pi-crew 0.11.24 → 0.11.26

package/src/runtime/delegate-spawn.ts

@@ -14,6 +14,13 @@
  *   apply (`--tools`/`--exclude-tools` from role-tools config) — a
  *   "read-only" explorer/analyst grandchild must actually be read-only
  *   (ADR-5 §9's serialization exemption depends on it).
+ *   R43-S1 (2026-10-19 fix-wave 6): the restrictions are now TRANSITIVE —
+ *   the effective grandchild tool policy is the intersection (min) of the
+ *   PARENT task role's policy and the requested role's policy
+ *   (spawn-policy.ts effectiveGrandchildToolPolicy), applied to the
+ *   in-memory agent config below. The delegate grandchildren are spawned
+ *   from a MINIMAL AgentConfig (no agents/<role>.md frontmatter is read),
+ *   so this is the ONLY argv-level tool cut they receive.
  * - S1#1: the grandchild authenticates under its OWN subId identity
  *   (grandchild-scoped broker token pre-minted by the handler) — never the
  *   parent's task token. Identity fields (`agentId: subId`) match.
@@ -27,11 +34,15 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { type ChildPiRunResult, runChildPi } from "./child-pi/child-pi.ts";
+import { effectiveGrandchildToolPolicy } from "./spawn-policy.ts";
 
 export interface GrandchildSpawnInput {
 	cwd: string;
 	runId: string;
 	parentTaskId: string;
+	/** Parent task record role (run-locked read) — R43-S1 transitive tier
+	 *  containment: the grandchild's tool policy is min(parent, requested). */
+	parentRole?: string;
 	/** Nested-slot holder id (minted by the broker handler). */
 	subId: string;
 	prompt: string;
@@ -48,6 +59,13 @@ export interface GrandchildSpawnInput {
 	/** Grandchild-scoped broker credentials (S1#1 — NEVER the parent token). */
 	brokerSpawn?: { socketPath: string; token: string };
 	onSpawn?: (pid: number | null) => void;
+	/** M3-5 / R43-N3: owner-side cancellation. The broker's delegate abort
+	 *  registry aborts this on run terminalise / budget abort / broker stop, so
+	 *  a grandchild can no longer outlive its run by up to its own 24h deadline
+	 *  (pre-fix: fire-and-forget spawner with no abort path). Aborting produces
+	 *  `{ ok: false, cancelled: true }` — distinct from the deadline
+	 *  `timedOut` outcome so the settle path can audit which one happened. */
+	signal?: AbortSignal;
 }
 
 export interface GrandchildSpawnResult {
@@ -55,19 +73,36 @@ export interface GrandchildSpawnResult {
 	/** Fenced-ish result text (caller fences before mailbox delivery). */
 	resultText: string;
 	/** Usage in tokens for roll-up (input+output+cache summed over
-	 *  message_end events); undefined = unattributed. */
+	 *  message_end events); undefined = unattributed.
+	 *  M3-4/R44-N4: AUDIT ONLY — the budget charge is the host-side
+	 *  reservation, never this self-attested number. */
 	usageTokens?: number;
 	timedOut?: boolean;
+	/** M3-5/R43-N3: the OWNER aborted the spawn (run terminalise / budget abort
+	 *  / broker stop) — distinct from the grandchild's own deadline. */
+	cancelled?: boolean;
 }
 
-/** Minimal in-memory agent config for a delegate grandchild role. */
-function agentForRole(role: string): AgentConfig {
+/**
+ * Minimal in-memory agent config for a delegate grandchild role.
+ *
+ * R43-S1: applies the EFFECTIVE tool policy — intersection (min) of the
+ * parent task role's policy and the requested grandchild role's policy —
+ * so the pi argv `--tools`/`--exclude-tools` cut reflects the transitive
+ * floor. A read-only parent's grandchild is bash/edit/write-denied even if
+ * the requested role itself is executor-class (defense-in-depth behind the
+ * spawn-policy admission gate).
+ */
+export function grandchildAgentForRole(role: string, parentRole?: string): AgentConfig {
+	const policy = effectiveGrandchildToolPolicy(parentRole, role);
 	return {
 		name: role,
 		description: `delegate grandchild (${role})`,
 		source: "builtin",
 		filePath: "",
 		systemPrompt: "",
+		...(policy.tools !== undefined ? { tools: policy.tools } : {}),
+		...(policy.excludeTools !== undefined ? { disallowedTools: policy.excludeTools } : {}),
 	};
 }
 
@@ -118,7 +153,18 @@ export async function spawnDelegateGrandchild(input: GrandchildSpawnInput): Prom
 	const artifactsRoot = grandchildArtifactsRoot(input.cwd, input.runId, input.parentTaskId, input.subId);
 	fs.mkdirSync(artifactsRoot, { recursive: true });
 
+	// M3-5/R43-N3: two abort sources — this spawn's own deadline and the
+	// OWNER (broker abort registry). `ownerAborted` distinguishes them for the
+	// settle audit; the AbortController it drives is the single signal handed to
+	// runChildPi, so both paths kill the child the same way.
 	const abort = new AbortController();
+	let ownerAborted = false;
+	const onOwnerAbort = (): void => {
+		ownerAborted = true;
+		abort.abort(input.signal?.reason);
+	};
+	if (input.signal?.aborted) onOwnerAbort();
+	else input.signal?.addEventListener("abort", onOwnerAbort, { once: true });
 	const timer = setTimeout(() => abort.abort(), input.timeoutSec * 1000);
 	timer.unref?.();
 
@@ -133,8 +179,9 @@ export async function spawnDelegateGrandchild(input: GrandchildSpawnInput): Prom
 		const result: ChildPiRunResult = await runChildPi({
 			cwd: input.cwd,
 			task: input.prompt,
-			agent: agentForRole(input.role),
-			// S1#2: thread the role so role-based tool restrictions apply.
+			// S1#2 + R43-S1: thread the role AND the parent role so the effective
+			// (min-intersected) tool policy applies at the argv level.
+			agent: grandchildAgentForRole(input.role, input.parentRole),
 			role: input.role,
 			...(input.model !== undefined ? { model: input.model } : {}),
 			...(input.maxTurns !== undefined ? { maxTurns: input.maxTurns } : {}),
@@ -154,13 +201,19 @@ export async function spawnDelegateGrandchild(input: GrandchildSpawnInput): Prom
 		const ok = result.exitCode === 0;
 		return { ok, resultText: grandchildResultText(result), ...(usageTokens !== undefined ? { usageTokens } : {}) };
 	} catch (error) {
-		const timedOut = abort.signal.aborted;
+		const timedOut = abort.signal.aborted && !ownerAborted;
+		const cancelled = ownerAborted;
 		return {
 			ok: false,
-			timedOut,
-			resultText: timedOut ? "[delegate timed out]" : `delegate spawn failed: ${(error as Error).message}`,
+			...(cancelled ? { cancelled } : { timedOut }),
+			resultText: cancelled
+				? "[delegate cancelled: run terminated]"
+				: timedOut
+					? "[delegate timed out]"
+					: `delegate spawn failed: ${(error as Error).message}`,
 		};
 	} finally {
 		clearTimeout(timer);
+		input.signal?.removeEventListener("abort", onOwnerAbort);
 	}
 }

package/src/runtime/dispatch-batch.ts

@@ -21,6 +21,7 @@ import type { TaskAttemptState, TeamRunManifest, TeamTaskState } from "../state/
 import { logInternalError } from "../utils/internal-error.ts";
 import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
 import { isDelegateShadowTask } from "./broker/delegate/shadow-lifecycle.ts";
+import { repointWaitState } from "./broker/protocol/wait-resolve.ts";
 import { classifyAmbientNoiseGate } from "./classifier/ambient-noise-gate.ts";
 import { resolveClassifierEnabled, resolveClassifierModel } from "./classifier/classifier-service.ts";
 import { readCrewAgents, recordFromTask, saveCrewAgents } from "./crew-agent-records.ts";
@@ -192,11 +193,16 @@ export async function sweepExpiredWaitingTasks(
 		}
 		saveRunTasks(fresh.manifest, tasks);
 		let manifest = fresh.manifest;
-		// WP-2 review round 1 (P3): clear manifest.waitState when its park was
-		// requeued — mirror the broker's clearWaitState guard, else the stale
-		// pointer shields the run from staleness repair for the full 24h TTL.
+		// WP-2 review round 1 (P3) + M4-R1(b) (fix-wave 6 residual): the ask-timeout
+		// requeue ended ONE park — scoped-forget the slot by RE-POINTING it at a
+		// surviving parked task (latest deadline wins, the wait.resolve M3-6
+		// invariant) instead of clearing it: a third task may still be parked and
+		// this single slot is its only stale-repair shield (isWaitAnswerPending
+		// reads only this field). Cleared only when no park is left — which also
+		// retires the stale-pointer-shields-the-run issue this guard was added for.
 		if (manifest.waitState && requeuedTaskIds.includes(manifest.waitState.taskId)) {
-			manifest = { ...manifest, waitState: undefined, updatedAt: new Date().toISOString() };
+			const waitState = repointWaitState(tasks, manifest.waitState, (candidateId) => requeuedTaskIds.includes(candidateId));
+			manifest = { ...manifest, waitState, updatedAt: new Date().toISOString() };
 			saveRunManifest(manifest);
 		}
 		if (

package/src/runtime/effectiveness.ts

@@ -34,6 +34,17 @@ export function delegateCompletedTaskIdsFromEvents(events: ReadonlyArray<{ type?
 	return ids;
 }
 
+/** R47-V7 (2026-10-19): a task completed by the deterministic gate-skip path
+ * (task-runner.ts pre-gate `skipVerifier` branch) carries a SYNTHESIZED
+ * terminal result — a fabricated `exitCode: 0`, a green gate summary as the
+ * result artifact/stdout, and no model attempt. task-runner tags that
+ * provenance as `diagnostics.synthetic = true`. Unlike the genuine gate
+ * verdict (also in diagnostics), this synthesized "completed with exit 0"
+ * shape must never be mistaken for real worker output. */
+export function taskIsSyntheticGateSkip(task: TeamTaskState): boolean {
+	return task.diagnostics?.synthetic === true;
+}
+
 export function taskHasObservableWorkerActivity(task: TeamTaskState): boolean {
 	return Boolean(
 		(task.agentProgress?.toolCount ?? 0) > 0 ||
@@ -49,7 +60,13 @@ export function taskHasObservableWorkerActivity(task: TeamTaskState): boolean {
 			// team_20261010162310): green-gated verifier tasks were false-blocked
 			// here ("no observable worker activity") → run stuck non-terminal
 			// "blocked" → sync team calls hung forever.
-			task.diagnostics?.verifyGate !== undefined,
+			//
+			// R47-V7 (2026-10-19): the skip-path result is SYNTHETIC provenance —
+			// its exit code is fabricated, not a real worker outcome — so a
+			// provenance-tagged synthetic task does NOT count as observable work.
+			// (The gate verdict stays on diagnostics as genuine evidence; only the
+			// synthesized result is excluded.) See {@link taskIsSyntheticGateSkip}.
+			(task.diagnostics?.verifyGate !== undefined && !taskIsSyntheticGateSkip(task)),
 	);
 }
 
@@ -106,8 +123,19 @@ export function evaluateRunEffectiveness(input: {
 	let severity: RunEffectivenessSeverity = "ok";
 	if (input.executeWorkers && guardMode !== "off" && noObservedWorkTasks.length > 0) {
 		severity = guardMode === "fail" ? "failed" : guardMode === "block" ? "blocked" : "warning";
-		// P0.1: default warn escalates to blocked for mutating-role tasks without observed work
-		if (severity === "warning" && noObservedWorkTasks.some((task) => permissionForRole(task.role) !== "read_only")) {
+		// P0.1: default warn escalates to blocked for mutating-role tasks without observed work.
+		// R47-V7 / U13 reconciliation (2026-10-19): a synthetic gate-skip task has
+		// no observable worker activity (so it is excluded from the score above, per
+		// R47-V7) but it is NOT evidence of an idle/broken run — the host gate really
+		// verified the change. Escalating it to "blocked" would re-open the U13
+		// false-block → non-terminal run → sync team call hang (live-caught
+		// 2026-10-10). Exclude synthetic tasks from the auto-escalation so a
+		// gate-skipped verifier (a WRITE role) can never block the run by itself.
+		// (An explicit guardMode block/fail still honors the user's setting.)
+		if (
+			severity === "warning" &&
+			noObservedWorkTasks.some((task) => !taskIsSyntheticGateSkip(task) && permissionForRole(task.role) !== "read_only")
+		) {
 			severity = "blocked";
 		}
 	}

package/src/runtime/goal-workflow/plan-templates.ts

@@ -141,7 +141,7 @@ registerPlanTemplate({
 			name: "verify",
 			role: "verifier",
 			taskTemplate:
-				"Verify that all review findings are addressed. Run FAST checks (completes in <2 min): `npm run test:critical && npx tsc --noEmit`. Do NOT run `npm run test:unit` or `npm test` — too slow (642 files, >4 min). Confirm: {{goal}} is achieved.",
+				"Verify that all review findings are addressed. Run FAST checks (completes in <2 min): `npm run test:critical && npx tsc --noEmit`. Do NOT run `npm run test:unit` or `npm test` — too slow (642 files, >4 min). Confirm: {{goal}} is achieved. Start the report with the verdict line `PASS: <what verified> — <evidence>` or `FAIL: <what failed> — <reason>` (the green-contract consumer reads it; no verdict line = UNVERIFIED).",
 			maxTasks: 1,
 			dependsOn: ["review"],
 			verificationCommand: "npm run test:critical && npx tsc --noEmit",
@@ -189,7 +189,7 @@ registerPlanTemplate({
 			name: "verify",
 			role: "verifier",
 			taskTemplate:
-				"Verify the complete implementation of: {{goal}}. Run FAST checks (`npm run test:critical && npx tsc --noEmit`, completes in <2 min). Do NOT run `npm run test:unit` or `npm test` — too slow for in-loop verification (642 files, >4 min). Validate all acceptance criteria.",
+				"Verify the complete implementation of: {{goal}}. Run FAST checks (`npm run test:critical && npx tsc --noEmit`, completes in <2 min). Do NOT run `npm run test:unit` or `npm test` — too slow for in-loop verification (642 files, >4 min). Validate all acceptance criteria. Start the report with the verdict line `PASS: <what verified> — <evidence>` or `FAIL: <what failed> — <reason>` (the green-contract consumer reads it; no verdict line = UNVERIFIED).",
 			maxTasks: 1,
 			dependsOn: ["review"],
 			verificationCommand: "npm run test:critical && npx tsc --noEmit",

package/src/runtime/live-session/live-agent-control.ts

@@ -22,6 +22,35 @@ export interface LiveAgentControlCursor {
 	offset: number;
 }
 
+/**
+ * R41-1 (M3-11) — durable processed marker.
+ *
+ * `processedAt` used to be set on the IN-MEMORY request object only, and the
+ * dedupe that made it meaningful lived in a per-invocation
+ * `BoundedSeenControlRequestIdSet` (live-session-runtime.ts). After a crash or
+ * a resume, the cursor starts at offset 0 and the seen-set is empty, so EVERY
+ * control request already applied was read back and re-applied (stop / steer /
+ * follow-up replayed into a fresh session).
+ *
+ * The fix persists the consumed state as an append-only marker line in the same
+ * `live-control.jsonl` file: crash-safe, no rewrite of request lines, no extra
+ * file to lock, and it survives a resume with a cold cursor. Marker lines are
+ * distinguishable from request lines by `type === "processed"` and are filtered
+ * out of every read.
+ */
+export interface LiveAgentControlMarker {
+	type: "processed";
+	requestId: string;
+	runId: string;
+	taskId: string;
+	processedAt: string;
+	error?: string;
+}
+
+function isControlMarker(value: unknown): value is LiveAgentControlMarker {
+	return Boolean(value && typeof value === "object" && (value as { type?: unknown }).type === "processed");
+}
+
 export function liveAgentControlPath(manifest: TeamRunManifest, taskId: string): string {
 	return path.join(ensureAgentStateDir(manifest, taskId), "live-control.jsonl");
 }
@@ -71,14 +100,31 @@ export function readLiveAgentControlRequests(
 	if (!fs.existsSync(filePath)) return { requests: [], cursor };
 	const text = fs.readFileSync(filePath, "utf-8");
 	const lines = text.split(/\r?\n/).filter(Boolean);
-	const requests = lines.slice(cursor.offset).flatMap((line) => {
+	const records = lines.map((line) => {
 		try {
-			const parsed = JSON.parse(line) as LiveAgentControlRequest;
-			return parsed && parsed.runId === manifest.runId && parsed.taskId === taskId ? [parsed] : [];
+			return JSON.parse(line) as unknown;
 		} catch {
-			return [];
+			return undefined; // unparseable line — skip (same tolerance as before)
 		}
 	});
+	// R41-1: markers may appear anywhere in the file (appended by any process),
+	// so the processed set is scanned over the WHOLE file — not just the unread
+	// window — before the cursor slice is filtered. This is what makes a cold
+	// cursor after crash/resume replay-free.
+	const processedRequestIds = new Set<string>();
+	for (const record of records) {
+		if (!isControlMarker(record)) continue;
+		if (record.runId !== manifest.runId || record.taskId !== taskId) continue;
+		processedRequestIds.add(record.requestId);
+	}
+	const requests = records.slice(cursor.offset).flatMap((record) => {
+		if (!record || isControlMarker(record)) return [];
+		const parsed = record as LiveAgentControlRequest;
+		if (parsed.runId !== manifest.runId || parsed.taskId !== taskId) return [];
+		// Already consumed in an earlier process (persisted marker) — never replay.
+		if (processedRequestIds.has(parsed.id)) return [];
+		return [parsed];
+	});
 	return { requests, cursor: { offset: lines.length } };
 }
 
@@ -92,6 +138,8 @@ export async function applyLiveAgentControlRequest(input: {
 		abort?: () => Promise<void> | void;
 	};
 	seenRequestIds?: Set<string>;
+	/** R41-1: when supplied, a processed marker is durably appended after the request is consumed. */
+	manifest?: TeamRunManifest;
 }): Promise<boolean> {
 	const { request, taskId, agentId, session, seenRequestIds } = input;
 	if (seenRequestIds?.has(request.id)) return false;
@@ -130,9 +178,34 @@ export async function applyLiveAgentControlRequest(input: {
 			`runId=${request.runId} taskId=${request.taskId} operation=${request.operation} requestId=${request.id}`,
 		);
 	}
+	// R41-1: persist the consumed state BEFORE anyone can observe "applied" — a
+	// crash right after this return must not replay the request.
+	if (input.manifest) appendProcessedControlMarker(input.manifest, taskId, request);
 	return true;
 }
 
+/**
+ * R41-1: appends a processed marker for a request this process consumed.
+ * Best-effort — a failed marker write must never fail the control loop (the
+ * in-memory seen-set still dedupes within this process); it only means the
+ * request may replay once after a crash.
+ */
+function appendProcessedControlMarker(manifest: TeamRunManifest, taskId: string, request: LiveAgentControlRequest): void {
+	const marker: LiveAgentControlMarker = {
+		type: "processed",
+		requestId: request.id,
+		runId: manifest.runId,
+		taskId,
+		processedAt: request.processedAt ?? new Date().toISOString(),
+		...(request.error ? { error: request.error } : {}),
+	};
+	try {
+		fs.appendFileSync(liveAgentControlFile(manifest, taskId), `${JSON.stringify(marker)}\n`, "utf-8");
+	} catch (error) {
+		logInternalError("live-agent-control.mark-processed", error, `taskId=${taskId} requestId=${request.id}`);
+	}
+}
+
 export async function applyLiveAgentControlRequests(input: {
 	manifest: TeamRunManifest;
 	taskId: string;
@@ -146,13 +219,23 @@ export async function applyLiveAgentControlRequests(input: {
 	seenRequestIds?: Set<string>;
 }): Promise<LiveAgentControlCursor> {
 	const batch = readLiveAgentControlRequests(input.manifest, input.taskId, input.cursor);
-	for (const request of batch.requests)
-		await applyLiveAgentControlRequest({
+	for (const request of batch.requests) {
+		const applied = await applyLiveAgentControlRequest({
 			request,
 			taskId: input.taskId,
 			agentId: input.agentId,
 			session: input.session,
 			seenRequestIds: input.seenRequestIds,
+			manifest: input.manifest,
 		});
+		// R41-1: the realtime subscription (live-session-runtime) consumes an
+		// already-persisted request WITHOUT a manifest, so it cannot write the
+		// marker itself. The poll sees the id in the shared seen-set on its next
+		// tick — mark it consumed here so a crash before then cannot replay it.
+		// A request addressed to a DIFFERENT agent is never marked (it is not ours
+		// to consume): applyLiveAgentControlRequest returns false for it without
+		// touching the seen-set.
+		if (!applied && input.seenRequestIds?.has(request.id)) appendProcessedControlMarker(input.manifest, input.taskId, request);
+	}
 	return batch.cursor;
 }

package/src/runtime/live-session/live-agent-manager.ts

@@ -84,6 +84,50 @@ const liveAgents = new Map<string, LiveAgentHandle>();
 // warning) to keep memory bounded.
 const MAX_LIVE_AGENTS = 5_000;
 
+/**
+ * R41-4 (M3-12): hard deadline for `session.abort()`.
+ *
+ * terminateLiveAgent awaited abort() with NO deadline: a session whose abort
+ * never settles (hung tool / provider holding the turn) deferred the whole
+ * teardown (dispose + registry removal + worker kill) forever, so the record
+ * stayed "running" and the process leaked. Mirrors the in-file
+ * Promise.race-with-timeout pattern in live-session-runtime.ts
+ * (bindExtensions 30s / control 30s).
+ */
+const LIVE_AGENT_ABORT_DEADLINE_MS = 10_000;
+
+async function abortLiveSessionWithDeadline(handle: LiveAgentHandle, deadlineMs: number = LIVE_AGENT_ABORT_DEADLINE_MS): Promise<void> {
+	const abort = handle.session.abort;
+	if (typeof abort !== "function") return;
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const deadline = new Promise<void>((resolve) => {
+		timer = setTimeout(() => {
+			logInternalError(
+				"live-agent-manager.abort-timeout",
+				new Error(`session.abort() did not settle within ${deadlineMs}ms`),
+				`agentId=${handle.agentId}`,
+			);
+			resolve();
+		}, deadlineMs);
+		// NOTE: deliberately NOT unref'd. A ref'd timer is what lets the deadline
+		// actually fire when nothing else keeps the event loop alive (an unref'd
+		// deadline on an awaited race can never settle — the RR-021 unref
+		// incident). The wait is bounded by deadlineMs, so it cannot leak.
+	});
+	try {
+		// The abort promise is left to settle on its own after the deadline;
+		// only the RACE is bounded (teardown must not be deferred).
+		await Promise.race([Promise.resolve(abort.call(handle.session)), deadline]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+
+/** @internal — test seam for the R41-4 abort deadline (see live-agent-manager-eviction tests). */
+export const __test__abortLiveSessionWithDeadline = abortLiveSessionWithDeadline;
+/** @internal — the production abort deadline, exposed so tests can assert its magnitude. */
+export const __test__LIVE_AGENT_ABORT_DEADLINE_MS = LIVE_AGENT_ABORT_DEADLINE_MS;
+
 /**
  * List all live agents for a specific workspace.
  * Only agents belonging to the given workspaceId are returned.
@@ -128,17 +172,23 @@ export function registerLiveAgent(
 	// evict the oldest completed agent (already finished, so caller no
 	// longer needs it). If none exist, evict the oldest running one with
 	// a warning so memory stays bounded.
+	// R41-4 (M3-12): eviction used to be a bare map.delete — the evicted
+	// session was never aborted/disposed, and the cap could therefore drop a
+	// RUNNING record while its session kept executing (an untracked live
+	// worker). Both branches now go through evictLiveAgentForCap, which
+	// initiates abort() (bounded by a deadline) and disposes before removing
+	// the record. Also: "oldest completed" is now picked by completedAtMs, not
+	// by insertion order (Map order says nothing about completion time).
 	if (liveAgents.size >= MAX_LIVE_AGENTS) {
-		const completed = [...liveAgents.entries()].find(([, h]) => h.activity.completedAtMs > 0);
+		const completed = [...liveAgents.entries()]
+			.filter(([, h]) => h.activity.completedAtMs > 0)
+			.sort((a, b) => a[1].activity.completedAtMs - b[1].activity.completedAtMs)[0];
 		if (completed) {
-			liveAgents.delete(completed[0]);
-			invalidateSortedLiveAgents();
+			evictLiveAgentForCap(completed[0], completed[1], `liveAgents at cap ${MAX_LIVE_AGENTS}`);
 		} else {
-			const oldestKey = liveAgents.keys().next().value;
-			if (oldestKey !== undefined) {
-				logInternalError("live-agent-manager.cap", new Error(`liveAgents at cap ${MAX_LIVE_AGENTS}; evicting oldest ${oldestKey}`));
-				liveAgents.delete(oldestKey);
-				invalidateSortedLiveAgents();
+			const oldest = liveAgents.entries().next().value;
+			if (oldest) {
+				evictLiveAgentForCap(oldest[0], oldest[1], `liveAgents at cap ${MAX_LIVE_AGENTS} with no completed agent`);
 			}
 		}
 	}
@@ -259,6 +309,33 @@ function markLiveAgentHandleTerminated(handle: LiveAgentHandle): void {
 	invalidateSortedLiveAgents();
 }
 
+/**
+ * R41-4 (M3-12): cap eviction = abort (deadline-bounded) + dispose + delete.
+ *
+ * Order matters: abort() is INITIATED first (it is the only channel that
+ * cancels an in-flight turn), then the handle is marked terminal, the session
+ * disposed and the record removed. registerLiveAgent is synchronous, so the
+ * abort promise itself cannot be awaited — it runs fire-and-forget through
+ * abortLiveSessionWithDeadline, so a never-settling abort cannot keep the
+ * session alive past the deadline (and never blocks the registration).
+ *
+ * The delete is identity-checked: only the exact handle being evicted is
+ * removed, so a handle re-registered for the same agentId can never be
+ * dropped by this path.
+ */
+function evictLiveAgentForCap(agentId: string, handle: LiveAgentHandle, reason: string): void {
+	logInternalError("live-agent-manager.cap", new Error(`${reason}; evicting ${agentId}`));
+	const aborting = abortLiveSessionWithDeadline(handle).catch((error) => {
+		logInternalError("live-agent-manager.cap-abort", error, `agentId=${agentId}`);
+	});
+	markLiveAgentHandleTerminated(handle);
+	safeDisposeLiveSession(handle);
+	if (liveAgents.get(agentId) === handle) liveAgents.delete(agentId);
+	invalidateSortedLiveAgents();
+	// Fire-and-forget by design — see docblock. Keeps the timer promise observed.
+	void aborting;
+}
+
 /**
  * U4 hung-tool escape hatch — drop-reference.
  *
@@ -308,11 +385,18 @@ export async function terminateLiveAgent(
 		/* non-critical */
 	}
 	try {
-		await handle.session.abort?.();
+		// R41-4 (M3-12): abort must not defer teardown — a hung abort() used to
+		// leave the handle registered as "running" forever. Bounded by
+		// LIVE_AGENT_ABORT_DEADLINE_MS; teardown runs either way (finally).
+		await abortLiveSessionWithDeadline(handle);
 	} finally {
 		markLiveAgentHandleTerminated(handle);
 		safeDisposeLiveSession(handle);
-		liveAgents.delete(handle.agentId); // Move AFTER abort completes to prevent race
+		// Move AFTER abort completes to prevent race — and identity-check the
+		// entry so a handle re-registered for the same agentId during the
+		// bounded abort is not removed (R41-4 sibling invariant to the cap
+		// eviction path).
+		if (liveAgents.get(handle.agentId) === handle) liveAgents.delete(handle.agentId);
 		invalidateSortedLiveAgents();
 		// WI-5 (SDD-4): if the session still backs a live worker process that
 		// abort()/dispose() failed to stop, signal it last so terminate cannot

package/src/runtime/live-session/live-session-runtime.ts

@@ -892,6 +892,13 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		const agentId = `${input.manifest.runId}:${input.task.id}`;
 		const inherited =
 			input.runtimeConfig?.inheritContext === true && input.parentContext ? ` with inherited context: ${input.parentContext}` : "";
+		// M3-2 (R47-3/V4): the verifier output contract requires a PASS:/FAIL:
+		// verdict line; the mock must emit contract-shaped output for verifier-role
+		// tasks or the (now real) verdict consumer marks the evidence unverified
+		// and the green contract blocks the run (fail-closed — correct for real
+		// verifiers, wrong for the success mock).
+		const mockVerdictSuffix = input.task.role === "verifier" ? "\nPASS: mock verifier — mock live-session success" : "";
+		const mockText = `Mock live-session success for ${input.agent.name}${inherited}${mockVerdictSuffix}`;
 		const event = {
 			type: "message_end",
 			message: {
@@ -899,7 +906,7 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 				content: [
 					{
 						type: "text",
-						text: `Mock live-session success for ${input.agent.name}${inherited}`,
+						text: mockText,
 					},
 				],
 			},
@@ -945,7 +952,7 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		// the batched writers here — tests read these files right after return.
 		flushPendingSidechainWrites();
 		if (isCurrent()) input.onEvent?.(event);
-		const stdout = `Mock live-session success for ${input.agent.name}${inherited}`;
+		const stdout = mockText;
 		if (isCurrent()) input.onOutput?.(stdout);
 		updateLiveAgentStatus(agentId, "completed");
 		markLiveAgentCompleted(agentId);

package/src/runtime/model/model-fallback.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { getCrewEnv } from "../../config/env-vars.ts";
 import { errors } from "../../errors.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { fuzzyResolveModelId } from "./model-resolver.ts";
@@ -646,7 +647,7 @@ export function resolveModelFallbackPolicy(
 		| undefined,
 	env: NodeJS.ProcessEnv = process.env,
 ): ModelFallbackPolicy | undefined {
-	const envMaxAuto = env.PI_CREW_MAX_AUTO_FALLBACKS;
+	const envMaxAuto = getCrewEnv("PI_CREW_MAX_AUTO_FALLBACKS", env);
 	let maxAutoFallbacks: number | undefined;
 	if (envMaxAuto) {
 		const parsed = Number.parseInt(envMaxAuto, 10);
@@ -680,7 +681,7 @@ export function resolveModelFallbackPolicy(
 	// "parent-first") silently behaved as parentFirst. Invalid → warn + fall
 	// back to config/default, mirroring the PI_CREW_MAX_AUTO_FALLBACKS
 	// clamp-warn sibling pattern above.
-	const envOrder = env.PI_CREW_MODEL_FALLBACK_ORDER;
+	const envOrder = getCrewEnv("PI_CREW_MODEL_FALLBACK_ORDER", env);
 	let order: "parentFirst" | "asIs" | undefined;
 	if (envOrder) {
 		if (envOrder === "parentFirst" || envOrder === "asIs") {
@@ -697,12 +698,8 @@ export function resolveModelFallbackPolicy(
 	} else {
 		order = config?.order;
 	}
-	const requireCredentials =
-		env.PI_CREW_MODEL_REQUIRE_CREDENTIALS === "1"
-			? true
-			: env.PI_CREW_MODEL_REQUIRE_CREDENTIALS === "0"
-				? false
-				: config?.requireCredentials;
+	const envRequireCredentials = getCrewEnv("PI_CREW_MODEL_REQUIRE_CREDENTIALS", env);
+	const requireCredentials = envRequireCredentials === "1" ? true : envRequireCredentials === "0" ? false : config?.requireCredentials;
 	// quotaAwareOrdering defaults to true (user preference: default-on with cache).
 	// When explicitly disabled, no deprioritization/rank data is attached.
 	const quotaAware = config?.quotaAwareOrdering !== false;
@@ -725,7 +722,7 @@ export function resolveDefaultSubagentModel(
 	config: { defaultSubagentModel?: string } | undefined,
 	env: NodeJS.ProcessEnv = process.env,
 ): string | undefined {
-	return env.PI_CREW_MODEL?.trim() || config?.defaultSubagentModel?.trim() || undefined;
+	return getCrewEnv("PI_CREW_MODEL", env)?.trim() || config?.defaultSubagentModel?.trim() || undefined;
 }
 
 export interface ConfiguredModelRouting {

package/src/runtime/model/pi-args.ts

@@ -2,7 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentConfig } from "../../agents/agent-config.ts";
-import { getCrewEnvBool } from "../../config/env-vars.ts";
+import { getCrewEnv, getCrewEnvBool } from "../../config/env-vars.ts";
 import { atomicWriteFile } from "../../state/atomic-write.ts";
 import { hasRunStateLayout, packageRoot, userPiRoot } from "../../utils/paths.ts";
 import { PI_NO_MCP_FLOOR, piVersionAtLeast } from "../child-pi/pi-version.ts";
@@ -131,13 +131,13 @@ export function applyThinkingSuffix(model: string | undefined, thinking: string
 }
 
 export function currentCrewDepth(env: NodeJS.ProcessEnv = process.env): number {
-	const raw = env.PI_CREW_DEPTH ?? env.PI_TEAMS_DEPTH ?? "0";
+	const raw = getCrewEnv("PI_CREW_DEPTH", env) ?? "0";
 	const parsed = Number(raw);
 	return Number.isInteger(parsed) && parsed >= 0 ? parsed : 0;
 }
 
 export function resolveCrewMaxDepth(inputMaxDepth?: number, env: NodeJS.ProcessEnv = process.env): number {
-	const raw = env.PI_CREW_MAX_DEPTH ?? env.PI_TEAMS_MAX_DEPTH;
+	const raw = getCrewEnv("PI_CREW_MAX_DEPTH", env);
 	const envDepth = raw !== undefined ? Number(raw) : NaN;
 	if (Number.isInteger(envDepth) && envDepth >= 1 && envDepth <= 10) return envDepth;
 	if (Number.isInteger(envDepth) && envDepth > 10) {

package/src/runtime/model/runtime-policy.ts

@@ -1,4 +1,5 @@
 import type { CrewRuntimeConfig } from "../../config/config.ts";
+import { getCrewEnv } from "../../config/env-vars.ts";
 import type { CrewRuntimeKind } from "../crew-agent-runtime.ts";
 import { currentCrewDepth } from "./pi-args.ts";
 
@@ -51,8 +52,9 @@ export function resolveEmbeddedFaultThreshold(policy: CrewRuntimeConfig["embedde
  * set, and PI_CREW_ALLOW_MOCK is filtered from child envs.
  */
 export function mockLiveSessionEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
-	if (env.PI_CREW_MOCK_LIVE_SESSION !== "success") return false;
-	return env.PI_CREW_ALLOW_MOCK === "1" || env.PI_CREW_ALLOW_MOCK === "true";
+	if (getCrewEnv("PI_CREW_MOCK_LIVE_SESSION", env) !== "success") return false;
+	const allowMock = getCrewEnv("PI_CREW_ALLOW_MOCK", env);
+	return allowMock === "1" || allowMock === "true";
 }
 
 export function resolveTaskRuntimeKind(