pi-crew 0.11.40 → 0.11.41

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.40",
+	"version": "0.11.41",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/runtime/foreground-watchdog.ts

@@ -6,7 +6,9 @@
  * assistant has no way to know when a run completes or gets stuck without
  * manual polling. This watchdog monitors active runs and:
  *
- * 1. Detects hung runs (active status, no heartbeat update for >10 min)
+ * 1. Detects hung runs (active status, manifest not updated for >2 min with
+ *    no agent activity evidence — wave 13: a live registry claim or a fresh
+ *    task heartbeat withholds the verdict, see CLAIMED_RUN_HUNG_MS)
  * 2. Injects a followUp message via pi.sendUserMessage() so the assistant
  *    is automatically notified — no manual sleep+check needed.
  * 3. Cleans up after itself when the run completes or the session ends.
@@ -19,6 +21,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getCrewEnv, getCrewEnvInt } from "../config/env-vars.ts";
 import { TEAM_TERMINAL_TASK_STATUSES } from "../state/contracts.ts";
+import { activeRunEntries } from "../state/stores/active-run-registry.ts";
 import { loadRunManifestById } from "../state/stores/state-store.ts";
 import type { TeamTaskState } from "../state/types.ts";
 import { readCrewAgents } from "./crew-agent-records.ts";
@@ -128,6 +131,170 @@ function resolveCheckIntervalMs(overrideMs: number | undefined): number {
 	return DEFAULT_CHECK_INTERVAL_MS;
 }
 
+// ── Wave 13 (F1, GAP-0): hung-verdict liveness short-circuit ────────────────
+//
+// Live evidence (2026-10-24/25): five false "appears hung" alerts in one
+// session, all direct single-agent runs executing ONE long tool call (a
+// 20-min CI poll loop, a 20-min test suite). The hung verdict
+// (isLikelyOrphanedActiveRun: manifest stale ≥2 min + no agent activity
+// within 5 min) is structurally blind while a tool executes — every
+// liveness write is event-driven and no pi events fire mid-tool — so a
+// HEALTHY run reads as hung ~5-10 min into a long tool. The two signals
+// other consumers already trust, and this verdict ignores, are consulted
+// here IN THE WATCHDOG (never inside isLikelyOrphanedActiveRun — that
+// predicate is shared with the dashboard's isDisplayActiveRun, GAP-4):
+//   (a) a LIVE active-run-registry claim, and
+//   (b) a fresh task heartbeat (kept fresh through long tools by F2's
+//       live-executor timer).
+// The two branches are INDEPENDENT ORs: the registry drops non-async
+// entries once the manifest is >30 min stale, so past that horizon only the
+// heartbeat carries liveness — never require both.
+
+/**
+ * Wave 13 (F1, GAP-0): hard ceiling for how long a LIVE active-run-registry
+ * claim can shield a run from the watchdog's hung verdict. A claimed run
+ * whose NEWEST liveness evidence (claim assertion time, task heartbeats/
+ * activity) is older than this still alerts — a genuine in-process deadlock
+ * (claim held, nothing progressing) is still caught — while healthy claimed
+ * runs mid-long-tool are not false-alarmed by the 2-min ladder. 45 min is
+ * 1.5× the registry's own 30-min freshness horizon and 9× the 5-min activity
+ * shield, so only a truly stuck claim trips it. Unclaimed runs keep the
+ * fast 2-min ladder unchanged; ORPHANED_ACTIVE_RUN_MS (process-status.ts,
+ * shared with the dashboard — GAP-4) is NOT touched.
+ */
+export const CLAIMED_RUN_HUNG_MS = 45 * 60 * 1000;
+
+/**
+ * Wave 13 (F1): freshness window for task-heartbeat liveness evidence —
+ * mirrors ACTIVE_EVIDENCE_TTL_MS in stale-reconciler.ts (5 min).
+ */
+const TASK_HEARTBEAT_EVIDENCE_MS = 5 * 60 * 1000;
+
+/**
+ * Wave 13 (F1): read-only active-run-registry claim consult result.
+ * `claimedAtMs` is the registry entry's `updatedAt` (the moment the claim
+ * was asserted — registerActiveRun fires at dispatch); undefined when the
+ * entry carries no parseable timestamp.
+ */
+interface LiveRunClaim {
+	claimedAtMs?: number;
+}
+
+/**
+ * Wave 13 (F1, GAP-0): consult the active-run registry for a LIVE claim on
+ * `runId`. Read-only mirror of findLiveRegistryEntry (stale-reconciler G24):
+ * activeRunEntries() applies the full liveness filter itself (terminal
+ * status, dead async PID, >30-min-stale non-async manifests, symlink
+ * safety), so an entry found here means some live session/runner claims the
+ * run RIGHT NOW. Inlined via the registry store instead of importing
+ * stale-reconciler (its reaping graph must not enter the watchdog's import
+ * closure); the async-PID half of hasLiveRunClaim is deliberately omitted —
+ * async runs never reach this verdict path (isLikelyOrphanedActiveRun
+ * excludes them). Fail-open: any registry error ⇒ no claim — a broken
+ * registry must never shield a genuinely hung run (G24 contract).
+ */
+function consultActiveRunRegistry(runId: string): LiveRunClaim | undefined {
+	try {
+		const entry = activeRunEntries().find((item) => item.runId === runId);
+		if (!entry) return undefined;
+		const claimedAtMs = entry.updatedAt ? Date.parse(entry.updatedAt) : Number.NaN;
+		return { claimedAtMs: Number.isFinite(claimedAtMs) ? claimedAtMs : undefined };
+	} catch {
+		return undefined;
+	}
+}
+
+let liveClaimConsult: (runId: string) => LiveRunClaim | undefined = consultActiveRunRegistry;
+
+/** @internal Test seam — replace the registry claim consult (null = real). */
+export function setLiveClaimConsultForTests(consult: ((runId: string) => LiveRunClaim | undefined) | null): void {
+	liveClaimConsult = consult ?? consultActiveRunRegistry;
+}
+
+/**
+ * Wave 13 (F1): does any running/waiting task carry FRESH live evidence?
+ * Behavioral mirror of hasRecentActiveEvidence (stale-reconciler.ts): a
+ * running/waiting task whose `heartbeat.lastSeenAt` (with `alive !== false`)
+ * or `agentProgress.lastActivityAt` is within TASK_HEARTBEAT_EVIDENCE_MS
+ * counts. Absent/unreadable tasks (`[]`) ⇒ false — fail-open to the ladder,
+ * same as WD-STALE-RECORD.
+ */
+function hasFreshTaskHeartbeatEvidence(tasks: TeamTaskState[] | undefined, now: number): boolean {
+	if (!Array.isArray(tasks)) return false;
+	return tasks.some((task) => {
+		if (task.status !== "running" && task.status !== "waiting") return false;
+		const heartbeatAt = task.heartbeat?.lastSeenAt ? new Date(task.heartbeat.lastSeenAt).getTime() : Number.NaN;
+		if (task.heartbeat?.alive !== false && Number.isFinite(heartbeatAt) && now - heartbeatAt <= TASK_HEARTBEAT_EVIDENCE_MS) return true;
+		const activityAt = task.agentProgress?.lastActivityAt ? new Date(task.agentProgress.lastActivityAt).getTime() : Number.NaN;
+		return Number.isFinite(activityAt) && now - activityAt <= TASK_HEARTBEAT_EVIDENCE_MS;
+	});
+}
+
+/**
+ * Wave 13 (F1): newest liveness-evidence timestamp (epoch ms) among the
+ * claim assertion time and the running/waiting tasks' heartbeat/activity
+ * marks — everything EXCEPT manifest.updatedAt, which is the frozen
+ * artifact under judgment, not evidence (the registry's own filter already
+ * bounds it at 30 min for entry presence; counting it here would make the
+ * CLAIMED_RUN_HUNG_MS ceiling unreachable). undefined when no signal
+ * carries a finite timestamp.
+ */
+function newestClaimEvidenceMs(tasks: TeamTaskState[] | undefined, claim: LiveRunClaim): number | undefined {
+	let newest: number | undefined;
+	const consider = (ms: number): void => {
+		if (Number.isFinite(ms) && (newest === undefined || ms > newest)) newest = ms;
+	};
+	if (claim.claimedAtMs !== undefined) consider(claim.claimedAtMs);
+	for (const task of tasks ?? []) {
+		if (task.status !== "running" && task.status !== "waiting") continue;
+		const heartbeatAt = task.heartbeat?.lastSeenAt ? new Date(task.heartbeat.lastSeenAt).getTime() : Number.NaN;
+		consider(heartbeatAt);
+		const activityAt = task.agentProgress?.lastActivityAt ? new Date(task.agentProgress.lastActivityAt).getTime() : Number.NaN;
+		consider(activityAt);
+	}
+	return newest;
+}
+
+/** Wave 13 (F1): hung-verdict liveness short-circuit result. */
+interface LivenessShortCircuit {
+	/** True ⇒ the hung verdict is withheld this cycle (live evidence present). */
+	suppress: boolean;
+	/** Debug-log reason (PI_CREW_DEBUG-gated). */
+	reason: string;
+	/** Claim present but its evidence aged past CLAIMED_RUN_HUNG_MS — the alert detail must name it. */
+	claimExhausted: boolean;
+}
+
+/**
+ * Wave 13 (F1, GAP-0): should the hung verdict for this cycle be withheld?
+ * Two INDEPENDENT OR branches (never require both):
+ *   (b) a fresh task heartbeat (≤5 min) ⇒ suppress outright;
+ *   (a) a live registry claim ⇒ suppress while the newest liveness evidence
+ *       is ≤ CLAIMED_RUN_HUNG_MS old; past the ceiling the ladder proceeds
+ *       (claimExhausted ⇒ the alert names the claimed-run threshold).
+ * No claim and no fresh heartbeat ⇒ the existing 2-min ladder is unchanged
+ * (an unclaimed zombie still alerts fast).
+ */
+function assessClaimedRunLiveness(runId: string, tasks: TeamTaskState[] | undefined, now: number): LivenessShortCircuit {
+	if (hasFreshTaskHeartbeatEvidence(tasks, now)) {
+		return { suppress: true, reason: "fresh task heartbeat", claimExhausted: false };
+	}
+	const claim = liveClaimConsult(runId);
+	if (claim) {
+		const evidenceMs = newestClaimEvidenceMs(tasks, claim);
+		const evidenceAgeMs = evidenceMs !== undefined ? now - evidenceMs : undefined;
+		if (evidenceAgeMs !== undefined && evidenceAgeMs <= CLAIMED_RUN_HUNG_MS) {
+			return {
+				suppress: true,
+				reason: `live registry claim (newest evidence ${Math.max(0, Math.round(evidenceAgeMs / 1000))}s old)`,
+				claimExhausted: false,
+			};
+		}
+		return { suppress: false, reason: "claim evidence older than CLAIMED_RUN_HUNG_MS", claimExhausted: true };
+	}
+	return { suppress: false, reason: "no live claim", claimExhausted: false };
+}
+
 /**
  * Pre-emit state re-verify loader. Injectable for tests to simulate the run
  * going terminal between the cycle's initial read and the emit point.
@@ -471,39 +638,59 @@ export function startForegroundWatchdog(opts: WatchdogOptions): void {
 					// Keep monitoring: if the manifest eventually finalizes, the
 					// terminal branch delivers the completion notice.
 				} else {
-					const detail = `status=${manifest.status}, updatedAt=${manifest.updatedAt}, agents=${agents.length}`;
-					consecutiveHungNotices += 1;
-					try {
-						if (consecutiveHungNotices <= HUNG_NOTICE_CAP) {
-							// WD-DEDUP: alert-once per runId at module scope — even a
-							// fresh watchdog instance must not re-alert the same run.
-							if (!hungAlertAlreadySent(runId)) {
-								// Mark BEFORE queueing so a racing cycle cannot double-queue.
-								updateHungAlertRecord(runId, { alerted: true });
-								// WD-DELIVER-GUARD: the host queues a followUp while the
-								// session streams and delivers it arbitrarily later — so
-								// hand it over only at the idle boundary, re-verifying the
-								// run state at THAT moment.
+					// Wave 13 (F1, GAP-0): liveness short-circuit BEFORE any hung alert.
+					// The verdict above is structurally blind while a tool executes; a
+					// live registry claim or fresh task heartbeat withholds it. A
+					// suppressed cycle means the run left the hung state — reset the
+					// no-progress counter so a later genuine alert gets the full drip cap.
+					const liveness = assessClaimedRunLiveness(runId, reverified.tasks, now);
+					if (liveness.suppress) {
+						consecutiveHungNotices = 0;
+						debugLog(`[foreground-watchdog] suppress hung verdict for ${runId}: ${liveness.reason}`);
+					} else {
+						// Wave 13 (F3, GAP-2): the detail carries its EVIDENCE time (the
+						// manifest read the verdict was based on) — "as of <ISO>" — not the
+						// emit time, so a user re-checking can tell a stale/queued alert
+						// apart from one about the last few minutes. An exhausted claim
+						// names the claimed-run threshold so the user knows it is not the
+						// 2-min ladder.
+						const claimNote = liveness.claimExhausted
+							? `, claimed-run hung threshold exceeded (no live evidence for >${Math.round(CLAIMED_RUN_HUNG_MS / 60_000)} min)`
+							: "";
+						const detail = `status=${manifest.status}, updatedAt=${manifest.updatedAt}, agents=${agents.length}, as of ${manifest.updatedAt}${claimNote}`;
+						consecutiveHungNotices += 1;
+						try {
+							if (consecutiveHungNotices <= HUNG_NOTICE_CAP) {
+								// WD-DEDUP: alert-once per runId at module scope — even a
+								// fresh watchdog instance must not re-alert the same run.
+								if (!hungAlertAlreadySent(runId)) {
+									// Mark BEFORE queueing so a racing cycle cannot double-queue.
+									updateHungAlertRecord(runId, { alerted: true });
+									// WD-DELIVER-GUARD: the host queues a followUp while the
+									// session streams and delivers it arbitrarily later — so
+									// hand it over only at the idle boundary, re-verifying the
+									// run state at THAT moment.
+									queueHungAlertDelivery(
+										pi,
+										cwd,
+										runId,
+										`pi-crew watchdog: run ${runId} appears hung (${detail}). Consider running team action='cancel' runId='${runId}' or team action='doctor'.`,
+										opts.isSessionIdle,
+									);
+								}
+							} else if (consecutiveHungNotices === HUNG_NOTICE_CAP + 1) {
+								// One-time handoff, then silence — still monitoring, no more drips.
 								queueHungAlertDelivery(
 									pi,
 									cwd,
 									runId,
-									`pi-crew watchdog: run ${runId} appears hung (${detail}). Consider running team action='cancel' runId='${runId}' or team action='doctor'.`,
+									`pi-crew watchdog: run ${runId} is still hung after ${consecutiveHungNotices} checks — going quiet now. Intervene via team action='cancel' runId='${runId}', team action='doctor', or leave it; a completion notice will still fire.`,
 									opts.isSessionIdle,
 								);
 							}
-						} else if (consecutiveHungNotices === HUNG_NOTICE_CAP + 1) {
-							// One-time handoff, then silence — still monitoring, no more drips.
-							queueHungAlertDelivery(
-								pi,
-								cwd,
-								runId,
-								`pi-crew watchdog: run ${runId} is still hung after ${consecutiveHungNotices} checks — going quiet now. Intervene via team action='cancel' runId='${runId}', team action='doctor', or leave it; a completion notice will still fire.`,
-								opts.isSessionIdle,
-							);
+						} catch {
+							/* non-critical */
 						}
-					} catch {
-						/* non-critical */
 					}
 				}
 				// Keep monitoring (ARCH-5: silently past the cap — no more notices).

package/src/runtime/task-runner/live-executor.ts

@@ -5,6 +5,7 @@ import { appendEventFireAndForget } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import { loadRunManifestById } from "../../state/stores/state-store.ts";
 import type { ArtifactDescriptor, TeamRunManifest, TeamTaskState } from "../../state/types.ts";
+import { logInternalError } from "../../utils/internal-error.ts";
 import type { WorkflowStep } from "../../workflows/workflow-config.ts";
 import {
 	appendCrewAgentEvent,
@@ -104,6 +105,79 @@ function updateTask(tasks: TeamTaskState[], updated: TeamTaskState): TeamTaskSta
 	return tasks.map((task) => (task.id === updated.id ? updated : task));
 }
 
+/**
+ * Wave 13 (F2, GAP-1): default cadence (ms) of the live-executor tool
+ * heartbeat timer. 30s sits far inside every liveness window that consumes
+ * the task heartbeat (watchdog task-heartbeat evidence 5 min, stale-reconciler
+ * ACTIVE_EVIDENCE_TTL_MS 5 min, CLAIMED_RUN_HUNG_MS 45 min), costs at most one
+ * throttled tasks.json persist per running tool per 30s, and never touches
+ * the event log. Fixed constant, NOT env-configurable on purpose (SPEC §3.2):
+ * wiring an env kill-switch would require registering
+ * PI_CREW_LIVE_HEARTBEAT_MS in src/config/env-vars.ts AND a forwarding
+ * decision in src/config/env-allowlist-registry.ts (fail-fast at module
+ * load) — both outside this wave's file scope.
+ */
+export const LIVE_TOOL_HEARTBEAT_INTERVAL_MS = 30_000;
+
+/** Opaque handle for the per-attempt live tool heartbeat timer. */
+export interface LiveToolHeartbeatTimer {
+	/** Stop the timer and clear its interval. Idempotent. */
+	stop(): void;
+}
+
+/**
+ * Wave 13 (F2, GAP-1) — start the tool heartbeat timer for one live attempt
+ * (SPEC §3.2). Every `intervalMs`, IF a tool is currently executing
+ * (`isToolInFlight()` — `agentProgress.currentToolStartedAt` set by
+ * tool_execution_start, cleared by tool_execution_end), call `touch()`
+ * (the heartbeat-only persist, shared 1s throttle with event-driven persists).
+ * Idle between tools ⇒ no write. `touch` must NOT append task.progress events
+ * so the event log cannot grow from heartbeats.
+ *
+ * Failure containment (mirrors startWorkerHeartbeatPulse [pulse-3]): a
+ * throwing gate/touch is logged and the timer keeps ticking — the heartbeat
+ * must never crash the host process. The interval is `unref`'d so it can
+ * never hold the event loop open.
+ */
+export function startLiveToolHeartbeatTimer(opts: {
+	intervalMs: number;
+	isToolInFlight: () => boolean;
+	touch: () => void;
+}): LiveToolHeartbeatTimer {
+	// Kill-switch shape (interval ≤ 0 ⇒ disabled, no timer) kept so a future
+	// env-configurable interval can slot in without touching call sites.
+	if (opts.intervalMs <= 0) {
+		return {
+			stop() {
+				// Intentional no-op: a disabled timer (interval ≤ 0) has no handle.
+			},
+		};
+	}
+	const timer = setInterval(() => {
+		try {
+			if (opts.isToolInFlight()) opts.touch();
+		} catch (err) {
+			logInternalError("task-runner.live-tool-heartbeat", err as Error);
+		}
+	}, opts.intervalMs);
+	timer.unref?.();
+	return {
+		stop() {
+			clearInterval(timer);
+		},
+	};
+}
+
+let armLiveToolHeartbeatTimer: typeof startLiveToolHeartbeatTimer = startLiveToolHeartbeatTimer;
+
+/**
+ * @internal Test seam — replace the timer constructor used inside runLiveTask
+ * (null = real). Mirrors the loader seams in foreground-watchdog.ts.
+ */
+export function setLiveToolHeartbeatTimerForTests(starter: typeof startLiveToolHeartbeatTimer | null): void {
+	armLiveToolHeartbeatTimer = starter ?? startLiveToolHeartbeatTimer;
+}
+
 export async function runLiveTask(input: RunLiveTaskInput): Promise<RunLiveTaskOutput> {
 	const { manifest, step, agent, prompt } = input;
 	let task = input.task;
@@ -122,6 +196,24 @@ export async function runLiveTask(input: RunLiveTaskInput): Promise<RunLiveTaskO
 	let lastRunProgressPersistedAt = 0;
 	let lastHeartbeatPersistedAt = 0;
 	let lastRunProgressSummary: ProgressEventSummary | undefined;
+	/**
+	 * Wave 13 (F2, GAP-1): heartbeat-only persist, extracted from
+	 * persistLiveProgress so the tool heartbeat timer can reuse the EXACT
+	 * event-driven path (same 1s throttle via the shared lastHeartbeatPersistedAt,
+	 * same persistSingleTaskUpdate write, same isCurrent gate). Touching only
+	 * tasks.json — never the event log — so timer ticks cannot inflate it.
+	 */
+	const touchTaskHeartbeat = (force = false): void => {
+		if (!isCurrent()) return;
+		const now = Date.now();
+		if (!force && now - lastHeartbeatPersistedAt < 1000) return;
+		task = {
+			...task,
+			heartbeat: touchWorkerHeartbeat(task.heartbeat ?? createWorkerHeartbeat(task.id)),
+		};
+		tasks = persistSingleTaskUpdate(manifest, tasks, task);
+		lastHeartbeatPersistedAt = now;
+	};
 	const persistLiveProgress = (event: unknown, force = false): void => {
 		if (!isCurrent()) return;
 		const now = Date.now();
@@ -130,14 +222,7 @@ export async function runLiveTask(input: RunLiveTaskInput): Promise<RunLiveTaskO
 			lastAgentRecordPersistedAt = now;
 		}
 		// Bug #5 fix: also persist heartbeat to tasks.json so heartbeat-watcher can detect live-session activity
-		if (force || now - lastHeartbeatPersistedAt >= 1000) {
-			task = {
-				...task,
-				heartbeat: touchWorkerHeartbeat(task.heartbeat ?? createWorkerHeartbeat(task.id)),
-			};
-			tasks = persistSingleTaskUpdate(manifest, tasks, task);
-			lastHeartbeatPersistedAt = now;
-		}
+		touchTaskHeartbeat(force);
 		const summary = progressEventSummary(task, event);
 		const decision = shouldAppendProgressEventUpdate({
 			previous: lastRunProgressSummary,
@@ -166,44 +251,60 @@ export async function runLiveTask(input: RunLiveTaskInput): Promise<RunLiveTaskO
 		agentMax != null && agentMax > 0 && (!input.runtimeConfig?.maxTurns || agentMax < input.runtimeConfig.maxTurns)
 			? { ...input.runtimeConfig, maxTurns: agentMax }
 			: input.runtimeConfig;
-	const liveResult = await runLiveSessionTask({
-		manifest,
-		task,
-		step,
-		agent,
-		prompt,
-		signal: input.signal,
-		transcriptPath,
-		runtimeConfig: effectiveRuntimeConfig,
-		parentContext: input.parentContext,
-		parentModel: input.parentModel,
-		modelRegistry: input.modelRegistry,
-		modelOverride: input.modelOverride,
-		teamRoleModel: input.teamRoleModel,
-		teamRoleFallbackModels: input.teamRoleFallbackModels,
-		teamRoleThinking: input.teamRoleThinking,
-		isCurrent,
-		workspaceId: input.workspaceId,
-		// U11: embedded-tier mitigation knobs (lane-B contract) — forwarded
-		// verbatim; undefined keeps every mitigation inert (legacy path).
-		embeddedMitigations: input.embeddedMitigations,
-		// Phase 2: Pass output schema for yield validation
-		outputSchema: undefined,
-		onOutput: (text) => {
-			if (!isCurrent()) return;
-			appendCrewAgentOutput(manifest, task.id, text);
-		},
-		onEvent: (event) => {
-			if (!isCurrent()) return;
-			appendCrewAgentEvent(manifest, task.id, event);
-			task = {
-				...task,
-				agentProgress: applyAgentProgressEvent(task.agentProgress ?? emptyCrewAgentProgress(), event, task.startedAt),
-			};
-			tasks = updateTask(tasks, task);
-			persistLiveProgress(event);
-		},
+	// Wave 13 (F2, GAP-1): arm the tool heartbeat timer for this attempt. The
+	// tick no-ops unless a tool is executing (agentProgress.currentToolStartedAt
+	// set by tool_execution_start / cleared by tool_execution_end), so idle gaps
+	// between tools write nothing; the shared 1s throttle inside
+	// touchTaskHeartbeat bounds disk writes; and the finally below clears the
+	// interval on completion, throw AND cancel — no timer leak across attempts.
+	const heartbeatTimer = armLiveToolHeartbeatTimer({
+		intervalMs: LIVE_TOOL_HEARTBEAT_INTERVAL_MS,
+		isToolInFlight: () => task.agentProgress?.currentToolStartedAt !== undefined,
+		touch: () => touchTaskHeartbeat(false),
 	});
+	let liveResult: Awaited<ReturnType<typeof runLiveSessionTask>>;
+	try {
+		liveResult = await runLiveSessionTask({
+			manifest,
+			task,
+			step,
+			agent,
+			prompt,
+			signal: input.signal,
+			transcriptPath,
+			runtimeConfig: effectiveRuntimeConfig,
+			parentContext: input.parentContext,
+			parentModel: input.parentModel,
+			modelRegistry: input.modelRegistry,
+			modelOverride: input.modelOverride,
+			teamRoleModel: input.teamRoleModel,
+			teamRoleFallbackModels: input.teamRoleFallbackModels,
+			teamRoleThinking: input.teamRoleThinking,
+			isCurrent,
+			workspaceId: input.workspaceId,
+			// U11: embedded-tier mitigation knobs (lane-B contract) — forwarded
+			// verbatim; undefined keeps every mitigation inert (legacy path).
+			embeddedMitigations: input.embeddedMitigations,
+			// Phase 2: Pass output schema for yield validation
+			outputSchema: undefined,
+			onOutput: (text) => {
+				if (!isCurrent()) return;
+				appendCrewAgentOutput(manifest, task.id, text);
+			},
+			onEvent: (event) => {
+				if (!isCurrent()) return;
+				appendCrewAgentEvent(manifest, task.id, event);
+				task = {
+					...task,
+					agentProgress: applyAgentProgressEvent(task.agentProgress ?? emptyCrewAgentProgress(), event, task.startedAt),
+				};
+				tasks = updateTask(tasks, task);
+				persistLiveProgress(event);
+			},
+		});
+	} finally {
+		heartbeatTimer.stop();
+	}
 	const startupEvidence = createStartupEvidence({
 		command: "live-session",
 		startedAt: attemptStartedAt,