pi-legion 3.1.0 → 5.0.0

package/index.ts

@@ -21,7 +21,8 @@ import type {
 import { Type, type Static } from "typebox";
 import { RpcSupervisor } from "./src/supervisor/rpc-supervisor.ts";
 import { InProcessSupervisor } from "./src/supervisor/inprocess-supervisor.ts";
-import { RoutingSupervisor } from "./src/supervisor/routing-supervisor.ts";
+import { runAtAbsoluteDepth } from "./src/supervisor/inprocess-depth.ts";
+import { notifyInProcessSlotReleased, RoutingSupervisor } from "./src/supervisor/routing-supervisor.ts";
 import type { LegionSupervisor } from "./src/supervisor/types.ts";
 import { InMemoryUIProxy, type UIProxy } from "./src/supervisor/ui-proxy.ts";
 import { discoverAgents, findAgent, formatAgentRoster, BUILTIN_AGENTS_DIR } from "./src/agents/agents.ts";
@@ -48,19 +49,26 @@ import { resolveTeamContext } from "./src/agents/context.ts";
 import { createSessionRuntime, renderLiveChildStatus, type SessionRuntime, shouldRecycleAfterCollect, type WaitResult } from "./src/extension/runtime.ts";
 import { createDbEventSource, createLegionEventBus, type DbEventSource, type LegionEventBus } from "./src/extension/event-bus.ts";
 import { LegionPostman, registerLegionTools, type LegionMailCommand } from "./src/extension/legion-tools.ts";
+import type { PhaseMachine } from "./src/legion/phase-machine.ts";
 import { LEGION_DB_ENV, LEGION_NODE_ID_ENV } from "./src/runs/args.ts";
 import type { VerifyRunner } from "./src/runs/acceptance.ts";
 import { legionDbPath, openLegionDb, type DatabaseSync } from "./src/legion/db.ts";
-import { appendEvent } from "./src/legion/events.ts";
+import { appendEvent, maxEventId } from "./src/legion/events.ts";
 import { attachUsageTotals, upsertUsage } from "./src/legion/usage.ts";
 import { getChildByName, getChildren, getNode, getSubtree, insertNode, type LegionNode, updateNode } from "./src/legion/nodes.ts";
 import { DEFAULT_LEGION_SETTINGS, type LegionSettings } from "./src/shared/types.ts";
 import { parseNestedPathEnv } from "./src/shared/nested-path.ts";
-import { allocateSiblingNames, isValidAgentName, makeName } from "./src/shared/name.ts";
-import { deriveOutcome, isLastTurnComplete, parseSessionFile } from "./src/shared/session.ts";
+import { allocateSiblingNames, isValidAgentName } from "./src/shared/name.ts";
+import {
+	deriveOutcome,
+	isLastTurnComplete,
+	NO_ASSISTANT_ABORT_REASON,
+	parseSessionFile,
+} from "./src/shared/session.ts";
 import { restoreHostNodeOptions } from "./src/supervisor/child-memory.ts";
 import { currentChildContext } from "./src/supervisor/child-context.ts";
 import { setVerifyQueueListener } from "./src/runs/verify-queue.ts";
+import { setLaunchQueueListener } from "./src/supervisor/admission-queue.ts";
 import { applyEventRetention, checkpoint, formatHygieneReport, hygieneEnabled, runStartupHygiene } from "./src/runs/hygiene.ts";
 import {
 	createStatusNodeOpener,
@@ -80,11 +88,14 @@ import {
 } from "./src/extension/blocked.ts";
 import { formatAlreadyRecycled } from "./src/extension/recycle.ts";
 import {
+	completionStatusOf,
+	type RenewalProposal,
 	SUBAGENT_NOTIFY_TYPE,
 } from "./src/extension/notify.ts";
 import { renderSubagentNotice } from "./src/extension/notice-renderer.ts";
 import { renderSpawnResult } from "./src/extension/spawn-render.ts";
 import { PARENT_PLAYBOOK, TOOL_DESCRIPTION } from "./src/extension/playbook.ts";
+import { CHILD_ROLE_ENV } from "./src/extension/child-guard.ts";
 import { configureSessionErrors, recordSessionError } from "./src/extension/session-errors.ts";
 import { getAgentDir } from "./src/agents/paths.ts";
 import { expectedModelsFromSettings, parseDoctorSections, runLegionDoctor } from "./src/extension/legion-doctor.ts";
@@ -95,19 +106,32 @@ import {
 	type OrchestratorLegionContext,
 } from "./src/runs/orchestrator.ts";
 import { RunStore, pickChildByName } from "./src/runs/store.ts";
+import {
+	candidateStoreRoots,
+	resolveChildAcrossStores,
+	unknownChildMessage,
+	type CandidateStore,
+} from "./src/runs/store-lookup.ts";
 import { RUN_OWNER_FILE, ownerState } from "./src/runs/owner.ts";
+import { measureProgress, readSessionLines } from "./src/runs/progress-signal.ts";
 import { resolveLaunchWorktree } from "./src/runs/worktree.ts";
 import {
 	type AgentConfig,
 	type AgentScope,
+	type ChildRecord,
 	DEFAULTS,
+	DEFAULT_MAX_RENEWALS,
 	DEFAULT_ON_BLOCKED,
+	DEFAULT_RENEWABLE,
 	ErrorCodes,
+	type Execution,
 	type ModelOrigin,
 	type RetireOptions,
 	type SpawnMode,
 	SubagentError,
 	type SubagentsSettings,
+	unknownChildError,
+	type Handle,
 } from "./src/shared/types.ts";
 
 // ---------------------------------------------------------------------------
@@ -117,7 +141,12 @@ import {
 const TaskItem = Type.Object({
 	agent: Type.String({ description: "Name of the agent to invoke" }),
 	task: Type.String({ description: "Task to delegate" }),
-	cwd: Type.Optional(Type.String()),
+	cwd: Type.Optional(
+		Type.String({
+			description:
+				"Directory the child records live under (`<cwd>/.pi-subagents`), used by launch and by every control action. Defaults to the session cwd. A name miss searches the neighbouring stores too, so this is rarely needed.",
+		}),
+	),
 	model: Type.Optional(Type.String()),
 	preset: Type.Optional(
 		Type.String({ description: "Named kind+model+thinking preset" }),
@@ -173,7 +202,12 @@ const SubagentParams = Type.Object({
 	preset: Type.Optional(
 		Type.String({ description: "Named kind+model+thinking preset" }),
 	),
-	cwd: Type.Optional(Type.String()),
+	cwd: Type.Optional(
+		Type.String({
+			description:
+				"Directory the child records live under (`<cwd>/.pi-subagents`) for launch and every control action. Defaults to the session cwd. A name miss also searches neighbouring stores, so setting this is rarely needed.",
+		}),
+	),
 	worktree: Type.Optional(
 		Type.Boolean({
 			description:
@@ -234,10 +268,25 @@ const SubagentParams = Type.Object({
 type SubagentParams = Static<typeof SubagentParams>;
 
 const VexillatioParams = Type.Object({
-	task: Type.String({ description: "Recon task: one clear question list" }),
+	// Optional on purpose: `tasks[]` is a complete request on its own, exactly like
+	// `subagent({ tasks })`. Leaving this required made pi's own argument check
+	// reject `{ tasks: [...] }` before `execute` ran, so every `tasks[]`-only call
+	// failed with `task: must have required properties task` and had to be retried
+	// with a dummy `task` label (models copy the `subagent` shape).
+	task: Type.Optional(
+		Type.String({
+			description:
+				"Recon task: one clear question list. Optional when `tasks[]` is provided (then it only labels the parent run).",
+		}),
+	),
 	agent: Type.Optional(Type.String({ description: "Utility agent name (default: scout)" })),
 	tasks: Type.Optional(Type.Array(TaskItem, { description: "Parallel recon launches" })),
-	cwd: Type.Optional(Type.String()),
+	cwd: Type.Optional(
+		Type.String({
+			description:
+				"Directory the child records live under (`<cwd>/.pi-subagents`) for launch and every control action. Defaults to the session cwd. A name miss also searches neighbouring stores, so setting this is rarely needed.",
+		}),
+	),
 	model: Type.Optional(Type.String()),
 	timeoutMs: Type.Optional(Type.Number({ description: "Per-child wait in ms, default 600000" })),
 });
@@ -309,8 +358,159 @@ function currentProcessSpawnMode(): SpawnMode {
 	return currentChildContext()?.spawnMode ?? "rpc";
 }
 
+/**
+ * The frozen interruption head line (`test/unit/teams.test.ts` matches it, and
+ * `esc-no-retire-v3` records why it leads every interrupted result).
+ */
+const INTERRUPTED_HEAD = "interrupted (parent turn ended; children still running)";
+
 function notice(pi: ExtensionAPI, text: string): void {
-	pi.sendMessage({ customType: SUBAGENT_NOTIFY_TYPE, content: text, display: true }, { triggerTurn: true, deliverAs: "followUp" });
+	// #273: `sendMessage` is a host ACTION and pi throws
+	// "Extension runtime not initialized. Action methods cannot be called during
+	// extension loading." if it is reached before the runtime is up. An error
+	// handler that is more fatal than the error it reports turns "a resume
+	// failed" into "the whole agent process died", which is what happened on the
+	// centurion recovery path. Degrade to stderr instead; the caller still gets
+	// the fact, and nothing crashes.
+	try {
+		pi.sendMessage({ customType: SUBAGENT_NOTIFY_TYPE, content: text, display: true }, { triggerTurn: true, deliverAs: "followUp" });
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		console.error(`[pi-legion] notice not delivered (${reason}): ${text}`);
+	}
+}
+
+/**
+ * Launch-admission-queue bounds from settings (issue #266, contract D6-a/D10).
+ *
+ * Frozen key names are `subagents.inprocess.maxQueuedLaunches` /
+ * `subagents.inprocess.launchQueueTimeoutMs`. An absent key is *omitted* rather
+ * than defaulted here: the single source of the defaults is
+ * `src/supervisor/admission-queue.ts`, and passing a literal 32/900000 from the
+ * adapter would create a second copy that can drift from the docs and sentinel.
+ */
+function launchQueueBounds(settings: {
+	inprocess?: { maxQueuedLaunches?: number; launchQueueTimeoutMs?: number };
+}): { maxPending?: number; timeoutMs?: number } {
+	const bounds: { maxPending?: number; timeoutMs?: number } = {};
+	if (settings.inprocess?.maxQueuedLaunches !== undefined) bounds.maxPending = settings.inprocess.maxQueuedLaunches;
+	if (settings.inprocess?.launchQueueTimeoutMs !== undefined) bounds.timeoutMs = settings.inprocess.launchQueueTimeoutMs;
+	return bounds;
+}
+
+/**
+ * D9/§13.4: the one user-visible line per queued / admitted / expired / stopped
+ * launch.
+ *
+ * Deliberately `triggerTurn: false` (unlike {@link notice}): admission is a
+ * mid-turn fact about work the caller already asked for, so waking the parent
+ * with a fresh turn for every queue transition would re-enter the agent for a
+ * purely cosmetic line. Anything the caller must act on still arrives through
+ * the tool result and, for `async:false`, the inline `↳ waited Ns` line.
+ */
+function launchQueueNoticeSink(pi: ExtensionAPI): (line: string) => void {
+	return (line: string) => {
+		try {
+			pi.sendMessage(
+				{ customType: SUBAGENT_NOTIFY_TYPE, content: line, display: true },
+				{ triggerTurn: false },
+			);
+		} catch {
+			// Cosmetic: a gone parent session must never break admission.
+		}
+	};
+}
+
+/**
+ * D9-1: the launch line's queue suffix, or `""` for a launch that spawned now.
+ *
+ * `▶ scout-7 (scout) supervisor=inprocess queued(3)` — the position is what the
+ * operator needs to know the launch is waiting rather than broken. Only the
+ * trailing segment is added: the line's published prefix and `details.spawns`
+ * (a renderer input) keep their existing shapes.
+ */
+function launchLineQueueSuffix(handle: Pick<Handle, "queued" | "queuePosition">): string {
+	if (handle.queued !== true) return "";
+	return handle.queuePosition === undefined ? " queued" : ` queued(${handle.queuePosition})`;
+}
+
+/**
+ * D8/A20: the honest wait line for an `async:false` child that queued.
+ *
+ * Read from the admitted `ChildRecord.queueWaitedMs` — never re-derived from a
+ * clock here, or the number would describe the adapter's own latency instead of
+ * the queue's. `""` when the child never waited.
+ */
+function queuedWaitLine(child: { name: string; queueWaitedMs?: number } | undefined): string {
+	if (!child || child.queueWaitedMs === undefined || child.queueWaitedMs <= 0) return "";
+	return `↳ ${child.name} waited ${Math.round(child.queueWaitedMs / 1000)}s in the launch queue`;
+}
+
+/**
+ * D6/D7: report a queue that an abort cleared out.
+ *
+ * "Empty queue and zero spawns" is only half the contract; the caller must also
+ * learn that N launches it asked for never ran. One line, names in `seq` order.
+ */
+function launchQueueFlushLine(flushed: readonly string[]): string {
+	if (flushed.length === 0) return "";
+	return `${flushed.length} queued launch(es) dropped: ${flushed.join(", ")}`;
+}
+
+/**
+ * #238: create and start the DB event source that feeds the legion bus on attach.
+ *
+ * This is the production attach path and it is exported so a unit test can drive
+ * it directly (same seam style as `buildPlan`/`resolveWaitTargets`): the seeding
+ * behaviour is a property of THIS call, not of `createDbEventSource`, and a test
+ * that only exercised the factory would keep passing if this seed were removed.
+ *
+ * Seeding at `MAX(id)` matters because `createDbEventSource`'s own default is 0,
+ * i.e. "replay the whole log". On a ledger with history that re-delivered every
+ * stored event through `onWidgetEvent` — one full `snapshotNodes()` plus a
+ * repaint each, ~2.5s of blocked UI at 120 nodes / 1000 events — to reach a
+ * state the DB already describes.
+ *
+ * Rows committed in the window between this seed query and the first poll are
+ * not lost: `poll()` only skips when `lastDataVersion` matches, that variable
+ * starts `undefined` (so the first poll always reads), and the cursor is only
+ * ever advanced from ids actually returned by `SELECT ... WHERE id > cursor`.
+ * A row committed after the seed is therefore either picked up by the first
+ * poll or dirties `data_version` and is picked up on the next tick. The seed is
+ * not atomic with `start()`, but it does not need to be.
+ *
+ * Note the drain loop's early `return`: it exits BEFORE `lastDataVersion` is
+ * assigned (that assignment is after the loop), so an interrupted drain leaves
+ * the version unlatched. That errs safe — the next poll re-reads from the
+ * cursor instead of skipping — but it is a re-read, not a "set then return".
+ */
+export function attachLegionRuntime(input: {
+	db: DatabaseSync;
+	eventBus: LegionEventBus;
+}): DbEventSource {
+	const dbEventSource = createDbEventSource(input.db, { cursor: maxEventId(input.db) });
+	dbEventSource.start(input.eventBus);
+	return dbEventSource;
+}
+
+/**
+ * The phase machine for a legion node, from its role card (#298).
+ *
+ * Reads `phases:` off the agent definition for the node's role. Absent means the
+ * built-in machine, so an undeclared team is unaffected. A card that declares an
+ * invalid machine never reaches here: `parseAgentDocument` rejects it at load.
+ */
+function phaseMachineForRole(role: string | null | undefined, cwd: string, settings: SubagentsSettings): PhaseMachine | undefined {
+	if (!role) return undefined;
+	try {
+		const discovery = discoverAgents(cwd, "user", { includeBuiltin: settings.disableBuiltins !== true });
+		const overridden = applyAgentOverrides(discovery.agents, settings.agentOverrides);
+		return findAgent(overridden, role)?.phases;
+	} catch {
+		// Discovery is best-effort here: a broken project dir must not stop a team
+		// from attaching, and the built-in machine still works.
+		return undefined;
+	}
 }
 
 function createLegionRuntime(input: {
@@ -326,11 +526,12 @@ function createLegionRuntime(input: {
 	settings: LegionSettings;
 	eventBus: LegionEventBus;
 	registerTools: boolean;
+	/** #298: the team root's declared phase machine, when its card supplies one. */
+	machine?: PhaseMachine;
 }): LegionRuntimeIdentity {
 	const self = getNode(input.db, input.nodeId);
 	const eventBus = input.eventBus;
-	const dbEventSource = createDbEventSource(input.db);
-	dbEventSource.start(eventBus);
+	const dbEventSource = attachLegionRuntime(input);
 	const postman = new LegionPostman({
 		db: input.db,
 		nodeId: input.nodeId,
@@ -339,6 +540,7 @@ function createLegionRuntime(input: {
 		eventBus,
 		sendRootMessage: (text: string) => notice(input.pi, text),
 		sendSelfMessage: (text: string) => notice(input.pi, text),
+		...(input.machine ? { machine: input.machine } : {}),
 		resumeChild: (node: LegionNode, mail: LegionMailCommand) => resumeLegionChild({
 			pi: input.pi, supervisor: input.supervisor, db: input.db, dbPath: input.dbPath,
 			eventBus, settings: input.settings, cwd: input.cwd, storeRootDir: input.storeRootDir,
@@ -363,7 +565,7 @@ function createLegionRuntime(input: {
 		postman,
 		childNodeId: (name) => getChildByName(input.db, input.nodeId, name)?.id,
 	};
-	if (input.registerTools && input.nodeId !== "root") registerLegionTools(input.pi, { db: input.db, nodeId: input.nodeId, role: self?.role, settings: input.settings, cwd: input.cwd, runDir: input.runDir, eventBus, sendSelfMessage: (text: string) => notice(input.pi, text) });
+	if (input.registerTools && input.nodeId !== "root") registerLegionTools(input.pi, { db: input.db, nodeId: input.nodeId, role: self?.role, settings: input.settings, cwd: input.cwd, runDir: input.runDir, eventBus, sendSelfMessage: (text: string) => notice(input.pi, text), ...(input.machine ? { machine: input.machine } : {}) });
 	postman.start();
 	return identity;
 }
@@ -421,8 +623,31 @@ function resolveLegionIdentity(input: {
 			nodeRun = input.store.createRun({ task: node.taskSummary ?? `Resume ${node.role} node ${node.id}`, cwd: input.cwd, path: parseNestedPathEnv(process.env.PI_SUBAGENT_PARENT_PATH), maxDepth: effectiveMaxDepth(input.settings.legion?.maxDepth), nodeId, herdr: { supervisor: "rpc", node_id: nodeId } });
 		}
 		if (node.runId !== nodeRun.runId) updateLegionRunId(db, nodeId, nodeRun.runId);
-		const identity = createLegionRuntime({ pi: input.pi, supervisor: input.supervisor, db, dbPath: absoluteDbPath, nodeId, rootRunId: getNode(db, "root")?.runId ?? path.basename(path.dirname(absoluteDbPath)), runDir: input.store.runDir(nodeRun.runId), cwd: input.cwd, storeRootDir: input.store.rootDir, settings: settingsForLegion(input.settings), eventBus: input.eventBus, registerTools: true });
-		if (node.role === "centurion") void resumeLegionTeam({ identity, input });
+		const machine = phaseMachineForRole(node.role, input.cwd, input.settings);
+		const identity = createLegionRuntime({ pi: input.pi, supervisor: input.supervisor, db, dbPath: absoluteDbPath, nodeId, rootRunId: getNode(db, "root")?.runId ?? path.basename(path.dirname(absoluteDbPath)), runDir: input.store.runDir(nodeRun.runId), cwd: input.cwd, storeRootDir: input.store.rootDir, settings: settingsForLegion(input.settings), eventBus: input.eventBus, registerTools: true, ...(machine ? { machine } : {}) });
+		// #273: `createLegionRuntime` runs during extension LOADING, where host
+		// actions (sendMessage, spawn, ui) are not available yet. Defer the team
+		// recovery to the next tick so a failure inside it cannot crash the load
+		// path, and so any notice it emits has a live runtime to go to.
+		if (node.role === "centurion") {
+			// #275: run the recovery at depth 0 explicitly. `queueMicrotask`
+			// INHERITS the AsyncLocalStorage depth (verified: `als.getStore()`
+			// inside a queued microtask still reads the parent's value), so a
+			// recovery queued from a nested context would start already deep and
+			// report `nesting limit reached (depth N, max 4)` for a two-level
+			// chain. `runAtAbsoluteDepth(0, …)` is the mechanism this codebase
+			// already uses for exactly that reason (see inprocess-depth.ts
+			// "REV2-1"): the recovery runs at the TOP of the tree, not under
+			// whatever context happened to enqueue it.
+			queueMicrotask(() => {
+				void runAtAbsoluteDepth(0, async () => {
+					await resumeLegionTeam({ identity, input });
+				}).catch((error: unknown) => {
+					const reason = error instanceof Error ? error.message : String(error);
+					console.error(`[pi-legion] team recovery for ${identity.nodeId} failed: ${reason}`);
+				});
+			});
+		}
 		return identity;
 	}
 	if (input.cached?.nodeId === "root" && path.resolve(input.cached.storeRootDir) === path.resolve(input.store.rootDir)) return input.cached;
@@ -508,12 +733,57 @@ async function resumeLegionChild(input: { pi: ExtensionAPI; supervisor: LegionSu
 	const childRun = store.readRun(input.node.runId);
 	if (!childRun) throw new Error(`child run.json not found: ${input.node.runId}`);
 	const parentOfSupervisor = parent.parentId ? getNode(input.db, parent.parentId) : null;
-	const orchestrator = new Orchestrator({ supervisor: input.supervisor, runDir: store.runDir(parentRun.runId), cwd, maxDepth: catalog.settings.legion?.maxDepth, maxSpawns: catalog.settings.maxSubagentSpawnsPerSession ?? null, team: resumedTeam.team, childContext: resolveTeamContext("child", catalog.settings, resumedTeam.team), parentPath: parentRun.path, ...rpcApproveFrom(catalog.settings), legion: { db: input.db, dbPath: input.dbPath, nodeId: parent.id, parentNodeId: parent.parentId, parentRunId: parentOfSupervisor?.runId ?? null, runId: parentRun.runId, runStore: store, settings: input.settings, eventBus: input.eventBus } });
+	const orchestrator = new Orchestrator({ supervisor: input.supervisor, runDir: store.runDir(parentRun.runId), cwd, maxDepth: catalog.settings.legion?.maxDepth, maxSpawns: catalog.settings.maxSubagentSpawnsPerSession ?? null, team: resumedTeam.team, childContext: resolveTeamContext("child", catalog.settings, resumedTeam.team), parentPath: parentRun.path, ...rpcApproveFrom(catalog.settings), launchQueue: launchQueueBounds(catalog.settings), onLaunchQueueNotice: launchQueueNoticeSink(input.pi), legion: { db: input.db, dbPath: input.dbPath, nodeId: parent.id, parentNodeId: parent.parentId, parentRunId: parentOfSupervisor?.runId ?? null, runId: parentRun.runId, runStore: store, settings: input.settings, eventBus: input.eventBus } });
 	orchestrator.restore(parentRun);
 	const handle = await orchestrator.launch({ agent, task: input.message, name: saved.name, ...(input.node.team ? { team: input.node.team } : {}), ...(saved.model ? { model: saved.model } : {}), worktree: Boolean(saved.worktreePath) });
 	await store.updateChild(parentRun.runId, saved.name, (child) => Object.assign(child, handle.child));
 }
 
+/**
+ * The live legion runtime for THIS process, held at module scope rather than in
+ * the `piLegion` closure (#283).
+ *
+ * `pi` re-runs the extension factory for every `DefaultResourceLoader.reload()`,
+ * and an in-process child session creates its own loader
+ * (`inprocess-supervisor.ts` builds one per `createAgentSession`). So a single
+ * process can enter `piLegion` many times. A closure-local `let` reset to
+ * `undefined` on each entry defeated the cache inside `resolveLegionIdentity`,
+ * which then opened a fresh `legion.db` — and never closed it. Measured on a
+ * centurion dispatching one in-process scout: one extra open per entry, ~2.5k
+ * leaked descriptors per 20 s, RSS climbing to 6 GB until V8 aborted with
+ * `JavaScript heap out of memory`.
+ */
+/**
+ * Runtime handles for THIS process, keyed by ledger path (#283).
+ *
+ * Two independent facts force a map rather than a single slot:
+ *
+ * 1. `pi` re-runs the extension factory for every `DefaultResourceLoader.reload()`,
+ *    and an in-process child session builds its OWN loader per
+ *    `createAgentSession` — so one process enters `piLegion` many times. A
+ *    closure-local binding reset on every entry defeated the `cached`
+ *    short-circuit in `resolveLegionIdentity`, which then opened a fresh
+ *    `legion.db` per entry and never closed it: measured on a centurion
+ *    dispatching one in-process scout, ~2.5k leaked descriptors per 20 s and RSS
+ *    climbing to 6 GB until V8 aborted with `JavaScript heap out of memory`.
+ * 2. Those entries do NOT share one ledger. A parent and its in-process child
+ *    legitimately own different `legion.db` files, and each registers its own
+ *    `session_shutdown`. With a single slot the child's shutdown closed the
+ *    PARENT's database, surfacing later as `database is not open` from whichever
+ *    pump or admission probe ran next.
+ *
+ * Keying by (resolved path, nodeId) keeps the reuse (2) while giving each owner
+ * its own lifecycle (1).
+ *
+ * The path alone is NOT enough: a parent and its in-process child share ONE
+ * ledger file (the child inherits `dbPath` from the orchestrator's launch
+ * context) and differ only by the node row they own. Keying by path made them
+ * collide, so the child's shutdown closed the parent's handle and a sibling's
+ * next spawn failed with `database is not open` (#285 follow-up).
+ */
+const legionIdentityKey = (dbPath: string, nodeId: string): string => `${dbPath}\u0000${nodeId}`;
+const legionIdentities = new Map<string, LegionRuntimeIdentity>();
+
 export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps = {}) {
 	// #197 D8: a session is a child if either transport says so. RPC children
 	// are separate processes marked in env; in-process children share the
@@ -537,6 +807,25 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 				else lastUi?.setStatus("legion-verify", undefined);
 			} catch { /* no UI */ }
 		});
+		// #266 D9-3: the launch admission queue's own pill. Deliberately a separate
+		// listener from verify's — different phases, and verify's is poll-driven.
+		// The contract's baseline is `legion-queue: N queued`; the `· 8/8 slots busy`
+		// tail needs `slotsInUse`/`slots`, which the pure queue does not know (the
+		// limit lives in the supervisor), so that dimension is omitted until the
+		// event carries it — the contract allows the omission explicitly.
+		setLaunchQueueListener((event) => {
+			try {
+				if (event.phase === "queued" || event.phase === "admitted") {
+					const suffix = event.slotsInUse !== undefined && event.slots !== undefined
+						? ` · ${event.slotsInUse}/${event.slots} slots busy`
+						: "";
+					lastUi?.setStatus("legion-queue", `legion-queue: ${event.queued} queued${suffix}`);
+					if (event.queued === 0) lastUi?.setStatus("legion-queue", undefined);
+				} else if (event.phase === "overflow" || event.phase === "expired" || event.phase === "flushed") {
+					lastUi?.setStatus("legion-queue", undefined);
+				}
+			} catch { /* no UI */ }
+		});
 	}
 	const onSpawnRefused = (message: string) => {
 		try { lastUi?.notify(`pi-legion: ${message}`, "error"); } catch { /* no UI (child / print mode) */ }
@@ -546,8 +835,20 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 	let lastCwd = process.cwd();
 	const supervisor = deps.supervisor ?? new RoutingSupervisor({
 		rpc: new RpcSupervisor({ onSpawnRefused }),
+		// The in-process supervisor is constructed here (not by RoutingSupervisor) so
+		// it can read live settings per spawn. That means `onSlotReleased` must be
+		// wired EXPLICITLY: RoutingSupervisor only adds it when it builds the
+		// backend itself (`options.inprocess ?? new InProcessSupervisor({...})`).
+		// Passing a pre-built instance used to drop the hook silently, so a freed
+		// slot never woke a launch-queue pump in production — admission then waited
+		// for the fallback recheck instead of firing on the release (#266 D2-d-2).
 		inprocess: new InProcessSupervisor({
 			onSpawnRefused,
+			// The event payload is not needed here: every Orchestrator on this run dir
+			// re-probes its own items, so a bare wake-up edge is the whole contract.
+			onSlotReleased: () => {
+				notifyInProcessSlotReleased();
+			},
 			getLimits: () => {
 				try {
 					return loadSubagentSettings({
@@ -562,7 +863,23 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 		onSpawnRefused,
 	});
 	const verifyRunner = deps.verifyRunner;
-	const legionBus = createLegionEventBus();
+	// #238: the resident status widget defers its repaint to a microtask, which puts
+	// a paint failure outside the per-subscriber try/catch in `createLegionEventBus`.
+	// The runtime funnels that failure through `reportError` → `onHandlerError`, so
+	// a handler must actually be configured or the containment is silent. A widget
+	// repaint that throws (a stale UI context, a SQLITE_IOERR on the tree read) must
+	// never take the host down, and must leave a trace.
+	const legionBus = createLegionEventBus({
+		onHandlerError: (error, event, handler) => {
+			const detail = error instanceof Error ? error.message : String(error);
+			// `event === null` means a deferred failure with no event to attribute;
+			// `handler` is then an origin tag rather than a subscriber function.
+			const where = event
+				? `${event.type} node=${event.nodeId}`
+				: typeof handler === "string" ? handler : "deferred";
+			console.error(`[pi-legion] legion event handler failed (${where}): ${detail}`);
+		},
+	});
 	const rpcUIProxy = (supervisor as LegionSupervisor & { uiProxy?: UIProxy }).uiProxy;
 	const uiProxy = deps.uiProxy ?? rpcUIProxy ?? new InMemoryUIProxy();
 	const onBudgetRefused = deps.onBudgetRefused ?? ((event) => {
@@ -584,16 +901,50 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 			return true;
 		}
 	};
-	let legionIdentity: LegionRuntimeIdentity | undefined;
-	const stopLegionRuntime = (): void => {
-		if (!legionIdentity) return;
-		legionIdentity.postman.stop();
-		legionIdentity.dbEventSource.stop();
-		// #40: bound the ledger and fold the WAL back before closing.
-		if (hygieneEnabled() && !isChild) applyEventRetention(legionIdentity.db);
-		else checkpoint(legionIdentity.db);
-		legionIdentity.db.close();
-		legionIdentity = undefined;
+	/**
+	 * Close one ledger handle (by resolved path) or every handle this process
+	 * opened. Shutdown handlers pass their own path so a child session teardown
+	 * cannot close the parent's database (#283).
+	 */
+	const stopLegionRuntime = (key?: string): void => {
+		const targets = key === undefined
+			? [...legionIdentities.entries()]
+			: (legionIdentities.has(key) ? [[key, legionIdentities.get(key)!] as const] : []);
+		for (const [key, identity] of targets) {
+			legionIdentities.delete(key);
+			identity.postman.stop();
+			identity.dbEventSource.stop();
+			// #40: bound the ledger and fold the WAL back before closing.
+			if (hygieneEnabled() && !isChild) applyEventRetention(identity.db);
+			else checkpoint(identity.db);
+			identity.db.close();
+		}
+	};
+	/** The handle this extension entry owns, if any (see `legionIdentities`). */
+	let ownLegionKey: string | undefined;
+	const ownLegionIdentity = (): LegionRuntimeIdentity | undefined =>
+		ownLegionKey === undefined ? undefined : legionIdentities.get(ownLegionKey);
+	/**
+	 * Register a resolved identity and make it this entry's own (#283/#285).
+	 *
+	 * One rule for every call site: the map holds at most one live handle per
+	 * ledger path, and an existing handle is only closed when THIS entry is
+	 * replacing the path it already owned. Reassigning across paths never closes
+	 * anything — a sibling entry (parent vs in-process child) may still be using
+	 * the handle, and closing it surfaced as `database is not open` from that
+	 * sibling's next spawn.
+	 */
+	const adoptLegionIdentity = (identity: LegionRuntimeIdentity): void => {
+		const key = legionIdentityKey(identity.dbPath, identity.nodeId);
+		const existing = legionIdentities.get(key);
+		// Only close when this entry is replacing the key it ALREADY owns: that
+		// handle is provably ours. A handle owned by a sibling (same ledger file,
+		// different node) is not ours to close.
+		if (existing && existing !== identity && ownLegionKey === key) {
+			stopLegionRuntime(key);
+		}
+		if (existing !== identity) legionIdentities.set(key, identity);
+		ownLegionKey = key;
 	};
 	const initializeLegionRuntime = (ctx: Pick<ExtensionContext, "cwd"> & { sessionFile?: string; legionNode?: { dbPath: string; nodeId: string } }): void => {
 		// The injected node's dbPath is authoritative: an in-process child shares the
@@ -603,9 +954,27 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 			userSettingsPath: path.join(getAgentDir(), "settings.json"),
 			projectSettingsPath: path.join(ctx.cwd, ".pi", "settings.json"),
 		});
-		const next = resolveLegionIdentity({ pi, supervisor, store, cwd: ctx.cwd, settings, eventBus: legionBus, cached: legionIdentity, sessionFile: ctx.sessionFile, legionNode: ctx.legionNode });
-		if (legionIdentity && next !== legionIdentity) stopLegionRuntime();
-		legionIdentity = next;
+		// Resolve the ledger path BEFORE asking for a cache entry: a fresh factory
+		// entry starts with no owned path, but the same database may already have a
+		// live handle from an earlier entry in this process (#283).
+		const targetPath = ctx.legionNode?.dbPath ?? process.env[LEGION_DB_ENV];
+		const targetNode = ctx.legionNode?.nodeId ?? process.env[LEGION_NODE_ID_ENV];
+		const cached = targetPath !== undefined && targetNode !== undefined && path.isAbsolute(targetPath)
+			? legionIdentities.get(legionIdentityKey(path.resolve(targetPath), targetNode))
+			: ownLegionIdentity();
+		const next = resolveLegionIdentity({ pi, supervisor, store, cwd: ctx.cwd, settings, eventBus: legionBus, cached, sessionFile: ctx.sessionFile, legionNode: ctx.legionNode });
+		if (next === undefined) return;
+		// Index by ledger path: a re-entry for the SAME database reuses the cached
+		// handle, a different database (parent vs its in-process child) gets its
+		// own slot.
+		//
+		// Never close `cached` here just because this entry resolved elsewhere.
+		// `resolveLegionIdentity` returns a DIFFERENT object for the same path when
+		// the node/session changed, and that earlier handle may still be in use by
+		// the entry that opened it — closing it produced `database is not open`
+		// from a sibling's spawn (#285 follow-up). Only the entry that owns a path
+		// closes it, via its own session_shutdown.
+		adoptLegionIdentity(next);
 	};
 	if (isChild) {
 		registerChildGuard(pi);
@@ -659,7 +1028,7 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 		}
 		const { storeRoot, notify } = pendingHygiene;
 		try {
-			const report = runStartupHygiene({ storeRoot, protectRunIds: legionIdentity ? [legionIdentity.rootRunId] : [] });
+			const report = runStartupHygiene({ storeRoot, protectRunIds: ownLegionIdentity() ? [ownLegionIdentity()!.rootRunId] : [] });
 			const text = formatHygieneReport(report);
 			if (text) notify?.(text);
 		} catch (error) {
@@ -703,7 +1072,9 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 			...children.map((job) => job.retire?.(shutdownRetire).catch(() => {})),
 			...pendingUtilityRetires.map((retire) => retire(shutdownRetire).catch(() => {})),
 		]);
-		stopLegionRuntime();
+		// Scope to the ledger THIS entry opened: a parent and its in-process child
+		// both register a shutdown handler, and each must close only its own (#283).
+		stopLegionRuntime(ownLegionKey);
 	};
 	if (process.env[UTILITY_CHILD_ENV] !== "1") {
 		pi.registerTool({
@@ -736,11 +1107,10 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 					sessionCwd: ctx.cwd,
 					signal,
 					isChild,
-					legion: legionIdentity,
+					legion: ownLegionIdentity(),
 					eventBus: legionBus,
 					onLegion: (identity) => {
-						if (legionIdentity && legionIdentity !== identity) stopLegionRuntime();
-						legionIdentity = identity;
+						adoptLegionIdentity(identity);
 					},
 					onUtilityChild: (retire) => pendingUtilityRetires.push(retire),
 				});
@@ -764,16 +1134,25 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 			catalog.settings,
 			catalog.team,
 		);
+		// A centurion running as a NESTED child is still a "parent" for templating
+		// purposes — it dispatches its own squad — but it must not be offered itself:
+		// the runtime refuses a non-root centurion dispatch (a nested centurion is
+		// a second command chain the root cannot collect), so listing it invites a
+		// call that can only fail. Leaving it out keeps the roster truthful.
+		const selfRole = process.env[CHILD_ROLE_ENV];
+		const rosterAgents = selfRole
+			? catalog.agents.filter((agent) => agent.name !== selfRole)
+			: catalog.agents;
 		return {
 			systemPrompt: `${event.systemPrompt}\n\n${PARENT_PLAYBOOK}\n\n${renderParentRoster(
-				catalog.agents,
+				rosterAgents,
 				catalog.team,
 				catalog.teamWarnings,
 			)}${parentContext ? `\n\n${parentContext}` : ""}`,
 		};
 	});
 	if (process.env[UTILITY_CHILD_ENV] === "1") {
-		pi.on("session_shutdown", () => stopLegionRuntime());
+		pi.on("session_shutdown", () => stopLegionRuntime(ownLegionKey));
 		return;
 	}
 	let lastUi: ExtensionUIContext | undefined;
@@ -793,13 +1172,37 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 		statusStrip: process.env.PI_LEGION_STRIP === "tree" ? "tree" : "railway",
 		eventBus: legionBus,
 		getTreeNodes: () => {
-			const identity = legionIdentity;
+			const identity = ownLegionIdentity();
 			return identity
 				? attachUsageTotals(identity.db, getSubtree(identity.db, identity.nodeId))
 				: [];
 		},
+		// #298: let the tree render a team's declared workflow. Cached per role
+		// because agent discovery touches the filesystem and the tree re-renders on
+		// every event.
+		getPhaseMachine: (() => {
+			const cache = new Map<string, PhaseMachine | undefined>();
+			return (role) => {
+				if (!role) return undefined;
+				if (cache.has(role)) return cache.get(role);
+				let machine: PhaseMachine | undefined;
+				try {
+					// `loadCatalog` already applies agentOverrides and team selection, so
+					// this is the same definition the launch path resolves.
+					const catalog = loadCatalog(lastCwd, lastCwd, undefined);
+					machine = findAgent(catalog.agents, role)?.phases;
+				} catch {
+					// Discovery must never break rendering: a malformed project dir would
+					// otherwise blank the tree.
+					machine = undefined;
+				}
+				cache.set(role, machine);
+				return machine;
+			};
+		})(),
 		getTreeIdentity: (name) => {
-			const node = legionIdentity && getChildByName(legionIdentity.db, legionIdentity.nodeId, name);
+			const own = ownLegionIdentity();
+			const node = own && getChildByName(own.db, own.nodeId, name);
 			return node ? {
 				nodeId: node.id,
 				parentId: node.parentId,
@@ -807,10 +1210,37 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 				supervisorName: name,
 			} : undefined;
 		},
+		/**
+		 * subagent-renewal-v1 D3: the one renewal proposal the completion notice
+		 * may carry.
+		 *
+		 * Read from the persisted ChildRecord so a proposal survives process
+		 * boundaries (each tool call is a fresh process). Every "do not offer"
+		 * rule — D1 completed, D7 still running, D5 role opt-out, D8 no baseline —
+		 * lives inside `renewalProposalFor`, so returning its undefined is the
+		 * whole decision.
+		 */
+		getRenewalProposal: (name, execution) => {
+			// Each tool call is a fresh process, so the child record comes off disk
+			// rather than from any in-memory launch state.
+			const cwd = lastCwd;
+			if (!cwd) return undefined;
+			const located = findChild(runStoreFor(cwd).listRuns(), name);
+			if (!located) return undefined;
+			const catalog = loadCatalog(cwd, cwd, undefined);
+			const def = findControlAgent(catalog.agents, catalog.allAgents, located.child.agent);
+			return renewalProposalFor({
+				agent: def,
+				child: located.child,
+				sessionFile: located.child.sessionFile,
+				execution,
+				name,
+			});
+		},
 		subscribeSupervisorEvents: (name, listener, options) => rpcEventSource.onEvent?.(
 			name,
 			(event) => {
-				const nodeId = legionIdentity?.childNodeId(name);
+				const nodeId = ownLegionIdentity()?.childNodeId(name);
 				if (nodeId) publishSupervisorEvent(legionBus, nodeId, event, options);
 				listener(event);
 			},
@@ -925,9 +1355,17 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 		stop: stopChildren,
 		childStatus: (name, cwd) => {
 			try {
-				const found = findChild(runStoreFor(cwd).listRuns(), name);
+				const store = runStoreFor(cwd);
+				const runs = store.listRuns();
+				const found = findChild(runs, name);
 				if (!found) return undefined;
 				const child = found.child;
+				const alive = supervisor.isAlive(child.name);
+				// Run-dir ownership verdict (#209-3), the same one `subagent status`
+				// uses: `alive` is this process's in-memory registry and never holds a
+				// child launched elsewhere, so a foreign record needs the owner marker.
+				// Undefined while alive — liveness already wins there.
+				const owner = ownerVerdictFor(store, runs, child.name, alive);
 				return {
 					name: child.name,
 					state: child.state,
@@ -938,7 +1376,11 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 					...(child.acceptance
 						? { acceptance: { status: child.acceptance.status, level: child.acceptance.level } }
 						: {}),
-					alive: supervisor.isAlive(child.name),
+					// run.json records the arbitrated backend; a legacy record has none,
+					// and `renderLiveChildStatus` renders that as `unknown` — never `rpc`.
+					...(child.spawnMode ? { spawnMode: child.spawnMode } : {}),
+					alive,
+					...(owner ? { owner } : {}),
 				};
 			} catch {
 				return undefined;
@@ -1070,12 +1512,12 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 
 			let activeLegion: LegionRuntimeIdentity | undefined;
 			try {
-				activeLegion = resolveLegionIdentity({ pi, supervisor, store, cwd, settings, eventBus: legionBus, cached: legionIdentity, sessionFile: ctx.sessionManager?.getSessionFile() });
+				activeLegion = resolveLegionIdentity({ pi, supervisor, store, cwd, settings, eventBus: legionBus, cached: ownLegionIdentity(), sessionFile: ctx.sessionManager?.getSessionFile() });
 				if (!activeLegion && action === "launch" && !isChild) {
 					const plan = buildPlan(params);
 					if (plan.ok) activeLegion = createRootLegion({ pi, supervisor, store, cwd, task: plan.task, settings, maxDepth: effectiveMaxDepth(settings.legion?.maxDepth), eventBus: legionBus });
 				}
-				if (activeLegion) legionIdentity = activeLegion;
+				if (activeLegion) adoptLegionIdentity(activeLegion);
 			} catch (error) {
 				return fail(`legion runtime initialization failed: ${error instanceof Error ? error.message : String(error)}`, ErrorCodes.INVALID_PARAMS);
 			}
@@ -1096,6 +1538,9 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 					verifyRunner,
 					store,
 					cwd,
+					// #270: the session cwd is a second store worth searching when the
+					// call passes an explicit `cwd` that differs from it.
+					...(ctx.cwd && ctx.cwd !== cwd ? { callerCwd: ctx.cwd } : {}),
 					agents,
 					allAgents,
 					team,
@@ -1113,6 +1558,7 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 				params,
 				signal,
 				ctx,
+				pi,
 				supervisor,
 				uiProxy,
 				onBudgetRefused,
@@ -1139,7 +1585,16 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 					details !== null && typeof details === "object" && !Array.isArray(details)
 						? (details as Record<string, unknown>)
 						: undefined;
-				return ok("interrupted (parent turn ended; children still running)", carried);
+				// #266 D7: the inner interrupted result also carries the launch-queue
+				// flush line (`N queued launch(es) dropped: …`), which a bare head line
+				// would silently erase — the caller would think its launches still ran.
+				// An inner result that already reports the interruption is therefore
+				// kept as-is; only an otherwise-successful result is replaced.
+				const inner = (result.content ?? [])
+					.map((part) => (part.type === "text" ? part.text : ""))
+					.join("\n");
+				if (inner.includes(INTERRUPTED_HEAD)) return ok(inner, carried);
+				return ok(INTERRUPTED_HEAD, carried);
 			}
 			return result;
 		},
@@ -1156,7 +1611,7 @@ export default function piLegion(pi: ExtensionAPI, deps: ExtensionSupervisorDeps
 	};
 
 	uiProxy.onRequest((pending) => {
-		const legionNodeId = legionIdentity?.childNodeId(pending.childName);
+		const legionNodeId = ownLegionIdentity()?.childNodeId(pending.childName);
 		if (legionNodeId) publishUIRequest(legionBus, legionNodeId, pending.request.method);
 		const ui = lastUi;
 		if (!ui) return;
@@ -1317,6 +1772,11 @@ async function controlAction(input: {
 	verifyRunner?: VerifyRunner;
 	store: RunStore;
 	cwd: string;
+	/**
+	 * #270: the session's own cwd, when the call also passes an explicit `cwd`.
+	 * Child records may live in either store, so both are searched on a miss.
+	 */
+	callerCwd?: string;
 	agents: AgentConfig[];
 	allAgents: AgentConfig[];
 	team: ActiveTeam;
@@ -1367,7 +1827,7 @@ async function controlAction(input: {
 				// all names but before the serial loop reaches it. Treat that target as
 				// stopped; only rebuild if its persisted record is not already retired.
 				const found = findChild(input.store.listRuns(), name);
-				if (!found) throw new SubagentError(`unknown child: ${name}`, ErrorCodes.NOT_FOUND);
+				if (!found) throw unknownChildError(name);
 				if (found.child.state === "retired") return;
 				const orchestrator = new Orchestrator({
 					supervisor: input.supervisor,
@@ -1398,20 +1858,42 @@ async function controlAction(input: {
 		}
 		if (!params.name) {
 			const runs = store.listRuns();
-			const live = listLiveChildrenForStatus(runs);
+			// Liveness facts are read once per name and reused by both the filter and
+			// the block, so `status` cannot classify a child one way and render it
+			// another (display-liveness D6 exit 1).
+			const factsByName = new Map<string, StatusLivenessFacts & { pid?: number }>();
+			const factsFor = (child: StatusChildRecord): StatusLivenessFacts & { pid?: number } => {
+				const cached = factsByName.get(child.name);
+				if (cached) return cached;
+				const alive = input.supervisor.isAlive(child.name);
+				const owner = ownerVerdictFor(store, runs, child.name, alive);
+				// A pid only exists for a child this process actually tracks; a
+				// record from another session has none, and none is invented.
+				const pid = input.runtime.get(child.name)?.pid;
+				const facts = { alive, ...(owner ? { owner } : {}), ...(pid ? { pid } : {}) };
+				factsByName.set(child.name, facts);
+				return facts;
+			};
+			const classified = classifyChildrenForStatus(runs, factsFor);
 			return ok(
 				renderStatusOverview(
-					live.map((child) => {
-						const alive = input.supervisor.isAlive(child.name);
-						const owner = ownerVerdictFor(store, runs, child.name, alive);
-						return { child, alive, ...(owner ? { owner } : {}) };
+					classified.map(({ child, live }) => {
+						const { pid, ...facts } = factsFor(child);
+						return { child, ...facts, ...(pid ? { pid } : {}), live };
 					}),
 				),
 			);
 		}
 		const runs = store.listRuns();
-		const found = findChild(runs, params.name);
-		if (!found) return unknownChild(params.name, store, cwd);
+		// #270: a miss in this store is not a miss overall — a worktree child's
+		// record lives under its own store, which this one cannot enumerate.
+		const found = findChild(runs, params.name) ?? findChildAcrossStores({
+			name: params.name,
+			cwd,
+			callerCwd: input.callerCwd,
+			ownRoot: store.rootDir,
+		});
+		if (!found) return unknownChild(params.name, store, cwd, input.callerCwd);
 		const alive = input.supervisor.isAlive(params.name);
 		const owner = ownerVerdictFor(store, runs, params.name, alive);
 		return ok(renderLiveChildStatus({
@@ -1435,8 +1917,15 @@ async function controlAction(input: {
 		);
 	}
 
-	const found = findChild(store.listRuns(), params.name);
-	if (!found) return unknownChild(params.name, store, cwd);
+	const found =
+		findChild(store.listRuns(), params.name) ??
+		findChildAcrossStores({
+			name: params.name,
+			cwd,
+			callerCwd: input.callerCwd,
+			ownRoot: store.rootDir,
+		});
+	if (!found) return unknownChild(params.name, store, cwd, input.callerCwd);
 
 	const orchestrator = new Orchestrator({
 		supervisor: input.supervisor,
@@ -1499,13 +1988,29 @@ function unknownChild(
 	name: string,
 	store: RunStore,
 	cwd: string,
+	callerCwd?: string,
 ): AgentToolResult<unknown> {
-	const known = store.listRuns().flatMap((run) => run.children.map((child) => child.name));
+	// #270: search the stores that can plausibly hold the record before giving up.
+	// A worktree child's store lives under `<runDir>/worktrees/<name>/.pi-subagents`,
+	// which the root store can never enumerate, so a single-store lookup reports a
+	// miss for a child that plainly exists.
+	// The store already searched comes first, then every other candidate
+	// (caller cwd, worktree stores). `resolveChildAcrossStores` re-searches the
+	// own store too — that is deliberate: it returns the `searched` list the
+	// message needs, and a store with no runs simply drops out of it.
+	const { searched } = resolveChildAcrossStores({
+		name,
+		cwd,
+		callerCwd,
+		roots: [
+			{ rootDir: path.resolve(store.rootDir), reason: "cwd" as const },
+			...candidateStoreRoots({ cwd, callerCwd }).filter(
+				(candidate) => candidate.rootDir !== path.resolve(store.rootDir),
+			),
+		],
+	});
 	return fail(
-		`unknown child: ${name} (no run under ${cwd}/.pi-subagents` +
-			`${known.length ? `; known here: ${known.join(", ")}` : ""}). ` +
-			`Child records are scoped to the \`cwd\` they were launched from — ` +
-			`pass the same \`cwd\` you used for \`launch\`.`,
+		unknownChildMessage({ name, cwd, searched: searched as CandidateStore[] }),
 		ErrorCodes.NOT_FOUND,
 	);
 }
@@ -1596,6 +2101,171 @@ async function retireChild(
 	}
 }
 
+/**
+ * D8: a fresh progress baseline, taken from the session file as it is NOW.
+ *
+ * A child that has just been spawned (or relaunched from its session) may have
+ * an empty or not-yet-created session file; `lines: 0` is then the honest
+ * answer and everything written afterwards counts as progress. Never throws —
+ * an unreadable file is "nothing written yet", not a launch failure.
+ */
+export function renewalBaselineFor(
+	sessionFile: string,
+	at: number = Date.now(),
+	readLines: (file: string) => string[] | undefined = readSessionLines,
+): { at: number; lines: number } {
+	return { at, lines: readLines(sessionFile)?.length ?? 0 };
+}
+
+/**
+ * D5-a: was this child **cut off by its turn budget** rather than finishing?
+ *
+ * `continue`/`resume` works on every terminal child, but only a budget casualty
+ * should spend a renewal (D6) — otherwise an ordinary retry after a normal
+ * failure quietly eats the budget, and the budget stops meaning anything.
+ *
+ * Judgement order is frozen by D5-a and follows `src/shared/session.ts`'s
+ * measured semantics (F29), most reliable first:
+ *
+ *  1. `stopReason === "toolUse"` — the final assistant row was still waiting on
+ *     a tool when the process went away: the classic budget-exhaustion shape.
+ *  2. No assistant message for the last prompt — F29: a hard kill writes no
+ *     assistant row at all, so "missing reply" IS the abort signal.
+ *  3. `reason` mentions `terminated` — the host's own label, the weakest of the
+ *     three because wording is not a contract.
+ *
+ * A clean `stop` / `length` turn (the user simply asked for another round)
+ * matches none of them and does **not** spend a renewal.
+ *
+ * `shouldRecycleAfterCollect` is deliberately NOT used: it only separates
+ * terminal from non-terminal, which is a different question.
+ */
+export function wasBudgetCut(execution: Execution | undefined): boolean {
+	if (!execution) return false;
+	// 1. Terminated while a tool call was outstanding.
+	if (execution.stopReason === "toolUse") return true;
+	// 2. F29 hard kill: the turn has no assistant row at all.
+	if (
+		execution.reason === NO_ASSISTANT_ABORT_REASON &&
+		execution.stopReason !== "stop" &&
+		execution.stopReason !== "length"
+	) {
+		return true;
+	}
+	// 3. Host wording, last resort.
+	return execution.reason?.toLowerCase().includes("terminated") ?? false;
+}
+
+/**
+ * D3: the renewal proposal to attach to a **real termination** notice, or
+ * `undefined` when the contract says not to offer one.
+ *
+ * Extracted as a pure function (not inlined at the notify call site) because
+ * the whole decision is testable without launching a child: "was the budget
+ * cut + is the role renewable + has it a baseline" is arithmetic, not I/O.
+ *
+ * The four exits, all locked by tests:
+ * - **D1** a `completed` child is never a renewal candidate: it produced a
+ *   verdict, so offering `continue` would relaunch finished work.
+ * - **D7/A3** a `running` snapshot is a `wait`/`collect` deadline on a **live**
+ *   child (`inprocess-supervisor` merely resolved `{settled:false}`); the child
+ *   never lost a budget, so renewing it would spend a fresh one for nothing.
+ * - **D5/A4** `renewable: false` → no proposal at all, so the notice keeps the
+ *   exact pre-W3 bytes (no renewal lines).
+ * - **A2** no measurable progress is still **reported**: the caller passes the
+ *   measurement through and `notify.ts` prints "no measurable progress". The
+ *   proposal is withheld only for the three reasons above, never for "we could
+ *   not tell".
+ *
+ * **A5/D6**: `used >= max` still gets a proposal — the renderer turns it into
+ * `renewals exhausted (used/max) — split the task instead of renewing`. That is
+ * a deliberate hand-off to the human, not silence.
+ *
+ * `maxRenewals: 0` (D6) is "renewal disabled": `renewable` is the role-level
+ * switch, `0` the budget-level one, and both must agree before an offer is made.
+ */
+export function renewalProposalFor(input: {
+	agent: Pick<AgentConfig, "renewable" | "maxRenewals"> | undefined;
+	child: Pick<ChildRecord, "renewalBaseline" | "renewalsUsed">;
+	/** Session file the progress measurement reads; the resume credential (D8). */
+	sessionFile: string;
+	execution: { status: string; reason?: string };
+	name: string;
+	/** Injectable for tests; defaults to W1's measurer over the real session file. */
+	measure?: (sessionFile: string, baseline: { at: number; lines: number }) => {
+		toolResults: number;
+		assistantMessages: number;
+		filesChanged?: number;
+	};
+}): RenewalProposal | undefined {
+	const status = completionStatusOf(
+		input.execution.status,
+		// Acceptance is not part of this decision: D1 keys on the completion
+		// status alone, and `unknown` + a parsed verdict is handled by the
+		// caller's own status, not re-derived here.
+		undefined,
+	);
+	// D1: a finished child is not a renewal candidate.
+	if (status === "completed") return undefined;
+	// D7: `running` is a live child behind a `wait`/`collect` deadline.
+	if (status === "running") return undefined;
+	// D5: the role forbids renewal (e.g. scout: a timed-out search was mis-scoped).
+	if ((input.agent?.renewable ?? DEFAULT_RENEWABLE) === false) return undefined;
+	const max = input.agent?.maxRenewals ?? DEFAULT_MAX_RENEWALS;
+	// D6: `0` disables renewal outright; offering `0/0` would be a lie.
+	if (max <= 0) return undefined;
+	// D8: no baseline means nothing to measure against (#266-era records).
+	const baseline = input.child.renewalBaseline;
+	if (!baseline) return undefined;
+
+	const used = input.child.renewalsUsed ?? 0;
+	// D2 puts the worktree probe last, so the measurement is session-file only.
+	const measured = (input.measure ?? defaultRenewalMeasure)(
+		input.sessionFile,
+		baseline,
+	);
+	return {
+		progress: {
+			toolResults: measured.toolResults,
+			assistantMessages: measured.assistantMessages,
+			...(measured.filesChanged !== undefined
+				? { filesChanged: measured.filesChanged }
+				: {}),
+		},
+		used,
+		max,
+		// D4/A8: renewal IS `continue`; the parent gets a finished command.
+		command: `subagent({ action: "continue", name: "${input.name}", message: "<what to continue>" })`,
+	};
+}
+
+/** Session-file half of {@link renewalProposalFor}; no worktree probe (D2 puts it last). */
+function defaultRenewalMeasure(
+	sessionFile: string,
+	baseline: { at: number; lines: number },
+): { toolResults: number; assistantMessages: number; filesChanged?: number } {
+	return measureProgress({ sessionFile, baseline });
+}
+
+/**
+ * D6/D8: charge one renewal to a child, D5-a's way.
+ *
+ * Split out from `reviveChild` so the arithmetic is testable in isolation: the
+ * caller has already decided (via {@link wasBudgetCut}) whether this continue
+ * was a budget casualty, and only then does the counter move.
+ *
+ * Absent `renewalsUsed` means "never renewed" (#266-era record), so it reads as
+ * 0 rather than throwing. The baseline is the caller's business: it must come
+ * from the **relaunched** session file, which only that layer holds.
+ */
+export function chargeRenewal(
+	child: Pick<ChildRecord, "renewalsUsed">,
+): number {
+	const used = (child.renewalsUsed ?? 0) + 1;
+	child.renewalsUsed = used;
+	return used;
+}
+
 /**
  * Continue or resume a child.
  *
@@ -1641,6 +2311,32 @@ async function reviveChild(
 			name,
 			...(found.child.model ? { model: found.child.model } : {}),
 		});
+		// D6/D8/D5-a: spend one renewal, but only if this child was actually cut
+		// off by its turn budget.
+		//
+		// `continue` is legal on every terminal child (D4), yet an ordinary retry
+		// after a normal `stop` must not eat the budget — otherwise two harmless
+		// retries would silently exhaust the allowance that exists for genuine
+		// budget casualties. `wasBudgetCut` answers that from the session shape
+		// (F29/D5-a), not from `shouldRecycleAfterCollect` (terminal vs not, a
+		// different question).
+		//
+		// The baseline is reset in both branches. A non-budget continue still
+		// moved the child's own "since" line forward: keeping the old baseline
+		// would count this whole extra turn as progress at the next termination
+		// and overstate how much the child achieved under the current budget.
+		const resumedChild =
+			orchestrator.childrenSnapshot().find((entry) => entry.name === handle.name) ??
+			found.child;
+		// Read the verdict from `found.child`, NOT the orchestrator's record: `launch`
+		// clears `previous.execution` before returning (it is a relaunch), and
+		// `found` is a freshly parsed copy from `store.listRuns()`, so the pre-resume
+		// outcome is still intact there. Reading the orchestrator's object here
+		// would see `undefined` on every single resume and never charge anything.
+		const budgetCut = wasBudgetCut(found.child.execution);
+		resumedChild.renewalBaseline = renewalBaselineFor(handle.sessionFile);
+		if (budgetCut) chargeRenewal(resumedChild);
+		await persistChild(ctx.store, ctx.found.runId, ctx.orchestrator, handle.name);
 		followChild(ctx, { watch: true });
 		return ok(
 			`Resumed ${handle.name} from its session. Context preserved from ${handle.sessionFile}`,
@@ -1658,6 +2354,7 @@ async function reviveChild(
 async function launchFamily(input: {
 	params: SubagentParams;
 	ctx: ExtensionContext;
+	pi: ExtensionAPI;
 	supervisor: LegionSupervisor;
 	uiProxy: UIProxy;
 	onBudgetRefused: NonNullable<ConstructorParameters<typeof Orchestrator>[0]["onBudgetRefused"]>;
@@ -1735,6 +2432,10 @@ async function launchFamily(input: {
 		worktreeBootstrapTimeoutMs: settings.legion?.worktreeBootstrapTimeoutMs,
 		...teamForChildren(input.team),
 		...rpcApproveFrom(settings),
+		// #266 D6-a/D10: queue bounds + the D9 notice channel. The command chain is
+		// the bug's main path (a 12-step `tasks[]` fanout against `maxChildrenPerNode`).
+		launchQueue: launchQueueBounds(settings),
+		onLaunchQueueNotice: launchQueueNoticeSink(input.pi),
 		...(legion ? { legion: { db: legion.db, dbPath: legion.dbPath, nodeId: legion.nodeId, runId: run.runId, parentNodeId: legion.parentNodeId ?? undefined, parentRunId: legion.parentRunId ?? undefined, runStore: store, settings: legion.settings, eventBus: legion.eventBus } } : {}),
 		onBudgetRefused: input.onBudgetRefused,
 	});
@@ -1764,6 +2465,7 @@ async function launchFamily(input: {
 		// abort (interrupted results run after that), so it is kept per name
 		// here — same precedent as `timeoutByName`.
 		spawnByName: new Map(),
+		pidByName: new Map(),
 		...(nameGate.name ? { launchName: nameGate.name } : {}),
 	};
 
@@ -1775,10 +2477,28 @@ async function launchFamily(input: {
 
 	const interruptedResult = async (): Promise<AgentToolResult<unknown> | undefined> => {
 		if (!input.signal?.aborted) return undefined;
+		// #266 D7/A5: a parent turn end empties the launch queue and spawns nothing.
+		// Deliberately only HERE (and in the vexillatio interrupt): Esc/wait
+		// interruptions end the parent's *wait*, not its turn, and must leave
+		// children — queued ones included — running (`esc-no-retire-v3`).
+		const flushed = orchestrator.flushLaunchQueue("parent turn ended");
 		for (const name of session.handles) await abandonLaunchedChild(session, name);
 		session.handles.length = 0;
+		const flushLine = launchQueueFlushLine(flushed);
 		return {
-			content: [{ type: "text", text: session.results.join("\n") || "interrupted (parent turn ended; children still running)" }],
+			content: [{
+				type: "text",
+				text: [
+					// The head line LEADS (same frozen shape as the vexillatio interrupt):
+					// the outer abort net keeps an inner result that already reports the
+					// interruption, and only a leading head makes that detection reliable
+					// — otherwise each `parent turn ended; child still running (watched)`
+					// line reads like a standalone notice and the flush line is lost.
+					INTERRUPTED_HEAD,
+					session.results.join("\n"),
+					flushLine,
+				].filter(Boolean).join("\n"),
+			}],
 			details: { runId: run.runId, handles: [], async: params.async ?? true, ...spawnDetails() },
 		};
 	};
@@ -1858,6 +2578,13 @@ interface LaunchSession {
 	timeoutByName: Map<string, number>;
 	/** Arbitrated backend per resolved handle; survives an abort clearing `handles`. */
 	spawnByName: Map<string, { name: string; agent: string; spawnMode: SpawnMode }>;
+	/**
+	 * Own process of an `rpc` child, keyed by name — same reason `timeoutByName`
+	 * exists: `Handle.pid` is not persisted, so a re-follow from `ChildRecord`
+	 * cannot recover it. Kept out of `spawnByName` so `details.spawns` (a
+	 * renderer input) keeps its published shape.
+	 */
+	pidByName: Map<string, number>;
 	/** Explicit child name for this single-step launch; omit to auto-allocate. */
 	launchName?: string;
 }
@@ -1952,9 +2679,8 @@ async function launchStep(
 			// `--no-extensions` the child would resolve it there and die with
 			// "No API key found". The parent registry knows the live provider.
 			...(resolved.model ? { modelProvider: providerForModel(session.modelRegistry, resolved.model) } : {}),
-			// The origin decides whether an unacceptable model is refused or
-			// dropped, and only this layer can tell them apart (a parent model
-			// arrives as the same `dispatch` source as a per-run override).
+			// The origin distinguishes a deliberate per-run model from the parent's
+			// model falling through; the launch line reports which one won.
 			modelOrigin: model.modelOrigin,
 			worktree: resolveLaunchWorktree({
 				roleDefault: effective.worktree,
@@ -1976,6 +2702,7 @@ async function launchStep(
 			agent: effective.name,
 			spawnMode: handle.spawnMode,
 		});
+		if (handle.pid) session.pidByName.set(handle.name, handle.pid);
 		if (effective.timeoutMs !== undefined) {
 			session.timeoutByName.set(handle.name, effective.timeoutMs);
 		}
@@ -1984,18 +2711,8 @@ async function launchStep(
 			return;
 		}
 		session.results.push(
-			`▶ ${handle.name} (${effective.name}) supervisor=${handle.spawnMode}`,
+			`▶ ${handle.name} (${effective.name}) supervisor=${handle.spawnMode}${launchLineQueueSuffix(handle)}`,
 		);
-		// An inherited model the target CLI cannot express is dropped on purpose
-		// (the parent's pi model means nothing to cursor). Say so, or the user
-		// reasonably believes the child is running the model they see on the
-		// parent — the same silent surprise this whole guard exists to remove.
-		if (handle.child.modelDropped?.length) {
-			session.results.push(
-				`  ⚠ ${effective.name} runs on ${effective.kind}'s own default: ` +
-					`${handle.child.modelDropped.join(", ")} does not apply to that CLI.`,
-			);
-		}
 		session.onUpdate?.({
 			content: [
 				{
@@ -2094,23 +2811,100 @@ function resolveStep(
 	};
 }
 
+/**
+ * Collect one child, tolerating the transient gap an admission creates.
+ *
+ * `pumpAdmissions` deletes the `queued` placeholder before replaying the real
+ * launch, so between those two steps the name exists in neither the placeholder
+ * map nor the freshly spawned record. `collect()` resolves names through
+ * `requireChild`, so a collect that lands in that window throws
+ * `unknown child: <name>` — a race, not a real failure, and one only a queued
+ * child can hit. The window is a microtask-or-two long (the replay is awaited),
+ * so a short bounded retry is enough; anything genuinely gone still surfaces.
+ *
+ * Only used by the sequential `async:false` path. `async:true` never collects
+ * here — its watcher goes through the same `collect` but is re-armed, so a retry
+ * loop there would fight the watcher instead of helping it.
+ */
+async function collectThroughAdmission(
+	session: LaunchSession,
+	name: string,
+	signal?: AbortSignal,
+): Promise<Awaited<ReturnType<Orchestrator["collect"]>>> {
+	const deadline = Date.now() + ADMISSION_SETTLE_TIMEOUT_MS;
+	for (;;) {
+		try {
+			return await session.orchestrator.collect(name, {
+				timeoutMs: session.timeoutByName.get(name) ?? DEFAULTS.turnTimeoutMs,
+				...(signal ? { signal } : {}),
+			});
+		} catch (error) {
+			const transient = error instanceof SubagentError && error.code === ErrorCodes.NOT_FOUND;
+			if (!transient || Date.now() >= deadline || signal?.aborted) throw error;
+			await new Promise((resolve) => setTimeout(resolve, ADMISSION_SETTLE_POLL_MS));
+		}
+	}
+}
+
+/**
+ * How long a collect may retry across the admission gap before reporting it.
+ *
+ * Deliberately much shorter than a turn timeout: the gap is two `await`s wide,
+ * so anything still missing after this long is not racing — it is gone.
+ */
+const ADMISSION_SETTLE_TIMEOUT_MS = 5_000;
+const ADMISSION_SETTLE_POLL_MS = 25;
+
 /** Wait for each launched child's turn, appending its outcome. */
 async function collectInline(session: LaunchSession, signal?: AbortSignal): Promise<void> {
-	for (const name of session.handles) {
+	// #266 D8: collect children that already hold a slot FIRST.
+	//
+	// A queued handle resolves synchronously (`launch()` returns it before any
+	// spawn), so it lands in `handles` BEFORE the admitted siblings. Collecting in
+	// raw launch order would therefore block on the queued child first — waiting
+	// for a slot that only those very siblings can release once THEY are
+	// collected — i.e. a deadlock, not a wait. Launch order is preserved within
+	// each group, so a run with no queue keeps its exact previous order.
+	const queuedHere = new Set(
+		session.orchestrator
+			.childrenSnapshot()
+			.filter((child) => child.state === "queued")
+			.map((child) => child.name),
+	);
+	const ordered = [
+		...session.handles.filter((name) => !queuedHere.has(name)),
+		...session.handles.filter((name) => queuedHere.has(name)),
+	];
+	for (const name of ordered) {
 		if (signal?.aborted) {
 			session.results.push("interrupted (parent turn ended; children still running)");
 			return;
 		}
 		try {
-			const collected = await session.orchestrator.collect(name, {
-				timeoutMs: session.timeoutByName.get(name) ?? DEFAULTS.turnTimeoutMs,
-				...(signal ? { signal } : {}),
-			});
+			const collected = await collectThroughAdmission(session, name, signal);
 			if (signal?.aborted || collected.execution.reason === "aborted by parent") {
 				session.results.push("interrupted (parent turn ended; children still running)");
 				return;
 			}
 			session.results.push(renderCollect(name, collected));
+			// #266 D8/A20: `async:false` must report the real wait, not just look slow.
+			// Read AFTER collect: `queueWaitedMs` is written at admission, so an item
+			// that is still waiting when the collect deadline fires has no line yet.
+			const waitedLine = queuedWaitLine(
+				session.orchestrator.childrenSnapshot().find((child) => child.name === name),
+			);
+			if (waitedLine) session.results.push(waitedLine);
+			// A finished child must release its slot BEFORE the next collect starts,
+			// or a queue can never drain: `collectInline` is sequential, and the
+			// caller's retire loop runs after every collect (so with `maxChildrenPerNode:
+			// 1` the second child would wait for a slot the first still holds).
+			// Gated on a non-empty queue so the un-queued fast path is unchanged.
+			if (
+				session.orchestrator.launchQueueEntries().length > 0 &&
+				shouldRecycleAfterCollect(collected.execution.status)
+			) {
+				await session.orchestrator.retire(name);
+			}
 		} catch (error) {
 			session.results.push(`✗ ${name}: collect failed: ${String(error)}`);
 		}
@@ -2143,10 +2937,16 @@ type UtilityPlan =
 	| { ok: false; message: string };
 
 function buildUtilityPlan(params: VexillatioParams): UtilityPlan {
-	if (!params.task.trim()) return { ok: false, message: "`task` must not be blank." };
-	const steps: UtilityTaskItem[] = params.tasks?.length
-		? params.tasks
-		: [{ agent: params.agent?.trim() || "scout", task: params.task }];
+	const singleTask = params.task ?? "";
+	const parallel = params.tasks?.length ? params.tasks : undefined;
+	// `tasks[]` wins and `task` degrades to a parent-run label, so both shapes
+	// accepted by the schema reach a launch: `{ task }`, `{ tasks }`, `{ task, tasks }`.
+	if (!parallel && !singleTask.trim()) {
+		return { ok: false, message: "Provide one of: `task` (single recon) or `tasks[]` (parallel recon)." };
+	}
+	const steps: UtilityTaskItem[] = parallel
+		? parallel
+		: [{ agent: params.agent?.trim() || "scout", task: singleTask }];
 	const unsupportedVerify = steps.findIndex((item) => item.verify !== undefined);
 	if (unsupportedVerify >= 0) {
 		return {
@@ -2323,6 +3123,10 @@ async function launchUtilityFamily(input: {
 			childContext: resolveTeamContext("child", catalog.settings, catalog.team),
 			team: catalog.team,
 			...rpcApproveFrom(catalog.settings),
+			// #266: the parallel-recon path shares the same bounds and notice channel
+			// as the command chain — one scheduler for every dispatch family (D2).
+			launchQueue: launchQueueBounds(catalog.settings),
+			onLaunchQueueNotice: launchQueueNoticeSink(input.pi),
 			onBudgetRefused: input.onBudgetRefused,
 			...(legion ? {
 				legion: {
@@ -2381,6 +3185,7 @@ async function launchUtilityFamily(input: {
 					agent: item.agent.name,
 					sessionFile: handle.sessionFile,
 					spawnMode: handle.spawnMode,
+					...(handle.pid ? { pid: handle.pid } : {}),
 					orchestrator,
 					retire,
 				},
@@ -2397,6 +3202,7 @@ async function launchUtilityFamily(input: {
 		agent: string;
 		sessionFile: string;
 		spawnMode: SpawnMode;
+		pid?: number;
 		orchestrator: Orchestrator;
 		retire: (opts?: RetireOptions) => Promise<void>;
 	}> = [];
@@ -2414,6 +3220,7 @@ async function launchUtilityFamily(input: {
 			timeoutMs,
 			// Arbitrated at launch; never re-derived here (#209).
 			spawnMode: handle.spawnMode,
+			...(handle.pid ? { pid: handle.pid } : {}),
 			orchestrator: handle.orchestrator,
 			store,
 			watch,
@@ -2445,6 +3252,17 @@ async function launchUtilityFamily(input: {
 			lines.push(`sessionFile: ${handle.sessionFile}`);
 			return lines.join("\n");
 		} catch (error) {
+			// #266: a queued item is never "failed" — it never started. Treating it as
+			// still running keeps it out of the failure list and lets the retry/watch
+			// path own it, instead of retiring a launch the caller only asked to wait on.
+			const queuedNow = handle.orchestrator
+				.childrenSnapshot()
+				.find((entry) => entry.name === handle.name)?.state === "queued";
+			if (queuedNow) {
+				followUtility(handle, true);
+				stillRunning.add(handle.name);
+				return `── ${handle.name} ──\nexecution: queued (waiting for a free slot)\nsessionFile: ${handle.sessionFile}`;
+			}
 			if (input.supervisor.isAlive(handle.name)) {
 				followUtility(handle, true);
 				stillRunning.add(handle.name);
@@ -2455,13 +3273,27 @@ async function launchUtilityFamily(input: {
 			return `✗ ${handle.name}: collect failed: ${error instanceof Error ? error.message : String(error)}\nsessionFile: ${handle.sessionFile}`;
 		}
 	}));
-	if (input.signal?.aborted) return interruptedUtilityResult({
-		runId,
-		handles,
-		stillRunning,
-		results,
-		collected,
-	});
+	if (input.signal?.aborted) {
+		// #266 D7/A5: same rule as the command chain — a parent turn end empties
+		// every dispatch family's queue and spawns nothing. Each utility item owns
+		// its own Orchestrator, so each one flushes its own view of the shared queue.
+		const flushed: string[] = [];
+		for (const handle of handles) {
+			const child = handle.orchestrator.childrenSnapshot().find((entry) => entry.name === handle.name);
+			// D9: a queued item produced no result, so it must never be reported as
+			// one. It is either dropped by the flush below (reported by name) or, if
+			// it was already admitted, genuinely still running.
+			if (child?.state === "queued") flushed.push(...handle.orchestrator.flushLaunchQueue("parent turn ended"));
+		}
+		return interruptedUtilityResult({
+			runId,
+			handles,
+			stillRunning,
+			results,
+			collected,
+			flushed,
+		});
+	}
 	results.push(...collected);
 	return {
 		content: [{ type: "text", text: results.join("\n\n") || "No utility agents were launched." }],
@@ -2493,9 +3325,18 @@ function interruptedUtilityResult(input: {
 	stillRunning: Set<string>;
 	results: string[];
 	collected: string[];
+	/** #266 D7: names the abort cleared out of the launch queue (seq order). */
+	flushed?: readonly string[];
 }): AgentToolResult<unknown> {
 	const head = "interrupted (parent turn ended; children still running)";
-	const segments = [...input.results, ...input.collected].filter((segment) => segment.length > 0);
+	// #266 D7: a dropped queued launch is the reason the rest of the result is
+	// short, so it is reported even when nothing was collected at all. Trailing,
+	// like the command chain's line: it reads as a summary of what was cleared.
+	const segments = [
+		...input.results,
+		...input.collected,
+		launchQueueFlushLine(input.flushed ?? []),
+	].filter((segment) => segment.length > 0);
 	const stillRunning = input.handles
 		.filter(({ name }) => input.stillRunning.has(name))
 		.map(({ name }) => name);
@@ -2663,6 +3504,13 @@ function followJob(
 		treeIdentity?: { nodeId: string; parentId: string | null; depth: number };
 		/** Arbitrated backend from `Handle.spawnMode`; omitted when unknown (#209). */
 		spawnMode?: SpawnMode;
+		/**
+		 * Own process of an `rpc` child (`Handle.pid`), for the memory probe.
+		 * Omitted when the caller has no handle at hand — a rebuilt orchestrator
+		 * only knows `ChildRecord`, and a pid is not persisted, so it must not be
+		 * guessed or looked up elsewhere.
+		 */
+		pid?: number;
 	},
 ): void {
 	const child = input.orchestrator
@@ -2683,6 +3531,7 @@ function followJob(
 		...(child?.thinking !== undefined ? { thinking: child.thinking } : {}),
 		...(child?.worktreeBranch ? { worktreeBranch: child.worktreeBranch } : {}),
 		...(spawnMode ? { spawnMode } : {}),
+		...(input.pid ? { pid: input.pid } : {}),
 		...(input.treeIdentity ? input.treeIdentity : child?.nodeId ? {
 			nodeId: child.nodeId,
 			parentId: child.nodeId.includes(".") ? child.nodeId.slice(0, child.nodeId.lastIndexOf(".")) : null,
@@ -2760,16 +3609,21 @@ function followChild(ctx: ChildContext, opts: { watch: boolean }): void {
 }
 
 /**
- * The arbitrated backend recorded for one handled child of this request.
+ * The arbitrated backend recorded for one handled child of this request, plus
+ * the OS process of that child when the launch reported one.
  *
  * Spreads to nothing when unknown, so the caller never has to invent a value.
  */
 function spawnModeOf(
 	session: LaunchSession,
 	name: string,
-): { spawnMode?: SpawnMode } {
+): { spawnMode?: SpawnMode; pid?: number } {
 	const recorded = session.spawnByName.get(name);
-	return recorded ? { spawnMode: recorded.spawnMode } : {};
+	const pid = session.pidByName.get(name);
+	return {
+		...(recorded ? { spawnMode: recorded.spawnMode } : {}),
+		...(pid ? { pid } : {}),
+	};
 }
 
 function followLaunched(
@@ -2801,6 +3655,39 @@ function followLaunched(
 	});
 }
 
+/**
+ * Persist the orchestrator's current view of one child.
+ *
+ * RunStore is async while Orchestrator's `onChildUpdate` is synchronous, so
+ * persistence is done explicitly here rather than from inside the callback
+ * (which would leave floating promises).
+ */
+/**
+ * D8: give a child its spawn-time progress baseline exactly once.
+ *
+ * Called before every persist, so whichever launch path created the record
+ * seeds it at (as near as makes no difference) spawn time: `persistChild` runs
+ * immediately after `launch()` on every path — fresh launch, `tasks[]` fan-out,
+ * utility dispatch — and the session file is empty-ish at that moment by
+ * definition (`lines: 0` is then the honest answer, see {@link renewalBaselineFor}).
+ *
+ * The guard is "absent", never "stale":
+ * - a record written before this field existed seeds on its next write, which
+ *   is the first moment anything is known about it;
+ * - a renewed child keeps the baseline `reviveChild` handed it, so D8's
+ *   "count only what happened since the renewal" cannot be undone here.
+ */
+export function seedRenewalState(
+	child: Pick<ChildRecord, "sessionFile" | "renewalBaseline" | "renewalsUsed">,
+	now: number = Date.now(),
+	readLines: (file: string) => string[] | undefined = readSessionLines,
+): void {
+	if (!child.renewalBaseline) {
+		child.renewalBaseline = renewalBaselineFor(child.sessionFile, now, readLines);
+	}
+	if (child.renewalsUsed === undefined) child.renewalsUsed = 0;
+}
+
 /**
  * Persist the orchestrator's current view of one child.
  *
@@ -2817,6 +3704,10 @@ async function persistChild(
 ): Promise<void> {
 	const child = orchestrator.childrenSnapshot().find((c) => c.name === name);
 	if (!child) return;
+	// D8: every persist path is a launch path on its first call, so this is where
+	// a fresh child gets its baseline (see `seedRenewalState` for why it is safe
+	// to run unconditionally on later persists too).
+	seedRenewalState(child);
 	try {
 		const recorded = store.findChild(runId, name);
 		if (!recorded) {
@@ -2840,6 +3731,10 @@ async function abandonLaunchedChild(session: LaunchSession, name: string): Promi
 		session.runtime.release(name);
 		return;
 	}
+	// #266: a launch that never started cannot be "still running". Reporting it as
+	// watched would contradict the `N queued launch(es) dropped` line and tell the
+	// caller to wait for a child that will never produce a turn.
+	if (child.state === "queued") return;
 	// Esc / parent-turn abort must not retire: child keeps running; follow+watch
 	// so settle still notifies the parent (esc-no-retire-v3).
 	followLaunched(session, name, { watch: true });
@@ -2851,40 +3746,132 @@ async function abandonLaunchedChild(session: LaunchSession, name: string): Promi
 // ---------------------------------------------------------------------------
 
 /**
- * Live (non-retired / non-exited) children under this cwd for status overview.
+ * Child-record states that are terminal, so a record carrying one is never live
+ * (display-liveness D6, exit 1). `failed`/`settled` live on the execution side
+ * rather than in `TaskState`, but a run.json written by another version (or a
+ * hand-edited record) can carry them and they are terminal either way, so the
+ * set is keyed on strings instead of the narrow state union.
+ */
+const TERMINAL_STATUS_CHILD_STATES = new Set<string>([
+	"retired",
+	"exited",
+	"failed",
+	"settled",
+]);
+
+/** The persisted child record shape, as resolved through the run store. */
+type StatusChildRecord = NonNullable<ReturnType<RunStore["findChild"]>>;
+
+/**
+ * Liveness facts for one child, supplied by the caller.
  *
- * Names can be reused after retire; prefer the newest live record per name
- * (same preference as {@link pickChildByName}).
+ * `alive` is this process's in-memory supervisor answer (it never holds a child
+ * launched by another session); `owner` is the run-dir ownership verdict that
+ * covers that hole (#209-3). See {@link ownerVerdictFor}.
  */
-export function listLiveChildrenForStatus(
+export interface StatusLivenessFacts {
+	alive: boolean;
+	/** `undefined` while `alive` — in-memory liveness already decided (#209-3). */
+	owner?: "live" | "dead" | "unknown";
+}
+
+/** One run record after the status filter ran (display-liveness D6 exit 1). */
+export interface StatusChildClassification {
+	child: StatusChildRecord;
+	/**
+	 * Counted in `Status · N live children`. `false` = listed but NOT counted:
+	 * the record's run-dir owner pid is gone (#209-3 / A3).
+	 */
+	live: boolean;
+}
+
+/**
+ * Split the persisted child records under this cwd into `live` and `dead`.
+ *
+ * A record is dead when its owner pid is gone and this process is not running
+ * it — not merely when its `state` says so. `owner === "unknown"` counts as
+ * live: filtering unknown out would hide a child that may well be starting, and
+ * D2 forbids collapsing unknown into dead. Its block still reports
+ * `owner: unknown` + `state=working`, so it is never *displayed* as confirmed
+ * live — it is only not hidden.
+ *
+ * Names can be reused after retire, so the newest record per name wins, except
+ * that a dead record never shadows an older record of the same name that is
+ * still alive (same preference as {@link pickChildByName}).
+ *
+ * Without `factsFor` the filter falls back to the record state alone; that keeps
+ * this callable from a context that has no store (and keeps the pre-liveness
+ * signature working), but the `status` exit must pass facts.
+ */
+export function classifyChildrenForStatus(
 	runs: ReturnType<RunStore["listRuns"]>,
-): NonNullable<ReturnType<RunStore["findChild"]>>[] {
+	factsFor?: (child: StatusChildRecord) => StatusLivenessFacts,
+): StatusChildClassification[] {
 	const ranked = [...runs].sort((a, b) => b.createdAt.localeCompare(a.createdAt));
-	const seen = new Set<string>();
-	const out: NonNullable<ReturnType<RunStore["findChild"]>>[] = [];
+	const candidates: StatusChildClassification[] = [];
 	for (const run of ranked) {
 		for (const child of run.children) {
-			if (child.state === "retired" || child.state === "exited") continue;
-			if (seen.has(child.name)) continue;
-			seen.add(child.name);
-			out.push(child);
+			if (TERMINAL_STATUS_CHILD_STATES.has(child.state)) continue;
+			const facts = factsFor?.(child);
+			// Dead = the run dir's owner pid is gone AND this process is not running
+			// it. `owner === "unknown"` (no marker, or no pid in it) is never dead:
+			// unknown must not be collapsed into dead (display-liveness D2).
+			const live = !(facts?.owner === "dead" && !facts.alive);
+			candidates.push({ child, live });
 		}
 	}
-	return out;
+	// Name reuse: a newer DEAD record must not shadow an older record of the
+	// same name that is still live (mirror of `pickChildByName`, which prefers a
+	// live match over a newer retired one). Among equals the newest wins, hence
+	// the newest-first iteration order.
+	const chosen = new Map<string, StatusChildClassification>();
+	for (const entry of candidates) {
+		const prior = chosen.get(entry.child.name);
+		if (!prior || !prior.live) chosen.set(entry.child.name, entry);
+	}
+	return candidates.filter((entry) => chosen.get(entry.child.name) === entry);
 }
 
-/** Multi-child status text: one {@link renderLiveChildStatus} block per live child. */
-export function renderStatusOverview(
-	children: Array<{
-		child: NonNullable<ReturnType<RunStore["findChild"]>>;
-		alive: boolean;
-		/** Run-dir ownership verdict (#209-3); see {@link renderLiveChildStatus}. */
-		owner?: "live" | "dead" | "unknown";
-	}>,
-): string {
-	if (children.length === 0) return "No live children.";
-	const noun = children.length === 1 ? "child" : "children";
-	const blocks = children.map(({ child, alive, owner }) =>
+/**
+ * Live children under this cwd for the status overview.
+ *
+ * Pass `factsFor` to decide liveness from owner evidence instead of the record
+ * state alone; see {@link classifyChildrenForStatus}.
+ */
+export function listLiveChildrenForStatus(
+	runs: ReturnType<RunStore["listRuns"]>,
+	factsFor?: (child: StatusChildRecord) => StatusLivenessFacts,
+): StatusChildRecord[] {
+	return classifyChildrenForStatus(runs, factsFor).flatMap((entry) =>
+		entry.live ? [entry.child] : [],
+	);
+}
+
+/** One child block for {@link renderStatusOverview}. */
+export interface StatusChildEntry {
+	child: StatusChildRecord;
+	alive: boolean;
+	/** Run-dir ownership verdict (#209-3); see {@link renderLiveChildStatus}. */
+	owner?: "live" | "dead" | "unknown";
+	/**
+	 * Own process of an `rpc` child, when this session launched it. A pid is
+	 * not persisted, so a record from another session has none — and none is
+	 * invented here (D3).
+	 */
+	pid?: number;
+	/**
+	 * `false` = listed but not counted in the header (owner pid gone, see
+	 * {@link classifyChildrenForStatus}). Absent means live, so callers that only
+	 * hold live children keep their meaning.
+	 */
+	live?: boolean;
+}
+
+/** Multi-child status text: one {@link renderLiveChildStatus} block per child. */
+export function renderStatusOverview(children: StatusChildEntry[]): string {
+	const deadCount = children.filter((entry) => entry.live === false).length;
+	const liveCount = children.length - deadCount;
+	const blocks = children.map(({ child, alive, owner, pid }) =>
 		renderLiveChildStatus({
 			name: child.name,
 			state: child.state,
@@ -2896,9 +3883,22 @@ export function renderStatusOverview(
 			spawnMode: child.spawnMode,
 			alive,
 			...(owner ? { owner } : {}),
+			...(pid ? { pid } : {}),
 		}),
 	);
-	return [`Status · ${children.length} live ${noun}`, "", blocks.join("\n\n")].join("\n");
+	const parts: string[] = [];
+	if (liveCount === 0) {
+		// Nothing live. With no record at all this stays the exact literal the
+		// tests pin; with records that are all dead the count line below says so,
+		// instead of implying the run directory is empty.
+		parts.push("No live children.");
+	} else {
+		const noun = liveCount === 1 ? "child" : "children";
+		parts.push(`Status · ${liveCount} live ${noun}`);
+	}
+	if (deadCount > 0) parts.push(`(${deadCount} dead)`);
+	if (blocks.length > 0) parts.push("", blocks.join("\n\n"));
+	return parts.join("\n");
 }
 
 /**
@@ -3242,6 +4242,41 @@ function findControlAgent(
 	);
 }
 
+/**
+ * #270: resolve a child from another store when this one has no record.
+ *
+ * Only reached on a miss, so the common case (child launched here) costs
+ * nothing. The returned shape matches {@link findChild} so callers do not care
+ * which store answered — except that `runDir` now belongs to the owning store,
+ * which is why the caller re-derives its orchestrator run directory from it.
+ */
+function findChildAcrossStores(input: {
+	name: string;
+	cwd: string;
+	callerCwd?: string | undefined;
+	ownRoot: string;
+}): {
+	runId: string;
+	run: ReturnType<RunStore["listRuns"]>[number];
+	child: NonNullable<ReturnType<RunStore["findChild"]>>;
+} | null {
+	const { found } = resolveChildAcrossStores({
+		name: input.name,
+		cwd: input.cwd,
+		callerCwd: input.callerCwd,
+		roots: candidateStoreRoots({ cwd: input.cwd, callerCwd: input.callerCwd }).filter(
+			(candidate) => path.resolve(candidate.rootDir) !== path.resolve(input.ownRoot),
+		),
+	});
+	if (!found) return null;
+	// Read the owning store again for the full record: `resolveChildAcrossStores`
+	// only reports where the name was seen.
+	const runs = new RunStore({ rootDir: found.storeRoot }).listRuns();
+	const picked = pickChildByName(runs, input.name);
+	if (!picked) return null;
+	return { runId: picked.run.runId, run: picked.run, child: picked.child };
+}
+
 function findChild(
 	runs: ReturnType<RunStore["listRuns"]>,
 	name: string,