pi-subagents 0.81.0 → 0.82.0

package/src/runs/background/interrupted-elsewhere.js

@@ -0,0 +1,68 @@
+import { resolvePiSessionId } from "../../shared/session-identity.js";
+import { ownerConfirmedDead } from "../foreground/foreground-history.js";
+import { ownerSessionIds } from "../shared/run-ownership.js";
+import { checkRecordedPidLiveness } from "./stale-run-reconciler.js";
+/** Runs interrupted longer ago than this are not pointed to. */
+const INTERRUPTED_ELSEWHERE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+function interruptedElsewhereLine(reopenId, count) {
+    const command = `\`pi --session ${reopenId}\``;
+    return count === 1
+        ? `1 subagent run was interrupted in another session. Reopen it to resume it: ${command}`
+        : `${count} subagent runs were interrupted in another session. Reopen it to resume them: ${command}`;
+}
+/**
+ * Collects runs of other sessions in this folder that were cut off because their Pi died, from what
+ * session start reads anyway. Read-only: nothing is written to those runs or sessions. The cheap
+ * filters run as records arrive; `lines` reads each session file's header once, then probes each
+ * candidate's pid once.
+ */
+export function createInterruptedElsewhereCollector(input) {
+    const ownSessions = ownerSessionIds(input.currentSessionId);
+    // sessionId -> runId -> whether its owner is dead; a run seen from both sources counts once.
+    const candidates = new Map();
+    const recent = (at) => typeof at === "number" && input.now - at <= INTERRUPTED_ELSEWHERE_MAX_AGE_MS;
+    const add = (sessionId, runId, ownerDead) => {
+        if (ownSessions.has(sessionId))
+            return;
+        const runs = candidates.get(sessionId) ?? new Map();
+        if (!runs.has(runId))
+            runs.set(runId, ownerDead);
+        candidates.set(sessionId, runs);
+    };
+    return {
+        observeStatus(observed) {
+            // The listing passes the status.json values it read.
+            const status = observed;
+            if (!status || typeof status.sessionId !== "string" || typeof status.runId !== "string" || (status.state !== "running" && status.state !== "queued"))
+                return;
+            if (status.parentWorkflowRunId !== undefined || status.cwd !== input.cwd || !recent(status.lastUpdate ?? status.startedAt))
+                return;
+            const { pid, pidNamespaceScope, bootId } = status;
+            if (typeof pid !== "number")
+                return;
+            add(status.sessionId, status.runId, () => checkRecordedPidLiveness({ pid, pidNamespaceScope, bootId }) === "dead");
+        },
+        observeForegroundRun(run) {
+            if (!run.sessionId || run.parentWorkflowRunId !== undefined || run.cwd !== input.cwd || !recent(run.updatedAt))
+                return;
+            add(run.sessionId, run.runId, () => ownerConfirmedDead(run));
+        },
+        lines() {
+            const lines = [];
+            for (const [sessionId, runs] of candidates) {
+                // Only a persisted session can be reopened; its id is then its file path, whose header names
+                // the id `pi --session` resolves, so the command needs no quoting in any shell.
+                const reopenId = resolvePiSessionId(sessionId);
+                if (!reopenId)
+                    continue;
+                let interrupted = 0;
+                for (const ownerDead of runs.values())
+                    if (ownerDead())
+                        interrupted += 1;
+                if (interrupted > 0)
+                    lines.push(interruptedElsewhereLine(reopenId, interrupted));
+            }
+            return lines;
+        },
+    };
+}

package/src/runs/background/notify.d.ts

@@ -43,6 +43,8 @@ export interface SubagentNotifyDetails {
     /** The finished run's id; for a workflow it equals workflowRunId. */
     runId?: string;
     workflowRunId?: string;
+    /** What happens next to a workflow that Pi's exit or a runtime replacement stopped; decided once at delivery. */
+    resumeNotice?: string;
     childRuns?: Array<{
         runId: string;
         workflowKey?: string;

package/src/runs/background/notify.js

@@ -15,6 +15,8 @@ import { COMPLETION_ACTION } from "../../shared/parent-wake.js";
 import { resolveSubagentResultStatus } from "../../intercom/result-intercom.js";
 import { isUnexplainedProcessSignal } from "../shared/process-signal.js";
 import { capSummaryOutputs } from "../shared/single-output.js";
+import { describeWorkflowResume } from "../../workflows/workflow-resume-claim.js";
+import { isReusableWorkflowStopCause } from "../../workflows/workflow-stop-cause.js";
 const CHILD_OUTPUT_PREVIEW_MAX_BYTES = 2_000;
 const ERROR_LINE_MAX_BYTES = 300;
 const CHILD_OUTPUT_PREVIEW_COUNT = 8;
@@ -187,10 +189,13 @@ function formatCorrelationLines(details) {
     return [
         details.asyncDir ? `Retention-managed async directory: ${boundedSafeText(details.asyncDir)}` : undefined,
         details.workflowRunId ? `Workflow run: ${details.workflowRunId}` : undefined,
+        details.resumeNotice,
         details.childRuns?.length ? `Child runs: ${details.childRuns.map(formatChildRun).join(", ")}` : undefined,
         details.reconciledFromDetachedChild ? `Reconciled detached child: ${details.reconciledFromDetachedChild}` : undefined,
     ].filter((line) => line !== undefined);
 }
+// The forms of describeWorkflowResume, so a re-render keeps the line out of the result preview.
+const RESUME_NOTICE_PREFIXES = ["Auto-resumed as ", "Resumed as ", "Relaunched as ", "Not auto-resumed: ", "Resume by hand: ", "Relaunch it by hand with "];
 const WATCHDOG_BLOCKERS_HEADING = "Watchdog blockers:";
 function formatWatchdogBlockerLines(details) {
     if (!details.watchdogBlockers?.length)
@@ -295,6 +300,9 @@ export function parseSubagentNotifyContent(content) {
     const workflowRunIndex = body.findIndex((line) => line.startsWith("Workflow run: "));
     const childRunsIndex = body.findIndex((line) => line.startsWith("Child runs: "));
     const reconciledIndex = body.findIndex((line) => line.startsWith("Reconciled detached child: "));
+    // Only the slot right after `Workflow run:` carries the resume line; the same text elsewhere is output.
+    const resumeNoticeLine = workflowRunIndex >= 0 ? body[workflowRunIndex + 1] : undefined;
+    const resumeNotice = resumeNoticeLine && RESUME_NOTICE_PREFIXES.some((prefix) => resumeNoticeLine.startsWith(prefix)) ? resumeNoticeLine : undefined;
     const watchdogIndex = body.findIndex((line) => line === WATCHDOG_BLOCKERS_HEADING);
     const watchdogBlockers = watchdogIndex >= 0 ? parseWatchdogBlockerLines(body.slice(watchdogIndex + 1)) : [];
     const metadataIndexes = [sessionIndex, handoffIndex, workflowRunIndex, childRunsIndex, reconciledIndex, watchdogIndex].filter((index) => index >= 0);
@@ -332,6 +340,7 @@ export function parseSubagentNotifyContent(content) {
         resultPreview,
         ...(handoffPath ? { handoffPath } : {}),
         ...(workflowRunId ? { workflowRunId } : {}),
+        ...(resumeNotice ? { resumeNotice } : {}),
         ...(childRuns?.length ? { childRuns } : {}),
         ...(reconciledFromDetachedChild ? { reconciledFromDetachedChild } : {}),
         ...(watchdogBlockers.length ? { watchdogBlockers } : {}),
@@ -614,6 +623,9 @@ export function buildCompletionDetails(result) {
         : undefined;
     const reconciledFromDetachedChild = typeof result.reconciledFromDetachedChild === "string" ? result.reconciledFromDetachedChild : undefined;
     const asyncDir = nonemptyPath(result.asyncDir);
+    // Read here, once per delivery; a re-render parses the line back instead of reading the run again.
+    const stopCause = result.workflow?.stopCause;
+    const resumeNotice = workflowRunId && asyncDir && isReusableWorkflowStopCause(stopCause) ? describeWorkflowResume(asyncDir, workflowRunId) : undefined;
     const watchdogBlockers = [];
     const watchdogConcerns = [];
     const collectWatchdogFindings = (owner, progress) => {
@@ -653,6 +665,7 @@ export function buildCompletionDetails(result) {
         ...(handoffPath ? { handoffPath } : {}),
         ...(rawRunId ? { runId: rawRunId } : {}),
         ...(workflowRunId ? { workflowRunId } : {}),
+        ...(resumeNotice ? { resumeNotice } : {}),
         ...(childRuns.length ? { childRuns } : {}),
         ...(childOutputs?.length ? { childOutputs } : {}),
         ...(reconciledFromDetachedChild ? { reconciledFromDetachedChild } : {}),

package/src/runs/background/result-delivery-ownership.d.ts

@@ -2,6 +2,12 @@ import type { SubagentState } from "../../shared/types.ts";
 type ResultDeliveryState = Pick<SubagentState, "currentSessionId" | "completionOwnerId">;
 export interface ResultDeliveryOwnership {
     owns(sessionId: string, completionOwnerId: unknown): boolean;
+    /**
+     * The completion owner a result is delivered under: `owning-session` when its own owner is another Pi
+     * process that is confirmed dead and this session owns the run, so nothing else can ever deliver it;
+     * otherwise `completionOwnerId`.
+     */
+    deliveryOwnerId(sessionId: string | undefined, completionOwnerId: string | null | undefined, ownerProcess: unknown, parentWorkflowRunId: unknown): string | null | undefined;
     claimedSessionIds(): readonly string[];
 }
 export declare function createResultDeliveryOwnership(state: ResultDeliveryState): ResultDeliveryOwnership;

package/src/runs/background/result-delivery-ownership.js

@@ -1,5 +1,9 @@
 import { ownsRun } from "../shared/run-ownership.js";
 import { inheritedSessionIds } from "../../shared/session-succession.js";
+import { OWNING_SESSION_COMPLETION_OWNER } from "../../shared/completion-owner.js";
+import { checkRecordedPidLiveness, isRecordedPid } from "./stale-run-reconciler.js";
+// A dead process cannot come back, so only that verdict is kept.
+const deadCompletionOwnerIds = new Set();
 export function createResultDeliveryOwnership(state) {
     const currentOwner = () => typeof state.completionOwnerId === "string" && state.completionOwnerId
         ? state.completionOwnerId
@@ -7,10 +11,24 @@ export function createResultDeliveryOwnership(state) {
     return {
         owns(sessionId, completionOwnerId) {
             const owner = currentOwner();
-            if (!owner || completionOwnerId !== owner)
+            if (!owner || (completionOwnerId !== owner && completionOwnerId !== OWNING_SESSION_COMPLETION_OWNER))
                 return false;
             return ownsRun(state.currentSessionId, sessionId);
         },
+        deliveryOwnerId(sessionId, completionOwnerId, ownerProcess, parentWorkflowRunId) {
+            const owner = currentOwner();
+            // A workflow child is reported by its workflow, which has its own owner-exited notice.
+            if (!owner || typeof completionOwnerId !== "string" || completionOwnerId === owner
+                || completionOwnerId === OWNING_SESSION_COMPLETION_OWNER || parentWorkflowRunId
+                || !ownsRun(state.currentSessionId, sessionId))
+                return completionOwnerId;
+            if (!deadCompletionOwnerIds.has(completionOwnerId)) {
+                if (!isRecordedPid(ownerProcess) || checkRecordedPidLiveness(ownerProcess) !== "dead")
+                    return completionOwnerId;
+                deadCompletionOwnerIds.add(completionOwnerId);
+            }
+            return OWNING_SESSION_COMPLETION_OWNER;
+        },
         claimedSessionIds() {
             if (!currentOwner() || !state.currentSessionId)
                 return [];

package/src/runs/background/result-watcher.d.ts

@@ -31,7 +31,7 @@ type ResultWatcherDeps = {
     resultScanLogging?: "all" | "activity" | "off";
     platform?: NodeJS.Platform;
     /** Shared current/predecessor session ownership used by the notifier. */
-    ownership?: Pick<ResultDeliveryOwnership, "owns" | "claimedSessionIds">;
+    ownership?: Pick<ResultDeliveryOwnership, "owns" | "claimedSessionIds" | "deliveryOwnerId">;
     /** Called once the parent has this run's result: the notifier accepted it, or an earlier delivery already did. */
     onResultDelivered?: (runId: string) => void;
 };
@@ -69,6 +69,8 @@ type ResultFileData = CompletionNotification & {
     intercomTarget?: string;
     parallelHandoff?: ParallelHandoffReference;
     notificationDeliveredAt?: unknown;
+    completionOwnerProcess?: unknown;
+    parentWorkflowRunId?: unknown;
 };
 /**
  * Watches persisted async results for the session currently owned by this

package/src/runs/background/result-watcher.js

@@ -19,25 +19,31 @@ const RETRY_DELAY_MS = 100;
 // lease attempt instead of parking this event loop while a runner publishes the same run.
 const CLEANUP_LEASE_WAIT_MS = 0;
 const SLOW_RESULT_SCAN_MS = 500;
-function jsonStringProperty(raw, property) {
-    const matches = raw.matchAll(new RegExp(`"${property}"\\s*:\\s*("(?:\\\\.|[^"\\\\])*")`, "g"));
+/** The last `"property": <value>` whose value matches `valuePattern`, parsed without reading the whole file; malformed reads as none. */
+function jsonPropertyValue(raw, property, valuePattern) {
     let encoded;
-    for (const match of matches)
+    for (const match of raw.matchAll(new RegExp(`"${property}"\\s*:\\s*(${valuePattern})`, "g")))
         encoded = match[1];
     if (!encoded)
         return undefined;
     try {
-        const value = JSON.parse(encoded);
-        return typeof value === "string" && value ? value : undefined;
+        return JSON.parse(encoded);
     }
     catch {
         return undefined;
     }
 }
+function jsonStringProperty(raw, property) {
+    const value = jsonPropertyValue(raw, property, `"(?:\\\\.|[^"\\\\])*"`);
+    return typeof value === "string" && value ? value : undefined;
+}
 function resultFileIdentity(raw, file) {
     return {
         sessionId: jsonStringProperty(raw, "sessionId"),
         completionOwnerId: jsonStringProperty(raw, "completionOwnerId"),
+        // Recorded as a flat object, so a brace-free match is the whole value.
+        completionOwnerProcess: jsonPropertyValue(raw, "completionOwnerProcess", `\\{[^{}]*\\}`),
+        parentWorkflowRunId: jsonStringProperty(raw, "parentWorkflowRunId"),
         runId: file.replace(/\.json$/i, ""),
     };
 }
@@ -105,6 +111,9 @@ export function createResultWatcher(pi, state, resultsDir, completionTtlMs, deps
     // While deliverPendingResults runs, completions skip the batch delay.
     let deliveringPending = 0;
     const identityCache = new Map();
+    // Result file -> last logged mission-sync error. A failed sync is retried
+    // every pass, so the same error is logged once per result file.
+    const reportedMissionSyncFailures = new Map();
     let deliveryActive = true;
     let deliveryEpoch = 0;
     let resultScanTimer = null;
@@ -116,6 +125,7 @@ export function createResultWatcher(pi, state, resultsDir, completionTtlMs, deps
             && typeof completionOwnerId === "string"
             && completionOwnerId === state.completionOwnerId);
     const claimedSessionIds = () => deps.ownership?.claimedSessionIds() ?? [];
+    const deliveryOwnerId = deps.ownership?.deliveryOwnerId ?? ((_sessionId, completionOwnerId) => completionOwnerId);
     const ownsCompletion = (sessionId, completionOwnerId, epoch) => {
         if (!deliveryActive || epoch !== deliveryEpoch)
             return false;
@@ -223,7 +233,7 @@ export function createResultWatcher(pi, state, resultsDir, completionTtlMs, deps
         // files keep their existing diagnostics and compatibility behavior.
         if (!identity.sessionId)
             return true;
-        if (ownsResult(identity.sessionId, identity.completionOwnerId))
+        if (ownsResult(identity.sessionId, deliveryOwnerId(identity.sessionId, identity.completionOwnerId, identity.completionOwnerProcess, identity.parentWorkflowRunId)))
             return true;
         // Acknowledgment removes the observer index; gating on the mission binding instead
         // re-ran mission sync for an unowned result on every scan.
@@ -306,7 +316,7 @@ export function createResultWatcher(pi, state, resultsDir, completionTtlMs, deps
             if (typeof data.sessionId !== "string" || !data.sessionId)
                 return;
             const sessionId = data.sessionId;
-            const completionOwnerId = data.completionOwnerId;
+            const completionOwnerId = deliveryOwnerId(sessionId, data.completionOwnerId, data.completionOwnerProcess, data.parentWorkflowRunId);
             const runId = typeof data.runId === "string" && data.runId
                 ? data.runId
                 : typeof data.id === "string" && data.id ? data.id : file.replace(/\.json$/i, "");
@@ -329,10 +339,15 @@ export function createResultWatcher(pi, state, resultsDir, completionTtlMs, deps
             let observerSucceeded = true;
             try {
                 syncMissionFromAsyncCompletion({ ...data, runId });
+                reportedMissionSyncFailures.delete(file);
             }
             catch (error) {
                 observerSucceeded = false;
-                console.error(`Mission completion sync failed for '${resultPath}':`, error);
+                const message = error instanceof Error ? error.message : String(error);
+                if (reportedMissionSyncFailures.get(file) !== message) {
+                    reportedMissionSyncFailures.set(file, message);
+                    console.error(`Mission completion sync failed for '${resultPath}':`, error);
+                }
             }
             try {
                 deps.observeCompletion?.({ ...data, runId });
@@ -484,6 +499,7 @@ export function createResultWatcher(pi, state, resultsDir, completionTtlMs, deps
                 ...data,
                 id: data.id ?? runId,
                 runId,
+                completionOwnerId,
                 triggerTurn,
                 intercomDelivered,
                 ...(nestedChildren?.length ? { nestedChildren } : {}),

package/src/runs/background/run-child-session.d.ts

@@ -91,12 +91,7 @@ export interface RunChildSessionResult {
     toolCount: number;
     durationMs: number;
     model?: string;
-    nativeMachine?: {
-        provider: "herdr";
-        machineId: string;
-        initialGit?: import("../../shared/types.ts").HerdrRemoteGitStatus;
-        finalGit?: import("../../shared/types.ts").HerdrRemoteGitStatus;
-    };
+    nativeMachine?: import("../../shared/types.ts").SingleResult["nativeMachine"];
     error?: string;
     finalOutput: string;
     outputState: SubagentOutputState;

package/src/runs/background/run-child-session.js

@@ -526,7 +526,7 @@ export function runChildSession(input) {
                     toolCount,
                     durationMs: Date.now() - startedAt,
                     model,
-                    nativeMachine: session?.machineEvidence ? { provider: "herdr", machineId: session.machineEvidence.machineId, ...(session.machineEvidence.initial ? { initialGit: session.machineEvidence.initial } : {}), ...(session.machineEvidence.final ? { finalGit: session.machineEvidence.final } : {}) } : undefined,
+                    nativeMachine: session?.machineEvidence ? { provider: session.machineEvidence.provider, machineId: session.machineEvidence.machineId, ...(session.machineEvidence.initial ? { initialGit: session.machineEvidence.initial } : {}), ...(session.machineEvidence.final ? { finalGit: session.machineEvidence.final } : {}) } : undefined,
                     error: stopped ? stopMessage() : timedOut ? (error ?? timeoutMessage()) : interrupted || (forcedDrainAfterFinalSuccess && !forcedDrainAfterEmptyTerminal && !commandError) ? undefined : finalError,
                     finalOutput: (timedOut || stopped) && !finalOutput.trim() ? (stopped ? stopMessage() : error ?? timeoutMessage()) : finalOutput,
                     outputState: finalOutput.trim() ? "present" : "absent",

package/src/runs/background/run-status.js

@@ -36,6 +36,7 @@ import { workflowAsyncChildSteeringGuidance } from "../shared/workflow-async-chi
 import { formatWorkflowKeyRevival, projectWorkflowKeyRevival } from "../../workflows/workflow-revival.js";
 import { capSummaryOutputs } from "../shared/single-output.js";
 import { ownsRun } from "../shared/run-ownership.js";
+import { foregroundChildStateLabel } from "../foreground/foreground-history.js";
 /** A step whose structured output has a path line needs only a short inline preview. */
 const STRUCTURED_PREVIEW_WITH_PATH_CHARS = 500;
 function formatProcessTerminal(value) {
@@ -200,7 +201,7 @@ function formatRememberedForegroundStatus(run) {
     for (const child of run.children) {
         const output = rememberedForegroundChildOutput(child).trim().split(/\r?\n/).find((line) => line.trim());
         const parts = [
-            `${child.index + 1}. ${child.sessionName?.trim() || child.agent} ${child.status}`,
+            `${child.index + 1}. ${child.sessionName?.trim() || child.agent} ${foregroundChildStateLabel(run, child)}`,
             child.exitCode !== undefined ? `exit ${child.exitCode}` : undefined,
             child.detachedReason ? `detached: ${child.detachedReason}` : undefined,
             child.acceptance ? `acceptance: ${child.acceptance.status}` : undefined,

package/src/runs/background/stale-run-reconciler.d.ts

@@ -24,6 +24,12 @@ interface ReconcileAsyncRunOptions {
     missingStatusGraceMs?: number;
     staleAlivePidMs?: number;
     pidNamespaceScope?: () => string | undefined;
+    bootId?: () => string | undefined;
+    /**
+     * This process's completion owner, for an owner-exited workflow repair to adopt so the session that
+     * reopened it delivers its notice. Only callers whose session owns the run pass it.
+     */
+    adoptCompletionOwnerId?: string;
 }
 interface ReconcileAsyncRunResult {
     status: AsyncStatus | null;
@@ -33,5 +39,24 @@ interface ReconcileAsyncRunResult {
 }
 export declare function reconcileNestedAsyncDescendants(route: NestedRoute, options?: ReconcileAsyncRunOptions): void;
 export declare function checkPidLiveness(pid: number, kill?: KillFn, probeZombie?: boolean): PidLiveness;
+export interface RecordedPid {
+    pid: number;
+    pidNamespaceScope?: string;
+    bootId?: string;
+}
+export declare function isRecordedPid(value: unknown): value is RecordedPid;
+export interface RecordedPidObservation {
+    observedScope: string | undefined;
+    observedBootId: string | undefined;
+    kill?: KillFn;
+    /** Replaces the default `checkPidLiveness` probe. */
+    probe?: (pid: number) => PidLiveness;
+}
+/**
+ * Liveness of a pid saved in a status file. A pid saved under another boot is dead without a
+ * probe, but only when both sides are in the same pid namespace or neither records one: a
+ * macOS host reading a Linux container's runs must not compare their boot ids.
+ */
+export declare function checkRecordedPidLiveness(recorded: RecordedPid, observation?: RecordedPidObservation): PidLiveness;
 export declare function reconcileAsyncRun(asyncDir: string, options?: ReconcileAsyncRunOptions, observeStatus?: RawDrainStatusObserver): ReconcileAsyncRunResult;
 export {};

package/src/runs/background/stale-run-reconciler.js

@@ -4,6 +4,7 @@ import { writeAtomicJson } from "../../shared/atomic-json.js";
 import { resultFilePath, resultPayloadPathForSessionRun, writeAsyncResultFile } from "./result-files.js";
 import { updateActiveRunIndex } from "./active-run-index.js";
 import { readProcessTerminal } from "./process-terminal.js";
+import { OWNING_SESSION_COMPLETION_OWNER } from "../../shared/completion-owner.js";
 import { readStatus } from "../../shared/utils.js";
 import { DIRS } from "../../shared/types.js";
 import { resolveEffectiveThinking } from "../../shared/model-info.js";
@@ -11,6 +12,8 @@ import { normalizeParallelGroups } from "./parallel-groups.js";
 import { nestedSummaryFromAsyncStatus, projectNestedEvents, resolveNestedAsyncDir, writeNestedEvent } from "../shared/nested-events.js";
 import { assertWorkflowGraphHostSteps } from "../shared/host-step-status.js";
 import { currentPidNamespaceScope } from "./pid-namespace.js";
+import { currentBootId } from "./boot-id.js";
+import { WORKFLOW_STOP_CAUSE_OWNER_EXITED } from "../../workflows/workflow-stop-cause.js";
 import { isTerminalAsyncState } from "./workflow-terminal-proof.js";
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -215,9 +218,14 @@ function settledWorkflowChildStatus(asyncDir, workflowRunId, step, now) {
         delete settled.stopped;
     return settled;
 }
-function buildFailedRepair(status, asyncDir, now, reason) {
+function buildFailedRepair(status, asyncDir, now, reason, ownerExited = false, adoptCompletionOwnerId) {
     const runId = status.runId || path.basename(asyncDir);
     const pid = typeof status.pid === "number" ? status.pid : "unknown";
+    // A dead workflow host is the Pi process itself; its journal keeps the finished children for a relaunch.
+    const exitedWorkflow = ownerExited && status.mode === "workflow" ? status.workflow : undefined;
+    // Its owner process is dead, so nothing else can deliver its notice: an owning session that repairs it
+    // adopts it, and a repair elsewhere leaves it to whichever session owns the run.
+    const completionOwnerId = exitedWorkflow ? adoptCompletionOwnerId || OWNING_SESSION_COMPLETION_OWNER : status.completionOwnerId;
     const terminal = readProcessTerminal(asyncDir, { runId }) ?? status.processTerminal;
     const runnerExit = terminal?.state === "observed" || terminal?.state === "unknown"
         ? terminal.instances?.find((instance) => instance.kind === "runner" && instance.processInstanceId === terminal.runnerProcessInstanceId)
@@ -225,7 +233,9 @@ function buildFailedRepair(status, asyncDir, now, reason) {
     const exitText = runnerExit?.kind === "runner"
         ? `exited with code ${runnerExit.exitCode ?? "none"}${runnerExit.signal ? ` (signal ${runnerExit.signal})` : ""}`
         : "exited or disappeared";
-    const baseMessage = reason ?? `Async runner process ${pid} ${exitText} before writing a result. Marked run failed by stale-run reconciliation.`;
+    const baseMessage = reason ?? (exitedWorkflow
+        ? `The Pi process (PID ${pid}) that ran workflow ${runId} exited before the workflow finished. Marked run failed by stale-run reconciliation. Its finished children are kept.`
+        : `Async runner process ${pid} ${exitText} before writing a result. Marked run failed by stale-run reconciliation.`);
     const diagnostics = readRunnerStartupDiagnostics(asyncDir);
     const message = diagnostics ? `${baseMessage}\n\nRunner stderr tail:\n${diagnostics}` : baseMessage;
     const steps = status.steps?.length ? status.steps : [{ agent: "subagent", status: "running" }];
@@ -263,6 +273,9 @@ function buildFailedRepair(status, asyncDir, now, reason) {
         lastUpdate: now,
         endedAt: now,
         steps: repairedSteps,
+        // Read from the pre-repair status: the repair time would make an old crash look new.
+        ...(exitedWorkflow ? { workflow: { ...exitedWorkflow, stopCause: WORKFLOW_STOP_CAUSE_OWNER_EXITED, ownerExitedAt: status.lastUpdate ?? status.startedAt } } : {}),
+        ...(completionOwnerId ? { completionOwnerId } : {}),
     };
     const resultAgent = repairedSteps[status.currentStep ?? 0]?.agent ?? repairedSteps[0]?.agent ?? "subagent";
     return {
@@ -272,7 +285,9 @@ function buildFailedRepair(status, asyncDir, now, reason) {
             id: runId,
             agent: resultAgent,
             mode: status.mode,
-            ...(status.completionOwnerId ? { completionOwnerId: status.completionOwnerId } : {}),
+            ...(exitedWorkflow ? { workflow: { stopCause: WORKFLOW_STOP_CAUSE_OWNER_EXITED } } : {}),
+            ...(completionOwnerId ? { completionOwnerId } : {}),
+            ...(status.completionOwnerProcess ? { completionOwnerProcess: status.completionOwnerProcess } : {}),
             ...(status.parentWorkflowRunId ? { parentWorkflowRunId: status.parentWorkflowRunId } : {}),
             ...(status.workflowKey ? { workflowKey: status.workflowKey } : {}),
             success: false,
@@ -298,8 +313,8 @@ function buildFailedRepair(status, asyncDir, now, reason) {
         },
     };
 }
-function writeFailedRepair(asyncDir, status, resultPath, now, reason) {
-    const repair = buildFailedRepair(status, asyncDir, now, reason);
+function writeFailedRepair(asyncDir, status, resultPath, now, reason, ownerExited = false, adoptCompletionOwnerId) {
+    const repair = buildFailedRepair(status, asyncDir, now, reason, ownerExited, adoptCompletionOwnerId);
     if (repair.result.sessionId)
         writeAsyncResultFile(resultPath, repair.result);
     writeAtomicJson(path.join(asyncDir, "status.json"), repair.status);
@@ -386,6 +401,32 @@ export function checkPidLiveness(pid, kill = process.kill, probeZombie = false)
         return "unknown";
     }
 }
+export function isRecordedPid(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const { pid, pidNamespaceScope, bootId } = value;
+    return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0
+        && (pidNamespaceScope === undefined || typeof pidNamespaceScope === "string")
+        && (bootId === undefined || typeof bootId === "string");
+}
+/**
+ * Liveness of a pid saved in a status file. A pid saved under another boot is dead without a
+ * probe, but only when both sides are in the same pid namespace or neither records one: a
+ * macOS host reading a Linux container's runs must not compare their boot ids.
+ */
+export function checkRecordedPidLiveness(recorded, observation = { observedScope: currentPidNamespaceScope(), observedBootId: currentBootId() }) {
+    const { observedScope, observedBootId } = observation;
+    if (recorded.pidNamespaceScope === observedScope && recorded.bootId && observedBootId && recorded.bootId !== observedBootId)
+        return "dead";
+    // An observer without a scope (macOS/Windows host sharing a container's temp root) cannot match a recorded one.
+    const scopeMismatch = recorded.pidNamespaceScope !== undefined && recorded.pidNamespaceScope !== observedScope;
+    // A local zombie is evidence about this pid only when its namespace is known to match.
+    const scopeVerified = recorded.pidNamespaceScope !== undefined && recorded.pidNamespaceScope === observedScope;
+    const liveness = observation.probe
+        ? observation.probe(recorded.pid)
+        : checkPidLiveness(recorded.pid, observation.kill, scopeVerified);
+    return liveness === "dead" && scopeMismatch ? "unknown" : liveness;
+}
 export function reconcileAsyncRun(asyncDir, options = {}, observeStatus) {
     const now = options.now?.() ?? Date.now();
     const status = readStatus(asyncDir);
@@ -450,13 +491,11 @@ export function reconcileAsyncRun(asyncDir, options = {}, observeStatus) {
             return { status: null, repaired: false, resultPath };
         }
     }
-    const observedScope = options.pidNamespaceScope ? options.pidNamespaceScope() : currentPidNamespaceScope();
-    // An observer without a scope (macOS/Windows host sharing a container's temp root) cannot match a recorded one.
-    const pidScopeMismatch = effectiveStatus.pidNamespaceScope !== undefined && effectiveStatus.pidNamespaceScope !== observedScope;
-    // A local zombie is evidence about this runner only when its namespace is known to match.
-    const pidScopeVerified = effectiveStatus.pidNamespaceScope !== undefined && effectiveStatus.pidNamespaceScope === observedScope;
-    const observedLiveness = checkPidLiveness(effectiveStatus.pid, options.kill, pidScopeVerified);
-    const liveness = observedLiveness === "dead" && pidScopeMismatch ? "unknown" : observedLiveness;
+    const liveness = checkRecordedPidLiveness({ pid: effectiveStatus.pid, pidNamespaceScope: effectiveStatus.pidNamespaceScope, bootId: effectiveStatus.bootId }, {
+        kill: options.kill,
+        observedScope: options.pidNamespaceScope ? options.pidNamespaceScope() : currentPidNamespaceScope(),
+        observedBootId: options.bootId ? options.bootId() : currentBootId(),
+    });
     if (liveness !== "dead") {
         const staleAfterMs = options.staleAlivePidMs ?? 24 * 60 * 60 * 1000;
         const lastUpdate = effectiveStatus.lastUpdate ?? effectiveStatus.startedAt;
@@ -466,5 +505,5 @@ export function reconcileAsyncRun(asyncDir, options = {}, observeStatus) {
         const message = `Async runner PID ${effectiveStatus.pid} ${probe}; status has not updated for ${now - lastUpdate}ms, so stale-run reconciliation marked the run failed because PID ownership is unverified.`;
         return writeFailedRepair(asyncDir, effectiveStatus, resultPath, now, message);
     }
-    return writeFailedRepair(asyncDir, effectiveStatus, resultPath, now);
+    return writeFailedRepair(asyncDir, effectiveStatus, resultPath, now, undefined, true, options.adoptCompletionOwnerId);
 }

package/src/runs/background/subagent-runner-bootstrap.js

@@ -14,6 +14,7 @@ import { acquireSessionLease } from "../shared/session-lease.js";
 import { readProcessTerminalCandidate, writeProcessTerminalCandidate, markProcessTerminalCandidateLeaseRelease } from "./process-terminal-candidate.js";
 import { persistRunnerStartupFailure } from "./runner-startup-failure.js";
 import { currentPidNamespaceScope } from "./pid-namespace.js";
+import { primeBootId } from "./boot-id.js";
 function isRecord(value) {
     return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -103,6 +104,8 @@ async function waitForStartupControl(controlPath, token, action, timeoutMs = 30_
 export async function runConfiguredSubagent(rawConfig, options = {}) {
     validateSubagentRunConfig(rawConfig);
     const config = rawConfig;
+    // The runner never reads the boot id from the OS (sysctl on macOS); Pi passes it to direct runners only.
+    primeBootId(typeof config.bootId === "string" && config.bootId ? config.bootId : undefined);
     let lease;
     let startupCommitted = config.revivalLease === undefined && config.launchBarrierToken === undefined;
     let executionLoaded = false;

package/src/runs/background/subagent-runner.d.ts

@@ -4,6 +4,7 @@ import { type RunnerSubagentStep as SubagentStep, type RunnerStep } from "../sha
 import type { InheritedChildRuntime } from "../shared/child-launch.ts";
 import type { ChildSessionFactory, DefaultChildSessionFactoryOptions } from "../shared/child-session.ts";
 import { type ChildEvent, type SteerDelivery, type StepSteerHandler } from "./run-child-session.ts";
+import type { RecordedPid } from "./stale-run-reconciler.ts";
 import type { SessionLeaseRequest } from "../shared/session-lease.ts";
 import { createHerdrExternalAdapter, type HerdrExternalAdapterId, type HerdrExternalResult } from "../shared/herdr-external-adapters.ts";
 import { type OrcaProgressTab } from "../shared/orca-progress-tabs.ts";
@@ -25,6 +26,7 @@ export interface SubagentRunConfig {
     asyncDir: string;
     sessionId?: string | null;
     completionOwnerId?: string;
+    completionOwnerProcess?: RecordedPid;
     piPackageRoot?: string;
     /** Test seam: module the runner imports its `ChildSessionFactory` from. */
     childSessionFactoryModule?: string;
@@ -76,6 +78,8 @@ export interface SubagentRunConfig {
     runtimeAcknowledgedExtensions?: RuntimeAcknowledgedChildExtensions;
     runnerProcessInstanceId?: string;
     launchBarrierToken?: string;
+    /** Pi's boot id, set only for a direct (non-launcher) runner; the runner never reads its own. */
+    bootId?: string;
     parentWorkflowRunId?: string;
     workflowKey?: string;
     lane?: WorkflowLaneMetadata;