pi-crew 0.9.32 → 0.9.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.9.32",
+  "version": "0.9.33",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",

package/src/extension/run-maintenance.ts

@@ -7,6 +7,7 @@ import { logInternalError } from "../utils/internal-error.ts";
 import { projectCrewRoot, userCrewRoot } from "../utils/paths.ts";
 import { redactSecrets } from "../utils/redaction.ts";
 import { isSafePathId, resolveRealContainedPath } from "../utils/safe-paths.ts";
+import { cleanupRunWorktrees } from "../worktree/cleanup.ts";
 import { listRuns } from "./run-index.ts";
 
 export interface PruneRunsResult {
@@ -21,7 +22,14 @@ export interface PruneRunsOptions {
 }
 
 function isFinished(run: TeamRunManifest): boolean {
-	return run.status === "completed" || run.status === "failed" || run.status === "cancelled" || run.status === "blocked";
+	// P3: "blocked" is NOT a terminal status — the run is waiting on something
+	// (plan approval, mailbox reply, scheduler stall) and can transition to
+	// running/cancelled/failed (per TEAM_RUN_STATUS_TRANSITIONS). Pruning a
+	// blocked run destroys recoverable state (e.g. a plan the user needs to
+	// approve, or a mailbox wait the user needs to answer). Truly stuck
+	// blocked runs are handled by the stale-reconciler/crash-recovery, not
+	// by prune.
+	return run.status === "completed" || run.status === "failed" || run.status === "cancelled";
 }
 
 function isSafeToPrune(cwd: string, run: TeamRunManifest): boolean {
@@ -66,6 +74,26 @@ export function pruneFinishedRuns(cwd: string, keep: number, options: PruneRunsO
 			);
 			continue;
 		}
+		// P2: clean up git worktrees BEFORE deleting state. Worktrees live at
+		// <crewRoot>/state/worktrees/<runId>/ — a separate path from stateRoot
+		// (<crewRoot>/state/runs/<runId>/) and artifactsRoot, so fs.rmSync below
+		// does NOT touch them. Without this, every pruned worktree-using run
+		// leaks its worktree dir + git branch. cleanupRunWorktrees (no force)
+		// preserves dirty worktrees by writing a diff artifact and skipping
+		// the removal — in that case we skip the whole prune of this run so
+		// the user can recover (no silent data loss). Compare handleForget
+		// which calls cleanupRunWorktrees.
+		const worktreeCleanup = cleanupRunWorktrees(run, { signal: options.signal });
+		if (worktreeCleanup.preserved.length > 0) {
+			logInternalError(
+				"prune.worktree-preserved",
+				new Error(
+					`Skipping prune: ${worktreeCleanup.preserved.length} dirty worktree(s) preserved for recovery: ${worktreeCleanup.preserved.map((p) => p.path).join(", ")}`,
+				),
+				`runId=${run.runId}`,
+			);
+			continue;
+		}
 		fs.rmSync(run.stateRoot, { recursive: true, force: true });
 		fs.rmSync(run.artifactsRoot, { recursive: true, force: true });
 		removed.push(run.runId);

package/src/extension/team-tool/lifecycle-actions.ts

@@ -2,9 +2,12 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { removeGuidance } from "../../config/markers.ts";
 import { appendHookEvent, executeHook } from "../../hooks/registry.ts";
+import { killProcessPid } from "../../runtime/child-pi.ts";
+import { terminateLiveAgentsForRun } from "../../runtime/live-agent-manager.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { appendEvent } from "../../state/event-log.ts";
 import { loadRunManifestById } from "../../state/state-store.ts";
+import { logInternalError } from "../../utils/internal-error.ts";
 import { projectCrewRoot, userCrewRoot, userPiRoot } from "../../utils/paths.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
 import { cleanupRunWorktrees } from "../../worktree/cleanup.ts";
@@ -217,6 +220,25 @@ export async function handleForget(params: TeamToolParamsValue, ctx: TeamContext
 			intent,
 		},
 	});
+	// P1: terminate live agents + kill the background runner BEFORE deleting state.
+	// Without this, forgetting a running run orphans those processes (separate
+	// process groups via setsid) which keep executing and consuming tokens after
+	// their state directory is gone. Mirrors handleCancel's cleanup.
+	await terminateLiveAgentsForRun(loaded.manifest.runId, "cancelled", appendEvent, loaded.manifest.eventsPath);
+	const asyncPid = loaded.manifest.async?.pid;
+	if (asyncPid !== undefined && asyncPid > 0) {
+		try {
+			killProcessPid(asyncPid);
+			appendEvent(loaded.manifest.eventsPath, {
+				type: "async.kill_requested",
+				runId: loaded.manifest.runId,
+				message: "Sent SIGTERM to background runner process (forget).",
+				data: { pid: asyncPid },
+			});
+		} catch (error) {
+			logInternalError("team-tool.handleForget.killAsync", error, `runId=${loaded.manifest.runId},pid=${asyncPid}`);
+		}
+	}
 	// Determine scope from manifest paths (project vs user-level runs)
 	const crewRoot = loaded.manifest.stateRoot.startsWith(userCrewRoot() + path.sep)
 		? userCrewRoot()

package/src/extension/team-tool.ts

@@ -314,6 +314,17 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 	if (!runCwd) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "resume", status: "error" }, true);
 	const loaded = loadRunManifestById(runCwd, params.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) return result(`Run '${params.runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "resume", status: "error" }, true);
+	// R1: foreign-ownership check — mirrors handleRetry/handleCancel. Without it,
+	// another session can resume (and re-execute) a run it doesn't own, racing
+	// the owning session.
+	const foreignRun = typeof loaded.manifest.ownerSessionId === "string" && loaded.manifest.ownerSessionId !== ctx.sessionId;
+	if (foreignRun && !params.force) {
+		return result(
+			`Run ${loaded.manifest.runId} belongs to another session. Use force: true to override.`,
+			{ action: "resume", status: "error", runId: loaded.manifest.runId },
+			true,
+		);
+	}
 	if (!loaded.manifest.workflow)
 		return result(`Run '${params.runId}' has no workflow to resume.`, { action: "resume", status: "error" }, true);
 	const agents = allAgents(discoverAgents(ctx.cwd));
@@ -324,8 +335,18 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 		direct?.workflow ?? allWorkflows(discoverWorkflows(ctx.cwd)).find((candidate) => candidate.name === loaded.manifest.workflow);
 	if (!workflow) return result(`Workflow '${loaded.manifest.workflow}' not found.`, { action: "resume", status: "error" }, true);
 	return await withRunLock(loaded.manifest, async () => {
+		// R2: re-read inside the lock so recovery + resetTasks reflect committed
+		// state, not the pre-lock snapshot. Between the pre-lock load and lock
+		// acquisition a task may have been cancelled (stale-reconciler) or
+		// completed (background runner); using the stale snapshot would reset
+		// running→queued and re-execute it (double execution: duplicate tokens +
+		// duplicate side effects). Sibling handlers (cancelOrphanedRuns,
+		// reconcileAllStaleRuns) re-read inside the lock for the same reason.
+		const fresh = loadRunManifestById(runCwd, loaded.manifest.runId);
+		const lockedManifest = fresh?.manifest ?? loaded.manifest;
+		const lockedTasks = fresh?.tasks ?? loaded.tasks;
 		const loadedConfig = loadConfig(ctx.cwd);
-		const recovered = recoverCheckpointedTasks(loaded.manifest, loaded.tasks);
+		const recovered = recoverCheckpointedTasks(lockedManifest, lockedTasks);
 		const resumeManifest = recovered.manifest;
 		const executedConfig = {
 			...effectiveRunConfig(loadedConfig.config, params.config),

package/src/runtime/skill-instructions.ts

@@ -135,6 +135,8 @@ interface CachedSkillMarkdown {
 	path: string;
 	source: "project" | "package" | "project-pi" | "user-pi" | "project-agents" | "user-agents";
 	content: string;
+	/** Pre-computed compacted body (frontmatter stripped + truncated). Cached to avoid re-compaction on every render. */
+	compacted: string;
 	mtimeMs: number;
 	size: number;
 }
@@ -173,6 +175,7 @@ function readSkillMarkdown(
 			path: string;
 			source: "project" | "package" | "project-pi" | "user-pi" | "project-agents" | "user-agents";
 			content: string;
+			compacted: string;
 	  }
 	| undefined {
 	if (!isValidSkillName(name)) return undefined;
@@ -188,10 +191,12 @@ function readSkillMarkdown(
 			if (fs.lstatSync(contained).isSymbolicLink()) continue;
 			const filePath = resolveRealContainedPath(entry.root, relative);
 			const stat = fs.statSync(filePath);
+			const rawContent = fs.readFileSync(filePath, "utf-8");
 			return rememberSkill(cacheKey, {
 				path: filePath,
 				source: entry.source,
-				content: fs.readFileSync(filePath, "utf-8"),
+				content: rawContent,
+				compacted: compactSkillContent(rawContent),
 				mtimeMs: stat.mtimeMs,
 				size: stat.size,
 			});
@@ -296,7 +301,7 @@ export function renderSkillInstructions(
 		]
 			.filter(Boolean)
 			.join("\n");
-		const rawContent = compactSkillContent(loaded.content);
+		const rawContent = loaded.compacted;
 		// Wrap skill content with provenance markers to help LLMs distinguish skill instructions
 		const wrappedContent = `<!-- skill: ${safeName} -->\n${rawContent}\n<!-- end-skill: ${safeName} -->`;
 		const section = `${header}\n\n${wrappedContent}`;

package/src/runtime/task-runner/prompt-builder.ts

@@ -75,6 +75,64 @@ export function renderOutputSchemaBlock(outputSchema: TaskOutputSchema): string
 	return lines.join("\n");
 }
 
+/**
+ * Expensive async sub-results that compose the stable prefix.
+ * These are cached per (cwd, step.task, runId) so parallel siblings
+ * in the same batch reuse them instead of recomputing.
+ */
+export interface StableComponents {
+	treeBlock: string;
+	suggestedFilesBlock: string;
+	knowledgeFragment: string;
+}
+
+const stableComponentCache = new Map<string, StableComponents>();
+
+function stablePrefixCacheKey(task: TeamTaskState, step: WorkflowStep, manifest: TeamRunManifest): string {
+	return `${task.cwd}|${step.task}|${manifest.runId}`;
+}
+
+/**
+ * Clear the stable prefix cache. Called at run end so the module-level cache
+ * (keyed by runId) does not grow unbounded across runs in a long-lived session.
+ * Safe to call at any time; the next compute re-populates lazily.
+ */
+export function clearStablePrefixCache(): void {
+	stableComponentCache.clear();
+}
+
+/**
+ * Compute (or return cached) expensive async sub-results that compose
+ * the stable prefix: workspace tree, file retrieval, knowledge fragment.
+ * Parallel siblings with the same cwd/step/run reuse the cached result.
+ */
+export async function computeStablePrefixComponents(
+	manifest: TeamRunManifest,
+	step: WorkflowStep,
+	task: TeamTaskState,
+	_agent?: AgentConfig,
+): Promise<StableComponents> {
+	const cacheKey = stablePrefixCacheKey(task, step, manifest);
+	const cached = stableComponentCache.get(cacheKey);
+	if (cached) return cached;
+
+	const tree = await buildWorkspaceTree(task.cwd);
+	const treeBlock = tree.rendered ? `# Workspace Structure\n${tree.rendered}` : "";
+
+	const retrieval = await runRetrievalCycle(step.task, manifest.goal, task.cwd);
+	const suggestedFilesBlock = renderSuggestedFilesSection(retrieval);
+
+	const knowledgeFragment = buildKnowledgeFragment(task.cwd, {
+		goal: manifest.goal,
+		taskText: step.task,
+		role: step.role,
+	});
+
+	const components: StableComponents = { treeBlock, suggestedFilesBlock, knowledgeFragment };
+	stableComponentCache.set(cacheKey, components);
+	return components;
+}
+
 export interface RenderedTaskPrompt {
 	/** Stable sections that rarely change between tasks of the same role/cwd. */
 	stablePrefix: string;
@@ -90,23 +148,16 @@ export async function renderTaskPrompt(
 	task: TeamTaskState,
 	agent?: AgentConfig,
 	skillBlock = "",
+	precomputedStableComponents?: StableComponents,
 ): Promise<RenderedTaskPrompt> {
 	const memoryBlock = agent?.memory
 		? buildMemoryBlock(agent.name, agent.memory, task.cwd, Boolean(agent.tools?.some((tool) => tool === "write" || tool === "edit")))
 		: "";
 
-	// Build workspace tree for stable context
-	const tree = await buildWorkspaceTree(task.cwd);
-	const treeBlock = tree.rendered ? `# Workspace Structure\n${tree.rendered}` : "";
-
-	// M3: run iterative file-retrieval AFTER the workspace tree is
-	// assembled and BEFORE the dynamic suffix is built, so the suggested
-	// files section lands in the stable prefix (next to the tree) and
-	// is visible to the worker before they start on the task. Never
-	// throws — the orchestrator falls back to in-memory heuristic when
-	// ripgrep is not installed.
-	const retrieval = await runRetrievalCycle(step.task, manifest.goal, task.cwd);
-	const suggestedFilesBlock = renderSuggestedFilesSection(retrieval);
+	// Use precomputed or cached stable components when available, avoiding
+	// redundant workspace tree, file retrieval, and knowledge fragment
+	// computation for parallel siblings in the same batch.
+	const stableComponents = precomputedStableComponents ?? (await computeStablePrefixComponents(manifest, step, task, agent));
 
 	// Stable prefix: role instructions, coordination, workspace tree — rarely changes
 	const stablePrefix = [
@@ -131,20 +182,16 @@ export async function renderTaskPrompt(
 		"",
 		coordinationBridgeInstructions(task),
 		"",
-		treeBlock,
+		stableComponents.treeBlock,
 		"",
-		suggestedFilesBlock,
+		stableComponents.suggestedFilesBlock,
 		"",
 		toolGuidanceBlock(agent),
 		"",
 		// O4: project knowledge (.crew/knowledge.md) — workers don't load the
 		// pi-crew extension (spawned with --no-extensions), so before_agent_start
 		// never fires for them. Inject here so every worker sees project knowledge.
-		buildKnowledgeFragment(task.cwd, {
-			goal: manifest.goal,
-			taskText: step.task,
-			role: step.role,
-		}),
+		stableComponents.knowledgeFragment,
 	]
 		.filter(Boolean)
 		.join("\n");

package/src/runtime/task-runner.ts

@@ -7,6 +7,7 @@ import { errors } from "../errors.ts";
 import { appendHookEvent, executeHook } from "../hooks/registry.ts";
 import { writeArtifact } from "../state/artifact-store.ts";
 import { appendEventAsync, appendEventBuffered, appendEventFireAndForget } from "../state/event-log.ts";
+import { withRunLockSync } from "../state/locks.ts";
 import { saveRunManifest } from "../state/state-store.ts";
 import { createTaskClaim } from "../state/task-claims.ts";
 import type {
@@ -158,6 +159,10 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 		} as TeamTaskState;
 		let tasks = updateTask(input.tasks, task);
 		const runtimeKind = input.taskRuntimeOverride ?? input.runtimeKind ?? (input.executeWorkers ? "child-process" : "scaffold");
+		// A1-F7: Pre-compute whether yield-event collection is needed. For child-process
+		// workers (the common case) this is always false, so we skip allocating/accumulating
+		// collectedJsonEvents entirely — eliminating ~10KB memory waste per task.
+		const collectYieldEvents = runtimeKind !== "child-process" && (input.runtimeConfig?.yield?.enabled ?? DEFAULT_YIELD_CONFIG.enabled);
 		// FIX: Check signal before persisting state — if cancelled, skip the write.
 		if (input.signal?.aborted) {
 			const cancelReason = cancellationReasonFromSignal(input.signal);
@@ -293,7 +298,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 		let finalStdout = "";
 		let transcriptPath: string | undefined;
 		let terminalEvidence: OperationTerminalEvidence[] = [];
-		const collectedJsonEvents: Record<string, unknown>[] = [];
+		const collectedJsonEvents: Record<string, unknown>[] | undefined = collectYieldEvents ? [] : undefined;
 
 		let startupEvidence = createStartupEvidence({
 			command: runtimeKind === "child-process" ? "pi" : runtimeKind === "live-session" ? "live-session" : "safe-scaffold",
@@ -502,9 +507,9 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 						// Errors are logged but processing continues so subsequent events still update state.
 						try {
 							appendCrewAgentEvent(manifest, task.id, event);
-							if (event && typeof event === "object" && !Array.isArray(event))
+							if (collectedJsonEvents && event && typeof event === "object" && !Array.isArray(event))
 								collectedJsonEvents.push(event as Record<string, unknown>);
-							if (collectedJsonEvents.length > 1000) {
+							if (collectedJsonEvents && collectedJsonEvents.length > 1000) {
 								collectedJsonEvents.splice(0, collectedJsonEvents.length - 1000);
 							}
 							// Accumulate lifetime usage via message_end events (survives compaction)
@@ -878,8 +883,8 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 		// only applies to live-session workers where submit_result is injected by the
 		// runtime. Skipping yield detection for child-process prevents every child
 		// worker from incorrectly being marked needs_attention.
-		const yieldEnabled = runtimeKind !== "child-process" && (input.runtimeConfig?.yield?.enabled ?? DEFAULT_YIELD_CONFIG.enabled);
-		if (yieldEnabled && collectedJsonEvents.length > 0) {
+		const yieldEnabled = collectYieldEvents;
+		if (yieldEnabled && collectedJsonEvents && collectedJsonEvents.length > 0) {
 			if (hasYieldInOutput(collectedJsonEvents)) {
 				const yieldEvent = collectedJsonEvents.find((e) => isYieldEvent(e));
 				if (yieldEvent) {
@@ -1190,8 +1195,16 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 				...(patchArtifact ? [patchArtifact] : []),
 			],
 		};
-		saveRunManifest(manifest);
-		tasks = persistSingleTaskUpdate(manifest, tasks, task);
+		// NEW-C3: persist manifest + tasks atomically under the run lock. Without this,
+		// the unlocked saveRunManifest here races with the team-runner batch merge path
+		// (which writes the manifest under withRunLock) — a parallel batch could read a
+		// stale manifest and overwrite this task's freshly-written artifacts, silently
+		// losing them. persistSingleTaskUpdate is re-entrance-safe (runLockHeldByUs guard),
+		// so nesting it inside this lock is a no-op re-acquire, not a deadlock.
+		withRunLockSync(manifest, () => {
+			saveRunManifest(manifest);
+			tasks = persistSingleTaskUpdate(manifest, tasks, task);
+		});
 		upsertCrewAgent(manifest, recordFromTask(manifest, task, runtimeKind));
 		// Execute task_result hook before emitting terminal event
 		const hookReport = await executeHook("task_result", {

package/src/runtime/team-runner.ts

@@ -44,6 +44,7 @@ import { recordsForMaterializedTasks } from "./task-display.ts";
 import { buildExecutionPlan as buildDagExecutionPlan, getReadyTasks as getDagReadyTasks, type TaskNode } from "./task-graph.ts";
 import { buildTaskGraphIndex, refreshTaskGraphQueues, taskGraphSnapshot } from "./task-graph-scheduler.ts";
 import { aggregateTaskOutputs } from "./task-output-context.ts";
+import { clearStablePrefixCache, computeStablePrefixComponents } from "./task-runner/prompt-builder.ts";
 import { runTeamTask } from "./task-runner.ts";
 import { mergeArtifacts } from "./team-runner-artifacts.ts";
 import { clearTrackedTaskUsage } from "./usage-tracker.ts";
@@ -264,6 +265,15 @@ function shouldMergeTaskUpdate(current: TeamTaskState, updated: TeamTaskState):
 	// but completed is the success terminal state and should not be reachable from
 	// failed via a stale merge. The check above only guards non-terminal→terminal.
 	if (current.status === "failed" && updated.status === "completed") return false;
+	// Mirror that guard for the other dangerous terminal→terminal flips (reverse
+	// audit CANCEL-3 + F3): a cancelled task must not be resurrected to completed,
+	// and a completed task must not be demoted to failed, by a stale worker merge.
+	// The task transition table (contracts.ts) only permits terminal→queued
+	// (retry); these flips are always stale results. A worker that completed after
+	// the task was cancelled, or a stale failed result arriving after completion,
+	// must not flip a settled terminal status.
+	if (current.status === "cancelled" && updated.status === "completed") return false;
+	if (current.status === "completed" && updated.status === "failed") return false;
 	// Guard: when current is "running" but has resultArtifact (another worker already
 	// completed it), a stale updated with status="running" and no resultArtifact
 	// must not overwrite the actual completed state.
@@ -715,7 +725,6 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 			);
 		stopTeamHeartbeat();
 		resolveRunPromise(manifest.runId, result);
-		cleanupUsage();
 		// Terminate live agents for this run — agents are done when the run ends.
 		void terminateLiveAgentsForRun(manifest.runId, "completed", appendEvent, manifest.eventsPath).catch((error) =>
 			logInternalError("team-runner.completed.terminate", error, `runId=${manifest.runId}`),
@@ -817,7 +826,6 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 			runId: manifest.runId,
 			data: { status: manifest.status, error: message },
 		});
-		cleanupUsage();
 		// M7: flush buffered events before returning on the error path so the
 		// final buffered progress events are durable alongside the failure state.
 		await flushEventLogBuffer();
@@ -830,6 +838,16 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 		// still has its own flush for M7 backward compat — flushEventLogBuffer
 		// is idempotent on an empty queue.
 		await flushEventLogBuffer();
+		// A2-F1: clear tracked usage for this run's tasks. Consolidated in finally
+		// (previously duplicated on the success + error paths) so cleanup is
+		// guaranteed on EVERY exit path — a future throw in the success tail or
+		// error handler can no longer leak entries. Safe to run last: nothing in
+		// team-runner reads usage after the run resolves, and the TUI widget reads
+		// live usage only while a task is running (before this point).
+		cleanupUsage();
+		// NEW-M1: clear the stable-prefix cache (keyed by runId) so it does not
+		// grow unbounded across runs in a long-lived session.
+		clearStablePrefixCache();
 	}
 }
 
@@ -1196,6 +1214,26 @@ async function executeTeamRunCore(
 			coalescedGroups,
 		);
 
+		// NEW-M1: Pre-warm stable prefix cache for one representative task
+		// per unique cwd. Parallel siblings with the same cwd/step reuse
+		// the cached workspace tree, file retrieval, and knowledge fragment
+		// instead of recomputing them independently (~200-800ms per batch).
+		if (batchTasks.length > 1) {
+			const seenCwds = new Set<string>();
+			await Promise.all(
+				batchTasks
+					.filter((task) => {
+						if (seenCwds.has(task.cwd)) return false;
+						seenCwds.add(task.cwd);
+						return true;
+					})
+					.map((task) => {
+						const step = findStep(workflow, task);
+						return computeStablePrefixComponents(manifest, step, task);
+					}),
+			);
+		}
+
 		const results = await mapConcurrent(dispatchUnits, concurrency.selectedCount, async (unit) => {
 			// M6 real dispatch path: single worker for N tasks.
 			if (unit.kind === "group") {
@@ -1419,7 +1457,18 @@ async function executeTeamRunCore(
 				);
 			}
 		});
-		if (results.length === 0) break;
+		if (results.length === 0) {
+			// F1: results is empty ONLY when every ready task was hook-skipped
+			// (batchTasks -> dispatchUnits empty). The skipped tasks are now terminal,
+			// so their downstream dependents become ready on the next iteration.
+			// Re-loop (continue) instead of breaking: breaking would skip those
+			// downstream tasks and fall through to a false-green "completed" run
+			// with queued tasks left behind. Terminates: each skipped task leaves
+			// "queued", so the queued set strictly shrinks; a stuck graph (ready
+			// empty but queued remain) is caught by the readyBatch.length===0
+			// guard above which marks the run "blocked".
+			continue;
+		}
 		// FIX: Filter out undefined entries from partial results when error occurred
 		// during parallel execution. Other workers may have written partial results
 		// before one threw. Results may be partial - some tasks in-flight at error
@@ -1454,7 +1503,15 @@ async function executeTeamRunCore(
 				"running",
 				"Merged task updates from parallel batch.",
 			);
-			const resultTasks = mergeTaskUpdatesPreservingTerminal(tasks, validResults);
+			// CANCEL-1: use the freshly-loaded disk tasks as the merge base instead
+			// of the in-memory `tasks` closure variable. The in-memory tasks reflect
+			// only team-runner's view; an external cancel (handleCancel, background
+			// race with SIGTERM arriving after cancel wrote but before merge ran)
+			// writes 'cancelled' to disk.tasks — using disk.tasks as base preserves
+			// that cancellation through the merge instead of overwriting it with the
+			// stale in-memory view. disk was loaded inside this lock, so it reflects
+			// the freshest committed state.
+			const resultTasks = mergeTaskUpdatesPreservingTerminal(disk?.tasks ?? tasks, validResults);
 			await saveRunManifestAsync(resultManifest);
 			await saveRunTasksAsync(resultManifest, resultTasks);
 			return { resultManifest, resultTasks };
@@ -1594,8 +1651,24 @@ async function executeTeamRunCore(
 			const message = reason?.message ?? cancelledResult?.manifest.summary ?? "Run cancelled during task execution.";
 			manifest = { ...manifest, status: "running" };
 			manifest = updateRunStatus(manifest, "cancelled", message);
-			await saveRunTasksAsync(manifest, tasks);
-			saveCrewAgents(manifest, recordsForMaterializedTasks(manifest, tasks, runtimeKind));
+			// CANCEL-2: re-cancel non-terminal tasks here, mirroring the batch-loop
+			// cancel check at team-runner.ts:~925. A manifest cancelled mid-merge
+			// (e.g. signal abort during the merge's awaits) would otherwise save
+			// tasks without the cancel applied, leaving status=cancelled but tasks
+			// showing completed/running -- inconsistent and breaks handleRetry's
+			// filter for failed/cancelled tasks. Terminal tasks are NOT clobbered.
+			const cancelMessage = reason ? `${message} (${reason.code})` : message;
+			const reCancelledTasks = tasks.map((task) => {
+				if (task.status !== "queued" && task.status !== "running" && task.status !== "waiting") return task;
+				return {
+					...task,
+					status: "cancelled" as const,
+					finishedAt: new Date().toISOString(),
+					error: cancelMessage,
+				};
+			});
+			await saveRunTasksAsync(manifest, reCancelledTasks);
+			saveCrewAgents(manifest, recordsForMaterializedTasks(manifest, reCancelledTasks, runtimeKind));
 			await saveRunManifestAsync(manifest);
 			await appendEventAsync(manifest.eventsPath, {
 				type: "run.cancelled",
@@ -1604,10 +1677,11 @@ async function executeTeamRunCore(
 				data: {
 					reason,
 					phase: "task-batch",
+
 					cancelledResultRunId: cancelledResult?.manifest.runId,
 				},
 			});
-			return { manifest, tasks };
+			return { manifest, tasks: reCancelledTasks };
 		}
 		queueIndex = buildTaskGraphIndex(tasks);
 		const injectedAfterBatch = attemptAdaptivePlan();
@@ -1717,6 +1791,12 @@ async function executeTeamRunCore(
 		manifest = updateRunStatus(manifest, "blocked", effectivenessDecision?.message ?? "Run effectiveness guard blocked completion.");
 	} else if (blockingDecision) {
 		manifest = updateRunStatus(manifest, "blocked", blockingDecision.message);
+	} else if (tasks.some((task) => task.status === "queued")) {
+		// F1 defense-in-depth: the loop exited with queued tasks still pending
+		// (e.g. a hook skipped all ready tasks and downstream tasks never became
+		// runnable). This is NOT a completed run — mark it blocked rather than
+		// false-green "completed".
+		manifest = updateRunStatus(manifest, "blocked", "Run exited with queued tasks still pending.");
 	} else {
 		manifest = updateRunStatus(
 			manifest,

package/src/state/atomic-write.ts

@@ -449,6 +449,7 @@ function normalizeOptions(arg: unknown): { expectedHash?: string; durability: Wr
 }
 
 export function atomicWriteFile(filePath: string, content: string, options?: AtomicWriteOptions): void {
+	cancelPendingCoalescedWrite(filePath);
 	const { durability } = normalizeOptions(options);
 	if (!isSymlinkSafeDirCached(filePath))
 		throw new Error(`Refusing to write: target is a symlink or inside untrusted directory: ${filePath}`);
@@ -588,6 +589,7 @@ export function atomicWriteFile(filePath: string, content: string, options?: Ato
 }
 
 export async function atomicWriteFileAsync(filePath: string, content: string, options?: AtomicWriteOptions): Promise<void> {
+	cancelPendingCoalescedWrite(filePath);
 	const { durability } = normalizeOptions(options);
 	// Phase 1.5 (RFC 15): when the worker-thread atomic writer is enabled
 	// (PI_CREW_WORKER_ATOMIC_WRITER=1), dispatch to a dedicated worker thread
@@ -754,6 +756,27 @@ function flushOnePendingAtomicWrite(filePath: string): void {
 	}
 }
 
+/**
+ * Cancel any pending coalesced write for `filePath`. An immediate (durable)
+ * write supersedes a pending coalesced (buffered) write — the immediate write
+ * IS the freshest data, so the stale buffered content must not be allowed to
+ * fire later and clobber it.
+ *
+ * Without this, a sequence like persistSingleTaskUpdate (coalesced, 50ms) →
+ * merge saveRunTasksAsync (immediate) leaves the coalesced entry pending; when
+ * its timer fires it overwrites the merge result with a stale single-task
+ * snapshot, losing other workers' results / attempt enrichment / graph
+ * recompute. It also closes the crash window where tasks.json shows "running"
+ * while events.jsonl already shows "completed" (re-run on recovery).
+ */
+function cancelPendingCoalescedWrite(filePath: string): void {
+	const pending = pendingAtomicWrites.get(filePath);
+	if (pending) {
+		clearTimeout(pending.timer);
+		pendingAtomicWrites.delete(filePath);
+	}
+}
+
 /** Flush every queued coalesced write synchronously. Safe to call any time. */
 export function flushPendingAtomicWrites(): void {
 	if (flushInProgress > 0) return;