pi-crew 0.9.67 → 0.10.1

package/src/extension/team-tool/run-intent.ts

@@ -16,6 +16,7 @@ import { allAgents, discoverAgents } from "../../agents/discover-agents.ts";
 import { loadConfig } from "../../config/config.ts";
 import { sanitizeTaskText } from "../../runtime/task-packet.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { loadSpecRecord } from "../../state/stores/spec-store.ts";
 import { allTeams, discoverTeams } from "../../teams/discover-teams.ts";
 import type { TeamConfig } from "../../teams/team-config.ts";
 import { errorMessage } from "../../utils/guards.ts";
@@ -23,6 +24,38 @@ import { logInternalError } from "../../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
 import { allWorkflows, discoverWorkflows } from "../../workflows/discover-workflows.ts";
 import type { WorkflowConfig } from "../../workflows/workflow-config.ts";
+
+/** T4/R6 (ADR-6 §5 + round-1): reject-start reason for strict usage —
+ *  exported for tests. undefined = start allowed. Covers: workflow-level OR
+ *  step-level specStrict without a verifier-role step (per-step flags bypass
+ *  the same no-silent-self-certification rule), DWF (structurally verifier-
+ *  less in v0.10.x), and — when cwd is provided — declared specRefs that
+ *  resolve to nothing at start (fail-closed freeze, round-1 P2). */
+export function specStrictRejectReason(workflow: WorkflowConfig, cwd?: string): string | undefined {
+	const strict = workflow.specStrict === true || workflow.steps.some((s) => s.specStrict === true);
+	if (!strict) return undefined;
+	if (workflow.runtime === "dynamic") {
+		return `Workflow '${workflow.name}' uses specStrict, but dynamic workflows do not support strict spec mode in v0.10.x (ctx.agent() tasks have no verifier-role gate). Drop specStrict for DWF runs (ADR-6 erratum §11).`;
+	}
+	if (!workflow.steps.some((s) => s.role === "verifier")) {
+		return `Workflow '${workflow.name}' enables specStrict (workflow or step level) but has no verifier-role step — strict mode requires independent verification (ADR-6 §5). Add a verifier step or drop specStrict.`;
+	}
+	if (cwd) {
+		// Round-1 P2: fail-closed at START — a strict step whose specRefs resolve
+		// to nothing would otherwise silently degrade to ungated at dispatch.
+		const declared = [...(workflow.specStrict === true ? workflow.steps : workflow.steps.filter((s) => s.specStrict === true))]
+			.flatMap((s) => s.specRefs ?? [])
+			.map((id) => ({ id, resolved: loadSpecRecord(cwd, id) !== undefined }))
+			.filter((x) => !x.resolved);
+		if (declared.length > 0) {
+			return `Workflow '${workflow.name}' is strict but these specRefs resolve to nothing in state/specs (typo, not imported, or corrupted): ${declared
+				.map((x) => x.id)
+				.join(", ")}. Import them first (scripts/spec-import.mjs) or fix the refs (ADR-6 erratum §11).`;
+		}
+	}
+	return undefined;
+}
+
 import { assertCleanLeaderAsync, findGitRootAsync } from "../../worktree/worktree-manager.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
 import type { TeamContext } from "./context.ts";
@@ -274,6 +307,36 @@ export async function validateRunIntent(
 		);
 	}
 
+	// T4/R6 (ADR-6 §5): REJECT-START — a strict-mode workflow without a
+	// verifier-role step fails at start (no silent self-certification).
+	// Non-strict workflows are unaffected.
+	const rejectReason = !directAgent ? specStrictRejectReason(workflow, resolvedCtx.cwd) : undefined;
+	if (rejectReason) {
+		return {
+			kind: "error",
+			result: result(rejectReason, { action: "run", status: "error" }, true),
+		};
+	}
+	// Platform honesty (ADR §4): loud warning — NOT best-effort. Where the
+	// re-run sandbox is unavailable every strict check fails closed.
+	if (!directAgent && workflow.specStrict === true && process.platform !== "linux") {
+		console.warn(
+			`⚠️  [team-tool.run] specStrict is enabled but this platform (${process.platform}) has no unshare -rn equivalent: every strict machine-check will FAIL CLOSED (ADR-6 §4).`,
+		);
+	}
+
+	// WP-8 (R8): model-routing transparency — one pre-run line: resolved
+	// chain + worst-case spawns/task (attemptModels × (maxAttempts+1)).
+	if (!directAgent) {
+		try {
+			// LAZY: defer the routing-pipeline import to run start.
+			const { summarizeModelBudget } = await import("../../runtime/model/model-budget-summary.ts");
+			console.warn(summarizeModelBudget(resolvedCtx.cwd).line);
+		} catch {
+			/* advisory only — never block a run on the summary */
+		}
+	}
+
 	// PREFLIGHT (advisory only, since v0.9.15) — informational notes per the
 	// rule in .crew/knowledge.md "pi-crew USAGE THRESHOLD RULE". Never blocks.
 	if (!directAgent) {

package/src/extension/team-tool/run.ts

@@ -1,8 +1,10 @@
 import { loadConfig } from "../../config/config.ts";
+import { getCrewEnv } from "../../config/env-vars.ts";
 // Heavy runtime — lazy-loaded to avoid 1.4s import cost at extension registration.
 import type { executeTeamRun as ExecuteTeamRunFn } from "../../runtime/team-runner.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { atomicWriteJson } from "../../state/atomic-write.ts";
+import { withRunLockSync } from "../../state/coordination/locks.ts";
 import { registerActiveRun, unregisterActiveRun } from "../../state/stores/active-run-registry.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import { createRunManifest, loadRunManifestById, updateRunStatus } from "../../state/stores/state-store.ts";
@@ -10,6 +12,7 @@ import { createRunManifest, loadRunManifestById, updateRunStatus } from "../../s
 // eslint-disable-next-line @typescript-eslint/no-unused-vars -- type-only import for TS inference
 const _typeCheck: typeof ExecuteTeamRunFn = null as never as typeof ExecuteTeamRunFn;
 
+import { fsFailureLabel } from "../../utils/fs-errno.ts";
 import { errorMessage } from "../../utils/guards.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
@@ -99,7 +102,7 @@ function tailFile(filePath: string, maxBytes = 4096): string | undefined {
 }
 
 function scheduleBackgroundEarlyExitGuard(cwd: string, runId: string, pid: number | undefined, logPath: string): void {
-	if (process.env.PI_CREW_ASYNC_EARLY_EXIT_GUARD === "0") return;
+	if (getCrewEnv("PI_CREW_ASYNC_EARLY_EXIT_GUARD") === "0") return;
 	const timer = setTimeout(() => {
 		const loaded = loadRunManifestById(cwd, runId);
 		if (!loaded || !isActiveRunStatus(loaded.manifest.status)) return;
@@ -112,15 +115,38 @@ function scheduleBackgroundEarlyExitGuard(cwd: string, runId: string, pid: numbe
 			return;
 		const liveness = checkProcessLiveness(pid);
 		if (liveness.alive) return;
-		const tail = tailFile(logPath);
-		const message = `Background runner exited within 3s; see background.log${tail ? `\n${tail}` : ""}`;
-		const failed = updateRunStatus(loaded.manifest, "failed", "Background runner exited within 3s; see background.log");
-		void appendEventAsync(failed.eventsPath, {
-			type: "async.failed",
-			runId: failed.runId,
-			message,
-			data: { pid, detail: liveness.detail },
-		});
+		// R14-3 (Round 14): stale-snapshot RMW — the failed-status write used the
+		// pre-lock `loaded` snapshot, so a concurrent non-terminal write (e.g.
+		// runtime.resolved) could be clobbered. Re-read fresh inside the run lock
+		// and re-verify the guard checks so a run that completed/cancelled since
+		// the initial load is not flipped to failed.
+		try {
+			withRunLockSync(loaded.manifest, () => {
+				const fresh = loadRunManifestById(cwd, runId);
+				if (!fresh) return;
+				if (!isActiveRunStatus(fresh.manifest.status)) return;
+				if (hasAsyncStartMarker(fresh.manifest)) return;
+				if (
+					readEventsCursor(fresh.manifest.eventsPath).events.some(
+						(event) => event.type === "async.started" || event.type === "async.completed" || event.type === "async.failed",
+					)
+				)
+					return;
+				const tail = tailFile(logPath);
+				const message = `Background runner exited within 3s; see background.log${tail ? `\n${tail}` : ""}`;
+				const failed = updateRunStatus(fresh.manifest, "failed", "Background runner exited within 3s; see background.log");
+				void appendEventAsync(failed.eventsPath, {
+					type: "async.failed",
+					runId: failed.runId,
+					message,
+					data: { pid, detail: liveness.detail },
+				});
+			});
+		} catch (error) {
+			// One-shot unref'd timer — a lock-contention error must not escape and
+			// crash the process; the owning session's poll will surface the failure.
+			logInternalError("team-tool.run.earlyExitGuard", error instanceof Error ? error : new Error(String(error)), `runId=${runId}`);
+		}
 	}, 3000);
 	timer.unref();
 }
@@ -255,8 +281,12 @@ function formatRunResult(manifest: TeamRunManifest, options: FormatRunResultOpti
 			}
 			const shortResult = resultExcerpt.slice(0, 500);
 			const statusTag = task.status === "completed" ? "✓" : task.status === "failed" ? "✗" : task.status === "cancelled" ? "⊘" : "·";
+			// bug-026 sub-issue B: surface the classified fatal-fs cause in the
+			// final report — "failed (disk full)" instead of a bare "failed".
+			const statusText =
+				task.status === "failed" && task.failureCause ? `${task.status} (${fsFailureLabel(task.failureCause)})` : task.status;
 			taskLines.push(
-				`- ${statusTag} ${task.id} [${task.role}]: ${task.status}${shortResult ? " — " + shortResult : ""}${task.error ? ` | Error: ${task.error.slice(0, 200)}` : ""}`,
+				`- ${statusTag} ${task.id} [${task.role}]: ${statusText}${shortResult ? " — " + shortResult : ""}${task.error ? ` | Error: ${task.error.slice(0, 200)}` : ""}`,
 			);
 			if (task.status === "failed" || task.status === "needs_attention") {
 				failedCount++;
@@ -471,7 +501,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	const runtime = await resolveCrewRuntime(executedConfig);
 	const runtimeResolution = runtimeResolutionState(runtime);
 	// DEBUG: log what we received (gated to avoid stdout pollution in production)
-	if (process.env.PI_CREW_DEBUG_BUDGET === "1") {
+	if (getCrewEnv("PI_CREW_DEBUG_BUDGET") === "1") {
 		console.log(
 			"[DEBUG budget] params keys:",
 			Object.keys(params),
@@ -558,8 +588,8 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 					diagnostics: {
 						requestedMode: effectiveRuntime.requestedMode,
 						workersDisabled: executedConfig.executeWorkers === false,
-						envCrew: process.env.PI_CREW_EXECUTE_WORKERS,
-						envTeams: process.env.PI_TEAMS_EXECUTE_WORKERS,
+						envCrew: getCrewEnv("PI_CREW_EXECUTE_WORKERS"),
+						envTeams: getCrewEnv("PI_TEAMS_EXECUTE_WORKERS"),
 					},
 				},
 			});
@@ -570,7 +600,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 					`Runtime: ${effectiveRuntime.kind} (requested ${effectiveRuntime.requestedMode})`,
 					`Reason: ${effectiveRuntime.reason ?? "unknown"}`,
 					`Config: executeWorkers=${executedConfig.executeWorkers ?? "<default>"}, runtime.mode=${executedConfig.runtime?.mode ?? "<default>"}`,
-					`Env: PI_CREW_EXECUTE_WORKERS=${process.env.PI_CREW_EXECUTE_WORKERS ?? "<unset>"}, PI_TEAMS_EXECUTE_WORKERS=${process.env.PI_TEAMS_EXECUTE_WORKERS ?? "<unset>"}`,
+					`Env: PI_CREW_EXECUTE_WORKERS=${getCrewEnv("PI_CREW_EXECUTE_WORKERS") ?? "<unset>"}, PI_TEAMS_EXECUTE_WORKERS=${getCrewEnv("PI_TEAMS_EXECUTE_WORKERS") ?? "<unset>"}`,
 				].join("\n"),
 				{
 					action: "run",
@@ -653,8 +683,8 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 				diagnostics: {
 					requestedMode: runtime.requestedMode,
 					workersDisabled: executedConfig.executeWorkers === false,
-					envCrew: process.env.PI_CREW_EXECUTE_WORKERS,
-					envTeams: process.env.PI_TEAMS_EXECUTE_WORKERS,
+					envCrew: getCrewEnv("PI_CREW_EXECUTE_WORKERS"),
+					envTeams: getCrewEnv("PI_TEAMS_EXECUTE_WORKERS"),
 				},
 			},
 		});
@@ -665,7 +695,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 				`Runtime: ${runtime.kind} (requested ${runtime.requestedMode})`,
 				`Reason: ${runtime.reason ?? "unknown"}`,
 				`Config: executeWorkers=${executedConfig.executeWorkers ?? "<default>"}, runtime.mode=${executedConfig.runtime?.mode ?? "<default>"}`,
-				`Env: PI_CREW_EXECUTE_WORKERS=${process.env.PI_CREW_EXECUTE_WORKERS ?? "<unset>"}, PI_TEAMS_EXECUTE_WORKERS=${process.env.PI_TEAMS_EXECUTE_WORKERS ?? "<unset>"}`,
+				`Env: PI_CREW_EXECUTE_WORKERS=${getCrewEnv("PI_CREW_EXECUTE_WORKERS") ?? "<unset>"}, PI_TEAMS_EXECUTE_WORKERS=${getCrewEnv("PI_TEAMS_EXECUTE_WORKERS") ?? "<unset>"}`,
 				"",
 				"To run effective subagents, remove executeWorkers=false / PI_CREW_EXECUTE_WORKERS=0 / PI_TEAMS_EXECUTE_WORKERS=0 or set runtime.mode=child-process.",
 				"Use runtime.mode=scaffold only for explicit dry-run prompt/artifact generation.",

package/src/extension/team-tool/status.ts

@@ -8,6 +8,7 @@ import { checkProcessLiveness, isActiveRunStatus } from "../../runtime/process-s
 import { formatTaskGraphLines, waitingReason } from "../../runtime/task-display.ts";
 import { verifyTaskCompletion } from "../../runtime/verification/completion-guard.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { withRunLockSync } from "../../state/coordination/locks.ts";
 import { readDeliveryState, readMailbox } from "../../state/coordination/mailbox.ts";
 import { appendEvent, readEventsCursor } from "../../state/event-log/event-log.ts";
 import { loadRunManifestById, saveRunTasks, updateRunStatus } from "../../state/stores/state-store.ts";
@@ -38,6 +39,71 @@ function markStaleAsync(runId: string): boolean {
 	return true;
 }
 
+/**
+ * R14-1 (Phase 3.4): the ONLY state mutation on the status read path — the
+ * stale-async transition — executed under the run lock with a FRESH re-read
+ * (respond.ts:43 pattern). handleStatus's `loaded` snapshot is best-effort
+ * (no lock): a concurrent writer can commit a terminal status between that
+ * load and this lock, and `updateRunStatus`'s transition guard would validate
+ * against the STALE status (running→failed legal) and clobber the fresh
+ * terminal state. Inside the lock we re-read and short-circuit when the fresh
+ * state no longer warrants the transition (run gone, async entry gone, status
+ * no longer active, process alive).
+ *
+ * Returns the transitioned manifest+tasks so the caller's read view reflects
+ * the write (same-poll visibility, matching pre-fix behavior), or undefined
+ * when the transition was skipped.
+ *
+ * Exported for unit testing (R14-1 regression: a run that completed on disk
+ * between load and lock must NOT be re-flipped to failed).
+ */
+export function transitionStaleAsyncUnderLock(
+	loaded: NonNullable<ReturnType<typeof loadRunManifestById>>,
+	runCwd: string,
+	runId: string,
+):
+	| {
+			manifest: NonNullable<ReturnType<typeof loadRunManifestById>>["manifest"];
+			tasks: NonNullable<ReturnType<typeof loadRunManifestById>>["tasks"];
+	  }
+	| undefined {
+	let transitioned:
+		| {
+				manifest: NonNullable<ReturnType<typeof loadRunManifestById>>["manifest"];
+				tasks: NonNullable<ReturnType<typeof loadRunManifestById>>["tasks"];
+		  }
+		| undefined;
+	withRunLockSync(loaded.manifest, () => {
+		const fresh = loadRunManifestById(runCwd, runId); // NOTE: inside withRunLockSync - consistent read
+		if (!fresh?.manifest.async || !isActiveRunStatus(fresh.manifest.status)) return;
+		const freshLiveness = checkProcessLiveness(fresh.manifest.async.pid);
+		if (freshLiveness.alive) return;
+		const failed = updateRunStatus(fresh.manifest, "failed", `Async process stale: ${freshLiveness.detail}`);
+		const freshTasks = fresh.tasks.map((task) =>
+			task.status === "running"
+				? {
+						...task,
+						status: "cancelled" as const,
+						finishedAt: new Date().toISOString(),
+						error: "Async process died; task was not completed.",
+					}
+				: task,
+		);
+		saveRunTasks(failed, freshTasks);
+		// async.stale (2026-08-10): sync append (byte-identical to pre-extract
+		// api.ts) so callers reading eventsPath immediately after status see
+		// the event — async fire-and-forget would race.
+		appendEvent(failed.eventsPath, {
+			type: "async.stale",
+			runId: failed.runId,
+			message: freshLiveness.detail,
+			data: { pid: fresh.manifest.async.pid },
+		});
+		transitioned = { manifest: failed, tasks: freshTasks };
+	});
+	return transitioned;
+}
+
 export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	if (!params.runId)
 		return result(
@@ -60,31 +126,23 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 		const liveness = checkProcessLiveness(asyncState.pid);
 		asyncLivenessLine = `Async: pid=${asyncState.pid ?? "unknown"} alive=${liveness.alive ? "true" : "false"} detail=${liveness.detail} log=${asyncState.logPath} spawnedAt=${asyncState.spawnedAt}`;
 		if (!liveness.alive && isActiveRunStatus(manifest.status)) {
-			// H5: only transition once per runId. Repeated status polls of a
-			// dead async run previously re-ran saveRunTasks + sync appendEvent
-			// on every call (~30ms blocking each).
-			if (markStaleAsync(manifest.runId)) {
-				manifest = updateRunStatus(manifest, "failed", `Async process stale: ${liveness.detail}`);
-				tasks = tasks.map((task) =>
-					task.status === "running"
-						? {
-								...task,
-								status: "cancelled" as const,
-								finishedAt: new Date().toISOString(),
-								error: "Async process died; task was not completed.",
-							}
-						: task,
-				);
-				saveRunTasks(manifest, tasks);
-				// async.stale (2026-08-10): sync append (byte-identical to pre-extract
-				// api.ts) so callers reading eventsPath immediately after status see
-				// the event — async fire-and-forget would race.
-				appendEvent(manifest.eventsPath, {
-					type: "async.stale",
-					runId: manifest.runId,
-					message: liveness.detail,
-					data: { pid: asyncState.pid },
-				});
+			// R14-1 (Phase 3.4): ownership gate — a foreign session must NOT
+			// trigger the stale-async transition on a read path; the owning
+			// session's poll handles it. Mirrors handleResume (team-tool.ts R1).
+			// Backward compat: only applies when ownerSessionId is a non-empty
+			// string — legacy runs without an owner are not gated.
+			const foreignRun = typeof manifest.ownerSessionId === "string" && manifest.ownerSessionId !== ctx.sessionId;
+			if (!foreignRun || params.force) {
+				// H5: only transition once per runId. Repeated status polls of a
+				// dead async run previously re-ran saveRunTasks + sync appendEvent
+				// on every call (~30ms blocking each).
+				if (markStaleAsync(manifest.runId)) {
+					const transitioned = transitionStaleAsyncUnderLock(loaded, runCwd, params.runId);
+					if (transitioned) {
+						manifest = transitioned.manifest;
+						tasks = transitioned.tasks;
+					}
+				}
 			}
 		}
 	}
@@ -193,7 +251,7 @@ export function handleStatus(params: TeamToolParamsValue, ctx: TeamContext): PiT
 						`- ${task.id} [${task.status}] ${task.role} -> ${task.agent}${task.taskPacket ? ` scope=${task.taskPacket.scope}` : ""}${task.verification ? ` green=${task.verification.observedGreenLevel}/${task.verification.requiredGreenLevel}` : ""}${task.modelAttempts?.length ? ` attempts=${task.modelAttempts.length}` : ""}${task.modelRouting ? ` modelRouting=${task.modelRouting.requested ? `${task.modelRouting.requested}->` : ""}${task.modelRouting.resolved}${task.modelRouting.usedAttempt ? ` attempt=${task.modelRouting.usedAttempt + 1}` : ""}` : ""}${task.agentProgress?.activityState ? ` activityState=${task.agentProgress.activityState}` : ""}${(() => {
 							const t = extractCommandTrace(task.agentProgress?.recentTools);
 							return t.summary ? ` ${t.summary}` : "";
-						})()}${attentionByTask.get(task.id)?.data?.reason ? ` attention=${String(attentionByTask.get(task.id)?.data?.reason)}` : ""}${task.jsonEvents !== undefined ? ` jsonEvents=${task.jsonEvents}` : ""}${task.usage ? ` usage=${JSON.stringify(task.usage)}` : ""}${task.resultArtifact ? ` result=${task.resultArtifact.path}` : ""}${task.transcriptArtifact ? ` transcript=${task.transcriptArtifact.path}` : ""}${task.worktree ? ` worktree=${task.worktree.path}` : ""}${task.error ? ` error=${task.error}` : ""}`,
+						})()}${attentionByTask.get(task.id)?.data?.reason ? ` attention=${String(attentionByTask.get(task.id)?.data?.reason)}` : ""}${task.jsonEvents !== undefined ? ` jsonEvents=${task.jsonEvents}` : ""}${task.usage ? ` usage=${JSON.stringify(task.usage)}` : ""}${task.resultArtifact ? ` result=${task.resultArtifact.path}` : ""}${task.transcriptArtifact ? ` transcript=${task.transcriptArtifact.path}` : ""}${task.worktree ? ` worktree=${task.worktree.path}` : ""}${task.error ? ` error=${task.error}` : ""}${task.failureCause ? ` failureCause=${task.failureCause}` : ""}`,
 				)
 			: ["- (none)"]),
 		`Task counts: ${[...counts.entries()].map(([status, count]) => `${status}=${count}`).join(", ") || "none"}`,

package/src/extension/team-tool.ts

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import type { AgentConfig } from "../agents/agent-config.ts";
 import { allAgents, discoverAgents, listDynamicAgents, registerDynamicAgent, unregisterDynamicAgent } from "../agents/discover-agents.ts";
 import { loadConfig } from "../config/config.ts";
+import { getCrewEnv } from "../config/env-vars.ts";
 // Heavy runtime — lazy-loaded to avoid 1.4s import cost at extension registration.
 // executeTeamRun is only called when a team run actually executes.
 import type { executeTeamRun as _executeTeamRunFn } from "../runtime/team-runner.ts";
@@ -373,8 +374,8 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 		if (!executedConfig.runtime?.mode && resumeManifest.runtimeResolution?.safety === "explicit_dry_run") {
 			const workersDisabled =
 				executedConfig.executeWorkers === false ||
-				process.env.PI_CREW_EXECUTE_WORKERS === "0" ||
-				process.env.PI_TEAMS_EXECUTE_WORKERS === "0";
+				getCrewEnv("PI_CREW_EXECUTE_WORKERS") === "0" ||
+				getCrewEnv("PI_TEAMS_EXECUTE_WORKERS") === "0";
 			if (!workersDisabled)
 				executedConfig.runtime = {
 					...executedConfig.runtime,
@@ -387,6 +388,14 @@ export async function handleResume(params: TeamToolParamsValue, ctx: TeamContext
 			...resumeManifest,
 			runtimeResolution,
 			updatedAt: new Date().toISOString(),
+			// B1 battery 2026-08-18 (case b root-cause fix): resume ADOPTS the run —
+			// ownerSessionId moves to the resuming session. Pre-fix, a force-resumed
+			// run kept its DEAD original owner id, so any THIRD session's startup
+			// orphan-scan saw "owner no longer exists" and cancelled the live,
+			// freshly-resumed run (observed live: orphan_cancelled 5m into a parked
+			// ask that the resume itself had just dispatched). Same-session resume
+			// is a no-op (id equality).
+			...(ctx.sessionId ? { ownerSessionId: ctx.sessionId } : {}),
 		};
 		await saveRunManifestAsync(runtimeManifest);
 		await appendEventAsync(runtimeManifest.eventsPath, {

package/src/hooks/registry.ts

@@ -23,13 +23,8 @@ export function registerHook(definition: HookDefinition): number {
 	return hookId;
 }
 
-export function clearHooks(): void {
-	registry.clear();
-	_piCrewHookIds.clear();
-	_nextHookId = 1;
-}
-
 // Scope-aware hook clearing: only removes hooks registered by pi-crew
+// (keeps hooks registered by other extensions/hosts intact).
 export function clearHooksScoped(): void {
 	for (const [name, hooks] of registry) {
 		const remaining = hooks.filter((h) => !("_hookId" in h && _piCrewHookIds.has((h as { _hookId?: number })._hookId ?? -1)));

package/src/i18n.ts

@@ -122,6 +122,11 @@ const translations: Record<string, Partial<Record<Key, string>>> = {
 let currentLocale: string | undefined;
 const warnedMissing = new Set<string>();
 
+// R5-L5/MISSED-1 (Round 5): warn-once dedupe Set — bounded naturally by the
+// translation-key count, but cap FIFO so a pathological locale/key space
+// cannot grow it unbounded in a long-lived host process.
+const MAX_WARNED_MISSING = 128;
+
 // --- Helpers ---
 
 function format(template: string, params: Params = {}): string {
@@ -132,6 +137,10 @@ function warnOnce(key: string): void {
 	const tag = `${currentLocale}:${key}`;
 	if (warnedMissing.has(tag)) return;
 	warnedMissing.add(tag);
+	if (warnedMissing.size > MAX_WARNED_MISSING) {
+		const oldest = warnedMissing.values().next().value;
+		if (oldest !== undefined) warnedMissing.delete(oldest);
+	}
 	logInternalError("i18n.missing", new Error(`Missing translation`), `key="${key}" locale="${currentLocale}"`);
 }