pi-crew 0.11.22 → 0.11.24

package/src/runtime/orphan-worker-registry.ts

@@ -174,31 +174,46 @@ function isValidId(id: string): boolean {
 	return true;
 }
 
-function readRegistry(): OrphanWorkerEntry[] {
+// FAMILY-2 (2026-10-17): strict read variant — ENOENT still maps to [] (a
+// missing registry is a legitimate empty state), but any OTHER fault
+// (EACCES/EBUSY/parse error/shape mismatch) THROWS. RMW callers
+// (registerWorker/unregisterWorker) must skip their write on a strict-read
+// fault: persisting the resulting [] would WIPE every sibling entry and
+// orphan those workers until host exit.
+function readRegistryStrict(): OrphanWorkerEntry[] {
 	const p = getRegistryPath();
+	// Atomic read: if file doesn't exist, readFileSync throws ENOENT
+	// which we handle explicitly. This eliminates the TOCTOU window
+	// between existsSync and readFileSync.
+	let raw: string;
 	try {
-		// Atomic read: if file doesn't exist, readFileSync throws ENOENT
-		// which we handle explicitly. This eliminates the TOCTOU window
-		// between existsSync and readFileSync.
-		const raw = fs.readFileSync(p, "utf-8");
-		const parsed = JSON.parse(raw);
-		if (!Array.isArray(parsed)) return [];
-		return parsed.filter(
-			(e): e is OrphanWorkerEntry =>
-				typeof e === "object" &&
-				e !== null &&
-				typeof e.pid === "number" &&
-				typeof e.sessionId === "string" &&
-				typeof e.runId === "string" &&
-				typeof e.registeredAt === "number" &&
-				typeof (e as OrphanWorkerEntry).parentPid === "number" &&
-				typeof (e as OrphanWorkerEntry).parentPidStartTime === "number" &&
-				typeof (e as OrphanWorkerEntry).startTime === "number",
-		);
+		raw = fs.readFileSync(p, "utf-8");
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+		throw error;
+	}
+	const parsed: unknown = JSON.parse(raw); // corrupt JSON throws (strict)
+	if (!Array.isArray(parsed)) {
+		throw new Error(`orphan-worker-registry: expected array, got ${typeof parsed}`);
+	}
+	return parsed.filter(
+		(e): e is OrphanWorkerEntry =>
+			typeof e === "object" &&
+			e !== null &&
+			typeof e.pid === "number" &&
+			typeof e.sessionId === "string" &&
+			typeof e.runId === "string" &&
+			typeof e.registeredAt === "number" &&
+			typeof (e as OrphanWorkerEntry).parentPid === "number" &&
+			typeof (e as OrphanWorkerEntry).parentPidStartTime === "number" &&
+			typeof (e as OrphanWorkerEntry).startTime === "number",
+	);
+}
+
+function readRegistry(): OrphanWorkerEntry[] {
+	try {
+		return readRegistryStrict();
 	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-			return [];
-		}
 		// Silent failure is deliberate for robustness (registry read failures
 		// shouldn't crash the process), but log at warning level to aid troubleshooting.
 		logInternalError("orphan-worker-registry", new Error(`readRegistry failed: ${error}`), undefined, "warn");
@@ -278,7 +293,20 @@ export function registerWorker(
 	const startTime = getProcessStartTime(pid) ?? 0;
 	const parentPidStartTime = Number.isFinite(parentPid) && parentPid > 0 ? (getProcessStartTime(parentPid) ?? 0) : 0;
 	withFileLockSync(getRegistryPath(), () => {
-		const entries = readRegistry();
+		// FAMILY-2: strict read — a read fault must SKIP the write (persisting
+		// the [] rebuild would wipe every sibling entry), not mask as empty.
+		let entries: OrphanWorkerEntry[];
+		try {
+			entries = readRegistryStrict();
+		} catch (error) {
+			logInternalError(
+				"orphan-worker-registry.register",
+				error instanceof Error ? error : new Error(String(error)),
+				`pid=${pid} runId=${runId} — skipping write (registry read fault)`,
+				"warn",
+			);
+			return;
+		}
 		// Dedupe by PID
 		const filtered = entries.filter((e) => e.pid !== pid);
 		filtered.push({
@@ -301,7 +329,19 @@ export function registerWorker(
 export function unregisterWorker(pid: number): void {
 	if (!Number.isFinite(pid) || pid <= 0) return;
 	withFileLockSync(getRegistryPath(), () => {
-		const entries = readRegistry();
+		// FAMILY-2: strict read — skip the write on a read fault (see registerWorker).
+		let entries: OrphanWorkerEntry[];
+		try {
+			entries = readRegistryStrict();
+		} catch (error) {
+			logInternalError(
+				"orphan-worker-registry.unregister",
+				error instanceof Error ? error : new Error(String(error)),
+				`pid=${pid} — skipping write (registry read fault)`,
+				"warn",
+			);
+			return;
+		}
 		const filtered = entries.filter((e) => e.pid !== pid);
 		if (filtered.length !== entries.length) {
 			writeRegistry(filtered);

package/src/runtime/pi-spawn.ts

@@ -96,7 +96,10 @@ function isWithinAllowedPrefixes(resolvedPath: string): boolean {
 		}
 	}
 
-	return allowedPrefixes.some((prefix) => normalized.startsWith(prefix));
+	// R2-L-A9 (wave-2b): a bare startsWith accepts sibling-name escapes
+	// (prefix "/opt/pi" also matches "/opt/pwned"). The prefix must match the
+	// path itself or a path-separator-bounded descendant.
+	return allowedPrefixes.some((prefix) => normalized === prefix || normalized.startsWith(prefix + path.sep));
 }
 
 function resolvePiPackageRoot(): string | undefined {

package/src/runtime/process/zombie-scanner.ts

@@ -179,8 +179,12 @@ function isPidAlive(pid: number): boolean {
 		// process.kill(pid, 0) throws if the pid is not alive (or not ours).
 		process.kill(pid, 0);
 		return true;
-	} catch {
-		return false;
+	} catch (error) {
+		// R7-A2 (2026-10-17): only ESRCH/ENOENT mean the process is gone.
+		// EPERM means the process is alive but protected (different security
+		// context); treat as alive — mirror of active-run-registry.ts fix.
+		const code = (error as NodeJS.ErrnoException).code;
+		return code !== "ESRCH" && code !== "ENOENT";
 	}
 }
 

package/src/runtime/recovery/crash-recovery.ts

@@ -700,6 +700,7 @@ export function purgeStaleActiveRunIndex(
 				// is fire-and-forget so it stays OUTSIDE the lock to avoid blocking the
 				// critical section on async IPC.
 				let abortedFreshLiveness = false;
+				let abortedIntentionalWait = false; // R2-M-A3: keep intentional-wait runs
 				try {
 					const fullLoaded = loadRunManifestById(entry.cwd, entry.runId);
 					if (fullLoaded) {
@@ -709,6 +710,14 @@ export function purgeStaleActiveRunIndex(
 							const fresh = loadRunManifestById(entry.cwd, entry.runId);
 							if (!fresh) return;
 							if (fresh.manifest.status !== "running") return;
+							// R2-M-A3 (2026-10-17): mirror :135/:329/:937 — purgeStaleActiveRunIndex
+							// was the only recovery path without an isIntentionalWait guard: a run
+							// parked on a plan approval / pending ask was purge-CANCELLED here even
+							// though every sibling recovery path preserves it. KEEP the entry.
+							if (isIntentionalWait(fresh.manifest, now)) {
+								abortedIntentionalWait = true;
+								return;
+							}
 							// R7-6 (2026-10-16): under-lock liveness revalidation — the pre-lock
 							// gate used inputs read BEFORE the lock; a concurrent `team resume`
 							// adoption may have rewritten them in that window (fresh
@@ -747,6 +756,14 @@ export function purgeStaleActiveRunIndex(
 								}
 							}
 							updateRunStatus(fresh.manifest, "cancelled", "Orphaned run: worker process dead and no recent activity");
+							// R2-M-A3: clear waitState on cancel (mirror cancelOrphanedRuns :431-438) —
+							// an orphan-cancelled run must not keep the park pointer shielding it
+							// from staleness repair for the full waiting TTL.
+							if (fresh.manifest.waitState) {
+								const cleared = { ...fresh.manifest, waitState: undefined, updatedAt: new Date(now).toISOString() };
+								saveRunManifest(cleared);
+								fresh.manifest = cleared;
+							}
 						});
 						// R7-6: only terminate live agents when the cancel actually landed —
 						// an aborted (fresh-evidence) run is alive; terminating it would kill
@@ -767,7 +784,9 @@ export function purgeStaleActiveRunIndex(
 				}
 				// R7-6: a fresh-evidence abort means the run is alive again — KEEP the
 				// registry entry (live-claim signal) instead of unregistering it.
-				if (abortedFreshLiveness) {
+				// R2-M-A3: an intentional-wait abort keeps the entry too (same reasoning —
+				// the run is parked on a human decision, not crashed).
+				if (abortedFreshLiveness || abortedIntentionalWait) {
 					kept.push(entry.runId);
 					continue;
 				}
@@ -794,12 +813,19 @@ export function purgeStaleActiveRunIndex(
 			if (!hasRecentLifeEvidence(entry, manifest.updatedAt, now, staleThresholdMs)) {
 				let cancelledUnderLock = false;
 				let abortedFreshLiveness = false;
+				let abortedIntentionalWait = false; // R2-M-A3: keep intentional-wait runs
 				try {
 					const fullLoaded = loadRunManifestById(entry.cwd, entry.runId);
 					if (fullLoaded && fullLoaded.manifest.status === "running") {
 						withRunLockSync(fullLoaded.manifest, () => {
 							const fresh = loadRunManifestById(entry.cwd, entry.runId);
 							if (fresh?.manifest.status !== "running") return;
+							// R2-M-A3 (2026-10-17): mirror the step-5 guard (and :135/:329/:937) — a
+							// parked run (plan approval / pending ask) is not an orphan. KEEP it.
+							if (isIntentionalWait(fresh.manifest, now)) {
+								abortedIntentionalWait = true;
+								return;
+							}
 							// R7-6 (2026-10-16): under-lock liveness revalidation — the pre-lock
 							// gate used inputs read BEFORE the lock; a concurrent `team resume`
 							// adoption may have rewritten them in that window (fresh
@@ -846,6 +872,12 @@ export function purgeStaleActiveRunIndex(
 									Math.round(staleThresholdMs / 60000) +
 									" minutes",
 							);
+							// R2-M-A3: clear waitState on cancel (mirror :431-438 + step 5 above).
+							if (fresh.manifest.waitState) {
+								const cleared = { ...fresh.manifest, waitState: undefined, updatedAt: new Date(now).toISOString() };
+								saveRunManifest(cleared);
+								fresh.manifest = cleared;
+							}
 							cancelledUnderLock = true;
 						});
 						// R7-1/R7-6: only terminate live agents when the cancel actually landed
@@ -867,7 +899,8 @@ export function purgeStaleActiveRunIndex(
 				}
 				// R7-1/R7-6: a fresh-evidence abort means the run is alive again — KEEP
 				// the registry entry (live-claim signal) instead of unregistering it.
-				if (abortedFreshLiveness) {
+				// R2-M-A3: an intentional-wait abort keeps the entry too.
+				if (abortedFreshLiveness || abortedIntentionalWait) {
 					kept.push(entry.runId);
 					continue;
 				}

package/src/runtime/scheduling/batch-barrier.ts

@@ -55,8 +55,19 @@ export class BatchBarrier {
 		}
 	>();
 
-	/** Register a member at spawn time. Idempotent per (batchId, agentId). */
+	/** R2-L-B6 (SEV-10): consolidated-notified batches are FREED (member maps
+	 * dropped) and remembered here as tombstones so `alreadyNotified` stays
+	 * true and late `markTerminal`/`register` calls never re-notify. Bounded
+	 * (evict-oldest) — previously every batchId leaked its member maps for the
+	 * session lifetime (zero production callers of dispose()). */
+	private readonly notifiedTombstones = new Map<string, number>();
+	private static readonly TOMBSTONE_CAP = 256;
+
+	/** Register a member at spawn time. Idempotent per (batchId, agentId).
+	 * R2-L-B6: no-op for a tombstoned (already notified) batch — the member
+	 * map is intentionally gone and must not resurrect a re-notifiable batch. */
 	register(batchId: string, agentId: string, meta?: { description?: string; type?: string }): void {
+		if (this.notifiedTombstones.has(batchId)) return;
 		let batch = this.batches.get(batchId);
 		if (!batch) {
 			batch = {
@@ -83,6 +94,18 @@ export class BatchBarrier {
 	 * on-the-fly as a batch-of-one so its terminal state is not silently lost.
 	 */
 	markTerminal(batchId: string, member: BatchMember): BatchSnapshot {
+		// R2-L-B6: the batch already fired its consolidated notification and was
+		// freed — report notified:true so the caller NEVER re-notifies a late
+		// member (documented late-spawn semantics), without resurrecting the map.
+		if (this.notifiedTombstones.has(batchId)) {
+			return {
+				batchId,
+				members: [{ ...member }],
+				terminal: [{ ...member }],
+				allDone: true,
+				notified: true,
+			};
+		}
 		let batch = this.batches.get(batchId);
 		if (!batch) {
 			batch = {
@@ -117,13 +140,22 @@ export class BatchBarrier {
 
 	/** Has the consolidated notification already been emitted for this batch? */
 	alreadyNotified(batchId: string): boolean {
-		return this.batches.get(batchId)?.notified ?? false;
+		return this.batches.get(batchId)?.notified ?? this.notifiedTombstones.has(batchId);
 	}
 
-	/** Mark the consolidated notification as emitted. No-op if already set. */
+	/** Mark the consolidated notification as emitted. No-op if already set.
+	 * R2-L-B6: DISPOSE the batch here — once the consolidated notify fired, the
+	 * member maps are dead weight; keep only a bounded tombstone so
+	 * `alreadyNotified`/late `markTerminal` preserve their answers. */
 	markNotified(batchId: string): void {
 		const batch = this.batches.get(batchId);
 		if (batch) batch.notified = true;
+		this.batches.delete(batchId);
+		this.notifiedTombstones.set(batchId, Date.now());
+		if (this.notifiedTombstones.size > BatchBarrier.TOMBSTONE_CAP) {
+			const oldest = this.notifiedTombstones.keys().next().value;
+			if (oldest !== undefined) this.notifiedTombstones.delete(oldest);
+		}
 	}
 
 	/** Read-only snapshot (for tests / debugging). */
@@ -141,7 +173,12 @@ export class BatchBarrier {
 
 	/** Drop a batch (used on cleanup / test reset). */
 	dispose(batchId?: string): void {
-		if (batchId === undefined) this.batches.clear();
-		else this.batches.delete(batchId);
+		if (batchId === undefined) {
+			this.batches.clear();
+			this.notifiedTombstones.clear();
+		} else {
+			this.batches.delete(batchId);
+			this.notifiedTombstones.delete(batchId);
+		}
 	}
 }

package/src/runtime/scheduling/run-coalesced-task-group.ts

@@ -61,7 +61,9 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 		}
 		return t;
 	});
-	await saveRunTasksAsync(manifest, updatedTasks);
+	// R3-H1 (fix): fresh-read group-scoped merge — never persist the dispatch-time
+	// full-array snapshot over concurrent sibling state changes.
+	await repairGroupTerminalWrite(manifest, taskIds, updatedTasks);
 	await appendEventAsync(manifest.eventsPath, {
 		type: "task.coalesced_dispatch_start",
 		runId: manifest.runId,
@@ -86,7 +88,9 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 			heartbeat: t.heartbeat ?? createWorkerHeartbeat(t.id),
 		};
 	});
-	await saveRunTasksAsync(manifest, updatedTasks);
+	// R3-H1 (fix): fresh-read group-scoped merge — never persist the dispatch-time
+	// full-array snapshot over concurrent sibling state changes.
+	await repairGroupTerminalWrite(manifest, taskIds, updatedTasks);
 
 	let rawOutput = "";
 	let success = false;
@@ -398,7 +402,9 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 			if (drainTimeout !== undefined) clearTimeout(drainTimeout);
 		}
 	}
-	await saveRunTasksAsync(manifest, updatedTasks);
+	// R3-H1 (fix): fresh-read group-scoped merge — never persist the dispatch-time
+	// full-array snapshot over concurrent sibling state changes.
+	await repairGroupTerminalWrite(manifest, taskIds, updatedTasks);
 	let updatedManifest: TeamRunManifest = {
 		...manifest,
 		artifacts: mergeArtifacts([...manifest.artifacts, ...newArtifacts]),

package/src/runtime/scheduling/scheduler.ts

@@ -36,6 +36,10 @@ export interface CrewSchedulerOptions {
  * waits (e.g. a yearly cron) must be chained in hops below this ceiling. */
 const MAX_TIMER_DELAY_MS = 2_147_483_000;
 
+/** R2-M-B4 (SEV-4): retention cap for job.spawnedRunIds (bounded persisted JSON;
+ * remove() cancels at most this most-recent window). */
+const SPAWNED_RUN_IDS_CAP = 50;
+
 export class CrewScheduler {
 	private jobs = new Map<string, ScheduledJob>();
 	private timers = new Map<string, ReturnType<typeof setInterval | typeof setTimeout>>();
@@ -81,6 +85,12 @@ export class CrewScheduler {
 
 	add(job: ScheduledJob): void {
 		this.jobs.set(job.id, job);
+		// R2-M-B6 (SEV-11): a persisted nextRun in the past = occurrences missed
+		// while the host was down. Classic cron leaves mail; we leave a one-time
+		//	`skipped` event + log line on RELOAD (this path). No catch-up — firing a
+		//	stale queue at load would storm the host. Runtime re-arms go through
+		//	update() (never add()), so a normal fire's stale nextRun cannot reach here.
+		this.reportMissedCronOccurrences(job);
 		if (job.enabled) this.arm(job);
 		this.emit?.({ type: "added", job });
 	}
@@ -123,7 +133,13 @@ export class CrewScheduler {
 	recordSpawnedRun(jobId: string, runId: string): void {
 		const job = this.jobs.get(jobId);
 		if (!job) return;
-		const spawnedRunIds = [...(job.spawnedRunIds ?? []), runId];
+		// R2-M-B4 (SEV-4): cap spawnedRunIds. The unbounded append persisted the
+		// FULL array per fire (O(n²) writes — a 5-min job ≈ 8.6k entries/30d,
+		// ~300-350 KB) and remove() then cancelled ALL historical runIds. Keep the
+		// most recent SPAWNED_RUN_IDS_CAP; runs beyond the cap are long terminal,
+		// so not cancelling them is the natural no-op.
+		const appended = [...(job.spawnedRunIds ?? []), runId];
+		const spawnedRunIds = appended.length > SPAWNED_RUN_IDS_CAP ? appended.slice(-SPAWNED_RUN_IDS_CAP) : appended;
 		this.jobs.set(jobId, { ...job, spawnedRunIds });
 	}
 
@@ -150,6 +166,26 @@ export class CrewScheduler {
 		return { ok: true };
 	}
 
+	/** R2-M-B6: one-time missed-occurrence report for a reloaded cron job whose
+	 * persisted nextRun is in the past (bounded occurrence walk — no catch-up). */
+	private reportMissedCronOccurrences(job: ScheduledJob): void {
+		if (job.scheduleType !== "cron" || !job.nextRun) return;
+		const nowMs = this.now().getTime();
+		const persistedMs = new Date(job.nextRun).getTime();
+		if (!Number.isFinite(persistedMs) || persistedMs >= nowMs) return;
+		let missed = 0;
+		let cursor = new Date(persistedMs);
+		for (let i = 0; i < 10_000; i++) {
+			const next = nextRunTime({ kind: "cron", spec: job.schedule }, cursor);
+			if (!(next instanceof Date) || next.getTime() > nowMs) break;
+			missed += 1;
+			cursor = next;
+		}
+		const reason = `missed ${missed} occurrence(s) while host down (persisted nextRun ${job.nextRun} < now ${new Date(nowMs).toISOString()})`;
+		this.emit?.({ type: "skipped", jobId: job.id, reason });
+		console.warn(`[pi-crew scheduler] job ${job.id} (${job.name ?? job.id}) skipped: ${reason}`);
+	}
+
 	private arm(job: ScheduledJob): void {
 		if (this.timers.has(job.id)) return;
 		if (job.scheduleType === "interval" && job.intervalMs) {
@@ -445,46 +481,55 @@ function cronFieldCandidates(field: string, min: number, max: number, names?: Re
 	return matched;
 }
 
-/**
- * Match a single cron field value against a cron field expression.
- * Supports the standard cron grammar: wildcard, single N, range a-b, list
- * a,b,c, step syntax (wildcard-step, range-step, from-step), and named tokens
- * (MON, JAN) when a `names` map is passed. Fixes the prior matcher that
- * rejected step values and named DOW (parseInt returned NaN).
- */
-function cronFieldMatches(value: number, field: string, min: number, max: number, names?: Record<string, number>): boolean {
-	const candidates = cronFieldCandidates(field, min, max, names);
-	return candidates?.has(value) === true;
-}
-
 function nextCronDate(spec: string, from: Date): Date | { error: string } | null {
 	const parts = spec.split(/\s+/);
 	if (parts.length < 5) return { error: "Invalid cron expression" };
 	const [minStr, hourStr, domStr, monthStr, dowStr] = parts;
 
+	// R2-L-B5 (SEV-9): hoist the candidate Sets OUT of the scan loop. The old
+	// minute-by-minute scan rebuilt 5 Sets per step (sparse crons walked up to
+	// 527k iterations ≈ 309ms event-loop stall, re-run after every fire). The
+	// scan below keeps EXACTLY the same semantics (first matching minute in
+	// chronological order) but hops by hour/day when the coarse fields mismatch.
+	const minuteCandidates = cronFieldCandidates(minStr, 0, 59);
+	const hourCandidates = cronFieldCandidates(hourStr, 0, 23);
+	const domCandidates = cronFieldCandidates(domStr, 1, 31);
+	const monthCandidates = cronFieldCandidates(monthStr, 1, 12, CRON_MONTH_NAMES);
+	const dowCandidates = cronFieldCandidates(dowStr, 0, 6, CRON_DOW_NAMES);
+	if (!minuteCandidates || !hourCandidates || !domCandidates || !monthCandidates || !dowCandidates) {
+		return { error: "Invalid cron expression" };
+	}
+
 	let cursor = new Date(from.getTime());
 	cursor.setSeconds(0, 0);
 	cursor = new Date(cursor.getTime() + 60_000);
 
-	const maxIterations = 366 * 24 * 60;
-	for (let i = 0; i < maxIterations; i++) {
-		const min = cursor.getUTCMinutes();
-		const hour = cursor.getUTCHours();
-		const dom = cursor.getUTCDate();
-		const month = cursor.getUTCMonth() + 1;
-		const dow = cursor.getUTCDay();
-
+	// Search window: 366 days (the old 366*24*60 minute-step bound).
+	const deadlineMs = cursor.getTime() + 366 * 24 * 60 * 60_000;
+	while (cursor.getTime() <= deadlineMs) {
+		// Day-level filter: month/dom/dow — skip whole days on mismatch.
 		if (
-			cronFieldMatches(min, minStr, 0, 59) &&
-			cronFieldMatches(hour, hourStr, 0, 23) &&
-			cronFieldMatches(dom, domStr, 1, 31) &&
-			cronFieldMatches(month, monthStr, 1, 12, CRON_MONTH_NAMES) &&
-			cronFieldMatches(dow, dowStr, 0, 6, CRON_DOW_NAMES)
+			!monthCandidates.has(cursor.getUTCMonth() + 1) ||
+			!domCandidates.has(cursor.getUTCDate()) ||
+			!dowCandidates.has(cursor.getUTCDay())
 		) {
-			return cursor;
+			// Hop to 00:00 of the next UTC day (Date.UTC normalizes overflow).
+			cursor = new Date(Date.UTC(cursor.getUTCFullYear(), cursor.getUTCMonth(), cursor.getUTCDate() + 1, 0, 0));
+			continue;
 		}
-
-		cursor = new Date(cursor.getTime() + 60_000);
+		// Hour-level filter: skip the rest of the hour on mismatch.
+		if (!hourCandidates.has(cursor.getUTCHours())) {
+			cursor = new Date(Date.UTC(cursor.getUTCFullYear(), cursor.getUTCMonth(), cursor.getUTCDate(), cursor.getUTCHours() + 1, 0));
+			continue;
+		}
+		// Matching day + hour: scan the remaining minutes of THIS hour only.
+		for (let minute = cursor.getUTCMinutes(); minute <= 59; minute++) {
+			if (minuteCandidates.has(minute)) {
+				return new Date(Date.UTC(cursor.getUTCFullYear(), cursor.getUTCMonth(), cursor.getUTCDate(), cursor.getUTCHours(), minute));
+			}
+		}
+		// No matching minute left in this hour → next hour boundary.
+		cursor = new Date(Date.UTC(cursor.getUTCFullYear(), cursor.getUTCMonth(), cursor.getUTCDate(), cursor.getUTCHours() + 1, 0));
 	}
 
 	return { error: "No next cron occurrence found within search window" };

package/src/runtime/stale-reconciler.ts

@@ -108,10 +108,28 @@ const WAITING_TTL_MS = 24 * 60 * 60 * 1000;
  * normal staleness repair paths apply (leak guard).
  */
 export function isWaitAnswerPending(manifest: TeamRunManifest, now = Date.now()): boolean {
-	const askedAtMs = manifest.waitState?.askedAt ? new Date(manifest.waitState.askedAt).getTime() : Number.NaN;
-	return Number.isFinite(askedAtMs) && now - askedAtMs <= WAITING_TTL_MS;
+	const waitState = manifest.waitState;
+	if (!waitState?.askedAt) return false;
+	const askedAtMs = new Date(waitState.askedAt).getTime();
+	if (!Number.isFinite(askedAtMs) || now - askedAtMs > WAITING_TTL_MS) return false;
+	// R2-M-A2 (2026-10-17): the parked-ask shield outlived the ask itself —
+	// WAITING_TTL_MS (24h) ≫ the server-clamped ask deadline (≤1h,
+	// request-parsers.ts WAIT_REQUEST_TIMEOUT_SEC_MAX), so a runner that died
+	// parked stayed shielded ~23h past its park deadline (dead parked runner
+	// blocked verdict tree/cancel/U9 fast-path). When the broker stamped a
+	// deadline on the park, the shield expires at deadline + grace; the 24h
+	// TTL above stays ONLY as the no-deadline fallback (pre-fix manifests).
+	if (typeof waitState.deadline === "number" && Number.isFinite(waitState.deadline)) {
+		return now <= waitState.deadline + PARKED_ASK_GRACE_MS;
+	}
+	return true;
 }
 
+/** R2-M-A2: grace past the ask deadline before a parked run loses
+ * reconciliation protection (buffer for the sweep cadence / in-tool
+ * surfacing — the deadline-owner sweep in dispatch-batch co-owns this). */
+const PARKED_ASK_GRACE_MS = 60 * 60 * 1000;
+
 /**
  * Generalized intentional-wait predicate (ADR-0 item 9, extended by ADR-4 §2):
  * the run is blocked on a human decision — plan approval (record-first with
@@ -415,10 +433,22 @@ export function hasLiveRunClaim(runId: string, manifest: TeamRunManifest): boole
 	return false;
 }
 
-function repairStaleRun(manifest: TeamRunManifest, tasks: TeamTaskState[], reason: string): TeamTaskState[] {
+function repairStaleRun(
+	manifest: TeamRunManifest,
+	tasks: TeamTaskState[],
+	reason: string,
+	// R2-M-A1 (2026-10-17): when set, ONLY these task ids are cancelled — used
+	// by the no_pid_individual_stale_task branch, whose contract (and comment)
+	// says "repair only the zombie subset, not the whole run": cancelling
+	// pid-ALIVE workers there destroyed healthy siblings in the SAME run.
+	onlyTaskIds?: Set<string>,
+): TeamTaskState[] {
 	const now = new Date().toISOString();
 	const repairedTasks = tasks.map((task) => {
-		if (task.status === "running" || task.status === "queued" || task.status === "waiting") {
+		if (
+			(onlyTaskIds === undefined || onlyTaskIds.has(task.id)) &&
+			(task.status === "running" || task.status === "queued" || task.status === "waiting")
+		) {
 			return {
 				...task,
 				status: "cancelled" as const,
@@ -571,7 +601,13 @@ export function reconcileStaleRun(manifest: TeamRunManifest, tasks: TeamTaskStat
 		// ALL tasks are zombies, while this path repairs only the zombie
 		// subset when some tasks are still healthy.
 		if (staleTaskIds.length > 0) {
-			const repaired = repairStaleRun(manifest, tasks, "no_pid_individual_stale_task");
+			// R2-M-A1 (2026-10-17): cancel ONLY the stale subset. The pre-fix code
+			// called repairStaleRun unscoped, which cancelled EVERY running/queued/
+			// waiting task in the run — including pid-ALIVE workers the branch was
+			// supposed to leave alone (pinned by stale-reconciler-r2h1-retention,
+			// updated in the same wave: task_a now stays running).
+			const staleSet = new Set(staleTaskIds);
+			const repaired = repairStaleRun(manifest, tasks, "no_pid_individual_stale_task", staleSet);
 			// Only return the individually repaired tasks in detail
 			return {
 				runId,
@@ -713,7 +749,10 @@ export function reconcileOrphanedTempWorkspaces(
 						const result = reconcileStaleRun(manifest, tasks, now);
 						if (result.repaired && result.repairedTasks) {
 							// Persist repaired tasks (atomic — temp+rename to survive mid-write crash)
-							atomicWriteJson(tasksPath, result.repairedTasks);
+							// R2-H1 (fix): persist the FULL array (NEW-1 persistTasks), not the filtered
+							// stale subset — the subset write destroyed every sibling record (mirror
+							// crash-recovery.ts:1066).
+							atomicWriteJson(tasksPath, result.persistTasks ?? result.repairedTasks);
 							// Update manifest status
 							const updated = {
 								...manifest,