pi-crew 0.9.28 → 0.9.30

package/src/prompt/prompt-runtime.ts

@@ -1,5 +1,8 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import * as fs from "node:fs";
+import * as path from "node:path";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { logInternalError } from "../utils/internal-error.ts";
+import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 
 export const PI_TEAMS_INHERIT_PROJECT_CONTEXT_ENV = "PI_TEAMS_INHERIT_PROJECT_CONTEXT";
 export const PI_TEAMS_INHERIT_SKILLS_ENV = "PI_TEAMS_INHERIT_SKILLS";
@@ -12,6 +15,99 @@ const PROJECT_CONTEXT_HEADER = "\n\n# Project Context\n\nProject-specific instru
 const SKILLS_HEADER = "\n\nThe following skills provide specialized instructions for specific tasks.";
 const DATE_HEADER = "\nCurrent date:";
 
+// ── FIX-02: Steering content sanitization limits ──────────────────────────
+// Bounded to keep a malformed/malicious steer entry from blowing up the
+// worker's prompt budget or smuggling control sequences into the agent.
+const MAX_STEER_MESSAGE_LENGTH = 4096;
+const MAX_STEER_MESSAGE_NEWLINES = 50;
+// C0 control characters minus the printable whitespace (\t \n \r). These
+// are the bytes most useful for ANSI escapes, terminal-control tricks, and
+// NUL-injection attacks when steer content reaches the worker's UI.
+const STEER_CONTROL_CHAR_PATTERN = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/;
+
+export interface SteerSanitizeResult {
+	valid: boolean;
+	reason?: string;
+	message?: string;
+}
+
+export interface SteerEntry {
+	type?: string;
+	message?: string;
+}
+
+/**
+ * Validate a single steering-file entry before forwarding it to
+ * `pi.sendMessage`. FIX-02: reject oversized payloads, excessive newlines,
+ * or control characters that could be used to confuse the worker UI.
+ */
+export function sanitizeSteerMessage(entry: SteerEntry): SteerSanitizeResult {
+	const message = entry.message;
+	if (typeof message !== "string" || message.length === 0) {
+		return { valid: false, reason: "missing-or-empty-message" };
+	}
+	if (message.length > MAX_STEER_MESSAGE_LENGTH) {
+		return { valid: false, reason: `message-too-long:${message.length}` };
+	}
+	const newlineCount = (message.match(/\n/g) ?? []).length;
+	if (newlineCount > MAX_STEER_MESSAGE_NEWLINES) {
+		return { valid: false, reason: `too-many-newlines:${newlineCount}` };
+	}
+	if (STEER_CONTROL_CHAR_PATTERN.test(message)) {
+		return { valid: false, reason: "contains-control-characters" };
+	}
+	return { valid: true, message };
+}
+
+// ── FIX-03: Steering file path containment validation ─────────────────────
+// The steering file path is inherited from the parent via env, so we
+// defensively re-validate it before the first read to catch symlink
+// redirection or paths that escape the session's artifacts root.
+export interface SteeringFileValidation {
+	valid: boolean;
+	reason?: string;
+	resolvedPath?: string;
+}
+
+/**
+ * Validate `PI_CREW_STEERING_FILE` before first read. FIX-03:
+ *   1. `lstatSync` rejects a symlink at the steering file itself.
+ *   2. `resolveRealContainedPath` walks the ancestor chain with O_NOFOLLOW
+ *      to reject any symlinked parent (e.g. a redirected `artifactsRoot`)
+ *      and to verify the resolved path stays inside the derived artifacts
+ *      root (`<artifactsRoot>/steering/<taskId>.jsonl` → `<artifactsRoot>`).
+ *
+ * Returns `{ valid: false }` with a reason on any violation. Callers must
+ * log + skip steering on failure rather than abort the worker.
+ */
+export function validateSteeringFile(steeringFile: string): SteeringFileValidation {
+	try {
+		const lst = fs.lstatSync(steeringFile);
+		if (lst.isSymbolicLink()) {
+			return { valid: false, reason: "steering-file-is-symlink" };
+		}
+	} catch (error) {
+		const errCode = (error as NodeJS.ErrnoException).code;
+		if (errCode && errCode !== "ENOENT") {
+			return { valid: false, reason: `lstat-failed:${errCode}` };
+		}
+	}
+	// Layout invariant from task-runner.ts: `steeringFile` is built as
+	// `<artifactsRoot>/steering/<taskId>.jsonl`. We don't trust the caller
+	// to pass `artifactsRoot`, so derive it as 2 levels up. `resolveRealContainedPath`
+	// then enforces both containment AND ancestor-symlink safety in one shot.
+	const artifactsRoot = path.resolve(steeringFile, "..", "..");
+	try {
+		const resolved = resolveRealContainedPath(artifactsRoot, steeringFile);
+		return { valid: true, resolvedPath: resolved };
+	} catch (error) {
+		return {
+			valid: false,
+			reason: `path-validation-failed:${error instanceof Error ? error.message : String(error)}`,
+		};
+	}
+}
+
 function readBooleanEnv(name: string): boolean | undefined {
 	const value = process.env[name];
 	if (value === undefined) return undefined;
@@ -83,43 +179,67 @@ export default function registerPiTeamsPromptRuntime(pi: ExtensionAPI): void {
 	// the active session via pi.sendMessage with deliverAs:"steer".
 	const steeringFile = process.env[PI_CREW_STEERING_FILE_ENV];
 	if (steeringFile) {
-		let lastOffset = 0;
-		const pollSteering = (): void => {
-			try {
-				const stat = fs.statSync(steeringFile, { throwIfNoEntry: false });
-				if (!stat || stat.size <= lastOffset) return;
-				const fd = fs.openSync(steeringFile, "r");
+		// FIX-03: validate the steering file path once before first read.
+		const validation = validateSteeringFile(steeringFile);
+		if (!validation.valid) {
+			logInternalError(
+				"prompt-runtime.steering-file-rejected",
+				new Error(validation.reason ?? "steering-file-validation-failed"),
+				`path=${steeringFile}`,
+				"warn",
+			);
+		} else {
+			const safeSteeringFile = validation.resolvedPath ?? steeringFile;
+			let lastOffset = 0;
+			const pollSteering = (): void => {
 				try {
-					const buf = Buffer.alloc(stat.size - lastOffset);
-					fs.readSync(fd, buf, 0, buf.length, lastOffset);
-					lastOffset = stat.size;
-					const lines = buf.toString("utf8").split("\n").filter(Boolean);
-					for (const line of lines) {
-						try {
-							const entry = JSON.parse(line) as { type?: string; message?: string };
-							if (entry.type === "steer" && entry.message) {
+					const stat = fs.statSync(safeSteeringFile, { throwIfNoEntry: false });
+					if (!stat || stat.size <= lastOffset) return;
+					const fd = fs.openSync(safeSteeringFile, "r");
+					try {
+						const buf = Buffer.alloc(stat.size - lastOffset);
+						fs.readSync(fd, buf, 0, buf.length, lastOffset);
+						lastOffset = stat.size;
+						const lines = buf.toString("utf8").split("\n").filter(Boolean);
+						for (const line of lines) {
+							try {
+								const entry = JSON.parse(line) as SteerEntry;
+								if (entry.type !== "steer") continue;
+								// FIX-02: sanitize each steer entry before forwarding
+								// to pi.sendMessage. Reject oversized payloads,
+								// excessive newlines, and control characters.
+								const sanitized = sanitizeSteerMessage(entry);
+								if (!sanitized.valid || sanitized.message === undefined) {
+									logInternalError(
+										"prompt-runtime.steer-rejected",
+										new Error(sanitized.reason ?? "steer-sanitization-failed"),
+										`line-preview=${line.slice(0, 64)}`,
+										"warn",
+									);
+									continue;
+								}
 								pi.sendMessage(
-									{ customType: "crew-steer", content: entry.message, display: false },
+									{ customType: "crew-steer", content: sanitized.message, display: false },
 									{ deliverAs: "steer" },
 								);
+							} catch {
+								// Malformed line — skip
 							}
+						}
+					} finally {
+						try {
+							fs.closeSync(fd);
 						} catch {
-							// Malformed line — skip
+							/* already closed */
 						}
 					}
-				} finally {
-					try {
-						fs.closeSync(fd);
-					} catch {
-						/* already closed */
-					}
+				} catch {
+					// File doesn't exist yet or read error — will retry next tick
 				}
-			} catch {
-				// File doesn't exist yet or read error — will retry next tick
-			}
-		};
-		const timer = setInterval(pollSteering, 500);
-		timer.unref?.();
+			};
+			const timer = setInterval(pollSteering, 500);
+			timer.unref?.();
+		}
 	}
 
 	// ── Prompt rewriting (existing) ────────────────────────────────────────

package/src/runtime/async-runner.ts

@@ -3,7 +3,7 @@ import * as fs from "node:fs";
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { appendEvent } from "../state/event-log.ts";
+import { appendEvent, appendEventAsync } from "../state/event-log.ts";
 import type { TeamRunManifest } from "../state/types.ts";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../utils/env-allowlist.ts";
 import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
@@ -257,7 +257,8 @@ export async function spawnBackgroundTeamRun(manifest: TeamRunManifest): Promise
 	const loader = resolveTypeScriptLoader();
 	if (!loader) {
 		const message = buildLoaderUnavailableMessage(packageRootFromRuntime());
-		appendEvent(manifest.eventsPath, {
+		// FIX-08: use async event append to avoid sleepSync event-loop blocking.
+		await appendEventAsync(manifest.eventsPath, {
 			type: "async.failed",
 			runId: manifest.runId,
 			message,

package/src/runtime/child-pi.ts

@@ -80,6 +80,22 @@ function clearHardKillTimer(pid: number | undefined): void {
 	childHardKillTimers.delete(pid);
 }
 
+/**
+ * B6: spawn taskkill and attach an 'error' listener. spawn() emits ENOENT/EACCES
+ * asynchronously via the 'error' event (not as a throw), so an unlistened spawn
+ * can crash the parent as an uncaught exception. taskkill is a standard Windows
+ * binary so this is defensive, but the listener keeps failures bounded.
+ */
+function spawnTaskkillSafe(pid: number): void {
+	const taskkillChild = spawn("taskkill", ["/pid", String(pid), "/t", "/f"], {
+		stdio: "ignore",
+		windowsHide: true,
+	});
+	taskkillChild.on("error", (err) => {
+		logInternalError("child-pi.taskkill-spawn-error", err instanceof Error ? err : new Error(String(err)), `pid=${pid}`);
+	});
+}
+
 export function killProcessPid(pid: number): void {
 	if (!Number.isInteger(pid) || pid <= 0) return;
 	try {
@@ -87,10 +103,7 @@ export function killProcessPid(pid: number): void {
 			// 3.8: Windows path uses taskkill /T /F (force kill the entire tree).
 			// taskkill itself can silently fail (PID gone, permission denied, etc.)
 			// so verify after 2s and log a warning if the process is still alive.
-			spawn("taskkill", ["/pid", String(pid), "/t", "/f"], {
-				stdio: "ignore",
-				windowsHide: true,
-			});
+			spawnTaskkillSafe(pid);
 			const verifyTimer = setTimeout(() => {
 				try {
 					process.kill(pid, 0); // throws ESRCH when dead
@@ -99,12 +112,10 @@ export function killProcessPid(pid: number): void {
 						"child-pi.taskkill-stuck",
 						new Error(`process ${pid} still alive 2s after taskkill /T /F; retrying`),
 						`pid=${pid}`,
+						"error",
 					);
 					try {
-						spawn("taskkill", ["/pid", String(pid), "/t", "/f"], {
-							stdio: "ignore",
-							windowsHide: true,
-						});
+						spawnTaskkillSafe(pid);
 					} catch {
 						/* best-effort */
 					}
@@ -894,6 +905,20 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 	});
 	// Pass steering file path to child for real-time steer injection
 	if (input.steeringFile) built.env.PI_CREW_STEERING_FILE = input.steeringFile;
+	// B5: if the parent already aborted before we spawn, do not start the child
+	// at all. Spawning a doomed process wastes resources, and the abort listener
+	// registered below will not re-fire for an already-aborted signal (so the
+	// child would only be killed later by the response-timeout path). Return a
+	// cancelled-style result immediately.
+	if (input.signal?.aborted) {
+		return {
+			exitCode: null,
+			stdout: "",
+			stderr: "",
+			error: "Aborted before spawn (parent AbortSignal already aborted)",
+			aborted: true,
+		};
+	}
 	const spawnSpec = getPiSpawnCommand(built.args);
 	try {
 		return await new Promise<ChildPiRunResult>((resolve) => {
@@ -1129,45 +1154,30 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 								turnCount += 1;
 								if (maxTurns !== undefined && !softLimitReached && turnCount >= maxTurns) {
 									softLimitReached = true;
-									// Inject steer via stdin to tell child to wrap up.
-									// Steer injection is ADVISORY: it asks the worker to wrap up. The real
-									// enforcement is the hard-abort at maxTurns + graceTurns (below). So a
-									// failed/non-writable stdin must NOT kill the worker — that destroys a
-									// valid answer already in stdout (Phase-0 root cause of the
-									// disableTools/maxTurns:1 exit-null bug). Just log + let the hard-abort
-									// path handle a genuinely runaway worker.
-									if (child.stdin?.writable) {
-										const steerPayload =
-											JSON.stringify({
-												type: "steer",
-												message:
-													"You have reached your turn limit. Wrap up immediately — provide your final answer now.",
-											}) + "\n";
-										const writeSucceeded = child.stdin.write(steerPayload);
-										if (!writeSucceeded) {
-											// Normal Node backpressure: the payload is buffered and will flush on
-											// 'drain'. NOT a failure — do NOT kill the worker. The steer is
-											// advisory; if the worker ignores it and runs past maxTurns +
-											// graceTurns, the hard-abort below terminates it.
+									// C8: deliver the "wrap up" advisory by appending to the steering JSONL
+									// file the child polls (PI_CREW_STEERING_FILE). The child is spawned with
+									// stdio:["ignore",...], so child.stdin is null and the old stdin branch was
+									// dead code that only spammed logs on every soft-limit hit. Advisory only —
+									// the hard-abort below at maxTurns + graceTurns is the real enforcement, so
+									// a failed write must NOT kill the worker.
+									if (input.steeringFile) {
+										try {
+											fs.appendFileSync(
+												input.steeringFile,
+												JSON.stringify({
+													type: "steer",
+													message:
+														"You have reached your turn limit. Wrap up immediately — provide your final answer now.",
+												}) + "\n",
+												"utf-8",
+											);
+										} catch (err) {
 											logInternalError(
-												"child-pi.steer-backpressure",
-												new Error(
-													"stdin write returned false (normal backpressure); steer buffered, worker NOT killed",
-												),
+												"child-pi.steer-write-failed",
+												err instanceof Error ? err : new Error(String(err)),
 												`pid=${child.pid}`,
 											);
 										}
-									} else {
-										// stdin closed (worker already finished) or otherwise unwritable.
-										// Also advisory — the worker is done or nearly done; let it exit
-										// naturally. Hard-abort remains the safety net for true runaways.
-										logInternalError(
-											"child-pi.steer-not-writable",
-											new Error(
-												"stdin not writable when attempting steer injection (worker may be done); worker NOT killed",
-											),
-											`pid=${child.pid}`,
-										);
 									}
 								} else if (maxTurns !== undefined && softLimitReached && turnCount >= maxTurns + (graceTurns ?? 5)) {
 									// Hard abort — terminate after grace turns

package/src/runtime/crash-recovery.ts

@@ -244,7 +244,7 @@ export function cancelOrphanedRuns(
 		});
 		if (cancelledRun)
 			void terminateLiveAgentsForRun(manifest.runId, "cancelled", appendEvent, loaded.manifest.eventsPath).catch((error) =>
-				logInternalError("crash-recovery.orphan.terminate", error, `runId=${manifest.runId}`),
+				logInternalError("crash-recovery.orphan.terminate", error, `runId=${manifest.runId}`, "warn"),
 			);
 	}
 
@@ -428,7 +428,7 @@ export function purgeStaleActiveRunIndex(staleThresholdMs = 300_000, now = Date.
 							appendEvent,
 							fullLoaded.manifest.eventsPath,
 						).catch((error) =>
-							logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`),
+							logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`, "warn"),
 						);
 					}
 				} catch {
@@ -482,7 +482,7 @@ export function purgeStaleActiveRunIndex(staleThresholdMs = 300_000, now = Date.
 							appendEvent,
 							fullLoaded.manifest.eventsPath,
 						).catch((error) =>
-							logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`),
+							logInternalError("crash-recovery.pid-dead.terminate", error, `runId=${fullLoaded.manifest.runId}`, "warn"),
 						);
 					}
 				} catch {
@@ -543,7 +543,7 @@ export function reconcileAllStaleRuns(cwd: string, manifestCache: ManifestCache,
 				}
 				updateRunStatus(fresh.manifest, "failed", `Stale run reconciled: ${result.detail}`);
 				void terminateLiveAgentsForRun(fresh.manifest.runId, "failed", appendEvent, fresh.manifest.eventsPath).catch((error) =>
-					logInternalError("crash-recovery.reconcile.terminate", error, `runId=${fresh.manifest.runId}`),
+					logInternalError("crash-recovery.reconcile.terminate", error, `runId=${fresh.manifest.runId}`, "warn"),
 				);
 				appendEvent(fresh.manifest.eventsPath, {
 					type: "crew.run.reconciled_stale",

package/src/runtime/cross-extension-rpc.ts

@@ -1,5 +1,5 @@
 import * as crypto from "node:crypto";
-import { isHmacEnabled, extractSignaturePayload, verifyRpcSignature } from "../extension/rpc-hmac.ts";
+import { extractSignaturePayload, isHmacEnabled, verifyRpcSignature } from "../extension/rpc-hmac.ts";
 
 export interface EventBus {
 	on(event: string, handler: (data: unknown) => void): () => void;

package/src/runtime/post-exit-stdio-guard.ts

@@ -9,6 +9,9 @@ export interface ChildWithPipedStdio {
 	stdout: ChildProcess["stdout"];
 	stderr: ChildProcess["stderr"];
 	on: ChildProcess["on"];
+	/** Set by Node after the child exits. Used to detect a post-exit attach. */
+	exitCode?: number | null;
+	signalCode?: NodeJS.Signals | null;
 }
 
 export interface ChildWithKill {
@@ -72,13 +75,28 @@ export function attachPostExitStdioGuard(child: ChildWithPipedStdio, options: Po
 		stderrEnded = true;
 		if (stdoutEnded && stderrEnded) clearTimers();
 	});
-	child.on("exit", () => {
-		exited = true;
-		armIdleTimer();
+
+	const armHardTimer = (): void => {
 		if (hardTimer) return;
 		hardTimer = setTimeout(destroyUnendedStdio, hardMs);
 		hardTimer.unref();
-	});
+	};
+	const onExit = (): void => {
+		exited = true;
+		armIdleTimer();
+		armHardTimer();
+	};
+	// The guard is normally attached from INSIDE the child's 'exit' handler
+	// (child-pi.ts), i.e. AFTER the child has already exited. A listener
+	// registered with child.on('exit') during the in-flight 'exit' dispatch
+	// will NOT fire (Node clones the listener array before iterating), so
+	// relying on it alone makes this guard a no-op and can hang the run if a
+	// descendant process holds the stdio pipes open. When a prior exit is
+	// detectable (exitCode/signalCode already set by Node), arm immediately.
+	if (child.exitCode != null || child.signalCode != null) {
+		onExit();
+	}
+	child.on("exit", onExit);
 	child.on("close", clearTimers);
 	child.on("error", clearTimers);
 

package/src/runtime/skill-instructions.ts

@@ -29,13 +29,9 @@ const DEFAULT_ROLE_SKILLS: Record<string, string[]> = {
 	critic: ["read-only-explorer", "multi-perspective-review"],
 	executor: ["state-mutation-locking", "safe-bash", "verification-before-done"],
 	reviewer: ["read-only-explorer", "multi-perspective-review"],
-	// SECURITY NOTE: The following skill names are trusted package-level skills.
-	// If a project has a skills/ directory containing subdirectories with these names,
-	// those project-level SKILL.md files will be FOUND FIRST (readSkillMarkdown checks
-	// project dir before package dir) and their content injected verbatim into prompts.
-	// The "Applicable Skills" block will add an untrusted-content warning for project skills,
-	// but be aware this is a potential supply-chain risk in multi-contributor projects.
 	"security-reviewer": ["secure-agent-orchestration-review", "ownership-session-security"],
+	// SECURITY NOTE: Package skills are checked FIRST (SEC-003). Project-level
+	// skills with the same name will NOT override the trusted package version.
 	"test-engineer": ["verification-before-done", "safe-bash"],
 	verifier: ["verification-before-done", "runtime-state-reader"],
 	writer: ["context-artifact-hygiene", "verification-before-done"],

package/src/runtime/stale-reconciler.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { errors } from "../errors.ts";
+import { atomicWriteJson } from "../state/atomic-write.ts";
 import { saveRunManifest } from "../state/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { recordFromTask, upsertCrewAgent } from "./crew-agent-records.ts";
@@ -67,8 +68,12 @@ function checkResultFile(manifest: TeamRunManifest, tasks: TeamTaskState[]): { f
 		);
 	if (allTerminal) {
 		// All tasks are terminal but manifest status was not updated — repair it.
+		// Derive the run status from task outcomes instead of blindly marking
+		// "completed": a run where every task failed/cancelled is NOT a success.
+		const hasFailed = tasks.some((t) => t.status === "failed");
+		const onlyCancelledOrSkipped = tasks.every((t) => t.status === "cancelled" || t.status === "skipped");
+		manifest.status = hasFailed ? "failed" : onlyCancelledOrSkipped ? "cancelled" : "completed";
 		// Persist manifest status change immediately to make checkResultFile self-contained.
-		manifest.status = "completed";
 		saveRunManifest(manifest);
 		// Sync agent records even when tasks are already terminal
 		// (e.g., a previous reconcile fixed tasks but crashed before updating agents)
@@ -492,8 +497,8 @@ export function reconcileOrphanedTempWorkspaces(
 						const tasks: TeamTaskState[] = JSON.parse(fs.readFileSync(tasksPath, "utf-8"));
 						const result = reconcileStaleRun(manifest, tasks, now);
 						if (result.repaired && result.repairedTasks) {
-							// Persist repaired tasks
-							fs.writeFileSync(tasksPath, JSON.stringify(result.repairedTasks, null, 2));
+							// Persist repaired tasks (atomic — temp+rename to survive mid-write crash)
+							atomicWriteJson(tasksPath, result.repairedTasks);
 							// Update manifest status
 							const updated = {
 								...manifest,
@@ -501,7 +506,7 @@ export function reconcileOrphanedTempWorkspaces(
 								updatedAt: new Date(now).toISOString(),
 								summary: `Stale run reconciled: ${result.detail}`,
 							};
-							fs.writeFileSync(manifestPath, JSON.stringify(updated, null, 2));
+							atomicWriteJson(manifestPath, updated);
 							// Update agent records
 							for (const task of result.repairedTasks) {
 								try {

package/src/runtime/task-runner/state-helpers.ts

@@ -32,6 +32,7 @@ export function persistSingleTaskUpdate(
 	updated: TeamTaskState,
 	checkpointPhase?: TaskCheckpointState["phase"],
 ): TeamTaskState[] {
+	const MAX_CAS_ATTEMPTS = 100;
 	let baseMtime = 0;
 	try {
 		baseMtime = fs.statSync(manifest.tasksPath).mtimeMs;
@@ -55,7 +56,7 @@ export function persistSingleTaskUpdate(
 
 	try {
 		return withRunLockSync(manifest, () => {
-			for (let attempt = 0; attempt < 100; attempt++) {
+			for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
 				// F4: persistSingleTaskUpdate now uses saveRunTasksCoalesced below
 				// (50ms debounce window). Read-modify-write loops are unsafe under
 				// coalescing — a parallel writer's buffered write is invisible to
@@ -93,8 +94,13 @@ export function persistSingleTaskUpdate(
 			}
 
 			if (merged === undefined) {
-				logInternalError("persistSingleTaskUpdate", new Error("failed to converge after 50 attempts"));
-				throw new Error("persistSingleTaskUpdate: failed to converge after 50 attempts");
+				logInternalError(
+					"persistSingleTaskUpdate",
+					new Error(`failed to converge after ${MAX_CAS_ATTEMPTS} attempts`),
+					undefined,
+					"error",
+				);
+				throw new Error(`persistSingleTaskUpdate: failed to converge after ${MAX_CAS_ATTEMPTS} attempts`);
 			}
 
 			try {
@@ -105,14 +111,14 @@ export function persistSingleTaskUpdate(
 				// writer's flushed-before-this-call state.
 				saveRunTasksCoalesced(manifest, merged);
 			} catch (err) {
-				logInternalError("persistSingleTaskUpdate", err);
+				logInternalError("persistSingleTaskUpdate", err, undefined, "error");
 				throw err;
 			}
 			return merged;
 		});
 	} catch (err) {
 		if (merged === undefined) {
-			logInternalError("persistSingleTaskUpdate", err);
+			logInternalError("persistSingleTaskUpdate", err, undefined, "error");
 		}
 		throw err;
 	}

package/src/runtime/team-runner.ts

@@ -704,6 +704,7 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 				"team-runner.goalAchievement.falseGreen",
 				new Error(gaApplied.manifest.goalAchievementNote ?? "false-green detected"),
 				`runId=${manifest.runId}`,
+				"error",
 			);
 		stopTeamHeartbeat();
 		resolveRunPromise(manifest.runId, result);
@@ -757,22 +758,17 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 		stopTeamHeartbeat();
 		// P1: Catch unhandled errors — ensure manifest/tasks/agents are terminal so they don't stay "running" forever.
 		const message = error instanceof Error ? error.message : String(error);
-		// FIX (2026-07-02): drop withRunLock here entirely.
-		// Previously this catch path acquired withRunLock to reload manifest+tasks
-		// from disk (best-effort with in-memory fallback). But the closeout path at
-		// line ~1596 ALSO holds the same run lock for its final save — when a late
-		// failure fires during closeout (e.g. async hook error after run.completed),
-		// this catch path can hit `Run 'run.lock' is locked by another operation.`
-		// and the error propagates as "Unhandled error in team runner" after the
-		// run has actually completed. Lock acquisition here is unnecessary —
-		// the closeout writes through to disk before this catch fires (or after —
-		// either is fine), and the in-memory state already contains the latest
-		// post-completion manifest/tasks. We use in-memory state unconditionally.
-		// The stale-data concern is mitigated by the dispatcher having re-read disk
-		// state under lock at line ~1364 for each iteration; the manifest+task
-		// objects in the calling scope are already post-merge.
-		const freshManifest = manifest;
-		const freshTasks = refreshTaskGraphQueues(input.tasks);
+		// Re-read the latest persisted state from disk instead of trusting
+		// input.tasks (the ORIGINAL start snapshot, still all "queued" — it is never
+		// mutated by executeTeamRunCore). A late failure during closeout would
+		// otherwise map every task to "failed", overwriting tasks that already
+		// completed during the run. loadRunManifestById is the established
+		// fresh-read pattern in this file (see ~line 1269); it is best-effort with
+		// no lock, consistent with the lock-drop decision below. If the disk read
+		// fails, fall back to input.tasks so the run is still marked terminal.
+		const fresh = loadRunManifestById(manifest.cwd, manifest.runId);
+		const freshManifest = fresh?.manifest ?? manifest;
+		const freshTasks = refreshTaskGraphQueues(fresh?.tasks ?? input.tasks);
 		const failedAt = new Date().toISOString();
 		const tasks = freshTasks.map((task) =>
 			task.status === "running" || task.status === "queued" || task.status === "waiting"