pi-crew 0.11.4 → 0.11.6

package/src/runtime/model/provider-extensions.ts

@@ -62,6 +62,61 @@ function cachedResult(settingsPath: string): { mtimeMs: number; result: Discover
 	return undefined;
 }
 
+/**
+ * GH #61: normalize a DIRECTORY `pi.extensions` entry to the entry FILE that
+ * Pi's own package auto-load registers. Pi's chain (package-manager
+ * `collectAutoExtensionEntries` → `resolveExtensionEntries`) resolves a
+ * directory to its nested pi-manifest entries, else `index.ts`/`index.js`.
+ * If pi-crew injects the directory as-is, the child worker loads the same
+ * extension twice under two path identities (".../dist" via --extension vs
+ * ".../dist/index.js" via package auto-discovery) and pi's
+ * detectExtensionConflicts kills the worker at startup (exit 1, every tool
+ * reported as conflicting). Always inject the FILE identity.
+ */
+function resolveExtensionDirEntry(dir: string, depth = 0): string | undefined {
+	if (depth > 2) return undefined; // guard pathological nesting loops
+	const pkgJsonPath = path.join(dir, "package.json");
+	if (fs.existsSync(pkgJsonPath)) {
+		try {
+			const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf8")) as { pi?: { extensions?: string[] } };
+			const piExts = pkg.pi?.extensions;
+			if (Array.isArray(piExts) && piExts.length > 0) {
+				for (const rel of piExts) {
+					const abs = path.resolve(dir, rel);
+					if (!fs.existsSync(abs)) continue;
+					return fs.statSync(abs).isDirectory() ? resolveExtensionDirEntry(abs, depth + 1) : abs;
+				}
+			}
+		} catch {
+			/* malformed package.json — fall through to index probes */
+		}
+	}
+	// Order mirrors Pi's resolveExtensionEntries EXACTLY for the first two
+	// (index.ts → index.js): when Pi's auto-load registers the extension, the
+	// injected identity MUST match its pick. index.mjs and package.json `main`
+	// are fallbacks for packages Pi's auto-load would NOT register at all (it
+	// checks neither) — a single injected instance there cannot conflict, and
+	// `main` preserves the legacy jiti dir-loading behaviour (GH #61 follow-up).
+	for (const name of ["index.ts", "index.js"]) {
+		const abs = path.join(dir, name);
+		if (fs.existsSync(abs) && fs.statSync(abs).isFile()) return abs;
+	}
+	const mjs = path.join(dir, "index.mjs");
+	if (fs.existsSync(mjs) && fs.statSync(mjs).isFile()) return mjs;
+	if (fs.existsSync(pkgJsonPath)) {
+		try {
+			const main = (JSON.parse(fs.readFileSync(pkgJsonPath, "utf8")) as { main?: string }).main;
+			if (main) {
+				const abs = path.resolve(dir, main);
+				if (fs.existsSync(abs) && fs.statSync(abs).isFile()) return abs;
+			}
+		} catch {
+			/* malformed package.json — skip */
+		}
+	}
+	return undefined;
+}
+
 /**
  * Resolve the extension entry point for an installed Pi package.
  * Order: package.json `pi.extensions` (array) → `index.ts` → `index.mjs` → `index.js` → `src/index.ts`.
@@ -80,7 +135,18 @@ function resolvePackageEntry(pkgDir: string): string | undefined {
 			if (Array.isArray(piExts) && piExts.length > 0) {
 				for (const rel of piExts) {
 					const abs = path.resolve(pkgDir, rel);
-					if (fs.existsSync(abs)) return abs;
+					if (!fs.existsSync(abs)) continue;
+					// GH #61: a DIRECTORY entry (e.g. pi-web-access "./dist") must be
+					// normalized to the file identity Pi's auto-load uses — injecting the
+					// raw dir double-loads the extension in child workers (tool conflicts,
+					// exit 1). An unresolvable dir is SKIPPED, matching Pi's own view of
+					// the package (its auto-load would not register it either).
+					if (fs.statSync(abs).isDirectory()) {
+						const entry = resolveExtensionDirEntry(abs);
+						if (entry) return entry;
+						continue;
+					}
+					return abs;
 				}
 			}
 			// Fall back to `main` when it points at a loadable entry (rare for extensions).

package/src/runtime/recovery/crash-recovery.ts

@@ -750,7 +750,12 @@ export async function reconcileAllStaleRuns(
 				const result = reconcileStaleRun(fresh.manifest, fresh.tasks, now);
 				if (result.repaired || result.verdict === "result_exists") {
 					if (result.repairedTasks) {
-						saveRunTasks(fresh.manifest, result.repairedTasks);
+						// NEW-1 (SDD 2026-09-30 WI-2): persist the FULL task array — the
+						// individual-stale branch filters `repairedTasks` down to the stale
+						// subset, and saveRunTasks full-overwrites tasks.json, which used to
+						// drop every healthy task from disk. `persistTasks` carries the full
+						// array; every other branch leaves it unset and falls back here.
+						saveRunTasks(fresh.manifest, result.persistTasks ?? result.repairedTasks);
 						for (const task of result.repairedTasks) {
 							try {
 								upsertCrewAgent(fresh.manifest, recordFromTask(fresh.manifest, task, "scaffold"));

package/src/runtime/scheduling/run-coalesced-task-group.ts

@@ -102,6 +102,18 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 	// (now-terminal) updatedTasks AFTER its own save resolves, so the terminal
 	// state always lands last regardless of disk timing.
 	let finalWriteStarted = false;
+	// NEW-3 (SDD-4 W-D): the coalesced path was the only dispatch path with NO
+	// pid evidence at all — the singleton path records checkpoint.childPid at
+	// child-spawned (child-executor.ts), but this module never calls
+	// checkpointTask, so heartbeat.pid stayed undefined AND checkpoint.childPid
+	// stayed undefined → the PID-liveness gates in stale-reconciler.ts and
+	// heartbeat-watcher.ts (both read `heartbeat?.pid ?? checkpoint?.childPid`)
+	// resolved to undefined for EVERY task in EVERY coalesced group; an
+	// alive-but-silent coalesced worker could be falsely repaired. Capture the
+	// real worker pid at spawn — onSpawn fires per spawn attempt, so
+	// retry/model-fallback overwrite this with the latest live pid (mirroring
+	// the singleton ownership-entry semantics in child-executor.ts).
+	let workerPid: number | undefined;
 	if (!executeWorkers) {
 		rawOutput = buildScaffoldOutput(groupTasks);
 		success = true;
@@ -121,7 +133,7 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 					// snapshot of the FULL task array — a sibling cancelled on disk after
 					// dispatch could be un-cancelled by a late heartbeat save (the map
 					// only mutated group tasks, but the SAVE wrote the whole stale array).
-					await persistGroupHeartbeats(manifest, taskIds);
+					await persistGroupHeartbeats(manifest, taskIds, workerPid);
 				} catch {
 					// Run may have been pruned mid-dispatch — best-effort only.
 				} finally {
@@ -188,6 +200,11 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 					maxTurns: input.runtimeConfig?.maxTurns,
 					graceTurns: input.runtimeConfig?.graceTurns,
 					onJsonEvent: (e) => input.onJsonEvent?.(firstTask.id, manifest.runId, e),
+					// NEW-3: capture the spawned worker's real pid for the heartbeat
+					// persists (see `workerPid` declaration above).
+					onSpawn: (pid) => {
+						workerPid = pid;
+					},
 				});
 			} finally {
 				if (timeoutHandle) clearTimeout(timeoutHandle);
@@ -246,13 +263,70 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 
 	const split = splitCoalescedOutput(rawOutput, taskIds);
 
+	// G20 (2026-10-02): fail-closed partial delimiter-hit. When the splitter
+	// reports the output as unpartitionable (strategy "deadletter" — the
+	// worker delimited SOME but not ALL of the group's tasks), broadcasting
+	// the full raw output to every task used to leak each task's delimited
+	// body to every OTHER task. Instead, record the group in the deadletter
+	// store using the same deliberate US-003 pattern as the retry-exhaustion
+	// hook above: ONE entry against the group's FIRST task, with the whole
+	// group's taskIds named in the message — the group shares one worker, so
+	// a single post-mortem record is the deliberate granularity. Each task
+	// then gets a content-free marker and a terminal "failed" status (see the
+	// mapping loop below); no task receives another task's content.
+	const deadlettered = split.some((s) => s.strategy === "deadletter");
+	if (deadlettered) {
+		appendDeadletter(manifest, {
+			runId: manifest.runId,
+			taskId: firstTask.id,
+			reason: "manual",
+			attempts: 1,
+			lastError: `coalesced group (${taskIds.length} task(s): ${taskIds.join(", ")}) — unpartitionable worker output: partial delimiter hit; per-task results withheld (G20 fail-closed, cross-task broadcast suppressed)`,
+			timestamp: new Date().toISOString(),
+			agent: agent.name,
+			role: firstTask.role,
+			runStatus: manifest.status,
+		});
+	}
+
 	const finishedAt = new Date().toISOString();
 	const newArtifacts: TeamRunManifest["artifacts"] = [];
 	updatedTasks = updatedTasks.map((t) => {
 		if (!taskIds.includes(t.id)) return t;
 		const entry = split.find((s) => s.taskId === t.id);
+		// G20 deadletter branch: unpartitionable output. Fail closed — every
+		// group task gets a marker that carries NO cross-task content (no
+		// delimited bodies, no full raw output) and a terminal "failed" status
+		// regardless of the worker's exit code: a worker whose output cannot be
+		// partitioned has NOT produced this task's result.
+		if (deadlettered) {
+			const markerText = `[coalesced-output-unpartitionable] task ${t.id}: worker output could not be partitioned (partial delimiter hit) — per-task result withheld (G20 fail-closed); see deadletter entry for group ${groupId}`;
+			const resultArtifact = writeArtifact(manifest.artifactsRoot, {
+				kind: "result",
+				relativePath: `results/${t.id}.txt`,
+				content: markerText,
+				producer: t.id,
+			});
+			newArtifacts.push(resultArtifact);
+			return {
+				...t,
+				status: "failed" as const,
+				finishedAt,
+				result: {
+					text: markerText,
+					producer: groupId,
+					strategy: "deadletter",
+				},
+				resultArtifact,
+			};
+		}
 		const ok = success && Boolean(entry?.text);
-		const text = entry?.text ?? rawOutput;
+		// G20 (second leak path closed): a task with NO split entry previously
+		// fell back to the FULL rawOutput — i.e. every other task's content.
+		// That fallback was exactly the cross-task leak; a missing entry now
+		// gets an empty marker instead. (splitCoalescedOutput returns an entry
+		// per taskId in every branch today, so this is defensive.)
+		const text = entry?.text ?? `[no partition entry for task ${t.id} — result withheld]`;
 		// BUGFIX (M6 real dispatch): write to artifactsRoot via writeArtifact
 		// so task.resultArtifact is set and aggregateTaskOutputs can read
 		// the per-task text. Previously the coalesced path used a raw
@@ -315,8 +389,10 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
 	await appendEventAsync(updatedManifest.eventsPath, {
 		type: "task.coalesced_dispatch_end",
 		runId: manifest.runId,
-		message: `Coalesced dispatch ${success ? "completed" : cancelled ? "cancelled" : "failed"} (${taskIds.length} tasks, ${split[0]?.strategy ?? "broadcast"} split)`,
-		data: { groupId, taskIds, success, cancelled, strategy: split[0]?.strategy },
+		message: deadlettered
+			? `Coalesced dispatch failed — unpartitionable output deadlettered (${taskIds.length} tasks, partial delimiter hit, G20 fail-closed)`
+			: `Coalesced dispatch ${success ? "completed" : cancelled ? "cancelled" : "failed"} (${taskIds.length} tasks, ${split[0]?.strategy ?? "broadcast"} split)`,
+		data: { groupId, taskIds, success, cancelled, strategy: split[0]?.strategy, deadlettered },
 	});
 
 	return { manifest: updatedManifest, tasks: updatedTasks, taskIds, rawOutput, success };
@@ -335,7 +411,7 @@ export async function runCoalescedTaskGroup(input: CoalescedTaskGroupInput): Pro
  * with heartbeats touched; sibling tasks are preserved untouched from the
  * fresh disk read. Keeps the FIND-06 'never replace terminal state' guard.
  */
-async function persistGroupHeartbeats(manifest: TeamRunManifest, taskIds: string[]): Promise<void> {
+async function persistGroupHeartbeats(manifest: TeamRunManifest, taskIds: string[], workerPid?: number): Promise<void> {
 	const fresh = loadRunManifestById(manifest.cwd, manifest.runId);
 	if (!fresh) return; // run pruned mid-dispatch — best-effort only.
 	const merged = fresh.tasks.map((t) => {
@@ -345,7 +421,14 @@ async function persistGroupHeartbeats(manifest: TeamRunManifest, taskIds: string
 		if (t.status === "completed" || t.status === "failed" || t.status === "cancelled") return t;
 		return {
 			...t,
-			heartbeat: touchWorkerHeartbeat(t.heartbeat ?? createWorkerHeartbeat(t.id), { alive: true }),
+			// NEW-3: stamp the worker's real pid on BOTH the create fallback and
+			// the touch update. Conditional spread is required — a literal
+			// `pid: undefined` would clobber a pid recorded by an earlier tick
+			// (touchWorkerHeartbeat spreads `updates` verbatim).
+			heartbeat: touchWorkerHeartbeat(t.heartbeat ?? createWorkerHeartbeat(t.id, workerPid), {
+				alive: true,
+				...(workerPid ? { pid: workerPid } : {}),
+			}),
 		};
 	});
 	await saveRunTasksAsync(manifest, merged);

package/src/runtime/stale-reconciler.ts

@@ -4,6 +4,7 @@ import * as path from "node:path";
 import { getCrewEnv } from "../config/env-vars.ts";
 import { errors } from "../errors.ts";
 import { atomicWriteFile, atomicWriteJson } from "../state/atomic-write.ts";
+import { type ActiveRunRegistryEntry, activeRunEntries } from "../state/stores/active-run-registry.ts";
 import { getCurrentPlanRecord } from "../state/stores/plan-store.ts";
 import { loadManifestWithRecovery, loadTasksWithRecovery, saveRunManifest } from "../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
@@ -44,6 +45,13 @@ export interface ReconcileResult {
 	detail: string;
 	/** Repaired task state, returned to a locked caller for persistence. */
 	repairedTasks?: TeamTaskState[];
+	/** NEW-1 (SDD 2026-09-30 WI-2): what the caller should PERSIST — the FULL
+	 *  task array, including tasks the repair did not touch. Only the
+	 *  individual-stale branch sets it (its `repairedTasks` is filtered down to
+	 *  the stale subset, which must NOT be full-overwrite-persisted or healthy
+	 *  tasks vanish from tasks.json). Callers fall back to `repairedTasks`
+	 *  when absent — every other branch already returns the full array there. */
+	persistTasks?: TeamTaskState[];
 }
 
 /**
@@ -353,6 +361,25 @@ function buildStaleReconcileError(task: TeamTaskState, reason: string): Error {
 	return errors.runStale(reason, heartbeatAgeSeconds);
 }
 
+/**
+ * G24 (SDD-4 WI-2): find a LIVE active-run-registry entry for this runId.
+ * activeRunEntries() already applies the full liveness filter (terminal status,
+ * dead async PID, >30min-stale non-async manifests, symlink safety), so an
+ * entry found here means some live session or runner claims the run RIGHT NOW.
+ * Read-only consult (register/unregister are never imported here). Fail-open:
+ * on an unexpected registry error return undefined so normal staleness
+ * reconciliation proceeds — a broken registry must not shield dead runs from
+ * repair forever.
+ */
+function findLiveRegistryEntry(runId: string): ActiveRunRegistryEntry | undefined {
+	try {
+		return activeRunEntries().find((entry) => entry.runId === runId);
+	} catch (err) {
+		logInternalError("stale-reconciler", new Error(`active-run registry consult failed for ${runId}: ${err}`), undefined, "warn");
+		return undefined;
+	}
+}
+
 function repairStaleRun(manifest: TeamRunManifest, tasks: TeamTaskState[], reason: string): TeamTaskState[] {
 	const now = new Date().toISOString();
 	const repairedTasks = tasks.map((task) => {
@@ -425,6 +452,33 @@ export function reconcileStaleRun(manifest: TeamRunManifest, tasks: TeamTaskStat
 		};
 	}
 
+	// G24 (SDD-4 WI-2, plan §2 upgrade-2026-09-29): foreign-LIVE skip. The
+	// active-run registry is the cross-session source of truth for "a live
+	// session/runner owns this run right now" (registerActiveRun at dispatch;
+	// entries self-expire via PID liveness + the 30min freshness horizon). Until
+	// now ownership was only checked as "run of the CURRENT session"
+	// (crash-recovery.ts ownerSessionId filter), so a child session — or the /tmp
+	// orphan scan, which has no session identity at all — could repair (cancel)
+	// a run whose workers were alive but heartbeat-frozen (G25 silent turn:
+	// 12m27s measured on a live worker). Must run BEFORE Phase 1/2/3: no phase
+	// below may act on a run a live owner still owns. Placement AFTER the
+	// intentional-wait guards keeps their more precise verdicts (both already
+	// return repaired:false, so no repair was ever at risk from them).
+	const liveEntry = findLiveRegistryEntry(runId);
+	if (liveEntry) {
+		return {
+			runId,
+			verdict: "healthy",
+			repaired: false,
+			// Honest text (G24): says exactly what happened — skipped because a live
+			// owner exists — and does not claim any repair. The "healthy" verdict
+			// keeps callers passive: crash-recovery does not push it into the
+			// notify result list, and reconcileOrphanedTempWorkspaces marks the
+			// workspace hasRunning so the foreign run's state is preserved.
+			detail: `Foreign-LIVE run: active-run registry entry is alive (cwd ${liveEntry.cwd}, updatedAt ${liveEntry.updatedAt}); reconcile skipped — a live session/runner owns this run, nothing was changed`,
+		};
+	}
+
 	// Phase 1: Check if results already exist
 	const phase1 = checkResultFile(manifest, tasks);
 	if (phase1.found) {
@@ -490,6 +544,7 @@ export function reconcileStaleRun(manifest: TeamRunManifest, tasks: TeamTaskStat
 				repaired: true,
 				detail: `No PID; ${staleTaskIds.length} individually stale task(s) repaired: ${staleTaskIds.join(", ")}`,
 				repairedTasks: repaired.filter((t) => staleTaskIds.includes(t.id)),
+				persistTasks: repaired, // NEW-1: persist FULL array (data-loss fix — SDD WI-2)
 			};
 		}
 		// Fall through: no recent activity but not all tasks stale enough yet.

package/src/runtime/task-output-context.ts

@@ -526,6 +526,16 @@ export function collectDependencyOutputContext(
 	return { dependencies: trimmedDependencies, sharedReads };
 }
 
+// ADR-5 §trust-fence: dependency output is DATA, never instructions. Mirror the
+// ask/delegate seams in src/prompt/prompt-runtime.ts (:323, :426, :589): strip
+// control chars and neutralize a smuggled closing fence tag so worker-controlled
+// content can never close the <dependency-context> fence early (see SDD 2026-09-30 WI-1).
+const DEPENDENCY_CONTROL_CHAR_PATTERN = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g;
+
+function sanitizeFencedBody(body: string): string {
+	return body.replace(DEPENDENCY_CONTROL_CHAR_PATTERN, "").replace(/<\/dependency-context/g, "&lt;/dependency-context");
+}
+
 export function renderDependencyOutputContext(context: DependencyOutputContext): string {
 	const parts: string[] = [];
 	if (context.dependencies.length) {
@@ -565,7 +575,7 @@ export function renderDependencyOutputContext(context: DependencyOutputContext):
 			parts.push("", read.content.trim(), "");
 		}
 	}
-	return parts.join("\n").trim();
+	return sanitizeFencedBody(parts.join("\n").trim());
 }
 
 export function writeTaskSharedOutput(manifest: TeamRunManifest, step: WorkflowStep, task: TeamTaskState): ArtifactDescriptor | undefined {

package/src/runtime/task-runner/child-executor.ts

@@ -28,7 +28,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { loadConfig } from "../../config/config.ts";
-import { getCrewEnv } from "../../config/env-vars.ts";
+import { getCrewEnv, getCrewEnvInt } from "../../config/env-vars.ts";
 import { errors } from "../../errors.ts";
 import { appendEventAsync, appendEventBuffered } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
@@ -64,6 +64,7 @@ import { readEnabledModelsPatterns } from "../model/model-scope.ts";
 import { type ParsedPiJsonOutput, parsePiJsonOutput } from "../output/pi-json-output.ts";
 import { type ProgressEventSummary, shouldAppendProgressEventUpdate } from "../output/progress-event-coalescer.ts";
 import { buildSyntheticTerminalEvidence, cancellationReasonFromSignal } from "../process/cancellation.ts";
+import { checkProcessLiveness } from "../process-status.ts";
 import { DEFAULT_RETRY_POLICY } from "../recovery/retry-executor.ts";
 import { runWorker } from "../run-worker.ts";
 import { parseSessionUsage } from "../session-usage.ts";
@@ -152,6 +153,90 @@ export function computeSpawnBudgetMax(attemptModelsCount: number, configuredMaxA
 	return attemptModelsCount * (configuredMaxAttempts + 1);
 }
 
+/**
+ * NEW-4/G25 (SDD-4 WI-4): default liveness-pulse interval, in ms.
+ *
+ * Why a pulse at all: `persistHeartbeat` was only invoked from stdout-driven
+ * callbacks (onStdoutLine / onJsonEvent / onSurfaceActivity). A worker turn
+ * that stays silent for longer than the stale windows — observed live:
+ * 12m27s (heartbeat gradient deadMs=300s, staleMs=60s; stale-reconciler
+ * NO_PID_HEARTBEAT_STALE_MS=300s) — froze heartbeat.lastSeenAt while the
+ * worker process was alive and mid-turn, so liveness consumers (heartbeat
+ * watcher gradient, widget, stale reconciler no-PID path) saw a "dead"
+ * worker that was actually healthy.
+ *
+ * 15s keeps the gradient at "healthy" (warnMs=30s) with 2× headroom, stays
+ * 4× under staleMs (60s) and 20× under deadMs (300s), and costs at most one
+ * throttled tasks.json persist per running task per 15s (persistHeartbeat's
+ * 1s throttle binds first for tighter configured intervals).
+ *
+ * Design choice (producer-side pulse vs reconciler corroboration): the
+ * reconciler and heartbeat-watcher ALREADY carry a PID-liveness gate
+ * (stale-reconciler.ts isTaskHeartbeatStale, heartbeat-watcher.ts
+ * dead→stale downgrade) keyed on `heartbeat.pid ?? checkpoint.childPid`.
+ * Those gates only help when a pid was recorded AND the consumer runs it;
+ * the pulse fixes the PRODUCER side for every consumer at once (gradient
+ * levels, widget, no-pid repair path, ambient notifications) without
+ * touching stale-reconciler.ts (owned by WI-2). Both are wanted; this is
+ * the least invasive in-lane half. See handoff for the recommendation.
+ */
+const DEFAULT_HEARTBEAT_PULSE_INTERVAL_MS = 15_000;
+
+/** Opaque handle for the per-attempt heartbeat liveness pulse. */
+export interface WorkerHeartbeatPulse {
+	/** Stop the pulse and clear its timer. Idempotent. */
+	stop(): void;
+}
+
+/**
+ * Resolve the liveness-pulse interval from `PI_CREW_HEARTBEAT_PULSE_MS`.
+ * Unset/invalid → default (15s). Values ≤ 0 disable the pulse entirely
+ * (escape hatch for operators/batteries that want the pre-fix behaviour).
+ */
+export function resolveHeartbeatPulseIntervalMs(): number {
+	const configured = getCrewEnvInt("PI_CREW_HEARTBEAT_PULSE_MS");
+	if (configured === undefined || !Number.isFinite(configured)) return DEFAULT_HEARTBEAT_PULSE_INTERVAL_MS;
+	if (configured <= 0) return 0;
+	return configured;
+}
+
+/**
+ * Start a periodic heartbeat liveness pulse: every `intervalMs`, if
+ * `isAlive()` reports the worker incarnation as alive, call `touch()`.
+ * This decouples heartbeat freshness from stdout events (NEW-4/G25): a
+ * silent-but-alive turn keeps the heartbeat fresh; a dead worker stops
+ * being touched the moment its pid checks dead (see [pulse-2]).
+ *
+ * Failure containment: a throwing `touch`/`isAlive` is logged and the timer
+ * keeps ticking — the pulse must never crash the host process ([pulse-3]).
+ * The timer is `unref`'d so it can never hold the event loop open.
+ */
+export function startWorkerHeartbeatPulse(opts: { intervalMs: number; isAlive: () => boolean; touch: () => void }): WorkerHeartbeatPulse {
+	if (opts.intervalMs <= 0) {
+		return {
+			stop() {
+				// Intentional no-op: a disabled pulse (interval ≤ 0) has no timer to clear.
+			},
+		};
+	}
+	let stopped = false;
+	const timer = setInterval(() => {
+		if (stopped) return;
+		try {
+			if (opts.isAlive()) opts.touch();
+		} catch (err) {
+			logInternalError("task-runner.heartbeat-pulse", err as Error);
+		}
+	}, opts.intervalMs);
+	timer.unref?.();
+	return {
+		stop() {
+			stopped = true;
+			clearInterval(timer);
+		},
+	};
+}
+
 /**
  * Resolve the model fallback policy from crew config + env. Best-effort: any
  * config read failure returns undefined (legacy unbounded/unordered behaviour).
@@ -442,12 +527,16 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 			// is informational and re-derivable from per-agent records.
 			// appendEventBuffered coalesces into a single lock acquire after bufferMs,
 			// reducing producer p95 from ~13µs (serial) to ~0µs (bench M7).
+			// .catch is REQUIRED (CI 2026-10-03 char-core5-6): the buffered flush
+			// rejects queued promises on write failure (e.g. ENOENT after cwd
+			// cleanup) — a naked `void` turns that into an unhandledRejection
+			// that kills the host test/process long after the caller returned.
 			void appendEventBuffered(manifest.eventsPath, {
 				type: "task.progress",
 				runId: manifest.runId,
 				taskId: task.id,
 				data: { ...summary, coalesceReason: decision.reason },
-			});
+			}).catch((error) => logInternalError("child-executor.progress-buffered", error, `taskId=${task.id}, runId=${manifest.runId}`));
 			lastRunProgressSummary = summary;
 			lastRunProgressPersistedAt = now;
 		}
@@ -535,6 +624,30 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 			}, taskTimeoutMs);
 			timeoutHandle.unref?.();
 		}
+		// NEW-4/G25 (SDD-4 WI-4): per-attempt heartbeat liveness pulse. Keeps
+		// heartbeat.lastSeenAt fresh while THIS attempt's worker process is
+		// alive, independent of stdout events (a silent turn no longer freezes
+		// the heartbeat → liveness consumers stop repairing live workers).
+		// Liveness predicate:
+		// - attempt aborted (wall-clock timeout / external cancel) → stop
+		//   asserting liveness; kill escalation owns the remainder.
+		// - pid known (onSpawn fired) → hard corroboration via kill(pid,0);
+		//   a dead pid is never touched, so genuine zombie repair keeps working.
+		// - pid not yet known (pre-spawn window / mock fixtures that bypass
+		//   spawn) → the pending runWorker promise is the best available
+		//   evidence of an in-flight incarnation; touch (fail-open, bounded:
+		//   real spawns pin the pid within ms, and the reconciler's ESRCH
+		//   verdict can never be overridden by a fresh heartbeat).
+		let attemptWorkerPid: number | undefined;
+		const heartbeatPulse = startWorkerHeartbeatPulse({
+			intervalMs: resolveHeartbeatPulseIntervalMs(),
+			isAlive: () => {
+				if (timeoutController.signal.aborted) return false;
+				if (attemptWorkerPid === undefined) return true;
+				return checkProcessLiveness(attemptWorkerPid).alive;
+			},
+			touch: () => persistHeartbeat(),
+		});
 		let childResult: ChildPiRunResult;
 		try {
 			childResult = await runWorker({
@@ -561,6 +674,9 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 				attempt: i,
 				steeringFile: resolveRealContainedPath(`${manifest.artifactsRoot}/steering`, `${task.id}.jsonl`),
 				onSpawn: (pid) => {
+					// NEW-4/G25: pin this incarnation's pid FIRST so the liveness pulse
+					// corroborates against the real process from its first tick on.
+					attemptWorkerPid = pid;
 					try {
 						// WP-1/R1 (H6): dispatch-time ownership writer — record the
 						// task ⇄ pid ⇄ artifactsDir leg of the ownership map as soon as
@@ -621,7 +737,9 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 							// Fire-and-forget async write for steering events (the file was
 							// truncated just above; this incarnation receives only its own
 							// pending steers).
-							void appendSteeringAsync(steeringDir, task.id, task.pendingSteers);
+							void appendSteeringAsync(steeringDir, task.id, task.pendingSteers).catch((error) =>
+								logInternalError("child-executor.steering-append", error as Error, `taskId=${task.id}`),
+							);
 							// RT-8: spread before clearing pendingSteers instead of mutating
 							// in place — preserves the immutable-snapshot invariant (the same
 							// object may already be referenced by the tasks array / snapshots).
@@ -692,7 +810,9 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 							const bgLogPath = `${manifest.stateRoot}/background.log`;
 							const eventLine = typeof event === "object" && !Array.isArray(event) ? JSON.stringify(event) : String(event);
 							// Fire-and-forget async write for background log
-							void appendBackgroundLogAsync(bgLogPath, eventLine);
+							void appendBackgroundLogAsync(bgLogPath, eventLine).catch((error) =>
+								logInternalError("child-executor.background-log", error as Error, `taskId=${task.id}`),
+							);
 						}
 						// Always keep in-memory agentProgress fresh (cheap) so the UI/events see
 						// the latest progress, but THROTTLE the disk persist. Previously this
@@ -764,6 +884,12 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 			// the persisted events/output after a task always match what the
 			// unbuffered implementation would have written.
 			flushCrewAgentRecordBuffer(manifest, task.id);
+			// NEW-4/G25: the attempt is over (success, failure, or throw) — stop
+			// the liveness pulse in the same per-attempt cleanup as the wall-clock
+			// timeout (R3 contract block): nothing may touch this incarnation's
+			// heartbeat anymore, including across the model-fallback respawn gap
+			// (where nothing is alive and the heartbeat must be allowed to age).
+			heartbeatPulse.stop();
 			if (timeoutHandle) clearTimeout(timeoutHandle);
 			// W2 fix — release the listener so it doesn't leak. {once:true}
 			// only auto-removes when the listener FIRES; if the timeout

package/src/runtime/task-runner/output-splitter.ts

@@ -9,25 +9,40 @@
  * Strategy (in priority order):
  *   1. Delimiter parse — exact match of `<<<TASK_RESULT:id>>>` markers
  *   2. Section heading parse — `### Task N of M` / `## Task N` headers
+ *      (only reachable when the output contains ZERO delimiter markers)
  *   3. Whole-output broadcast — assign full raw output to ALL taskIds
- *      (safe fallback for read-only roles where identical context is OK)
+ *      (safe fallback for read-only roles where identical context is OK;
+ *      only reachable when the output contains ZERO delimiter markers —
+ *      see the deadletter note below for why)
+ *   Deadletter (G20 fail-closed) — a PARTIAL delimiter hit (some but not
+ *      all taskIds delimited) marks the whole output unpartitionable: no
+ *      task may receive any partition of it. Previously this case fell
+ *      through to Strategy 3 and broadcast the full raw output — including
+ *      other tasks' delimited bodies — to every task in the group. The
+ *      caller (run-coalesced-task-group) records the group via
+ *      appendDeadletter and fails the tasks instead.
  *
  * Returns an array of { taskId, text } records in input-order. When the
  * delimiter strategy succeeds, each entry contains that task's delimited
  * text. When broadcast fallback is used, all entries contain the full
- * raw output.
+ * raw output. When the deadletter strategy is returned, all entries have
+ * empty text — the caller decides what marker to surface per task.
  *
  * Note: pure function — no I/O, no LLM calls, deterministic. This is
  * deliberately the simplest possible splitter; we don't try fuzzy
  * matching, NL extraction, or retry-the-LLM. The MVP trusts workers
- * to follow delimiters 99% of the time and broadcasts the rest.
+ * to follow delimiters 99% of the time; a zero-marker miss degrades to
+ * broadcast (nothing task-specific exists to leak), and a partial
+ * violation now fails closed (G20) instead of leaking cross-task
+ * delimited bodies.
  */
 
 export interface SplitResult {
 	taskId: string;
 	text: string;
-	/** Which strategy produced this entry. */
-	strategy: "delimiter" | "section" | "broadcast";
+	/** Which strategy produced this entry. `deadletter` = G20 fail-closed:
+	 * partial delimiter hit — output is unpartitionable, text is empty. */
+	strategy: "delimiter" | "section" | "broadcast" | "deadletter";
 }
 
 /**
@@ -69,8 +84,30 @@ export function splitCoalescedOutput(rawOutput: string, taskIds: string[]): Spli
 		}));
 	}
 
+	// G20 fail-closed: PARTIAL delimiter hit (0 < hits < taskIds.length).
+	// The worker started following the delimiter contract but did not finish
+	// it — the output mixes delimited per-task bodies with unattributed
+	// prose. No per-task partition can be trusted at this point, not even
+	// for the ids that DID get a delimiter: attributing a body to task X is
+	// only sound when every other body is provably not X's, and partial
+	// coverage cannot prove that. Previously this case skipped Strategy 2
+	// entirely (the `delimiterHits.size === 0` guard below) and fell through
+	// to Strategy 3, broadcasting the FULL raw output — including other
+	// tasks' delimited bodies — to every task in the group (cross-task
+	// content leak). Fail closed instead: mark the whole group deadletter;
+	// the caller records it and withholds per-task results.
+	if (delimiterHits.size > 0) {
+		return taskIds.map((id) => ({
+			taskId: id,
+			text: "",
+			strategy: "deadletter" as const,
+		}));
+	}
+
 	// Strategy 2: section heading parse.
 	// Look for `### Task N of M` or `## Task {id}` markers. We try both.
+	// Only reachable with ZERO delimiter hits — partial hits return
+	// deadletter above.
 	if (delimiterHits.size === 0) {
 		const bySection = parseBySectionHeadings(rawOutput, taskIds);
 		if (bySection.size === taskIds.length) {
@@ -85,6 +122,12 @@ export function splitCoalescedOutput(rawOutput: string, taskIds: string[]): Spli
 	// Strategy 3: broadcast fallback. All tasks get the full raw output.
 	// This is safe for read-only roles (explorers, reviewers) where
 	// downstream consumers care about findings, not strict per-task partitioning.
+	// G20: unreachable for partial delimiter hits (those return deadletter
+	// above). Broadcast is ONLY reachable when the output contains ZERO
+	// delimiter markers and section parsing failed — i.e. the raw output has
+	// no delimited per-task bodies at all, so broadcasting it cannot leak one
+	// task's delimited content to another task. If that zero-marker premise
+	// ever changes, this fallback must be re-audited for cross-task leaks.
 	return taskIds.map((id) => ({
 		taskId: id,
 		text: rawOutput,