pi-crew 0.11.24 → 0.11.26

package/src/config/types.ts

@@ -386,7 +386,10 @@ export interface CrewReliabilityConfig {
 	retryPolicy?: CrewRetryPolicyConfig;
 	autoRecover?: boolean;
 	deadletterThreshold?: number;
-	/** Interval (ms) for periodic stale-run auto-repair. Default 60_000 (60s). Set to 0 to disable. */
+	/** Interval (ms) for periodic stale-run auto-repair. Default 300_000 (5min) —
+	 *  the canonical value lives in the `?? 300_000` fallback at
+	 *  `src/extension/registration/observability.ts:256` (RT-F2 raised it from 60s;
+	 *  R45-F2). Set to 0 to disable. */
 	autoRepairIntervalMs?: number;
 	/** Remove /tmp/pi-crew-* directories after their orphaned runs are reconciled. Default: true. */
 	cleanupOrphanedTempDirs?: boolean;

package/src/extension/crew-cleanup.ts

@@ -79,6 +79,12 @@ export function registerCleanupHandler(pi: ExtensionAPI, opts?: { disposeTermina
 			// suppression; on REAL shutdowns (quit/reload) the flag is unset
 			// and this cleanup still drains the registry, as does the
 			// process-exit hook (tryRegisterSessionCleanup) when pi dies.
+			// R49-F6: this gate is a SWITCH FLAG (`isSessionSwitchInFlight()`), not the
+			// reason-aware gate used by lifecycle-handlers.ts:165-166. On a `reload` shutdown
+			// the flag can still read true (it is cleared on the next session_start), so
+			// this handler may skip a cleanup the reason-gate would have run — the
+			// process-exit hook (tryRegisterSessionCleanup) is the backstop. Divergence
+			// is deliberate (never kill workers on a navigational switch) but not obvious.
 			if (isSessionSwitchInFlight()) return;
 			// Kill all child-pi processes
 			await cleanupChildProcesses();

package/src/extension/project-init.ts

@@ -21,6 +21,13 @@ export interface ProjectInitResult {
 	configScope: "global" | "project" | "none";
 	configCreated: boolean;
 	configSkipped: boolean;
+	/**
+	 * F13-A: set when an EXPLICIT `overwrite: true` replaced an existing config
+	 * file. The previous content is preserved at this path — an overwrite of the
+	 * global (`~/.pi/agent/pi-crew.json`) or project config is destructive and may
+	 * discard user-customized settings, so it must never be silent.
+	 */
+	configBackupPath?: string;
 }
 
 function ensureDir(dir: string, createdDirs: string[]): void {
@@ -112,10 +119,20 @@ export function initializeProject(cwd: string, options: ProjectInitOptions = {})
 
 	let configCreated = false;
 	let configSkipped = false;
+	let configBackupPath: string | undefined;
 	if (configPath) {
 		if (configScope === "project") ensureDir(path.dirname(configPath), createdDirs);
 		else fs.mkdirSync(path.dirname(configPath), { recursive: true });
-		if (!fs.existsSync(configPath) || options.overwrite === true) {
+		const configExists = fs.existsSync(configPath);
+		if (!configExists) {
+			fs.writeFileSync(configPath, `${JSON.stringify(DEFAULT_PI_CREW_CONFIG, null, 2)}\n`, "utf-8");
+			configCreated = true;
+		} else if (options.overwrite === true) {
+			// F13-A: overwriting an existing config is destructive — it may hold the
+			// user's own settings (global scope writes ~/.pi/agent/pi-crew.json).
+			// Keep the previous content and report it instead of replacing silently.
+			configBackupPath = `${configPath}.bak-${Date.now()}`;
+			fs.copyFileSync(configPath, configBackupPath);
 			fs.writeFileSync(configPath, `${JSON.stringify(DEFAULT_PI_CREW_CONFIG, null, 2)}\n`, "utf-8");
 			configCreated = true;
 		} else {
@@ -166,5 +183,6 @@ export function initializeProject(cwd: string, options: ProjectInitOptions = {})
 		configScope,
 		configCreated,
 		configSkipped,
+		...(configBackupPath ? { configBackupPath } : {}),
 	};
 }

package/src/extension/register.ts

@@ -24,6 +24,7 @@ import { startRuntimeWarmup } from "../runtime/model/runtime-warmup.ts";
 import { primePeerDep } from "../runtime/peer-dep.ts";
 import { deployBundledThemes } from "../ui/deploy-bundled-themes.ts";
 import { installChildProcessAbortShield } from "../utils/child-process-shield.ts";
+import { logInternalError } from "../utils/internal-error.ts";
 import { resetTimings, time } from "../utils/timings.ts";
 import { registerAutonomousPolicy } from "./autonomous-policy.ts";
 import { registerContextStatusInjection } from "./context-status-injection.ts";
@@ -97,56 +98,93 @@ export async function registerPiTeams(pi: ExtensionAPI): Promise<void> {
 	const ctx = buildRegistrationContext(pi);
 	ctx.importCrashRecovery = importCrashRecovery;
 	ctx.purgeStaleActiveRunIndexSyncIfLoaded = purgeStaleActiveRunIndexSyncIfLoaded;
-	installRuntimeCleanup(pi, ctx);
-	installForegroundRunController(pi, ctx);
-	installSubagentManager(pi, ctx);
-	installLazyConfigurers(pi, ctx);
-	installCrossExtensionWiring(pi, ctx);
+
+	// R49-F5 (wave-6 M4-R2) — registrar guard. The registrars below run in a
+	// flat sequence; before this guard ANY throw aborted the remaining
+	// registrars and left a PARTIAL extension with no diagnostic (Pi's loader
+	// discards the rejection). Guard each call: on throw, record the subsystem
+	// name, log it through the internal-error channel, and CONTINUE — extension
+	// load must never break the session, but a failed subsystem must be
+	// visible. ONE consolidated warning is surfaced before the skill check.
+	const registrarFailures: string[] = [];
+	const withRegistrar = <T>(name: string, fn: () => T): T | undefined => {
+		try {
+			return fn();
+		} catch (err) {
+			const detail = err instanceof Error ? err.message : String(err);
+			registrarFailures.push(`${name} (${detail})`);
+			logInternalError(`register.${name}`, err, "extension registration subsystem");
+			return undefined;
+		}
+	};
+
+	withRegistrar("runtimeCleanup", () => installRuntimeCleanup(pi, ctx));
+	withRegistrar("foregroundRunController", () => installForegroundRunController(pi, ctx));
+	withRegistrar("subagentManager", () => installSubagentManager(pi, ctx));
+	withRegistrar("lazyConfigurers", () => installLazyConfigurers(pi, ctx));
+	withRegistrar("crossExtensionWiring", () => installCrossExtensionWiring(pi, ctx));
 
 	time("register.policy");
-	registerAutonomousPolicy(pi);
-	registerKnowledgeInjection(pi);
+	withRegistrar("autonomousPolicy", () => registerAutonomousPolicy(pi));
+	withRegistrar("knowledgeInjection", () => registerKnowledgeInjection(pi));
 
-	registerPiTools(pi, ctx);
-	registerPiCommands(pi, ctx);
-	installPiHooks(pi, ctx);
-	installSessionLifecycleHandlers(pi, ctx);
+	withRegistrar("piTools", () => registerPiTools(pi, ctx));
+	withRegistrar("piCommands", () => registerPiCommands(pi, ctx));
+	withRegistrar("piHooks", () => installPiHooks(pi, ctx));
+	withRegistrar("sessionLifecycleHandlers", () => installSessionLifecycleHandlers(pi, ctx));
 	// Phase 0 inter-pi broker: install the lifecycle controller immediately
 	// after the session handlers. The controller's gate (broker.enabled AND
 	// root-session only) decides whether anything is actually done; for
 	// subagents or when the flag is off, it returns a no-op controller.
-	ctx.brokerController = installCrewBrokerLifecycleController(pi, ctx);
+	ctx.brokerController = withRegistrar("crewBrokerLifecycle", () => installCrewBrokerLifecycleController(pi, ctx));
 
 	// M3-1 (UI-AUDIT P0-2/P1-1): wire the tab-title + Ghostty progress
 	// controller to runEventBus. Before this the controller was never
 	// constructed (dead since v0.8.3). Registers the dispose hook that the
 	// SIGTERM/SIGHUP handler calls (crew-cleanup.ts).
-	installTerminalStatus(pi, ctx);
-	registerCompactionGuard(pi, {
-		foregroundControllers: ctx.foregroundControllers,
-		foregroundTeamRunControllers: ctx.foregroundTeamRunControllers,
-	});
+	withRegistrar("terminalStatus", () => installTerminalStatus(pi, ctx));
+	withRegistrar("compactionGuard", () =>
+		registerCompactionGuard(pi, {
+			foregroundControllers: ctx.foregroundControllers,
+			foregroundTeamRunControllers: ctx.foregroundTeamRunControllers,
+		}),
+	);
 
 	if (process.env.CREW_RESILIENT_EDIT === "1") {
+		// R49-F5: do NOT swallow the outcome. `wrapEditWithResilientReplace`
+		// returns false when the hook was NOT registered (pi-diff present or the
+		// host lacks the tool_result seam) and the dynamic import can reject;
+		// both were previously discarded, so an operator who set
+		// CREW_RESILIENT_EDIT=1 got a silent no-op.
 		// LAZY: resilient-edit only loads when the opt-in env var is set.
 		import("../runtime/resilient-edit.ts")
-			.then(({ wrapEditWithResilientReplace }) => wrapEditWithResilientReplace(pi))
-			.catch(() => {
-				/* non-critical */
+			.then(({ wrapEditWithResilientReplace }) => {
+				if (!wrapEditWithResilientReplace(pi)) {
+					console.warn(
+						"[pi-crew] CREW_RESILIENT_EDIT=1 but the resilient-edit wrapper did NOT register " +
+							"(pi-diff detected or the host lacks the tool_result seam) — the opt-in is a no-op this session.",
+					);
+				}
+			})
+			.catch((err: unknown) => {
+				logInternalError("register.resilientEdit", err, "CREW_RESILIENT_EDIT=1");
+				console.warn(`[pi-crew] resilient-edit failed to load: ${err instanceof Error ? err.message : String(err)}`);
 			});
 	}
 
-	registerCrewMessageRenderers(pi);
-	registerCrewInputRouter(pi);
-	registerCrewShortcuts(pi);
-	registerContextStatusInjection(pi, {
-		enabled: loadConfig(process.cwd()).config.reliability?.ambientStatusInjection !== false,
-	});
+	withRegistrar("crewMessageRenderers", () => registerCrewMessageRenderers(pi));
+	withRegistrar("crewInputRouter", () => registerCrewInputRouter(pi));
+	withRegistrar("crewShortcuts", () => registerCrewShortcuts(pi));
+	withRegistrar("contextStatusInjection", () =>
+		registerContextStatusInjection(pi, {
+			enabled: loadConfig(process.cwd()).config.reliability?.ambientStatusInjection !== false,
+		}),
+	);
 
-	try {
-		registerCrewVibes(pi);
-	} catch (err) {
-		console.warn("[pi-crew] crew-vibes initialization failed:", err instanceof Error ? err.message : err);
+	withRegistrar("crewVibes", () => registerCrewVibes(pi));
+
+	if (registrarFailures.length > 0) {
+		console.warn(`[pi-crew] ${registrarFailures.length} subsystem(s) failed to register: ${registrarFailures.join(", ")}`);
 	}
 
 	const skillCheck = await runPostInitSkillCheck(process.cwd());

package/src/extension/registration/artifact-cleanup.ts

@@ -5,33 +5,69 @@ import { CLEANUP_MARKER_FILE, cleanupOldArtifacts, pruneExpiredArtifacts } from
 import type { ArtifactDescriptor, TeamRunManifest } from "../../state/types.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { projectCrewRoot, userCrewRoot } from "../../utils/paths.ts";
+import { resolveContainedRelativePath } from "../../utils/safe-paths.ts";
 
 /**
- * ST-10: Load artifact descriptors from all manifests in a runs directory.
- * Returns a flat list of every ArtifactDescriptor across all runs.
- * Best-effort: unreadable or corrupt manifests are silently skipped.
+ * ST-10 + R44-N1: artifact descriptors for ONE run, paired with the run's
+ * HOST-DERIVED artifacts root (containment anchor). The anchor is computed
+ * from the runs directory being scanned (`<crewRoot>/state/runs/<runId>` →
+ * `<crewRoot>/artifacts/<runId>` — the same convention `createRunPaths`
+ * derives), NEVER from the worker-writable manifest itself: a malicious
+ * manifest must not be able to nominate its own prune boundary.
  */
-function collectArtifactDescriptors(runsDir: string): ArtifactDescriptor[] {
-	const descriptors: ArtifactDescriptor[] = [];
+export interface RunArtifactGroup {
+	runId: string;
+	/** Host-derived per-run artifacts root (prune containment anchor). */
+	artifactsRoot: string;
+	descriptors: ArtifactDescriptor[];
+}
+
+/**
+ * ST-10: Load artifact descriptors from all manifests in a runs directory,
+ * grouped per run with the host-derived artifacts root for each run.
+ * Best-effort: unreadable or corrupt manifests are silently skipped. Runs
+ * whose DIRECTORY NAME cannot form a safe artifacts root (path-escape) are
+ * skipped with a warn (fail-closed — their descriptors are never pruned).
+ */
+export function collectArtifactDescriptors(runsDir: string): RunArtifactGroup[] {
+	const groups: RunArtifactGroup[] = [];
 	let dirs: fs.Dirent[];
 	try {
 		dirs = fs.readdirSync(runsDir, { withFileTypes: true });
 	} catch {
-		return descriptors;
+		return groups;
 	}
+	// runsDir = <crewRoot>/<state.runsSubdir> → the crew root sits two levels up
+	// (mirrors state-store.ts validateRunManifestPaths' baseRoot derivation).
+	const crewRoot = path.resolve(runsDir, "..", "..");
+	const artifactsParent = path.join(crewRoot, DEFAULT_PATHS.state.artifactsSubdir);
 	for (const dir of dirs) {
 		if (!dir.isDirectory()) continue;
+		let artifactsRoot: string;
+		try {
+			artifactsRoot = resolveContainedRelativePath(artifactsParent, dir.name, "runId");
+		} catch (error) {
+			// R44-N1 fail-closed: an unsafe run-dir name must not reach the prune
+			// path at all — its descriptors are dropped, not anchored elsewhere.
+			logInternalError(
+				"artifact-cleanup.run-anchor",
+				error instanceof Error ? error : new Error(String(error)),
+				`runsDir=${runsDir} runId=${dir.name}`,
+				"warn",
+			);
+			continue;
+		}
 		const manifestPath = path.join(runsDir, dir.name, DEFAULT_PATHS.state.manifestFile);
 		try {
 			const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf-8")) as TeamRunManifest;
 			if (Array.isArray(manifest.artifacts)) {
-				descriptors.push(...manifest.artifacts);
+				groups.push({ runId: dir.name, artifactsRoot, descriptors: manifest.artifacts });
 			}
 		} catch {
 			// Skip unreadable/corrupt manifests — best-effort.
 		}
 	}
-	return descriptors;
+	return groups;
 }
 
 export function runArtifactCleanup(cwd: string): void {
@@ -49,9 +85,14 @@ export function runArtifactCleanup(cwd: string): void {
 			markerFile: CLEANUP_MARKER_FILE,
 		});
 
-		// ST-10: Enforce retention/expiresAt from manifest metadata.
-		pruneExpiredArtifacts(collectArtifactDescriptors(path.join(userCrewRoot(), DEFAULT_PATHS.state.runsSubdir)));
-		pruneExpiredArtifacts(collectArtifactDescriptors(path.join(projectCrewRoot(cwd), DEFAULT_PATHS.state.runsSubdir)));
+		// ST-10 + R44-N1: enforce retention/expiresAt from manifest metadata,
+		// per-run and containment-anchored — a run's descriptors can only prune
+		// files under that run's OWN host-derived artifacts root.
+		for (const scope of [userCrewRoot(), projectCrewRoot(cwd)]) {
+			for (const group of collectArtifactDescriptors(path.join(scope, DEFAULT_PATHS.state.runsSubdir))) {
+				pruneExpiredArtifacts(group.descriptors, { artifactsRoot: group.artifactsRoot });
+			}
+		}
 	} catch (error) {
 		logInternalError("register.artifact-cleanup", error, `cwd=${cwd}`);
 	}

package/src/extension/registration/commands/manage.ts

@@ -99,8 +99,10 @@ export function registerManageCommands(pi: ExtensionAPI, deps: RegisterTeamComma
 		description: "Open the pi-crew interactive menu (list/run/status/cleanup/manage resources/doctor)",
 		handler: handleTeamManagerCommand,
 	});
-	// Backward-compat alias: this command was originally registered as "team-cleanup"
-	// (the interactive menu predates the runId-targeted cleanup action). Keep both so
+	// Backward-compat alias: the interactive menu originally shipped under a
+	// runId-targeted name; `/team-cleanup` itself was NEVER registered (R27-D1) —
+	// the live names are `/team-manager` and this `/team-cleanup-menu` alias, so
+	// docs must not advertise `/team-cleanup <runId>`. Keep both.
 
 	pi.registerCommand("team-cleanup-menu", {
 		description: "Alias for /team-manager (pi-crew interactive menu)",
@@ -218,6 +220,11 @@ export function registerManageCommands(pi: ExtensionAPI, deps: RegisterTeamComma
 			// LAZY: load withSessionId only when needed for skill-create command
 			const { withSessionId } = await import("../../team-tool/context.ts");
 			const sessionId = withSessionId(ctx);
+			// R49-F7: `ctx.workspaceFolder` is a PHANTOM read — it is a VS-Code-era
+			// field that pi's ExtensionCommandContext does not define (absent in the
+			// resolved 0.77/1.0.4 api literal), so the optional chain always falls back
+			// to `process.cwd()`. Harmless (the fallback is correct) but do not treat
+			// this branch as a real cwd override.
 			const cwd =
 				(
 					ctx as unknown as {

package/src/extension/registration/hook-registration.ts

@@ -80,6 +80,9 @@ function installResourcesDiscoverHook(pi: ExtensionAPI, ctx: RegistrationContext
 			return paths.length > 0 ? { skillPaths: paths } : {};
 		});
 	} catch {
+		// R49-F4: `pi.on()` does NOT throw for an unknown event name in pi 0.77/1.0.4
+		// (verified against the resolved api literal + dist) — this catch is defensive
+		// only. The real degradation on an older host is that the hook NEVER FIRES.
 		/* older Pi without resources_discover */
 	}
 }

package/src/extension/registration/lazy-configurers.ts

@@ -76,6 +76,8 @@ function installTurnReconcileHook(pi: ExtensionAPI, ctx: RegistrationContext): v
 			}
 		});
 	} catch {
+		// R49-F4: `pi.on()` never throws on an unknown event (pi 0.77/1.0.4) — this
+		// catch is defensive; the real older-host degradation is a NEVER-FIRING hook.
 		/* older Pi without before_agent_start — rely on the interval alone */
 	}
 }

package/src/extension/registration/lifecycle-handlers.ts

@@ -27,6 +27,8 @@ import {
 } from "../../extension/run-maintenance.ts";
 import { type BrokerSpawnCredentials, setActiveBrokerIssuer, setActiveBrokerRevoker } from "../../runtime/broker/broker-issuer.ts";
 import { CrewBroker } from "../../runtime/broker/crew-broker.ts";
+import { setActiveDelegateAborter } from "../../runtime/broker/delegate/delegate-abort.ts";
+import { DEFAULT_LOCK_BUSY_RETRY_DELAYS_MS, withRunLockBusyRetryAsync } from "../../runtime/broker/protocol/lock-busy.ts";
 import { terminateActiveChildPiProcesses } from "../../runtime/child-pi/child-pi.ts";
 import type { createManifestCache } from "../../runtime/manifest-cache.ts";
 import { configuredModelInfosFromPiConfig } from "../../runtime/model/model-fallback.ts";
@@ -40,7 +42,8 @@ import { tryRegisterSessionCleanup } from "../../runtime/session-resources.ts";
 import { createSessionSnapshot } from "../../runtime/session-snapshot.ts";
 import { applyCrewSettingsTiersToConfig, loadCrewSettingsTiers, scheduledJobsHiddenCountOf } from "../../runtime/settings-store.ts";
 import type { ReconcileResult } from "../../runtime/stale-reconciler.ts";
-import { loadRunManifestById } from "../../state/stores/state-store.ts";
+import { loadRunManifestById, saveRunManifest } from "../../state/stores/state-store.ts";
+import type { TeamRunManifest } from "../../state/types.ts";
 import { installInlinePanel } from "../../ui/inline-panel/index.ts";
 import { clearSessionSwitchInFlight, markSessionSwitchInFlight } from "../../ui/inline-panel/view-session-store.ts";
 import { registerPiCrewPowerbarSegments, resetPowerbarDedupState, updatePiCrewPowerbar } from "../../ui/powerbar-publisher.ts";
@@ -532,6 +535,56 @@ async function runDeferredSessionCleanup(
 	}
 }
 
+/** Manifest keys the scheduler stamps for traceability. They are NOT declared
+ *  on TeamRunManifest (carried as extra keys, exactly like the pre-fix inline
+ *  write did) — the provenance stamp is advisory metadata, never read back by
+ *  any consumer. */
+type SchedulerProvenanceFields = { schedulerJobId: string; schedulerName: string };
+
+/**
+ * M3-7 (R22-F2 / F22-2, fix-wave 6): stamp scheduler provenance on a scheduled
+ * run's manifest WITHOUT racing the runner.
+ *
+ * Pre-fix the executor did `atomicWriteJson(stateRoot + "/manifest.json",
+ * {...loaded.manifest, schedulerJobId, schedulerName})` — a RAW write that
+ * (a) bypassed run.lock, so it interleaved with team-runner's saveRunManifest /
+ * saveRunManifestAsync, and (b) bypassed the write-layer terminal-preserve
+ * guard, so a cancel/reconciler flip landing in the window was RESURRECTED to
+ * "running" while usage/artifacts were reverted to the pre-write snapshot. It
+ * fired on EVERY scheduled fire.
+ *
+ * Fix: re-read INSIDE run.lock (bounded busy-retry) and persist through
+ * `saveRunManifest`, which applies `preserveDiskTerminalStatus` (never erases a
+ * terminal disk status) and invalidates/repopulates the manifest cache. Read +
+ * write under the same lock closes the lost-update window by construction.
+ *
+ * Best-effort by contract (provenance must never break a scheduled fire): a
+ * pruned run, exhausted lock budget or write fault logs at warn and returns
+ * false.
+ *
+ * @internal exported for the M3-7 unit pin
+ * (test/unit/runtime/scheduling/scheduler-provenance-lock.test.ts).
+ */
+export async function stampSchedulerRunProvenance(cwd: string, runId: string, job: { id: string; name: string }): Promise<boolean> {
+	try {
+		const loaded = loadRunManifestById(cwd, runId);
+		if (!loaded) return false; // run pruned/unknown — nothing to stamp
+		const provenance: SchedulerProvenanceFields = { schedulerJobId: job.id, schedulerName: job.name };
+		await withRunLockBusyRetryAsync(loaded.manifest, DEFAULT_LOCK_BUSY_RETRY_DELAYS_MS, async () => {
+			// Fresh reload INSIDE the lock (respond.ts:42-43 discipline): outside
+			// would reintroduce the exact lost-update window being closed.
+			const fresh = loadRunManifestById(loaded.manifest.cwd, runId);
+			if (!fresh) return; // pruned between the outer load and the lock
+			const next: TeamRunManifest & SchedulerProvenanceFields = { ...fresh.manifest, ...provenance };
+			saveRunManifest(next);
+		});
+		return true;
+	} catch (error) {
+		logInternalError("scheduler.stamp-provenance", error, `runId=${runId} jobId=${job.id}`, "warn");
+		return false;
+	}
+}
+
 /**
  * Build a CrewScheduler wired to the current session. The scheduler's
  * executor closure invokes handleTeamTool lazily — the heavy team-tool
@@ -596,22 +649,11 @@ export function setupCrewScheduler(
 					const runId = runResult?.details?.runId;
 					if (runId && typeof runId === "string") {
 						crewScheduler?.recordSpawnedRun(job.id, runId);
-						// Update run manifest with scheduler provenance for traceability
-						try {
-							const cwd = extensionCtx.cwd ?? process.cwd();
-							const loaded = loadRunManifestById(cwd, runId);
-							if (loaded) {
-								// LAZY: defer dynamic import of atomic-write.ts to its call site.
-								const { atomicWriteJson } = await import("../../state/atomic-write.ts");
-								atomicWriteJson(loaded.manifest.stateRoot + "/manifest.json", {
-									...loaded.manifest,
-									schedulerJobId: job.id,
-									schedulerName: job.name,
-								});
-							}
-						} catch {
-							/* best-effort provenance tracking */
-						}
+						// Update run manifest with scheduler provenance for traceability.
+						// M3-7 (R22-F2): lock-held + terminal-preserving (was a raw
+						// atomicWriteJson outside run.lock that could resurrect a
+						// terminal status). Best-effort by contract.
+						await stampSchedulerRunProvenance(extensionCtx.cwd ?? process.cwd(), runId, job);
 					}
 					// R6-2(b) + I6 (round-6 audit): update state FIRST, then persist the
 					// UPDATED job. The old order persisted the fire-time snapshot (still
@@ -690,7 +732,7 @@ export interface CrewBrokerLifecycleController {
 }
 
 function isRootSession(env: NodeJS.ProcessEnv = process.env): boolean {
-	if (env.PI_CREW_KIND === "subagent") return false;
+	if (getCrewEnv("PI_CREW_KIND", env) === "subagent") return false;
 	try {
 		return currentCrewDepth(env) === 0;
 	} catch {
@@ -847,6 +889,24 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 	};
 	setActiveBrokerRevoker(revokeForTask);
 
+	// M3-5 / R43-N3: publish the delegate canceller alongside the revoker. The
+	// run-terminal paths (budget abort / cancellation → budget-enforcement.ts
+	// terminaliseRunWithDrain) call it so in-flight DELEGATE grandchildren are
+	// aborted instead of outliving the run to their own 24h deadline. Same
+	// self-gating as the revoker: no bound broker ⇒ nothing to cancel.
+	const abortDelegatesForRun = (runId: string, reason: string): number => {
+		if (!runId || typeof runId !== "string") return 0;
+		if (!isRootSession(process.env)) return 0;
+		if (!broker || brokerSessionId !== cachedSessionId) return 0;
+		try {
+			return broker.abortDelegatesForRun(runId, reason);
+		} catch (error) {
+			logInternalError("broker.abort-delegates", error instanceof Error ? error : new Error(String(error)), `runId=${runId}`, "warn");
+			return 0;
+		}
+	};
+	setActiveDelegateAborter(abortDelegatesForRun);
+
 	// Publish this issuer as the process-local active issuer so runChildPi can
 	// default `brokerIssuer` without the registration context being threaded
 	// through every runner call site. The issuer self-gates (root + flag), so
@@ -858,6 +918,7 @@ export function installCrewBrokerLifecycleController(_pi: ExtensionAPI, _ctx: Re
 		stop: async () => {
 			setActiveBrokerIssuer(undefined);
 			setActiveBrokerRevoker(undefined);
+			setActiveDelegateAborter(undefined);
 			if (broker) {
 				try {
 					await broker.stop();

package/src/extension/registration/render-loop.ts

@@ -19,7 +19,7 @@ import { forgetDetachedRun, hasDetachedRuns, peekFinishedDetachedRunResults } fr
 import { listLiveAgents } from "../../runtime/live-session/live-agent-manager.ts";
 import type { createManifestCache } from "../../runtime/manifest-cache.ts";
 import { loadTasksWithRecovery } from "../../state/stores/manifest-io.ts";
-import type { TeamRunManifest } from "../../state/types.ts";
+import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { overlayFreshTaskStatuses, summarizeHeartbeats } from "../../ui/heartbeat-aggregator.ts";
 import { requestRender, setExtensionWidget, toPiWidgetPlacement } from "../../ui/pi-ui-compat.ts";
 import { requestPowerbarUpdate } from "../../ui/powerbar-publisher.ts";
@@ -27,6 +27,7 @@ import { RenderScheduler } from "../../ui/render-scheduler.ts";
 import { runEventBus } from "../../ui/run-event-bus.ts";
 import type { createRunSnapshotCache } from "../../ui/run-snapshot-cache.ts";
 import { updateCrewWidget } from "../../ui/widget/index.ts";
+import { readJsonFileCoalesced } from "../../utils/file-coalescer.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { projectCrewRoot, userCrewRoot } from "../../utils/paths.ts";
 import { RunWatcherRegistry } from "../../utils/run-watcher-registry.ts";
@@ -128,6 +129,30 @@ export function applyTerminalRunEventToManifests(manifests: TeamRunManifest[], e
 	return isTerminalRunEventType(event.type) ? evictRunFromManifests(manifests, event.runId) : manifests;
 }
 
+/**
+ * R15-P1: GATE 3 used to call `loadTasksWithRecovery` — an uncached
+ * `readFileSync` + `JSON.parse` of the FULL task packet array (~8.4 KB/task) —
+ * once per running run on every 160 ms tick. Measured 14.78 ms/call at 200
+ * tasks, i.e. ~28% of the tick blocked on the event loop while runs were live.
+ *
+ * The read now goes through the in-tree coalesced reader (stat-gated on
+ * mtime+size, LRU-capped, short TTL): a tick that sees an unchanged file pays a
+ * syscall instead of a parse. The TTL is far below the stale (60 s) / dead
+ * (5 min) thresholds GATE 3 protects, and the quarantine/reconstruct path stays
+ * intact and self-invalidating — a recovered file is rewritten, so its mtime
+ * changes and the next tick misses the cache.
+ */
+const TASKS_READ_TTL_MS = 200;
+
+/**
+ * Read a run's tasks.json through the coalesced reader (GATE 3 truth source).
+ * Exported so the cache behaviour (and its freshness/quarantine invariants) can
+ * be pinned directly — see test/unit/extension/registration/render-loop-tasks-read-cache.test.ts.
+ */
+export function readTasksCoalesced(tasksPath: string, eventsPath: string, runId: string): TeamTaskState[] {
+	return readJsonFileCoalesced(tasksPath, TASKS_READ_TTL_MS, () => loadTasksWithRecovery(tasksPath, eventsPath, runId));
+}
+
 /**
  * Build the render scheduler + preload loop + bounded run watchers.
  *
@@ -385,7 +410,7 @@ export function setupRenderLoop(
 				// "dead worker" (live: team_20260923100114, 01_explore parked on
 				// ask). Overlay FRESH statuses before summarizing; divergence also
 				// schedules an in-place rebuild so the cache syncs off the tick.
-				const freshTasks = loadTasksWithRecovery(freshManifest.tasksPath, freshManifest.eventsPath, run.runId);
+				const freshTasks = readTasksCoalesced(freshManifest.tasksPath, freshManifest.eventsPath, run.runId);
 				const overlaid = overlayFreshTaskStatuses(snapshot, freshTasks);
 				if (overlaid !== snapshot) refreshSnapshotInPlace(run.runId);
 				const summary = summarizeHeartbeats(overlaid, { now });

package/src/extension/registration/tool-loop-guard.ts

@@ -215,7 +215,9 @@ export function createLoopGuardState() {
 /**
  * Install the loop guard on a Pi instance. Both hooks are best-effort:
  * older Pi versions without these events are tolerated (same pattern as
- * installResourcesDiscoverHook).
+ * installResourcesDiscoverHook). R49-F4: `pi.on()` never THROWS on an unknown
+ * event name (pi 0.77/1.0.4 verified) — so the try/catch below is defensive
+ * only, and the real older-host degradation is a NEVER-FIRING hook.
  */
 export function installToolLoopGuard(pi: ExtensionAPI): void {
 	const state = createLoopGuardState();
@@ -228,7 +230,7 @@ export function installToolLoopGuard(pi: ExtensionAPI): void {
 			return undefined;
 		});
 	} catch {
-		/* older Pi without tool_call events */
+		/* R49-F4: defensive only — pi.on() does not throw on unknown events; the hook simply never fires */
 	}
 	try {
 		pi.on("tool_result", (event: { toolName: string; input?: unknown; content?: unknown }) => {
@@ -238,6 +240,6 @@ export function installToolLoopGuard(pi: ExtensionAPI): void {
 			return { content: [...existing, ...appends] };
 		});
 	} catch {
-		/* older Pi without tool_result events */
+		/* R49-F4: defensive only — pi.on() does not throw on unknown events; the hook simply never fires */
 	}
 }

package/src/extension/registration/verify-gate-tool.ts

@@ -33,7 +33,6 @@ import { type Static, Type } from "@sinclair/typebox";
 import type { MetricRegistry } from "../../observability/metric-registry.ts";
 import {
 	DEFAULT_VERIFY_GATE_TIMEOUT_MS,
-	defaultVerifyGateChecks,
 	renderVerifyGateContext,
 	runVerifyGate,
 	type VerifyGateCheck,
@@ -59,7 +58,7 @@ const VerifyGateToolParams = Type.Object({
 			}),
 			{
 				description:
-					"Explicit checks. Defaults to the repo preset: package.json scripts 'typecheck' + 'test:critical' when present. Add grep evidence lines here (e.g. `grep -c \"<marker>\" dist/index.mjs`).",
+					'Explicit checks — REQUIRED for a meaningful verdict (M1-7: the gate never derives commands from a worker-mutable package.json). Without checks the verdict is INCONCLUSIVE (escalate). Add grep evidence lines here (e.g. `grep -c "<marker>" dist/index.mjs`).',
 			},
 		),
 	),
@@ -152,7 +151,12 @@ export function registerVerifyGateTool(pi: ExtensionAPI, deps: VerifyGateToolDep
 		}),
 		async execute(_id, params: Static<typeof VerifyGateToolParams>, signal, _onUpdate, ctx) {
 			const cwd = params.cwd && params.cwd.trim().length > 0 ? params.cwd : ctx.cwd;
-			const checks: VerifyGateCheck[] = params.checks ?? defaultVerifyGateChecks(cwd);
+			// M1-7 (R47-1): NO package.json fallback — the task/session cwd is
+			// worker-mutable, so deriving checks from it at call time let a worker
+			// grade its own work (tampered `scripts.typecheck: "exit 0"` ⇒ PASS).
+			// Callers must pass explicit checks; without them the gate is
+			// INCONCLUSIVE (escalate — never a PASS-shaped verdict).
+			const checks: VerifyGateCheck[] = params.checks ?? [];
 			// Nested-limit guards — validate BEFORE any executeTool call.
 			if (checks.length > VERIFY_GATE_TOOL_MAX_CHECKS) {
 				return {