.has(key) && ts < cutoff) {
 				this.lastLevel.delete(key);
 				this.consecutiveDead.delete(key);
+				// M-8 (2026-10-16): also drop the deadletter cooldown marker —
+				// before this the map leaked one entry per vanished run:taskId key
+				// and a stale cooldown timestamp could suppress a legitimate
+				// re-trigger after the same task reappeared.
+				this.lastDeadletterTriggerAt.delete(key);
 				this.lastSeen.delete(key);
 			}
 		}
@@ -242,5 +247,7 @@ export class HeartbeatWatcher {
 		this.lastLevel.clear();
 		this.consecutiveDead.clear();
 		this.lastSeen.clear();
+		// M-8: clear the deadletter cooldown map too (was leaked before).
+		this.lastDeadletterTriggerAt.clear();
 	}
 }

package/src/runtime/live-session/embedded-tier.ts

@@ -908,7 +908,9 @@ export function admitEmbeddedSession(input: {
 	});
 	// Raced against the prompt; a pre-race rejection must not surface as an
 	// unhandled rejection (which would trip our own process guard).
-	escapeSignal.catch(() => {});
+	escapeSignal.catch(() => {
+		/* intentional UR-guard — see comment above */
+	});
 	let tornDown = false;
 	registerEmbeddedSessionGuard(
 		input.agentId,

package/src/runtime/live-session/live-session-runtime.ts

@@ -868,6 +868,49 @@ export async function probeLiveSessionRuntime(): Promise<LiveSessionUnavailableR
 	};
 }
 
+// DR-02 C1: the per-agent control-request dedupe Set previously grew for
+// the whole run lifetime — fed by BOTH the 500ms/1000ms control poll and the
+// realtime subscription, with no eviction. Bounded FIFO eviction: a Set
+// preserves insertion order, so deleting the first-added id evicts the OLDEST
+// request id (mirrors the NotificationRouter.SEEN_MAP_MAX_SIZE bounded-seen
+// pattern). Worst case after an eviction is one redelivery of a very old
+// control request; the consumers (steer / follow-up) are idempotent by design.
+export const MAX_SEEN_CONTROL_REQUEST_IDS = 10_000;
+
+class BoundedSeenControlRequestIdSet extends Set<string> {
+	override add(id: string): this {
+		super.add(id);
+		while (this.size > MAX_SEEN_CONTROL_REQUEST_IDS) {
+			const oldest = this.values().next().value;
+			if (oldest === undefined) break;
+			this.delete(oldest);
+		}
+		return this;
+	}
+}
+
+/** @internal — test seam for the C1 cap (see live-agent-control-dedupe tests). */
+export const __test__BoundedSeenControlRequestIdSet = BoundedSeenControlRequestIdSet;
+
+/**
+ * R6-9 (DR-03 round-6): best-effort usage extraction for the fault/watchdog
+ * escape returns. The success return reports usageFromSessionStats(session),
+ * but the fault/watchdog catch paths previously carried NO usage — whenever
+ * embeddedWorkers routed work to the embedded tier and the task faulted, the
+ * burned turns vanished from the budget (under-count). The session may be
+ * disposed or partially unusable after the fault, so stats collection is
+ * guarded — it can never turn a fault into a crash. Returns undefined when no
+ * usable stats surface exists.
+ */
+function faultPathUsage(session: LiveSessionLike | undefined): UsageState | undefined {
+	try {
+		return usageFromSessionStats(session);
+	} catch (error) {
+		logInternalError("live-session.fault-usage-stats", error, "session stats unavailable on fault path");
+		return undefined;
+	}
+}
+
 export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<LiveSessionRunResult> {
 	// Cold-start race fix: ensure the hot module graph is warm before touching
 	// any module. Under tsx, concurrent first-imports race module-record
@@ -1406,7 +1449,7 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		registerLiveAgentModel(agentId, resolvedModelRef ?? "");
 		streamOut = createStreamingOutput(input.manifest, input.task.id);
 		let controlCursor: LiveAgentControlCursor = { offset: 0 };
-		const seenControlRequestIds = new Set<string>();
+		const seenControlRequestIds: Set<string> = new BoundedSeenControlRequestIdSet();
 		let controlBusy = false;
 		const pollControl = async () => {
 			if (!isCurrent() || controlBusy || !session) return;
@@ -1793,12 +1836,16 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 				},
 			});
 			updateLiveAgentStatus(agentId, "failed");
+			// R6-9: turns burned before the watchdog fired still count — capture the
+			// partial usage (guarded; session was disposed by the watchdog timer).
+			const watchdogUsage = faultPathUsage(session);
 			return {
 				available: true,
 				exitCode: 1,
 				stdout: stdoutTail.value().trim(),
 				stderr: error.message,
 				jsonEvents,
+				usage: watchdogUsage,
 				error: error.message,
 				...(embedded ? { fault: { kind: "turn-watchdog" as const, detail: error.message, countAsFault: true } } : {}),
 			};
@@ -1820,12 +1867,15 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 			// drop-reference (synchronous — never awaits the stuck abort): drain +
 			// terminate + dispose + UNREGISTER, so the hung session holds no slot.
 			dropLiveAgentReference(agentId);
+			// R6-9: partial usage from the turns completed before the tool hung.
+			const hungUsage = faultPathUsage(session);
 			return {
 				available: true,
 				exitCode: 1,
 				stdout: stdoutTail.value().trim(),
 				stderr: error.message,
 				jsonEvents,
+				usage: hungUsage,
 				error: error.message,
 				...(embedded ? { fault: { kind: "hung-tool" as const, timeoutMs: error.timeoutMs, countAsFault: true } } : {}),
 			};
@@ -1861,6 +1911,9 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 			stdout: stdoutTail.value().trim(),
 			stderr: message,
 			jsonEvents,
+			// R6-9: generic fault path — partial usage from completed turns so the
+			// budget sees the real spend even when the task failed.
+			usage: faultPathUsage(session),
 			error: message,
 			...(embeddedCatchFault ? { fault: embeddedCatchFault } : {}),
 		};

package/src/runtime/model/model-fallback.ts

@@ -606,7 +606,29 @@ export function resolveModelFallbackPolicy(
 	} else {
 		maxAutoFallbacks = config?.maxAutoFallbacks;
 	}
-	const order = (env.PI_CREW_MODEL_FALLBACK_ORDER as "parentFirst" | "asIs" | undefined) ?? config?.order;
+	// J5 (DR-03 round-6): validate the order env against the two legal values.
+	// The previous unvalidated cast let arbitrary strings flow into
+	// orderAutoFallbacks' `order === "asIs"` checks — any typo (e.g.
+	// "parent-first") silently behaved as parentFirst. Invalid → warn + fall
+	// back to config/default, mirroring the PI_CREW_MAX_AUTO_FALLBACKS
+	// clamp-warn sibling pattern above.
+	const envOrder = env.PI_CREW_MODEL_FALLBACK_ORDER;
+	let order: "parentFirst" | "asIs" | undefined;
+	if (envOrder) {
+		if (envOrder === "parentFirst" || envOrder === "asIs") {
+			order = envOrder;
+		} else {
+			logInternalError(
+				"model-fallback.model-fallback-order-invalid",
+				undefined,
+				`PI_CREW_MODEL_FALLBACK_ORDER="${envOrder}" is invalid (expected "parentFirst" or "asIs"), falling back to config`,
+				"warn",
+			);
+			order = config?.order;
+		}
+	} else {
+		order = config?.order;
+	}
 	const requireCredentials =
 		env.PI_CREW_MODEL_REQUIRE_CREDENTIALS === "1"
 			? true

package/src/runtime/output/pi-json-output.ts

@@ -20,6 +20,14 @@ export interface ParsedPiJsonOutput {
 	 * "429 ... overloaded"). Used to detect runs that exited 0 but produced
 	 * nothing because the model was rate-limited — see task-runner 429 fix. */
 	errorMessages?: string[];
+	/** DR-01 (deep review 2026-10-14): true when the LAST assistant
+	 * `message_end` event in the stream carried no non-empty text — the
+	 * session settled without a final answer. Upstream 429 exhaustion
+	 * manifests as a chain of EMPTY assistant message_end events (content [],
+	 * usage 0) between auto-retry cycles — never as stopReason:"error" — so
+	 * `errorMessages` stays empty and `finalText` keeps an early pre-outage
+	 * sentence. undefined when no assistant message_end was parsed at all. */
+	settledWithoutAnswer?: boolean;
 }
 
 function asRecord(value: unknown): Record<string, unknown> | undefined {
@@ -82,12 +90,23 @@ export function extractText(value: unknown): string[] {
 	return text.filter((entry) => entry.trim().length > 0);
 }
 
+/** True for `message_end` events whose message is assistant-role. Feeds the
+ *  settledWithoutAnswer flag (DR-01): see ParsedPiJsonOutput.settledWithoutAnswer. */
+function isAssistantMessageEnd(event: unknown): boolean {
+	const obj = asRecord(event);
+	if (obj?.type !== "message_end") return false;
+	const message = asRecord(obj.message);
+	return message?.role === "assistant";
+}
+
 export function parsePiJsonOutput(stdout: string): ParsedPiJsonOutput {
 	let jsonEvents = 0;
 	const textEvents: string[] = [];
 	const patches: string[] = [];
 	const errorMessages: string[] = [];
 	let usage: ParsedPiUsage | undefined;
+	let sawAssistantMessageEnd = false;
+	let lastAssistantMessageHadText = false;
 	for (const line of stdout.split("\n")) {
 		const trimmed = line.trim();
 		if (!trimmed) continue;
@@ -98,7 +117,12 @@ export function parsePiJsonOutput(stdout: string): ParsedPiJsonOutput {
 			continue;
 		}
 		jsonEvents++;
-		textEvents.push(...extractText(event));
+		const eventTexts = extractText(event);
+		textEvents.push(...eventTexts);
+		if (isAssistantMessageEnd(event)) {
+			sawAssistantMessageEnd = true;
+			lastAssistantMessageHadText = eventTexts.length > 0;
+		}
 		// Extract unified patches from tool_result events
 		extractPatch(event, patches);
 		// Extract provider/model error messages from message_end events (429 fix).
@@ -114,6 +138,7 @@ export function parsePiJsonOutput(stdout: string): ParsedPiJsonOutput {
 		usage,
 		patches: patches.length > 0 ? patches : undefined,
 		errorMessages: errorMessages.length > 0 ? errorMessages : undefined,
+		settledWithoutAnswer: sawAssistantMessageEnd ? !lastAssistantMessageHadText : undefined,
 	};
 }
 

package/src/runtime/policy-engine.ts

@@ -104,6 +104,24 @@ export function evaluateCrewPolicy(input: PolicyEngineInput): PolicyDecision[] {
 		}
 	}
 
+	// R4-4 (DR-02 wave 2): needs_attention is a TERMINAL-without-result status
+	// (surface-lost / no-yield paths in post-execution) and the scheduler counts
+	// it as done, so a run can otherwise complete green while a task never
+	// submitted its result. Surface it as a NON-blocking notify decision —
+	// detection-first: no status flip, no block, no retry (re-queue/recovery is
+	// owned by the surface-degrade drain machinery, not the policy engine).
+	const needsAttentionTasks = input.tasks.filter((t) => t.status === "needs_attention");
+	if (needsAttentionTasks.length > 0) {
+		const ids = needsAttentionTasks.map((t) => t.id).join(", ");
+		decisions.push(
+			decision(
+				"notify",
+				"task_needs_attention",
+				`${needsAttentionTasks.length} task(s) finished needs_attention without submitting a result: ${ids}.`,
+			),
+		);
+	}
+
 	if (decisions.length === 0 && input.tasks.length > 0 && input.tasks.every((task) => task.status === "completed")) {
 		decisions.push(decision("closeout", "run_complete", "All tasks completed and no policy blockers were found."));
 	}

package/src/runtime/process/zombie-scanner.ts

@@ -60,6 +60,13 @@ export interface ZombieSubagent {
 	surfacePaneId?: string;
 	rssKb: number;
 	elapsedSec: number | undefined;
+	/** M-7 (DR-04 round-7): /proc/<pid>/stat starttime — clock ticks since boot.
+	 *  Stable pid identity: unlike the pid number, starttime changes when the OS
+	 *  recycles a dead pid for a NEW process, so kill-time re-checks can detect
+	 *  PID reuse between scan and kill. */
+	starttime?: number;
+	/** M-7: wall-clock start time (ISO) derived from starttime + /proc/uptime. */
+	startedAt?: string;
 	cmd: string;
 }
 
@@ -106,8 +113,8 @@ function readProcEnviron(pid: number): Record<string, string> {
 	}
 }
 
-/** Read /proc/<pid>/stat to get ppid + elapsed. Returns undefined if unreadable. */
-function readProcStat(pid: number): { ppid: number; elapsedSec: number | undefined } | undefined {
+/** Read /proc/<pid>/stat to get ppid + starttime + elapsed. Returns undefined if unreadable. */
+function readProcStat(pid: number): { ppid: number; starttime: number | undefined; elapsedSec: number | undefined } | undefined {
 	try {
 		const stat = fs.readFileSync(`/proc/${pid}/stat`, "utf-8");
 		// stat format: pid (comm) state ppid ... starttime ...
@@ -117,14 +124,38 @@ function readProcStat(pid: number): { ppid: number; elapsedSec: number | undefin
 		if (!rest) return undefined;
 		const ppid = Number.parseInt(rest[PROC_STAT_PPID_INDEX] ?? "", 10);
 		const starttimeTicksRaw = Number.parseInt(rest[PROC_STAT_STARTTIME_INDEX] ?? "", 10);
-		const starttimeTicks = Number.isFinite(starttimeTicksRaw) ? starttimeTicksRaw : undefined;
-		const elapsedSec = computeElapsedSec(starttimeTicks);
-		return { ppid: Number.isFinite(ppid) ? ppid : 0, elapsedSec };
+		const starttime = Number.isFinite(starttimeTicksRaw) ? starttimeTicksRaw : undefined;
+		const elapsedSec = computeElapsedSec(starttime);
+		return { ppid: Number.isFinite(ppid) ? ppid : 0, starttime, elapsedSec };
 	} catch {
 		return undefined;
 	}
 }
 
+/** /proc/uptime first field (seconds since boot); undefined when unreadable. */
+function readUptimeSec(): number | undefined {
+	try {
+		const uptimeRaw = fs.readFileSync("/proc/uptime", "utf-8");
+		const uptimeSec = Number.parseFloat(uptimeRaw.split(" ")[0] ?? "");
+		return Number.isFinite(uptimeSec) ? uptimeSec : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * M-7 (DR-04 round-7): wall-clock start time of a pid from its starttime
+ * ticks — boot time = now - uptime, so startedAt = boot + starttime/CLK_TCK.
+ * Best-effort ISO string; undefined when /proc/uptime is unavailable.
+ */
+function computeStartedAtIso(starttime: number | undefined): string | undefined {
+	if (starttime === undefined || !Number.isFinite(starttime)) return undefined;
+	const uptimeSec = readUptimeSec();
+	if (uptimeSec === undefined) return undefined;
+	const bootMs = Date.now() - uptimeSec * 1000;
+	return new Date(bootMs + (starttime / 100) * 1000).toISOString();
+}
+
 function computeElapsedSec(starttimeTicks: number | undefined): number | undefined {
 	if (starttimeTicks === undefined || !Number.isFinite(starttimeTicks)) return undefined;
 	try {
@@ -132,10 +163,8 @@ function computeElapsedSec(starttimeTicks: number | undefined): number | undefin
 		// portably from Node requires a native addon; hardcoding 100 matches every
 		// mainstream Linux distro and keeps this dependency-free.
 		const ticksPerSec = 100;
-		// /proc/uptime: first field is seconds since boot.
-		const uptimeRaw = fs.readFileSync("/proc/uptime", "utf-8");
-		const uptimeSec = Number.parseFloat(uptimeRaw.split(" ")[0] ?? "");
-		if (!Number.isFinite(uptimeSec)) return undefined;
+		const uptimeSec = readUptimeSec();
+		if (uptimeSec === undefined) return undefined;
 		// starttime (ticks since boot) → process age in seconds = uptime - starttime/ticksPerSec.
 		const startAgeSec = starttimeTicks / ticksPerSec;
 		return Math.max(0, uptimeSec - startAgeSec);
@@ -150,8 +179,12 @@ function isPidAlive(pid: number): boolean {
 		// process.kill(pid, 0) throws if the pid is not alive (or not ours).
 		process.kill(pid, 0);
 		return true;
-	} catch {
-		return false;
+	} catch (error) {
+		// R7-A2 (2026-10-17): only ESRCH/ENOENT mean the process is gone.
+		// EPERM means the process is alive but protected (different security
+		// context); treat as alive — mirror of active-run-registry.ts fix.
+		const code = (error as NodeJS.ErrnoException).code;
+		return code !== "ESRCH" && code !== "ENOENT";
 	}
 }
 
@@ -271,6 +304,10 @@ export function scanZombieSubagents(): ZombieScanResult {
 				surfacePaneId: environ.PI_CREW_SURFACE_PANE || undefined,
 				rssKb: readProcRssKb(pid),
 				elapsedSec: stat?.elapsedSec,
+				// M-7: starttime (ticks) + derived wall-clock start — pid identity pin
+				// for kill-time PID-reuse checks and prompt-kill triage.
+				starttime: stat?.starttime,
+				startedAt: computeStartedAtIso(stat?.starttime),
 				cmd: readProcCmdline(pid),
 			};
 
@@ -392,9 +429,13 @@ export function formatZombieReport(scan: ZombieScanResult): string {
 
 	if (scan.zombies.length > 0) {
 		lines.push(`### Zombies — parent dead (${scan.zombies.length})`);
-		lines.push("These sub-agents are orphaned. Safe to kill after review:");
+		lines.push("These sub-agents are orphaned. Safe to kill, but do it PROMPTLY after this");
+		lines.push("scan: an unreviewed delay re-opens the PID-reuse window (the OS can recycle");
+		lines.push("a dead zombie's PID for an unrelated process). Before killing, re-check that");
+		lines.push("the PID's STARTED column below still matches — a newer starttime means the");
+		lines.push("process you are about to kill is NOT the zombie that was scanned.");
 		lines.push("");
-		lines.push("  PID       PARENT  RSS       ROLE          SURFACE          CMD");
+		lines.push("  PID       PARENT  AGE      STARTED              RSS       ROLE          SURFACE          CMD");
 		for (const z of scan.zombies) {
 			lines.push(formatZombieRow(z));
 		}
@@ -405,7 +446,7 @@ export function formatZombieReport(scan: ZombieScanResult): string {
 		lines.push(`### Live — parent still running (${scan.live.length})`);
 		lines.push("NOT zombies. Do not kill (parent PID is alive and may still reap them).");
 		lines.push("");
-		lines.push("  PID       PARENT  RSS       ROLE          SURFACE          CMD");
+		lines.push("  PID       PARENT  AGE      STARTED              RSS       ROLE          SURFACE          CMD");
 		for (const l of scan.live) {
 			lines.push(formatZombieRow(l));
 		}
@@ -435,7 +476,9 @@ export function formatZombieReport(scan: ZombieScanResult): string {
 		lines.push("");
 	}
 
-	lines.push("To kill a zombie: `kill <PID>` (the OS will reap it). This tool never kills.");
+	lines.push("To kill a zombie: `kill <PID>` (the OS will reap it). Kill soon after the");
+	lines.push("scan — a PID listed here can be reused by an unrelated process if you wait;");
+	lines.push("verify its starttime/age first. This tool never kills.");
 	return lines.join("\n");
 }
 
@@ -443,7 +486,30 @@ export function formatZombieReport(scan: ZombieScanResult): string {
 function formatZombieRow(z: ZombieSubagent): string {
 	// SURFACE = "kind:paneId" (T12) — the pane doctor closes when orphaned.
 	const surface = z.surface ? `${z.surface}:${z.surfacePaneId ?? "?"}` : "-";
-	return `  ${String(z.pid).padEnd(9)}${String(z.crewParentPid).padEnd(8)}${formatRss(z.rssKb).padEnd(10)}${(z.role ?? "?").padEnd(14)}${surface.padEnd(16)}${z.cmd.slice(0, 44)}`;
+	// M-7: AGE + STARTED — pid identity + triage (old zombies = long-leaked;
+	// STARTED mismatch at kill time = PID was reused, do NOT kill).
+	return (
+		`  ${String(z.pid).padEnd(9)}${String(z.crewParentPid).padEnd(8)}${formatAge(z.elapsedSec).padEnd(9)}` +
+		`${formatStartedAt(z.startedAt).padEnd(21)}${formatRss(z.rssKb).padEnd(10)}${(z.role ?? "?").padEnd(14)}` +
+		`${surface.padEnd(16)}${z.cmd.slice(0, 28)}`
+	);
+}
+
+/** M-7: age as a compact human duration ("37s", "5m", "3h", "2d"). */
+function formatAge(sec: number | undefined): string {
+	if (sec === undefined || !Number.isFinite(sec) || sec < 0) return "-";
+	if (sec < 60) return `${Math.floor(sec)}s`;
+	if (sec < 3600) return `${Math.floor(sec / 60)}m`;
+	if (sec < 86400) return `${Math.floor(sec / 3600)}h`;
+	return `${Math.floor(sec / 86400)}d`;
+}
+
+/** M-7: ISO startedAt → "MM-DD HH:MM:SS" (UTC, no year — scan-time triage). */
+function formatStartedAt(iso: string | undefined): string {
+	if (!iso) return "-";
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return "-";
+	return d.toISOString().slice(5, 19).replace("T", " ");
 }
 
 /** One table row for the R3-16 foreign section — state carries the triage flags. */
@@ -469,4 +535,6 @@ export const __test = {
 	looksLikePiBinary,
 	isHeadlessArgv,
 	collectAncestorPids,
+	// M-7: starttime helpers (ticks → wall-clock start).
+	computeStartedAtIso,
 };

package/src/runtime/process-status.ts

@@ -140,7 +140,12 @@ export function isDisplayActiveRun(run: TeamRunManifest, agents: CrewAgentRecord
 		if (Number.isFinite(updatedAt) && now - updatedAt > STALE_ACTIVE_RUN_MS) return false;
 	}
 	// Grace period: show completed runs for a few seconds so users see the result.
-	if (run.status === "completed" || run.status === "failed" || run.status === "cancelled") {
+	// R5-4 (DR-02 wave 2): "blocked" is terminal (isFinishedRunStatus) but NOT an
+	// error the user caused — without the grace branch it fell through to
+	// `!isActiveRunStatus` and vanished from the widget instantly while "failed"
+	// lingered 10min. Blocked now gets the same ERROR_VISIBILITY_GRACE_MS so the
+	// block reason stays inspectable.
+	if (run.status === "completed" || run.status === "failed" || run.status === "cancelled" || run.status === "blocked") {
 		const grace = run.status === "completed" ? COMPLETED_VISIBILITY_GRACE_MS : ERROR_VISIBILITY_GRACE_MS;
 		const lastAgentActivity = agents.reduce<number>((max, agent) => {
 			const ts = agent.completedAt ?? agent.startedAt;