pi-crew 0.9.68 → 0.10.2

package/src/extension/team-tool/orchestrate.ts

@@ -4,7 +4,11 @@
  * Parses a plan document and outputs agent chain commands.
  */
 import * as fs from "node:fs";
+import { currentCrewRole, permissionForRole } from "../../runtime/role-permission.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { withRunLock } from "../../state/coordination/locks.ts";
+import { appendPlanRevision } from "../../state/stores/plan-store.ts";
+import { loadRunManifestById, saveRunManifest } from "../../state/stores/state-store.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
 import {
 	buildAgentChain,
@@ -12,7 +16,9 @@ import {
 	type OrchestratedStep,
 	parsePlanDocument,
 	parsePlanDocumentSimple,
+	stepsToPlanRecord,
 } from "../plan-orchestrate.ts";
+import { locateRunCwd } from "../team-tool.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
 import { result, type TeamContext } from "./context.ts";
 
@@ -24,7 +30,7 @@ import { result, type TeamContext } from "./context.ts";
  *
  * Usage: `team action='orchestrate' planPath='/path/to/plan.md'`
  */
-export function handleOrchestrate(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
+export async function handleOrchestrate(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
 	const planPath = params.planPath as string | undefined;
 
 	if (!planPath) {
@@ -67,9 +73,67 @@ export function handleOrchestrate(params: TeamToolParamsValue, ctx: TeamContext)
 	const overview = formatPlanOverview(resolvedPath);
 	const commands = buildAgentChain(steps);
 
+	// T2/R4 (ADR-4 §6 producer 1): persist a PlanRecord when the caller binds
+	// an explicit run. Opt-in: orchestrate emits one `team action='run'` per
+	// step (each creating its OWN run), so silently attaching the record to
+	// "some" run would misattribute linkage. Without runId the action stays
+	// read-only and says so.
+	let planNote = "PlanRecord not persisted (no runId given — pass runId=<runId> to attach a versioned record to that run).";
+	let persisted: { id: string; version: number; items: number } | undefined;
+	const runId = typeof params.runId === "string" && params.runId.trim() ? params.runId.trim() : undefined;
+	if (runId) {
+		// Security (T2 review S1/S2): the persist branch is a run-mutating write.
+		// (a) role gate — read-only workers must NOT plant plan records;
+		// (b) ownership — foreign-session runs require explicit force;
+		// (c) locked read-modify-write + fail-closed tool error (never a throw
+		//     into the caller, never a lost update vs concurrent manifest writers).
+		const role = currentCrewRole();
+		if (role && permissionForRole(role) === "read_only") {
+			return result(
+				`Role '${role}' is read-only and cannot persist a plan record to a run.`,
+				{ action: "orchestrate", status: "error" },
+				true,
+			);
+		}
+		const runCwd = locateRunCwd(runId, ctx.cwd);
+		const loaded = runCwd ? loadRunManifestById(runCwd, runId) : undefined;
+		if (!loaded) {
+			return result(`runId not found: ${runId}`, { action: "orchestrate", status: "error" }, true);
+		}
+		const manifest = loaded.manifest;
+		if (typeof manifest.ownerSessionId === "string" && manifest.ownerSessionId !== ctx.sessionId && params.force !== true) {
+			return result(
+				`Run '${runId}' belongs to another session (owner ${manifest.ownerSessionId.slice(0, 8)}…). Pass force=true to persist anyway.`,
+				{ action: "orchestrate", status: "error", runId },
+				true,
+			);
+		}
+		try {
+			const outcome = await withRunLock(manifest, async () => {
+				const fresh = loadRunManifestById(runCwd as string, runId); // in-lock consistent read
+				if (!fresh) return undefined;
+				const record = stepsToPlanRecord(steps, runId, { title: `Orchestrated: ${planPath}` });
+				appendPlanRevision(fresh.manifest, record);
+				saveRunManifest({
+					...fresh.manifest,
+					updatedAt: new Date().toISOString(),
+					plan: { id: record.id, version: record.version },
+				});
+				return record;
+			});
+			if (!outcome) return result(`runId not found: ${runId}`, { action: "orchestrate", status: "error" }, true);
+			persisted = { id: outcome.id, version: outcome.version, items: outcome.items.length };
+			planNote = `PlanRecord persisted to run ${runId}: v${outcome.version} (${outcome.items.length} item(s)) — team action='plans' runId='${runId}' to inspect.`;
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return result(`PlanRecord persistence failed: ${message}`, { action: "orchestrate", status: "error", runId }, true);
+		}
+	}
+
 	const outputLines: string[] = [
 		`Plan: ${resolvedPath}`,
 		`Steps: ${steps.length}`,
+		planNote,
 		"",
 		"# Agent Chain Commands",
 		"",
@@ -86,6 +150,7 @@ export function handleOrchestrate(params: TeamToolParamsValue, ctx: TeamContext)
 			planPath: resolvedPath,
 			stepCount: steps.length,
 			commands,
+			persisted,
 			steps: steps.map((sqs) => ({
 				stepId: sqs.stepId,
 				tag: sqs.tag,

package/src/extension/team-tool/plans.ts

@@ -0,0 +1,192 @@
+/**
+ * T2/R4 (ADR-4 §7, erratum D-1) — `team action='plans'` handler.
+ *
+ * Read sub-actions (get/list/diff) render the revision list at
+ * `<stateRoot>/plans/plans.json` with DERIVED per-item progress. Mutating
+ * sub-actions (approve/reject) delegate to the existing api plan-approval ops
+ * (approve-plan / cancel-plan), which already dual-write manifest + record
+ * (ADR-4 §8) — one approval implementation, no drift.
+ *
+ * Usage:
+ *   team action='plans' runId='<id>'                     → get (current rev)
+ *   team action='plans' runId='<id>' config='{subAction:"get", rev:2}'
+ *   team action='plans' runId='<id>' config='{subAction:"list"}'
+ *   team action='plans' runId='<id>' config='{subAction:"diff", a:1, b:2}'
+ *   team action='plans' runId='<id>' config='{subAction:"approve"}' | reject
+ */
+import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
+import { deriveItemProgress, getCurrentPlanRecord, loadPlanRecords } from "../../state/stores/plan-store.ts";
+import { loadRunManifestById } from "../../state/stores/state-store.ts";
+import type { PlanItemRecord, PlanRecord, TeamTaskState } from "../../state/types.ts";
+import { handleTeamTool, locateRunCwd } from "../team-tool.ts";
+import type { PiTeamsToolResult } from "../tool-result.ts";
+import { result, type TeamContext } from "./context.ts";
+
+const RUN_NOT_FOUND_HINT = "Use team action='list' to discover runs.";
+
+function renderRecord(record: PlanRecord, tasks: TeamTaskState[]): string {
+	const progress = deriveItemProgress(record, tasks);
+	const lines: string[] = [];
+	lines.push(`Plan ${record.id} v${record.version}${record.revisionOf ? ` (revision of v${record.revisionOf.version})` : ""}`);
+	lines.push(`Title: ${record.title}`);
+	lines.push(`Run: ${record.runId} · created ${record.createdAt}${record.authorTaskId ? ` · author task ${record.authorTaskId}` : ""}`);
+	if (record.approval) {
+		lines.push(
+			`Approval: ${record.approval.status} (v${record.approval.planVersion}${record.approval.by ? ` by ${record.approval.by}` : ""} at ${record.approval.at})`,
+		);
+	}
+	lines.push("");
+	for (const phase of record.phases) {
+		lines.push(`[${phase.status}] Phase ${phase.id} — ${phase.title} (${phase.itemIds.length} item(s))`);
+		for (const itemId of phase.itemIds) {
+			const item = record.items.find((i: PlanItemRecord) => i.id === itemId);
+			if (!item) continue;
+			const p = progress.get(item.id);
+			const prog =
+				p && p.total > 0
+					? ` · ${p.done}/${p.total} done${p.failed ? `, ${p.failed} failed` : ""}${p.running ? `, ${p.running} running` : ""}`
+					: "";
+			lines.push(`  - [${item.status}] ${item.id}: ${item.title}${prog}`);
+			if (item.taskIds.length > 0) lines.push(`      tasks: ${item.taskIds.join(", ")}`);
+			if (item.acceptance.length > 0) lines.push(`      acceptance: ${item.acceptance.join("; ")}`);
+		}
+	}
+	return lines.join("\n");
+}
+
+interface PlanDiff {
+	added: string[];
+	removed: string[];
+	dropped: string[];
+	statusChanged: Array<{ id: string; from: string; to: string }>;
+	retitled: Array<{ id: string; from: string; to: string }>;
+}
+
+function diffRecords(a: PlanRecord, b: PlanRecord): PlanDiff {
+	const aById = new Map(a.items.map((i) => [i.id, i]));
+	const bById = new Map(b.items.map((i) => [i.id, i]));
+	const diff: PlanDiff = { added: [], removed: [], dropped: [], statusChanged: [], retitled: [] };
+	for (const [id, item] of bById) {
+		const prior = aById.get(id);
+		if (!prior) {
+			diff.added.push(id);
+			continue;
+		}
+		if (prior.status !== item.status) diff.statusChanged.push({ id, from: prior.status, to: item.status });
+		if (prior.title !== item.title) diff.retitled.push({ id, from: prior.title, to: item.title });
+		if (item.status === "dropped" && prior.status !== "dropped") diff.dropped.push(id);
+	}
+	for (const id of aById.keys()) if (!bById.has(id)) diff.removed.push(id);
+	return diff;
+}
+
+function renderDiff(a: PlanRecord, b: PlanRecord): string {
+	const diff = diffRecords(a, b);
+	const lines = [
+		`Diff v${a.version} → v${b.version} (${a.id})`,
+		`  added:         ${diff.added.length ? diff.added.join(", ") : "—"}`,
+		`  removed:       ${diff.removed.length ? diff.removed.join(", ") : "—"}`,
+		`  dropped:       ${diff.dropped.length ? diff.dropped.join(", ") : "—"}`,
+		`  status change: ${diff.statusChanged.length ? diff.statusChanged.map((s) => `${s.id} ${s.from}→${s.to}`).join(", ") : "—"}`,
+		`  retitled:      ${diff.retitled.length ? diff.retitled.map((s) => `${s.id}`).join(", ") : "—"}`,
+	];
+	if (diff.added.length + diff.removed.length + diff.dropped.length + diff.statusChanged.length + diff.retitled.length === 0) {
+		lines.push("  (no item-level changes)");
+	}
+	return lines.join("\n");
+}
+
+export async function handlePlans(params: TeamToolParamsValue, ctx: TeamContext): Promise<PiTeamsToolResult> {
+	const subAction = (typeof params.subAction === "string" && params.subAction.trim() ? params.subAction.trim() : "get") as
+		| "get"
+		| "list"
+		| "diff"
+		| "approve"
+		| "reject";
+	const runId = typeof params.runId === "string" && params.runId.trim() ? params.runId.trim() : "";
+	if (!runId) return result("plans requires runId.", { action: "plans", status: "error" }, true);
+	const runCwd = locateRunCwd(runId, ctx.cwd);
+	const loaded = runCwd ? loadRunManifestById(runCwd, runId) : undefined;
+	if (!loaded) return result(`Run '${runId}' not found.${RUN_NOT_FOUND_HINT}`, { action: "plans", status: "error" }, true);
+	const { manifest, tasks } = loaded;
+
+	// Mutating sub-actions delegate to the api plan-approval ops (single
+	// implementation of the dual-write + permission checks).
+	if (subAction === "approve" || subAction === "reject") {
+		return await handleTeamTool(
+			{
+				action: "api",
+				runId,
+				config: { operation: subAction === "approve" ? "approve-plan" : "cancel-plan" },
+			},
+			// Forward the FULL caller context (sessionId etc.) so the delegated ops
+			// can enforce ownership checks now or in a future train (review S3) —
+			// only the cwd is overridden to the owning run's location.
+			{ ...ctx, cwd: runCwd ?? ctx.cwd },
+		);
+	}
+
+	const revisions = loadPlanRecords(manifest);
+	if (revisions.length === 0) {
+		// ADR-4 §2 fallback: pre-v2 run — degrade gracefully, manifest gate info.
+		const gate = manifest.planApproval;
+		return result(
+			`Run '${runId}' has no plan record (pre-v2 run).${gate ? ` Manifest gate: ${gate.status}${gate.required ? " (required)" : ""}.` : ""}`,
+			{ action: "plans", status: "ok", runId },
+		);
+	}
+
+	if (subAction === "list") {
+		const lines = revisions.map(
+			(r) =>
+				`v${r.version} · ${r.createdAt} · ${r.items.length} item(s), ${r.items.filter((i) => i.status === "dropped").length} dropped · ${r.title}` +
+				(r.approval ? ` · approval ${r.approval.status}` : ""),
+		);
+		const current = manifest.plan ? ` (current: v${manifest.plan.version})` : " (current: highest — no manifest pointer)";
+		return result(`Plan revisions for ${runId}${current}:\n${lines.join("\n")}`, {
+			action: "plans",
+			status: "ok",
+			runId,
+			data: { revisions: revisions.length, current: manifest.plan?.version ?? revisions[revisions.length - 1]?.version },
+		});
+	}
+
+	if (subAction === "diff") {
+		const a = typeof params.a === "number" ? params.a : Number(params.a);
+		const b = typeof params.b === "number" ? params.b : Number(params.b);
+		if (!Number.isFinite(a) || !Number.isFinite(b)) {
+			return result(
+				"diff requires numeric revision params: config='{subAction:\"diff\", a:1, b:2}'.",
+				{ action: "plans", status: "error" },
+				true,
+			);
+		}
+		const recA = revisions.find((r) => r.version === a);
+		const recB = revisions.find((r) => r.version === b);
+		if (!recA || !recB) {
+			return result(
+				`Revision(s) not found: available versions are ${revisions.map((r) => `v${r.version}`).join(", ")}.`,
+				{ action: "plans", status: "error" },
+				true,
+			);
+		}
+		return result(renderDiff(recA, recB), { action: "plans", status: "ok", runId, data: { a, b } });
+	}
+
+	// get (default)
+	const rev = params.rev === undefined ? undefined : Number(params.rev);
+	const record = rev === undefined || Number.isNaN(rev) ? getCurrentPlanRecord(manifest) : revisions.find((r) => r.version === rev);
+	if (!record) {
+		return result(
+			`Revision v${rev} not found: available versions are ${revisions.map((r) => `v${r.version}`).join(", ")}.`,
+			{ action: "plans", status: "error" },
+			true,
+		);
+	}
+	return result(renderRecord(record, tasks), {
+		action: "plans",
+		status: "ok",
+		runId,
+		data: { planId: record.id, version: record.version, items: record.items.length },
+	});
+}

package/src/extension/team-tool/respond.ts

@@ -1,9 +1,12 @@
+import { renderAskAnswer } from "../../prompt/prompt-runtime.ts";
 import { readCrewAgents, recordFromTask, saveCrewAgents } from "../../runtime/crew-agent-records.ts";
+import { isWaitingWorkerAlive } from "../../runtime/dispatch-batch.ts";
 import type { TeamToolParamsValue } from "../../schema/team-tool-schema.ts";
 import { withRunLockSync } from "../../state/coordination/locks.ts";
-import { appendMailboxMessage, updateMailboxMessageReply } from "../../state/coordination/mailbox.ts";
+import { appendMailboxMessage, readMailbox, updateMailboxMessageReply } from "../../state/coordination/mailbox.ts";
 import { appendEventAsync } from "../../state/event-log/event-log.ts";
-import { loadRunManifestById, saveRunTasks, updateRunStatus } from "../../state/stores/state-store.ts";
+import { loadRunManifestById, saveRunManifest, saveRunTasks, updateRunStatus } from "../../state/stores/state-store.ts";
+import type { TeamTaskState } from "../../state/types.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { locateRunCwd } from "../team-tool.ts";
 import type { PiTeamsToolResult } from "../tool-result.ts";
@@ -11,10 +14,61 @@ import { result, type TeamContext } from "./context.ts";
 import { paramRequired } from "./param-error.ts";
 import { RUN_NOT_FOUND_HINT } from "./run-not-found.ts";
 
+/** WP-2/R2 (ADR-0 item 8/security P1-4): fence the injected ask answer as
+ *  untrusted when it is replayed into the next dispatch prompt via the
+ *  `pendingSteers` cross-attempt channel. The mailbox is a same-uid
+ *  unauthenticated channel — raw answer text is never injected without the
+ *  dependency-context fence. */
+/** Re-queue a waiting task for durable scheduler resume. Optionally carries an
+ *  injected note (the fenced ask answer / timeout note) on the pendingSteers
+ *  cross-attempt channel — child-executor re-appends pendingSteers into the
+ *  next worker incarnation's steering file, and registerLiveAgent drains them
+ *  for the live-session runtime. The park marker (`waiting`) is cleared: a
+ *  requeued task must not stay parked (mirrors applyRecoveryPlan discipline). */
+function requeueWaitingTask(tasks: TeamTaskState[], taskId: string, message: string, injection?: string): TeamTaskState[] {
+	return tasks.map((task) => {
+		if (task.id !== taskId) return task;
+		return {
+			...task,
+			status: "queued" as const,
+			startedAt: undefined,
+			finishedAt: undefined,
+			error: undefined,
+			waiting: undefined,
+			adaptive: {
+				...task.adaptive,
+				phase: "resumed",
+				task: message || task.adaptive?.task || "",
+			},
+			...(injection ? { pendingSteers: [...(task.pendingSteers ?? []), injection] } : {}),
+		};
+	});
+}
+
 /**
- * Handle `respond` action: send a message to a waiting (interactive) task.
- * The task must be in "waiting" status. The message is stored in the task's
- * mailbox and the task is re-queued for durable scheduler resume.
+ * Handle `respond` action: answer a waiting (parked) task's question.
+ *
+ * WP-2/R2 (ADR-0 docs/decisions/2026-08-17-waiting-producer-ask.md item 8):
+ * liveness discrimination replaces the old blanket re-queue of ALL waiting
+ * tasks.
+ * - ALIVE (heartbeat last-beat within the 60s gradient-stale window, or a
+ *   live in-memory session handle) → append a mailbox `kind:"response"`
+ *   entry carrying the task's `waiting.questionId` (from leader, to the task)
+ *   and LEAVE `task.waiting` in place: the parked `ask` tool polls the task
+ *   mailbox stream, picks the response up and flips waiting→running via its
+ *   own terminal report.
+ * - DEAD → re-queue the task AND inject the fenced answer into the next
+ *   dispatch prompt (pendingSteers cross-attempt channel). No questionId-
+ *   tagged mailbox response is written.
+ * - EXACTLY-ONE-DISPATCH GUARD: a response for a given questionId dispatches
+ *   via mailbox-write OR requeue+inject — never both — and is idempotent per
+ *   questionId. The branch is atomic under the run lock (check + write inside
+ *   one withRunLockSync + fresh-reload critical section); the requeue path
+ *   clears `waiting` so a second respond finds no waiting task (no-op).
+ * - Legacy waiting parks without `task.waiting` (pre-v2 records) keep the old
+ *   mailbox + re-queue resume behavior — there is no parked tool to pick a
+ *   questionId-tagged response up.
+ * - `ask.answered` is emitted on both discrimination paths.
  */
 export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): PiTeamsToolResult {
 	if (!params.runId)
@@ -80,24 +134,78 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 			);
 		}
 
-		const resumed = new Set(targetTasks.map((t) => t.id));
 		const mailboxIds: string[] = [];
+		/** ALIVE parks: response delivered via the mailbox stream the parked ask tool polls. */
+		const answeredIds: string[] = [];
+		/** DEAD parks (and legacy no-question parks): re-queued for durable scheduler resume. */
+		const requeuedIds: string[] = [];
+		/** Exactly-once no-ops: a mailbox response already exists for the questionId. */
+		const noopIds: string[] = [];
+		const answeredEvents: Array<{ taskId: string; questionId: string; delivery: "mailbox" | "requeue" }> = [];
+		let updatedTasks = fresh.tasks;
+
 		for (const task of targetTasks) {
-			const mailbox = appendMailboxMessage(fresh.manifest, {
-				direction: "inbox",
-				from: "leader",
-				to: task.id,
-				taskId: task.id,
-				body: message || "(resume)",
-				kind: "response",
-				priority: "normal",
-				deliveryMode: "next_turn",
-				data: { action: "respond", kind: "response" },
-				replyTo: params.replyTo,
-				replyFrom: params.replyFrom,
-				replyDeadline: params.replyDeadline,
-			});
-			mailboxIds.push(mailbox.id);
+			const questionId = task.waiting?.questionId;
+			if (!questionId) {
+				// Legacy pre-v2 waiting park (no ask question): keep the old
+				// mailbox + re-queue resume behavior verbatim.
+				const mailbox = appendMailboxMessage(fresh.manifest, {
+					direction: "inbox",
+					from: "leader",
+					to: task.id,
+					taskId: task.id,
+					body: message || "(resume)",
+					kind: "response",
+					priority: "normal",
+					deliveryMode: "next_turn",
+					data: { action: "respond", kind: "response" },
+					replyTo: params.replyTo,
+					replyFrom: params.replyFrom,
+					replyDeadline: params.replyDeadline,
+				});
+				mailboxIds.push(mailbox.id);
+				updatedTasks = requeueWaitingTask(updatedTasks, task.id, message);
+				requeuedIds.push(task.id);
+				continue;
+			}
+			// EXACTLY-ONE-DISPATCH GUARD (idempotent per questionId): if a
+			// mailbox response for this questionId already exists, do nothing —
+			// never write a second response and never requeue on top of it.
+			// Atomic: the scan and the write below share this run-lock section.
+			if (readMailbox(fresh.manifest, "inbox", task.id, "response").some((m) => m.questionId === questionId)) {
+				noopIds.push(task.id);
+				continue;
+			}
+			if (isWaitingWorkerAlive(task)) {
+				// ALIVE: deliver via the task mailbox stream the parked ask tool
+				// polls (≤500ms). The park stays — the tool's terminal report
+				// flips waiting→running; root-side status must NOT change here.
+				const mailbox = appendMailboxMessage(fresh.manifest, {
+					direction: "inbox",
+					from: "leader",
+					to: task.id,
+					taskId: task.id,
+					body: message || "(resume)",
+					kind: "response",
+					priority: "normal",
+					deliveryMode: "next_turn",
+					questionId,
+					data: { action: "respond", kind: "response", questionId },
+					replyTo: params.replyTo,
+					replyFrom: params.replyFrom,
+					replyDeadline: params.replyDeadline,
+				});
+				mailboxIds.push(mailbox.id);
+				answeredIds.push(task.id);
+				answeredEvents.push({ taskId: task.id, questionId, delivery: "mailbox" });
+				continue;
+			}
+			// DEAD: re-queue AND inject the fenced answer into the next dispatch
+			// prompt. No questionId-tagged mailbox response is written — the
+			// parked poller is gone; delivery rides the requeue instead.
+			updatedTasks = requeueWaitingTask(updatedTasks, task.id, message, renderAskAnswer(questionId, message));
+			requeuedIds.push(task.id);
+			answeredEvents.push({ taskId: task.id, questionId, delivery: "requeue" });
 		}
 
 		// If this respond includes a replyTo, update the original message with reply metadata.
@@ -105,40 +213,53 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 			updateMailboxMessageReply(fresh.manifest, params.replyTo, message || "(resume)");
 		}
 
-		// Re-queue waiting tasks so durable scheduler/resume can pick them up again.
-		const updatedTasks = fresh.tasks.map((task) => {
-			if (!resumed.has(task.id)) return task;
-			return {
-				...task,
-				status: "queued" as const,
-				startedAt: undefined,
-				finishedAt: undefined,
-				error: undefined,
-				adaptive: {
-					...task.adaptive,
-					phase: "resumed",
-					task: message || task.adaptive?.task || "",
-				},
-			};
-		});
-
-		saveRunTasks(fresh.manifest, updatedTasks);
 		let manifest = fresh.manifest;
-		if (
-			manifest.status === "blocked" ||
-			manifest.status === "completed" ||
-			manifest.status === "failed" ||
-			manifest.status === "cancelled"
-		) {
-			manifest = updateRunStatus(manifest, "running", `Resumed ${resumed.size} waiting task(s).`);
+		if (requeuedIds.length > 0) {
+			saveRunTasks(fresh.manifest, updatedTasks);
+			// WP-2 review round 1 (P3): clear manifest.waitState when its park was
+			// requeued — mirror the broker's clearWaitState guard (taskId match),
+			// else the stale pointer shields the run from staleness repair for
+			// the full 24h TTL and leaves a stale marker in the manifest/UI.
+			if (manifest.waitState && requeuedIds.includes(manifest.waitState.taskId)) {
+				manifest = { ...manifest, waitState: undefined, updatedAt: new Date().toISOString() };
+				saveRunManifest(manifest);
+			}
+			if (
+				manifest.status === "blocked" ||
+				manifest.status === "completed" ||
+				manifest.status === "failed" ||
+				manifest.status === "cancelled"
+			) {
+				manifest = updateRunStatus(manifest, "running", `Resumed ${requeuedIds.length} waiting task(s).`);
+			}
 		}
-		for (const taskId of resumed) {
+		// ask.answered on BOTH discrimination paths (ADR-0 item 8).
+		for (const answered of answeredEvents) {
 			// H1 (2026-08-10): handleRespond is a SYNC function inside a sync
 			// run-lock callback — cannot await; fire-and-forget async.
+			void appendEventAsync(manifest.eventsPath, {
+				type: "ask.answered",
+				runId: manifest.runId,
+				taskId: answered.taskId,
+				message: `Question ${answered.questionId} answered (${
+					answered.delivery === "mailbox"
+						? "worker alive — parked ask tool picks up the mailbox response"
+						: "worker dead — task requeued with the answer injected"
+				}).`,
+				data: { questionId: answered.questionId, delivery: answered.delivery },
+			}).catch((error) =>
+				logInternalError(
+					"respond.ask-answered-event",
+					error instanceof Error ? error : new Error(String(error)),
+					`runId=${manifest.runId}`,
+				),
+			);
+		}
+		for (const requeuedId of requeuedIds) {
 			void appendEventAsync(manifest.eventsPath, {
 				type: "task.resumed",
 				runId: manifest.runId,
-				taskId,
+				taskId: requeuedId,
 				message: message || "Task re-queued after respond.",
 				data: { mailboxIds },
 			}).catch((error) =>
@@ -149,24 +270,35 @@ export function handleRespond(params: TeamToolParamsValue, ctx: TeamContext): Pi
 				),
 			);
 		}
-		try {
-			const existingRuntimes = new Map(readCrewAgents(fresh.manifest).map((a) => [a.taskId, a.runtime]));
-			saveCrewAgents(
-				fresh.manifest,
-				updatedTasks.map((task) => recordFromTask(fresh.manifest, task, existingRuntimes.get(task.id) ?? "child-process")),
-			);
-		} catch (error) {
-			logInternalError("team-tool.handleRespond.crewAgents", error, `runId=${fresh.manifest.runId}`);
+		if (requeuedIds.length > 0) {
+			try {
+				const existingRuntimes = new Map(readCrewAgents(fresh.manifest).map((a) => [a.taskId, a.runtime]));
+				saveCrewAgents(
+					fresh.manifest,
+					updatedTasks
+						.filter((task) => requeuedIds.includes(task.id))
+						.map((task) => recordFromTask(fresh.manifest, task, existingRuntimes.get(task.id) ?? "child-process")),
+				);
+			} catch (error) {
+				logInternalError("team-tool.handleRespond.crewAgents", error, `runId=${fresh.manifest.runId}`);
+			}
 		}
 
-		const resumedIds = targetTasks.map((t) => t.id);
-		return result(`Resumed ${resumedIds.length} waiting task(s): ${resumedIds.join(", ")}. Message: ${message || "(no message)"}`, {
-			action: "respond",
-			status: "ok",
-			runId: fresh.manifest.runId,
-			resumedIds,
-			mailboxIds,
-			intent: `responding to ${resumedIds.join(", ")} in ${fresh.manifest.runId}`,
-		});
+		const summaryParts: string[] = [];
+		if (answeredIds.length > 0) summaryParts.push(`answered via mailbox (worker alive): ${answeredIds.join(", ")}`);
+		if (requeuedIds.length > 0) summaryParts.push(`requeued with injected answer (worker dead): ${requeuedIds.join(", ")}`);
+		if (noopIds.length > 0) summaryParts.push(`already answered, no-op: ${noopIds.join(", ")}`);
+		return result(
+			`Responded to ${targetTasks.length} waiting task(s). ${summaryParts.join("; ")}. Message: ${message || "(no message)"}`,
+			{
+				action: "respond",
+				status: "ok",
+				runId: fresh.manifest.runId,
+				resumedIds: requeuedIds,
+				mailboxIds,
+				intent: `responding to ${targetTasks.map((t) => t.id).join(", ")} in ${fresh.manifest.runId}`,
+				data: { answeredIds, noopIds },
+			},
+		);
 	});
 }

package/src/extension/team-tool/run-deadline.ts

@@ -1,5 +1,7 @@
 import type { PiTeamsConfig } from "../../config/config.ts";
 import { loadConfig } from "../../config/config.ts";
+import { isSessionSwitchInFlight } from "../../ui/inline-panel/view-session-store.ts";
+import { safeAbort } from "../../utils/safe-abort.ts";
 import type { TeamContext } from "./context.ts";
 
 /**
@@ -55,16 +57,46 @@ export function resolveRunDeadline<T extends object>(
 
 	const controller = new AbortController();
 	// Propagate caller abort (ctx.signal) to the shared controller.
+	// R6-F2 (W2/RC-03 consistency): named handler instead of an anonymous
+	// { once: true } closure. resolveRunDeadline returns immediately (there is
+	// no run-lifetime finally scope inside this module — callers in run.ts only
+	// clearTimeout the timer), so removal is wired to the deadline controller's
+	// own abort: once the run controller aborts for ANY cause (deadline timer
+	// fire, caller-signal propagation, or an explicit controller.abort() from a
+	// linked path such as startForegroundRun), the propagation listener is dead
+	// weight on ctx.signal and is removed. Behavior-neutral: if the caller's
+	// signal fired afterwards, the listener would only call abort() on an
+	// already-aborted controller — a no-op.
 	if (ctx.signal) {
-		if (ctx.signal.aborted) controller.abort();
-		else ctx.signal.addEventListener("abort", () => controller.abort(), { once: true });
+		if (ctx.signal.aborted) safeAbort(controller, "run-deadline.caller-preaborted");
+		else {
+			const callerSignal = ctx.signal;
+			// The deadline signal is passed down to run executors that may spawn
+			// children with it; aborting after a child exited throws AbortError
+			// from Node's child_process listener — never let that escape a
+			// pi event handler (safe-abort).
+			const onCallerAbort = () => {
+				// Regression: switching sessions (resume/new/fork — including
+				// /crew-view) tears the current turn down via session.abort(),
+				// firing the tool-call abort while the run is still forming. A
+				// foreground run must survive session switches (P0 — it shares
+				// the process), so a teardown abort must NOT cancel it. Only a
+				// genuine caller abort OUTSIDE a session switch propagates.
+				if (isSessionSwitchInFlight()) return;
+				safeAbort(controller, "run-deadline.caller-abort");
+			};
+			callerSignal.addEventListener("abort", onCallerAbort, { once: true });
+			controller.signal.addEventListener("abort", () => callerSignal.removeEventListener("abort", onCallerAbort), { once: true });
+		}
 	}
 	// Arm the deadline timer (unref'd so it never blocks process exit).
 	// RC-02: expose the timer so callers can clearTimeout on normal completion —
 	// otherwise every run leaves a dangling 1h timer retaining ctx/params in closure.
+	// Same abort-after-exit guard as above: the timer may fire after workers
+	// already exited and their spawn-signal listeners are gone — Node can throw.
 	let timer: NodeJS.Timeout | undefined;
 	if (deadlineMs > 0) {
-		timer = setTimeout(() => controller.abort(), deadlineMs);
+		timer = setTimeout(() => safeAbort(controller, "run-deadline.timer"), deadlineMs);
 		timer.unref?.();
 	}
 	return { signal: controller.signal, deadlineMs, controller, timer };