pi-crew 0.11.53 → 0.11.55

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.53",
+	"version": "0.11.55",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/config/env-allowlist-registry.ts

@@ -195,6 +195,10 @@ const CREW_ENV_FORWARDING_DECL: Record<string, CrewEnvForwardDecision> = {
 		kind: "child-write",
 		reason: "SEC-2026-11 w1a: PUBLIC base64 SPKI Ed25519 verify key handed to children via built.env (child-pi-spawn) for coordination-row verify-only; public material — possession cannot forge rows (private key is heap-only in the root session)",
 	},
+	PI_CREW_MAILBOX_VERIFY_KEYS: {
+		kind: "child-write",
+		reason: "FINDING B (2026-10-31): PUBLIC comma-separated base64 SPKI Ed25519 verify-key SET (dispatcher + spawner-relayed) handed to children via built.env (child-pi-spawn) so leader-signed cross-process rows (respond / steering fs-fallback in async runs) verify; public material — possession cannot forge rows (singular PI_CREW_MAILBOX_VERIFY_KEY semantics unchanged)",
+	},
 	PI_CREW_AGENT_EVENTS_PATH: { kind: "child-write", reason: "prepareSurfaceSpawn recorder log" },
 	PI_CREW_BROKER_SOCKET: { kind: "child-write", reason: "child-pi-spawn broker handshake (never ambient — per-run socket)" },
 	PI_CREW_BROKER_TOKEN: {

package/src/config/env-vars.ts

@@ -640,6 +640,10 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 		name: "PI_CREW_MAILBOX_VERIFY_KEY",
 		doc: "SEC-2026-11 w1a coordination sender-binding: base64 SPKI Ed25519 public verify key handed to child workers at spawn (child-pi-spawn.ts) so they can VERIFY parent-signed mailbox/steering rows; the PRIVATE signing key never leaves the root session heap (mailbox.ts signingKeypair). Children verify-only — possession of the public key cannot forge rows",
 	},
+	PI_CREW_MAILBOX_VERIFY_KEYS: {
+		name: "PI_CREW_MAILBOX_VERIFY_KEYS",
+		doc: "FINDING B (2026-10-31) plural sibling of PI_CREW_MAILBOX_VERIFY_KEY: comma-separated base64 SPKI Ed25519 PUBLIC verify keys (dispatcher + spawner-relayed) handed to child workers at spawn so cross-process rows (leader-signed respond / steering fs-fallback in async runs) verify instead of dropping as noise (mailbox.ts resolveCoordinationVerifyKeys merges + dedupes plural env, singular env and the in-process keypair). PUBLIC material only — possession cannot forge rows",
+	},
 	PI_CREW_MAX_AUTO_FALLBACKS: {
 		name: "PI_CREW_MAX_AUTO_FALLBACKS",
 		parser: "int",

package/src/extension/team-tool/parallel-dispatch.ts

@@ -12,6 +12,7 @@ import { spawnBackgroundTeamRun } from "../../runtime/async-runner.ts";
 import { resolveCrewRuntime } from "../../runtime/model/runtime-resolver.ts";
 import { captureRunModelContext } from "../../runtime/model/session-model.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { ensureCoordinationPublicVerifyKey } from "../../state/coordination/mailbox.ts";
 import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { createRunManifest } from "../../state/stores/state-store.ts";
 import { discoverTeams } from "../../teams/discover-teams.ts";
@@ -178,6 +179,10 @@ async function spawnSingleTask(
 			// Finding #1: persist the parent session's model routing so the detached
 			// runner restores it instead of default-chaining (see handleParallel).
 			modelContext,
+			// FINDING B (2026-10-31): mirror handleRun — stamp THIS (dispatcher)
+			// session's PUBLIC verify key so the detached runner's workers verify
+			// the respond/steering rows this session signs. PUBLIC material only.
+			dispatcherVerifyKey: ensureCoordinationPublicVerifyKey(),
 		});
 
 		await appendEventAsync(created.manifest.eventsPath, {

package/src/extension/team-tool/respond.ts

@@ -113,10 +113,73 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 		const taskId = params.taskId;
 		const message = params.message ?? "";
 
-		const targetTasks = taskId
+		let tasks = fresh.tasks;
+		let targetTasks = taskId
 			? fresh.tasks.filter((t) => t.id === taskId && t.status === "waiting")
 			: fresh.tasks.filter((t) => t.status === "waiting");
 
+		if (targetTasks.length === 0) {
+			// ASK-PARK CLOBBER SELF-HEAL (2026-10-31, live incidents team_20261031084714
+			// + team_20261031045633): the HOST process's coalesced tasks.json flush can
+			// race the BROKER process's run-locked sync waiting-park (the coalesce
+			// buffer is per-process, so the broker's write cannot cancel it) and blind-
+			// flush a pre-park `running` snapshot over `waiting` — losing BOTH the
+			// status and the questionId marker. Every subsequent respond then hit the
+			// reject below ("is running, not waiting") and every ask timed out.
+			// The broker's manifest.waitState pointer survives the clobber (manifest.json
+			// is not coalesced), so it is the authoritative repair source: when it is
+			// still live while tasks.json lost the park, restore `waiting` + marker
+			// from it inside the SAME run-lock section, then let the normal answer
+			// machinery below run verbatim. Fix 1 (atomic-write flush-time CAS) closes
+			// the root cause; this is the defense-in-depth backstop.
+			const waitState = fresh.manifest.waitState;
+			if (waitState && typeof waitState.deadline === "number" && waitState.deadline > Date.now()) {
+				// Narrowed const - the typeof guard on the property does not survive
+				// into the map callback below.
+				const waitDeadline = waitState.deadline;
+				const parked = fresh.tasks.find((t) => t.id === waitState.taskId);
+				if (
+					parked &&
+					parked.status === "running" &&
+					(parked.waiting === undefined || parked.waiting.questionId !== waitState.questionId)
+				) {
+					tasks = fresh.tasks.map((t) =>
+						t.id === waitState.taskId
+							? {
+									...t,
+									status: "waiting" as const,
+									waiting: {
+										questionId: waitState.questionId,
+										askedAt: waitState.askedAt,
+										deadline: waitDeadline,
+									},
+								}
+							: t,
+					);
+					// Sync save inside the SAME run-lock critical section — also cancels
+					// any same-process pending coalesced tasks.json write (stale
+					// snapshot) before it can clobber the repair.
+					saveRunTasks(fresh.manifest, tasks);
+					void appendEventAsync(fresh.manifest.eventsPath, {
+						type: "task.waiting_repaired",
+						runId: fresh.manifest.runId,
+						taskId: waitState.taskId,
+						message: `Repaired clobbered ask park for question ${waitState.questionId}: tasks.json showed the parked task running with no waiting marker (host coalesced-flush raced the broker park); waiting restored from manifest.waitState so the answer path could run.`,
+						data: { taskId: waitState.taskId, questionId: waitState.questionId, reason: "coalesce-clobber" },
+					}).catch((error) =>
+						logInternalError(
+							"respond.waiting-repaired-event",
+							error instanceof Error ? error : new Error(String(error)),
+							`runId=${fresh.manifest.runId}`,
+						),
+					);
+					targetTasks = taskId
+						? tasks.filter((t) => t.id === taskId && t.status === "waiting")
+						: tasks.filter((t) => t.status === "waiting");
+				}
+			}
+		}
+
 		if (targetTasks.length === 0) {
 			const existing = taskId ? fresh.tasks.find((t) => t.id === taskId) : undefined;
 			const hint =
@@ -155,7 +218,7 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 			pidAlive: boolean;
 			pidDetail: string;
 		}> = [];
-		let updatedTasks = fresh.tasks;
+		let updatedTasks = tasks;
 
 		for (const task of targetTasks) {
 			const questionId = task.waiting?.questionId;

package/src/extension/team-tool/run.ts

@@ -5,6 +5,7 @@ import type { executeTeamRun as ExecuteTeamRunFn } from "../../runtime/team-runn
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { atomicWriteJson } from "../../state/atomic-write.ts";
 import { withRunLockSync } from "../../state/coordination/locks.ts";
+import { ensureCoordinationPublicVerifyKey } from "../../state/coordination/mailbox.ts";
 import { registerActiveRun, unregisterActiveRun } from "../../state/stores/active-run-registry.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import { createRunManifest, loadRunManifestById, updateRunStatus } from "../../state/stores/state-store.ts";
@@ -359,6 +360,13 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		ownerSessionId: ctx.sessionId,
 		runKind: effectiveRunKind,
 		args: params.args,
+		// FINDING B (2026-10-31): stamp THIS (dispatcher) session's PUBLIC verify
+		// key onto the manifest so async runs — whose workers are spawned by the
+		// detached runner, not by us — can still verify the rows WE sign
+		// (respond, steering fs-fallback). Threaded by child-executor into every
+		// worker's PI_CREW_MAILBOX_VERIFY_KEYS env. PUBLIC material — never the
+		// private key.
+		dispatcherVerifyKey: ensureCoordinationPublicVerifyKey(),
 	});
 	const goalArtifact = writeArtifact(paths.artifactsRoot, {
 		kind: "prompt",

package/src/runtime/broker/protocol/msg-inbox.ts

@@ -17,9 +17,14 @@ export interface MsgInboxHelpers {
 	sendResult(conn: ServerConnection, id: string, result: unknown): void;
 }
 
-/** Phase 1.1: read the durable mailbox for the addressed task (or run-level
- *  "inbox" lane) with cursor/limit pagination. Returns messages whose status
- *  is NOT yet `acknowledged`; callers should ack after processing. */
+/** Phase 1.1: read the durable mailbox for the addressed task with
+ *  cursor/limit pagination. The run-level "inbox" lane (connection with no
+ *  taskId) is readable ONLY with compound auth (S-2, 2026-10-31 fix wave E):
+ *  the orchestrator key is compound by construction, while a legacy
+ *  bare-runId ("runId-fallback") worker connection is rejected — the same
+ *  task-scoped-token rule wait.* (protocol/wait-auth.ts) and delegate.request
+ *  enforce. Returns messages whose status is NOT yet `acknowledged`; callers
+ *  should ack after processing. */
 export async function handleMsgInbox(
 	conn: ServerConnection,
 	id: string,
@@ -54,6 +59,25 @@ export async function handleMsgInbox(
 	}
 	const limit = Math.min(Math.max(parsed.limit ?? 100, 1), 1000);
 	const taskId = conn.taskId ?? undefined;
+	// S-2 (fix wave E): reading the run-level (orchestrator) inbox lane
+	// requires COMPOUND auth. A legacy bare-runId ("runId-fallback") worker
+	// connection has no proven task identity, yet previously fell through to
+	// the run-level read here. The orchestrator key is compound BY
+	// CONSTRUCTION (crew-broker-tokens.ts tokenRoleWithMatchKind), so the
+	// legitimate run-level reader is unaffected; authMatchKind is undefined
+	// only for pre-hello connections, which the !conn.runId check above
+	// already excludes — fail-closed here regardless. Task-lane reads
+	// (conn.taskId set) are never runId-fallback: w1a proved explicit taskId
+	// claims only via the compound key at hello.
+	if (taskId === undefined && conn.authMatchKind !== "compound") {
+		helpers.sendError(
+			conn,
+			id,
+			"forbidden",
+			"msg.inbox: run-level lane requires a task-scoped token; re-dispatch with PI_CREW_BROKER_TASK_ID",
+		);
+		return;
+	}
 	const all = readMailbox(manifest, "inbox", taskId);
 	const filtered = all.filter((m) => m.status !== "acknowledged");
 	const offset = parsed.cursor ? Number.parseInt(parsed.cursor, 10) || 0 : 0;

package/src/runtime/child-pi/child-pi-spawn.ts

@@ -22,7 +22,7 @@ import * as path from "node:path";
 import { childPiBaseAllowlist } from "../../config/env-allowlist-registry.ts";
 import { getCrewEnv } from "../../config/env-vars.ts";
 import { isScratchpadEnabledForRole } from "../../config/role-tools.ts";
-import { COORDINATION_VERIFY_KEY_ENV, getMailboxVerifyKeyPublic } from "../../state/coordination/mailbox.ts";
+import { COORDINATION_VERIFY_KEY_ENV, COORDINATION_VERIFY_KEYS_ENV, getMailboxVerifyKeyPublic } from "../../state/coordination/mailbox.ts";
 import { buildScopedAllowList, providerEnvKeys, sanitizeEnvSecrets } from "../../utils/env-filter.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
@@ -507,6 +507,30 @@ export function prepareSpawnContext(
 		const relayMatchesRun =
 			relayedVerifyKey !== undefined && input.runId !== undefined && getCrewEnv("PI_CREW_BROKER_RUN_ID") === input.runId;
 		built.env[COORDINATION_VERIFY_KEY_ENV] = relayMatchesRun ? relayedVerifyKey : getMailboxVerifyKeyPublic();
+		// FINDING B (2026-10-31): ALSO hand the child the PLURAL verify-key set —
+		// the coordination rows a child must verify are written by MORE processes
+		// than its spawner: async runs have the DISPATCHER session (leader) sign
+		// respond rows + steering fs-fallback while the detached runner spawns the
+		// workers, so the singular key above never covers those rows and every
+		// leader-signed row dropped as noise (ask poll timeout). Sources, merged
+		// + deduped: (1) our own inherited plural env when we are a worker
+		// spawning a same-run grandchild (same relay-match guard as the singular
+		// relay — never leak another run's keys), (2) the dispatcher key threaded
+		// from the run manifest (input.dispatcherVerifyKey). PUBLIC keys only.
+		const pluralVerifyKeys: string[] = [];
+		if (relayMatchesRun) {
+			const inheritedPlural = getCrewEnv(COORDINATION_VERIFY_KEYS_ENV);
+			if (inheritedPlural !== undefined) {
+				for (const key of inheritedPlural.split(",")) {
+					const trimmed = key.trim();
+					if (trimmed.length > 0 && !pluralVerifyKeys.includes(trimmed)) pluralVerifyKeys.push(trimmed);
+				}
+			}
+		}
+		if (input.dispatcherVerifyKey && !pluralVerifyKeys.includes(input.dispatcherVerifyKey)) {
+			pluralVerifyKeys.push(input.dispatcherVerifyKey);
+		}
+		if (pluralVerifyKeys.length > 0) built.env[COORDINATION_VERIFY_KEYS_ENV] = pluralVerifyKeys.join(",");
 	}
 	// Phase 0 inter-pi broker: inject socket path + token (control-namespace keys,
 	// safe under assertOnlyControlEnvKeys). Only when the parent broker issued

package/src/runtime/child-pi/child-pi-timers.ts

@@ -24,6 +24,13 @@
  * constructs — previously cancelHardKill was a local const inside abort() and
  * was NOT cleared by clearChildPiTimeouts(), leaking a 200 ms unref'd timer per
  * cancel on short-lived children.
+ *
+ * F6 (deep-review 2026-10-31): the final-drain ceiling callback now cancels the
+ * quiet-window poller before firing (it previously left it armed, so a
+ * quiet-after-ceiling child triggered a SECOND forced drain and overwrote the
+ * hardKillTimer variable, orphaning the ceiling's timer → duplicate hard_kill
+ * events/SIGKILLs), and hard-kill emission is hardKilled-gated (idempotent) so
+ * a second timer can never re-emit.
  */
 import type { ChildProcess } from "node:child_process";
 import { DEFAULT_CHILD_PI } from "../../config/defaults.ts";
@@ -231,6 +238,9 @@ export function createChildPiTimers(deps: ChildPiTimersDeps): ChildPiTimers {
 						// still reaped if it ever fires later.
 						hardKillTimer = setTimeout(() => {
 							if (deps.state.getSettled() || deps.state.getChildExited()) return;
+							// F6: idempotent hard-kill — a second (orphaned/overwritten)
+							// hard-kill timer must never re-emit hard_kill/SIGKILL.
+							if (deps.state.getHardKilled()) return;
 							try {
 								deps.state.setHardKilled(true);
 								deps.input.onLifecycleEvent?.({
@@ -255,6 +265,15 @@ export function createChildPiTimers(deps: ChildPiTimersDeps): ChildPiTimers {
 			}
 			finalDrainTimer = setTimeout(() => {
 				if (deps.state.getSettled() || deps.state.getChildExited()) return;
+				// F6: the ceiling owns the drain from here on — cancel the
+				// quiet-window poller (mirroring its self-cancel above) so it
+				// cannot fire a SECOND forced drain when the child goes quiet
+				// after this ceiling already fired.
+				if (pollHandle) {
+					clearInterval(pollHandle);
+					pollHandle.unref();
+				}
+				pollHandle = undefined;
 				deps.state.setForcedFinalDrain(true);
 				deps.state.setFinalDrainFiredMonotonicMs(performance.now()); // Phase-0 diagnostic: race timing.
 				deps.input.onLifecycleEvent?.({
@@ -269,6 +288,9 @@ export function createChildPiTimers(deps: ChildPiTimersDeps): ChildPiTimers {
 				}
 				hardKillTimer = setTimeout(() => {
 					if (deps.state.getSettled() || deps.state.getChildExited()) return;
+					// F6: idempotent hard-kill — a second (orphaned/overwritten)
+					// hard-kill timer must never re-emit hard_kill/SIGKILL.
+					if (deps.state.getHardKilled()) return;
 					try {
 						deps.state.setHardKilled(true);
 						deps.input.onLifecycleEvent?.({
@@ -295,6 +317,9 @@ export function createChildPiTimers(deps: ChildPiTimersDeps): ChildPiTimers {
 			// are for graceful drain, not user-initiated cancel.
 			cancelHardKillTimer = setTimeout(() => {
 				if (deps.state.getSettled() || deps.state.getChildExited()) return;
+				// F6: idempotent hard-kill — skip when a drain-path hard kill
+				// already fired (SIGKILL was already delivered).
+				if (deps.state.getHardKilled()) return;
 				try {
 					deps.state.setHardKilled(true);
 					deps.child.kill(process.platform === "win32" ? undefined : "SIGKILL");

package/src/runtime/child-pi/child-pi.ts

@@ -233,6 +233,15 @@ export interface ChildPiRunInput {
 	 *  config). Env PI_CREW_SESSION_RECOVERY overrides in either direction;
 	 * default ON. Only consulted on crash-ish settles (exitCode null / killed). */
 	sessionRecovery?: boolean;
+	/** FINDING B (2026-10-31) — w1a cross-process verify: PUBLIC base64 SPKI
+	 *  DER Ed25519 verify key of the run's DISPATCHING session (the leader that
+	 *  signed the manifest; threaded from TeamRunManifest.dispatcherVerifyKey
+	 *  by child-executor). child-pi-spawn merges it into the child's
+	 *  PI_CREW_MAILBOX_VERIFY_KEYS env (plural set) so the dispatcher's
+	 *  respond/steering rows verify even when the SPAWNER is the detached
+	 *  runner (a different process with a different keypair). PUBLIC material —
+	 *  never the private key; absent on non-team spawns. */
+	dispatcherVerifyKey?: string;
 	/** Path to steering JSONL file for real-time steer injection. */
 	steeringFile?: string;
 	/** Run ID for cleanup tracking */

package/src/runtime/foreground-control.ts

@@ -31,6 +31,129 @@ export interface ForegroundControlRequest {
 	acknowledged: boolean;
 }
 
+/**
+ * On-disk control-file shape, parsed leniently: hand-written control files
+ * (tests, older writers) may omit `id`, so readers treat it as optional.
+ */
+type ForegroundControlFile = {
+	requests?: Array<{ id?: string; type: string; acknowledged?: boolean }>;
+};
+
+const FOREGROUND_CONTROL_LOCK_TIMEOUT_MS = 5000;
+const FOREGROUND_CONTROL_LOCK_STALE_MS = 10000;
+
+function isLockContention(err: unknown): boolean {
+	return typeof err === "object" && err !== null && (err as { code?: unknown }).code === "EEXIST";
+}
+
+// F1 (2026-10-31 verified review): the previous producer lock used
+// `fs.mkdirSync(lockDir, { recursive: true })`, which NEVER throws EEXIST —
+// it provided ZERO mutual exclusion and its contention branches were
+// unreachable dead code. This is the proven event-log dir-lock protocol
+// (withEventLogAppendLockSync, src/state/event-log/event-log.ts): the
+// non-recursive mkdir IS the mutex; timeout + mtime-stale reclaim +
+// dead-pid awareness + PID-guarded release. Deliberately module-local
+// (not extracted next to the event-log lock): that file is owned by a
+// parallel fix wave — dedup into a shared helper is a noted follow-up.
+// Divergence from the event-log pattern (per spec): contention retries ONLY
+// on EEXIST — any other IO error fails fast instead of spinning to timeout.
+function withForegroundControlLock<T>(controlPath: string, fn: () => T): T {
+	const lockDir = `${controlPath}.lock`;
+	const pidFile = path.join(lockDir, "pid");
+	// Ensure the parent directory exists before attempting the lock (mirrors event-log).
+	fs.mkdirSync(path.dirname(controlPath), { recursive: true });
+	const start = Date.now();
+	let acquired = false;
+	while (true) {
+		try {
+			fs.mkdirSync(lockDir);
+			acquired = true;
+			try {
+				// Disposable pid file ("wx" open + plain write): the lock dir itself
+				// is the mutex; the pid file only feeds stale/dead detection and the
+				// guarded release below.
+				const pidFd = fs.openSync(pidFile, "wx");
+				try {
+					fs.writeSync(pidFd, String(process.pid));
+				} finally {
+					fs.closeSync(pidFd);
+				}
+			} catch {
+				/* best-effort — e.g. EEXIST under a re-taken dir; a missing pid is mtime-detected */
+			}
+			break;
+		} catch (err) {
+			// Contend ONLY on EEXIST; any other IO error (ENOTDIR, EACCES, EROFS…)
+			// fails fast with a clear error instead of spinning to the timeout.
+			if (!isLockContention(err)) {
+				const cause = err instanceof Error ? err : new Error(String(err));
+				const wrapped = new Error(`Foreground control lock acquire failed for ${controlPath}: ${cause.message}`, {
+					cause,
+				});
+				logInternalError("foreground-control.lock-acquire-failed", wrapped, `controlPath=${controlPath}`);
+				throw wrapped;
+			}
+			if (Date.now() - start > FOREGROUND_CONTROL_LOCK_TIMEOUT_MS) {
+				const timeoutErr = new Error(`Foreground control lock timeout for ${controlPath}`);
+				logInternalError("foreground-control.lock-timeout", timeoutErr, `controlPath=${controlPath}`);
+				throw timeoutErr;
+			}
+			// Mtime-stale reclaim FIRST, independent of the pid file: a holder
+			// that crashed between mkdir and the pid write has no pid file —
+			// only an aged mtime can reclaim its dir.
+			try {
+				const dirStat = fs.statSync(lockDir);
+				if (Date.now() - dirStat.mtimeMs > FOREGROUND_CONTROL_LOCK_STALE_MS) {
+					fs.rmSync(lockDir, { recursive: true, force: true });
+					continue;
+				}
+			} catch {
+				/* dir vanished — let the loop retry */
+			}
+			// Dead-pid secondary fast-path: a provably dead owner only means keep
+			// waiting — NEVER steal a fresh lock on a pid-lookup race; the
+			// aged-mtime branch above is the only reclaim.
+			try {
+				const raw = fs.readFileSync(pidFile, "utf-8").trim();
+				const ownerPid = Number.parseInt(raw, 10);
+				if (!Number.isNaN(ownerPid) && ownerPid !== process.pid) {
+					try {
+						process.kill(ownerPid, 0);
+					} catch {
+						/* dead — but mtime not stale yet, keep waiting */
+					}
+				}
+			} catch {
+				/* no pid file — the mtime check above already handles it */
+			}
+			// Brief sleep to avoid CPU spinning.
+			// WI-7.3 (M7 spec §5): kept sync. Making this async would force
+			// requestForegroundControl() + its caller chain async (10+
+			// callers in message-tool/lifecycle paths). 10ms spin per
+			// iteration is bounded by the 5s timeout above (max ~500 iters
+			// = 5s total worst-case block, matching the lock-timeout).
+			sleepSync(10);
+		}
+	}
+	try {
+		return fn();
+	} finally {
+		if (acquired) {
+			// PID-guarded release: only remove the dir if the pid file still
+			// records OUR pid — if fn outlived staleMs and a stealer re-took the
+			// dir, the stealer owns it now.
+			try {
+				const currentPid = fs.readFileSync(pidFile, "utf-8").trim();
+				if (currentPid === String(process.pid)) {
+					fs.rmSync(lockDir, { recursive: true, force: true });
+				}
+			} catch {
+				/* lock stolen or already gone — do not touch */
+			}
+		}
+	}
+}
+
 export function foregroundControlPath(manifest: TeamRunManifest): string {
 	return path.join(manifest.stateRoot, "foreground-control.json");
 }
@@ -70,105 +193,11 @@ export function writeForegroundInterruptRequest(
 	reason = "User requested foreground interrupt.",
 ): ForegroundControlRequest {
 	const controlPath = foregroundControlPath(manifest);
-	const lockDir = `${controlPath}.lock`;
-	const pidFile = path.join(lockDir, "pid");
-	let requests: ForegroundControlRequest[] = [];
-
-	// FIX: Use file locking to prevent race condition in read-modify-write
-	// Added stale lock detection similar to event-log.ts
-	const acquireLock = (): void => {
-		const timeout = 5000;
-		const staleMs = 10000;
-		const start = Date.now();
-		while (true) {
-			try {
-				fs.mkdirSync(lockDir, { recursive: true });
-				try {
-					atomicWriteFile(pidFile, String(process.pid));
-				} catch {
-					/* best-effort */
-				}
-				break;
-			} catch {
-				if (Date.now() - start > timeout) {
-					// Check if lock is stale before giving up
-					try {
-						const raw = fs.readFileSync(pidFile, "utf-8").trim();
-						const ownerPid = Number.parseInt(raw, 10);
-						if (!Number.isNaN(ownerPid) && ownerPid !== process.pid) {
-							let alive = false;
-							try {
-								process.kill(ownerPid, 0);
-								alive = true;
-							} catch {
-								/* dead */
-							}
-							if (!alive) {
-								// Lock is stale — clear it and retry
-								fs.rmSync(lockDir, {
-									recursive: true,
-									force: true,
-								});
-								continue;
-							}
-							// Lock held by live process — throw
-							const err = new Error(`Foreground control lock timeout for ${controlPath}`);
-							logInternalError("foreground-control.lock-timeout", err, `controlPath=${controlPath}`);
-							throw err;
-						}
-					} catch {
-						/* no pid file — continue to throw */
-					}
-					const err = new Error(`Foreground control lock timeout for ${controlPath}`);
-					logInternalError("foreground-control.lock-timeout", err, `controlPath=${controlPath}`);
-					throw err;
-				}
-				// Stale detection: if the owning process is dead, remove the stale lock
-				try {
-					const raw = fs.readFileSync(pidFile, "utf-8").trim();
-					const ownerPid = Number.parseInt(raw, 10);
-					if (!Number.isNaN(ownerPid) && ownerPid !== process.pid) {
-						let alive = false;
-						try {
-							process.kill(ownerPid, 0);
-							alive = true;
-						} catch {
-							/* dead */
-						}
-						if (!alive) {
-							const stat = fs.statSync(lockDir);
-							if (Date.now() - stat.mtimeMs > staleMs) {
-								fs.rmSync(lockDir, {
-									recursive: true,
-									force: true,
-								});
-								continue;
-							}
-						}
-					}
-				} catch {
-					/* no pid file — fall through to sleep */
-				}
-				// Brief sleep to avoid CPU spinning
-				// WI-7.3 (M7 spec §5): kept sync. Making this async would force
-				// requestForegroundControl() + its caller chain async (10+
-				// callers in message-tool/lifecycle paths). 10ms spin per
-				// iteration is bounded by the 5s timeout above (max ~500 iters
-				// = 5s total worst-case block, matching the lock-timeout).
-				sleepSync(10);
-			}
-		}
-	};
-	const releaseLock = (): void => {
-		try {
-			fs.rmSync(lockDir, { recursive: true, force: true });
-		} catch {
-			/* best-effort */
-		}
-	};
-
-	acquireLock();
-	try {
+	// F2: this module-level lock is SHARED with the interrupt-guard consumer —
+	// the producer append and the consumer ack serialize on the same lock dir
+	// (`${controlPath}.lock`), closing the unlocked whole-file RMW race.
+	return withForegroundControlLock(controlPath, (): ForegroundControlRequest => {
+		let requests: ForegroundControlRequest[] = [];
 		if (fs.existsSync(controlPath)) {
 			try {
 				const parsed = JSON.parse(fs.readFileSync(controlPath, "utf-8")) as { requests?: ForegroundControlRequest[] };
@@ -201,9 +230,7 @@ export function writeForegroundInterruptRequest(
 			logInternalError("foreground_control.append", e, "type=foreground.interrupt_requested");
 		}
 		return request;
-	} finally {
-		releaseLock();
-	}
+	});
 }
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -217,12 +244,12 @@ export function writeForegroundInterruptRequest(
 // (writeForegroundInterruptRequest above) so the control-file contract has
 // one home.
 //
-// Polling/ack semantics carried over byte-identically from the previous
-// inline guard in background-runner.ts: existsSync+readFileSync+JSON.Parse
-// per tick, interval PI_CREW_INTERRUPT_GUARD_INTERVAL_MS (default 1000ms),
-// synchronous atomic ack write, once-per-request gate (defense-in-depth when
-// the ack write fails), appendEventBuffered("async.interrupt_detected"),
-// interval.unref().
+// Polling/ack semantics carried over from the previous inline guard in
+// background-runner.ts: existsSync+readFileSync+JSON.Parse per tick, interval
+// PI_CREW_INTERRUPT_GUARD_INTERVAL_MS (default 1000ms), synchronous atomic ack
+// write (now under the producer's dir-lock — F2), once-per-request gate
+// (defense-in-depth when the ack write fails),
+// appendEventBuffered("async.interrupt_detected"), interval.unref().
 //
 // What an interrupt DOES is host-scoped via onInterrupt:
 //  - detached runner (background-runner.startInterruptGuard): process-wide
@@ -261,21 +288,42 @@ export function startRunInterruptGuard(opts: RunInterruptGuardOptions): () => vo
 	const interval = setInterval(() => {
 		try {
 			if (!fs.existsSync(controlPath)) return;
-			const parsed = JSON.parse(fs.readFileSync(controlPath, "utf-8")) as {
-				requests?: Array<{ type: string; acknowledged?: boolean }>;
-			};
+			const parsed = JSON.parse(fs.readFileSync(controlPath, "utf-8")) as ForegroundControlFile;
 			const last = parsed.requests?.at(-1);
 			if (last?.type === "interrupt" && last?.acknowledged !== true) {
 				if (interruptHandled) return;
 				interruptHandled = true;
 				// RT-4 FIX: write acknowledged:true back SYNCHRONOUSLY so the next
 				// tick does not re-fire. Sync because a polling callback cannot await.
+				// F2 FIX: the ack is a whole-file read→mutate→write and now runs
+				// under the SAME module-level lock as the producer
+				// (withForegroundControlLock) with a FRESH read inside the critical
+				// section. The old path wrote back the stale tick snapshot
+				// unlocked — a producer append racing the tick was clobbered
+				// (lost interrupt request).
 				try {
-					const reqs = parsed.requests ?? [];
-					if (reqs.length > 0) {
-						reqs[reqs.length - 1].acknowledged = true;
-						atomicWriteFile(controlPath, JSON.stringify(parsed, null, 2));
-					}
+					withForegroundControlLock(controlPath, () => {
+						if (!fs.existsSync(controlPath)) return;
+						let fresh: ForegroundControlFile;
+						try {
+							fresh = JSON.parse(fs.readFileSync(controlPath, "utf-8")) as ForegroundControlFile;
+						} catch {
+							return;
+						}
+						const reqs = fresh.requests;
+						if (!Array.isArray(reqs) || reqs.length === 0) return;
+						// Ack the exact request that fired (by id when present);
+						// fall back to the tail entry so id-less legacy files
+						// keep acking like before.
+						let target = last.id !== undefined ? reqs.find((r) => r.id === last.id) : undefined;
+						if (target === undefined) {
+							const tail = reqs[reqs.length - 1];
+							if (tail?.type === "interrupt" && tail.acknowledged !== true) target = tail;
+						}
+						if (target === undefined || target.type !== "interrupt" || target.acknowledged === true) return;
+						target.acknowledged = true;
+						atomicWriteFile(controlPath, JSON.stringify(fresh, null, 2));
+					});
 				} catch {
 					/* best-effort ack — interruptHandled gate prevents re-fire */
 				}

package/src/runtime/goal-workflow/goal-loop-runner.ts

@@ -803,6 +803,12 @@ export async function runGoalLoop(input: RunGoalLoopInput): Promise<RunGoalLoopR
 				// manifest's model routing snapshot onto each turn manifest too, so
 				// status/resume paths see the same routing the turn was dispatched with.
 				...(manifest.modelContext ? { modelContext: manifest.modelContext } : {}),
+				// FINDING B (2026-10-31): inherit the OUTER manifest's dispatcher
+				// (session) PUBLIC verify key — the session that launched the loop is
+				// the process that answers asks/steers these turn workers, and the
+				// turn manifests are created here in the DETACHED runner (whose own
+				// keypair is a different process than the responder).
+				...(manifest.dispatcherVerifyKey ? { dispatcherVerifyKey: manifest.dispatcherVerifyKey } : {}),
 			});
 			goal =
 				store.patch(