pi-subagents 0.81.0 → 0.82.1

package/src/runs/background/stale-run-reconciler.js

@@ -4,6 +4,7 @@ import { writeAtomicJson } from "../../shared/atomic-json.js";
 import { resultFilePath, resultPayloadPathForSessionRun, writeAsyncResultFile } from "./result-files.js";
 import { updateActiveRunIndex } from "./active-run-index.js";
 import { readProcessTerminal } from "./process-terminal.js";
+import { OWNING_SESSION_COMPLETION_OWNER } from "../../shared/completion-owner.js";
 import { readStatus } from "../../shared/utils.js";
 import { DIRS } from "../../shared/types.js";
 import { resolveEffectiveThinking } from "../../shared/model-info.js";
@@ -11,6 +12,8 @@ import { normalizeParallelGroups } from "./parallel-groups.js";
 import { nestedSummaryFromAsyncStatus, projectNestedEvents, resolveNestedAsyncDir, writeNestedEvent } from "../shared/nested-events.js";
 import { assertWorkflowGraphHostSteps } from "../shared/host-step-status.js";
 import { currentPidNamespaceScope } from "./pid-namespace.js";
+import { currentBootId } from "./boot-id.js";
+import { WORKFLOW_STOP_CAUSE_OWNER_EXITED } from "../../workflows/workflow-stop-cause.js";
 import { isTerminalAsyncState } from "./workflow-terminal-proof.js";
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -215,9 +218,14 @@ function settledWorkflowChildStatus(asyncDir, workflowRunId, step, now) {
         delete settled.stopped;
     return settled;
 }
-function buildFailedRepair(status, asyncDir, now, reason) {
+function buildFailedRepair(status, asyncDir, now, reason, ownerExited = false, adoptCompletionOwnerId) {
     const runId = status.runId || path.basename(asyncDir);
     const pid = typeof status.pid === "number" ? status.pid : "unknown";
+    // A dead workflow host is the Pi process itself; its journal keeps the finished children for a relaunch.
+    const exitedWorkflow = ownerExited && status.mode === "workflow" ? status.workflow : undefined;
+    // Its owner process is dead, so nothing else can deliver its notice: an owning session that repairs it
+    // adopts it, and a repair elsewhere leaves it to whichever session owns the run.
+    const completionOwnerId = exitedWorkflow ? adoptCompletionOwnerId || OWNING_SESSION_COMPLETION_OWNER : status.completionOwnerId;
     const terminal = readProcessTerminal(asyncDir, { runId }) ?? status.processTerminal;
     const runnerExit = terminal?.state === "observed" || terminal?.state === "unknown"
         ? terminal.instances?.find((instance) => instance.kind === "runner" && instance.processInstanceId === terminal.runnerProcessInstanceId)
@@ -225,7 +233,9 @@ function buildFailedRepair(status, asyncDir, now, reason) {
     const exitText = runnerExit?.kind === "runner"
         ? `exited with code ${runnerExit.exitCode ?? "none"}${runnerExit.signal ? ` (signal ${runnerExit.signal})` : ""}`
         : "exited or disappeared";
-    const baseMessage = reason ?? `Async runner process ${pid} ${exitText} before writing a result. Marked run failed by stale-run reconciliation.`;
+    const baseMessage = reason ?? (exitedWorkflow
+        ? `The Pi process (PID ${pid}) that ran workflow ${runId} exited before the workflow finished. Marked run failed by stale-run reconciliation. Its finished children are kept.`
+        : `Async runner process ${pid} ${exitText} before writing a result. Marked run failed by stale-run reconciliation.`);
     const diagnostics = readRunnerStartupDiagnostics(asyncDir);
     const message = diagnostics ? `${baseMessage}\n\nRunner stderr tail:\n${diagnostics}` : baseMessage;
     const steps = status.steps?.length ? status.steps : [{ agent: "subagent", status: "running" }];
@@ -263,6 +273,9 @@ function buildFailedRepair(status, asyncDir, now, reason) {
         lastUpdate: now,
         endedAt: now,
         steps: repairedSteps,
+        // Read from the pre-repair status: the repair time would make an old crash look new.
+        ...(exitedWorkflow ? { workflow: { ...exitedWorkflow, stopCause: WORKFLOW_STOP_CAUSE_OWNER_EXITED, ownerExitedAt: status.lastUpdate ?? status.startedAt } } : {}),
+        ...(completionOwnerId ? { completionOwnerId } : {}),
     };
     const resultAgent = repairedSteps[status.currentStep ?? 0]?.agent ?? repairedSteps[0]?.agent ?? "subagent";
     return {
@@ -272,7 +285,9 @@ function buildFailedRepair(status, asyncDir, now, reason) {
             id: runId,
             agent: resultAgent,
             mode: status.mode,
-            ...(status.completionOwnerId ? { completionOwnerId: status.completionOwnerId } : {}),
+            ...(exitedWorkflow ? { workflow: { stopCause: WORKFLOW_STOP_CAUSE_OWNER_EXITED } } : {}),
+            ...(completionOwnerId ? { completionOwnerId } : {}),
+            ...(status.completionOwnerProcess ? { completionOwnerProcess: status.completionOwnerProcess } : {}),
             ...(status.parentWorkflowRunId ? { parentWorkflowRunId: status.parentWorkflowRunId } : {}),
             ...(status.workflowKey ? { workflowKey: status.workflowKey } : {}),
             success: false,
@@ -298,8 +313,8 @@ function buildFailedRepair(status, asyncDir, now, reason) {
         },
     };
 }
-function writeFailedRepair(asyncDir, status, resultPath, now, reason) {
-    const repair = buildFailedRepair(status, asyncDir, now, reason);
+function writeFailedRepair(asyncDir, status, resultPath, now, reason, ownerExited = false, adoptCompletionOwnerId) {
+    const repair = buildFailedRepair(status, asyncDir, now, reason, ownerExited, adoptCompletionOwnerId);
     if (repair.result.sessionId)
         writeAsyncResultFile(resultPath, repair.result);
     writeAtomicJson(path.join(asyncDir, "status.json"), repair.status);
@@ -386,6 +401,32 @@ export function checkPidLiveness(pid, kill = process.kill, probeZombie = false)
         return "unknown";
     }
 }
+export function isRecordedPid(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const { pid, pidNamespaceScope, bootId } = value;
+    return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0
+        && (pidNamespaceScope === undefined || typeof pidNamespaceScope === "string")
+        && (bootId === undefined || typeof bootId === "string");
+}
+/**
+ * Liveness of a pid saved in a status file. A pid saved under another boot is dead without a
+ * probe, but only when both sides are in the same pid namespace or neither records one: a
+ * macOS host reading a Linux container's runs must not compare their boot ids.
+ */
+export function checkRecordedPidLiveness(recorded, observation = { observedScope: currentPidNamespaceScope(), observedBootId: currentBootId() }) {
+    const { observedScope, observedBootId } = observation;
+    if (recorded.pidNamespaceScope === observedScope && recorded.bootId && observedBootId && recorded.bootId !== observedBootId)
+        return "dead";
+    // An observer without a scope (macOS/Windows host sharing a container's temp root) cannot match a recorded one.
+    const scopeMismatch = recorded.pidNamespaceScope !== undefined && recorded.pidNamespaceScope !== observedScope;
+    // A local zombie is evidence about this pid only when its namespace is known to match.
+    const scopeVerified = recorded.pidNamespaceScope !== undefined && recorded.pidNamespaceScope === observedScope;
+    const liveness = observation.probe
+        ? observation.probe(recorded.pid)
+        : checkPidLiveness(recorded.pid, observation.kill, scopeVerified);
+    return liveness === "dead" && scopeMismatch ? "unknown" : liveness;
+}
 export function reconcileAsyncRun(asyncDir, options = {}, observeStatus) {
     const now = options.now?.() ?? Date.now();
     const status = readStatus(asyncDir);
@@ -450,13 +491,11 @@ export function reconcileAsyncRun(asyncDir, options = {}, observeStatus) {
             return { status: null, repaired: false, resultPath };
         }
     }
-    const observedScope = options.pidNamespaceScope ? options.pidNamespaceScope() : currentPidNamespaceScope();
-    // An observer without a scope (macOS/Windows host sharing a container's temp root) cannot match a recorded one.
-    const pidScopeMismatch = effectiveStatus.pidNamespaceScope !== undefined && effectiveStatus.pidNamespaceScope !== observedScope;
-    // A local zombie is evidence about this runner only when its namespace is known to match.
-    const pidScopeVerified = effectiveStatus.pidNamespaceScope !== undefined && effectiveStatus.pidNamespaceScope === observedScope;
-    const observedLiveness = checkPidLiveness(effectiveStatus.pid, options.kill, pidScopeVerified);
-    const liveness = observedLiveness === "dead" && pidScopeMismatch ? "unknown" : observedLiveness;
+    const liveness = checkRecordedPidLiveness({ pid: effectiveStatus.pid, pidNamespaceScope: effectiveStatus.pidNamespaceScope, bootId: effectiveStatus.bootId }, {
+        kill: options.kill,
+        observedScope: options.pidNamespaceScope ? options.pidNamespaceScope() : currentPidNamespaceScope(),
+        observedBootId: options.bootId ? options.bootId() : currentBootId(),
+    });
     if (liveness !== "dead") {
         const staleAfterMs = options.staleAlivePidMs ?? 24 * 60 * 60 * 1000;
         const lastUpdate = effectiveStatus.lastUpdate ?? effectiveStatus.startedAt;
@@ -466,5 +505,5 @@ export function reconcileAsyncRun(asyncDir, options = {}, observeStatus) {
         const message = `Async runner PID ${effectiveStatus.pid} ${probe}; status has not updated for ${now - lastUpdate}ms, so stale-run reconciliation marked the run failed because PID ownership is unverified.`;
         return writeFailedRepair(asyncDir, effectiveStatus, resultPath, now, message);
     }
-    return writeFailedRepair(asyncDir, effectiveStatus, resultPath, now);
+    return writeFailedRepair(asyncDir, effectiveStatus, resultPath, now, undefined, true, options.adoptCompletionOwnerId);
 }

package/src/runs/background/subagent-runner-bootstrap.js

@@ -14,6 +14,7 @@ import { acquireSessionLease } from "../shared/session-lease.js";
 import { readProcessTerminalCandidate, writeProcessTerminalCandidate, markProcessTerminalCandidateLeaseRelease } from "./process-terminal-candidate.js";
 import { persistRunnerStartupFailure } from "./runner-startup-failure.js";
 import { currentPidNamespaceScope } from "./pid-namespace.js";
+import { primeBootId } from "./boot-id.js";
 function isRecord(value) {
     return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -103,6 +104,8 @@ async function waitForStartupControl(controlPath, token, action, timeoutMs = 30_
 export async function runConfiguredSubagent(rawConfig, options = {}) {
     validateSubagentRunConfig(rawConfig);
     const config = rawConfig;
+    // The runner never reads the boot id from the OS (sysctl on macOS); Pi passes it to direct runners only.
+    primeBootId(typeof config.bootId === "string" && config.bootId ? config.bootId : undefined);
     let lease;
     let startupCommitted = config.revivalLease === undefined && config.launchBarrierToken === undefined;
     let executionLoaded = false;

package/src/runs/background/subagent-runner.d.ts

@@ -4,6 +4,7 @@ import { type RunnerSubagentStep as SubagentStep, type RunnerStep } from "../sha
 import type { InheritedChildRuntime } from "../shared/child-launch.ts";
 import type { ChildSessionFactory, DefaultChildSessionFactoryOptions } from "../shared/child-session.ts";
 import { type ChildEvent, type SteerDelivery, type StepSteerHandler } from "./run-child-session.ts";
+import type { RecordedPid } from "./stale-run-reconciler.ts";
 import type { SessionLeaseRequest } from "../shared/session-lease.ts";
 import { createHerdrExternalAdapter, type HerdrExternalAdapterId, type HerdrExternalResult } from "../shared/herdr-external-adapters.ts";
 import { type OrcaProgressTab } from "../shared/orca-progress-tabs.ts";
@@ -25,6 +26,7 @@ export interface SubagentRunConfig {
     asyncDir: string;
     sessionId?: string | null;
     completionOwnerId?: string;
+    completionOwnerProcess?: RecordedPid;
     piPackageRoot?: string;
     /** Test seam: module the runner imports its `ChildSessionFactory` from. */
     childSessionFactoryModule?: string;
@@ -76,6 +78,8 @@ export interface SubagentRunConfig {
     runtimeAcknowledgedExtensions?: RuntimeAcknowledgedChildExtensions;
     runnerProcessInstanceId?: string;
     launchBarrierToken?: string;
+    /** Pi's boot id, set only for a direct (non-launcher) runner; the runner never reads its own. */
+    bootId?: string;
     parentWorkflowRunId?: string;
     workflowKey?: string;
     lane?: WorkflowLaneMetadata;

package/src/runs/background/subagent-runner.js

@@ -49,7 +49,7 @@ import { nestedSummaryFromAsyncStatus, projectNestedEvents, resolveNestedAsyncDi
 import { isContextOverflow } from "../shared/model-resolution.js";
 import { processTerminalPath, writeProcessTerminalCandidate } from "./process-terminal.js";
 import { persistRunnerStartupFailure } from "./runner-startup-failure.js";
-import { currentPidNamespaceScope } from "./pid-namespace.js";
+import { currentRecordedPid } from "./boot-id.js";
 import { createSteeringStatus, recordSteeringRequest, steeringStatus, terminalSteeringNoticeState, unconsumedSteerReason, updateSteeringTarget } from "./steering.js";
 import { PROMPT_REDACTED, SUBAGENT_STOPPED_MESSAGE, SUBAGENT_TIMED_OUT_MESSAGE, detectSubagentError, extractTextFromContent, extractToolArgsPreview, formatEmptyTerminalAssistantResponseError, getAgentDir, hasEmptyTerminalAssistantResponse, readStatus } from "../../shared/utils.js";
 import { planAbortRecovery } from "../shared/abort-recovery.js";
@@ -77,6 +77,7 @@ import { resolveCodexExecLaunch } from "../shared/codex-exec-adapter.js";
 import { resolveCursorAgentLaunch } from "../shared/cursor-agent-adapter.js";
 import { resolveExternalCliRunnerStatus } from "../shared/external-cli-contract.js";
 import { formatHerdrMachineHint, prepareHerdrMachineExternalCliRun } from "../shared/herdr-machine.js";
+import { isRexLocalMachine } from "../shared/rex-machine.js";
 import { HerdrExternalNeedsAttentionError, createHerdrExternalAdapter, prepareInternalHerdrExternalAdapter } from "../shared/herdr-external-adapters.js";
 import { runExternalJob } from "../shared/external-job-runner.js";
 import { createOrcaProgressTab } from "../shared/orca-progress-tabs.js";
@@ -522,6 +523,7 @@ export async function runSingleStepInner(step, ctx) {
             capabilityCeiling: step.capabilityCeiling ?? ctx.capabilityCeiling,
             inheritedCapabilityCeiling: ctx.inheritedChildRuntime?.capabilityCeiling,
             requiredExtensions: step.requiredExtensions ?? ctx.inheritedChildRuntime?.requiredExtensions,
+            agentName: step.agent,
             permissionRules: step.permissionRules,
         }));
     }
@@ -608,6 +610,8 @@ export async function runSingleStepInner(step, ctx) {
             return omitUndefinedProperties({ agent: step.agent, context: step.context, output: message, error: message, exitCode: 1, stopped: stopped || undefined, timedOut: stopped ? undefined : true });
         }
         if (step.machine) {
+            if (step.machine.provider !== "herdr")
+                throw new Error("Rex supports native Pi children only.");
             const runner = resolveExternalCliRunnerStatus({ ...step.runner, machine: step.machine });
             const outputSnapshot = captureSingleOutputSnapshot(step.outputPath);
             const placedRunId = `${ctx.id}-${ctx.flatIndex}`;
@@ -781,7 +785,8 @@ export async function runSingleStepInner(step, ctx) {
     let toolBudget = step.toolBudget ? initialToolBudgetState(step.toolBudget) : undefined;
     let toolBudgetBlocked = false;
     let actualLaunchContractDigest = step.launchContractDigest;
-    const mutationSnapshot = step.machine ? { source: "tracked-files", trackedOnly: true, cwd: step.cwd ?? ctx.cwd, dirtyFiles: [], fingerprints: {}, unavailable: "Local Git evidence is not authoritative for a pane-native remote run." } : snapshotTrackedMutations(step.cwd ?? ctx.cwd);
+    // A machine 'local' child edits this disk, so its local Git evidence is authoritative, as for an unplaced run.
+    const mutationSnapshot = step.machine && !isRexLocalMachine(step.machine) ? { source: "tracked-files", trackedOnly: true, cwd: step.cwd ?? ctx.cwd, dirtyFiles: [], fingerprints: {}, unavailable: "Local Git evidence is not authoritative for a pane-native remote run." } : snapshotTrackedMutations(step.cwd ?? ctx.cwd);
     let finalMutationEvidence = collectTrackedMutationEvidence(mutationSnapshot, step.cwd ?? ctx.cwd);
     let contextOverflow = false;
     let launchWarningsEmitted = false;
@@ -1004,7 +1009,7 @@ export async function runSingleStepInner(step, ctx) {
             ? formatEmptyTerminalAssistantResponseError(run.messages)
             : undefined;
         const remoteGitChanged = run.nativeMachine?.initialGit && run.nativeMachine.finalGit ? run.nativeMachine.initialGit.head !== run.nativeMachine.finalGit.head || run.nativeMachine.initialGit.dirty !== run.nativeMachine.finalGit.dirty : undefined;
-        const mutationEvidence = run.nativeMachine ? { source: "tracked-files", trackedOnly: true, changedFiles: [], attemptedMutation: remoteGitChanged === true, ...(remoteGitChanged === undefined ? { unavailable: "Remote Git before/after evidence was incomplete." } : {}) } : collectTrackedMutationEvidence(mutationSnapshot, step.cwd ?? ctx.cwd);
+        const mutationEvidence = run.nativeMachine && !isRexLocalMachine(step.machine) ? { source: "tracked-files", trackedOnly: true, changedFiles: [], attemptedMutation: remoteGitChanged === true, ...(remoteGitChanged === undefined ? { unavailable: "Remote Git before/after evidence was incomplete." } : {}) } : collectTrackedMutationEvidence(mutationSnapshot, step.cwd ?? ctx.cwd);
         finalMutationEvidence = mutationEvidence;
         const mutationAttemptObserved = run.observedMutationAttempt === true || mutationEvidence.attemptedMutation === true;
         // Validated structured output is persistable file content even when the final text is only
@@ -1669,6 +1674,7 @@ export async function runSubagent(config, childSessions) {
         ...(config.toolCallId ? { toolCallId: config.toolCallId } : {}),
         ...(config.sessionId ? { sessionId: config.sessionId } : {}),
         ...(config.completionOwnerId ? { completionOwnerId: config.completionOwnerId } : {}),
+        ...(config.completionOwnerProcess ? { completionOwnerProcess: config.completionOwnerProcess } : {}),
         mode: config.resultMode ?? (flatSteps.length > 1 ? "chain" : "single"),
         ...(config.nestedSelf ? { isNested: true } : {}),
         state: "running",
@@ -1680,8 +1686,7 @@ export async function runSubagent(config, childSessions) {
         ...(config.deadlineAt !== undefined ? { deadlineAt: config.deadlineAt } : {}),
         ...(config.toolBudget ? { toolBudget: initialToolBudgetState(config.toolBudget) } : {}),
         ...(config.usageBudget ? { usageBudget: usageBudgetState(config.usageBudget, undefined) } : {}),
-        pid: process.pid,
-        pidNamespaceScope: currentPidNamespaceScope(),
+        ...currentRecordedPid(),
         cwd,
         currentStep: 0,
         chainStepCount: steps.length,
@@ -1909,6 +1914,8 @@ export async function runSubagent(config, childSessions) {
             cwd,
             sessionId: config.sessionId,
             completionOwnerId: config.completionOwnerId,
+            completionOwnerProcess: config.completionOwnerProcess,
+            parentWorkflowRunId: config.parentWorkflowRunId,
             sessionFile: statusPayload.sessionFile ?? latestSessionFile,
         }), (filePath, payload) => publishRunResult(filePath, () => writePendingAsyncResultFile(filePath, payload)));
     };
@@ -4797,6 +4804,7 @@ export async function runSubagent(config, childSessions) {
             runtimeAcknowledgedExtensions: singleRuntimeAcknowledgedExtensions,
             sessionId: config.sessionId,
             completionOwnerId: config.completionOwnerId,
+            completionOwnerProcess: config.completionOwnerProcess,
             sessionFile: effectiveSessionFile,
             intercomTarget: config.controlIntercomTarget,
             shareUrl,

package/src/runs/background/subagent-wait.d.ts

@@ -54,7 +54,7 @@ export interface SubagentWaitParams {
     all?: boolean;
     /** Give up after this many milliseconds. Defaults to waitTool.defaultTimeoutMs, then 30 minutes. */
     timeoutMs?: number;
-    /** False keeps a blocking wait open through idle attention; supervisor/contact requests still stop the wait. */
+    /** False keeps a blocking wait open through all attention except supervisor/contact requests, such as idle time, a tool held open, or repeated tool failures. */
     stopOnAttention?: boolean;
 }
 /** Minimal event-bus surface wait subscribes to (matches pi.events). */

package/src/runs/background/subagent-wait.js

@@ -707,8 +707,13 @@ export async function waitForSubagents(params, signal, deps) {
     const supervisorAttentionHint = relevantAttention.some(hasSupervisorTool)
         ? " Reply to any pending supervisor request. If subagent_supervisor({ action: \"pending\" }) is empty, check intercom({ action: \"pending\" }) because an external intercom tool may own the request."
         : "";
+    // Only when watchdog attention alone ended the wait: stopOnAttention: false would have kept blocking.
+    const keepWaitingHint = stopOnAttention && supervisorAttentionHint === ""
+        && (waitForAll || finishedAsyncCount + providerFinishedCount === 0)
+        ? " These runs are still running and none is waiting on a supervisor reply. To keep waiting through this kind of attention, call bg_wait again with stopOnAttention: false; supervisor requests still end that wait."
+        : "";
     const attentionNote = relevantAttention.length > 0
-        ? ` ${relevantAttention.length} run(s) need attention: ${relevantAttention.map((run) => run.id).join(", ")} —${supervisorAttentionHint} inspect with subagent({ action: "status" }) then steer a top-level live async child, resume a paused/completed/failed child, or interrupt explicitly.`
+        ? ` ${relevantAttention.length} run(s) need attention: ${relevantAttention.map((run) => run.id).join(", ")} —${supervisorAttentionHint} inspect with subagent({ action: "status" }) then steer a top-level live async child, resume a paused/completed/failed child, or interrupt explicitly.${keepWaitingHint}`
         : "";
     const stillRunning = active.filter((run) => initialAsyncIds.has(run.id)).length
         + providerActive.filter((item) => initialProviderIds.has(backgroundWorkIdentity(item))).length;

package/src/runs/background/terminal-run-index.d.ts

@@ -5,4 +5,6 @@ export declare function readTerminalRunToolCallIndex(asyncDirRoot: string, toolC
 export declare function readRecentTerminalRunIndex(asyncDirRoot: string, options?: {
     sessionId?: string;
     limit?: number;
+    endedAfter?: number;
+    onCorruptStatus?: (warning: string) => void;
 }): string[];

package/src/runs/background/terminal-run-index.js

@@ -12,6 +12,35 @@ const TOOL_CALL_INDEX_DIR = "@tool-calls";
 function isTerminalState(state) {
     return state === "complete" || state === "failed" || state === "partial" || state === "paused" || state === "stopped" || state === "rejected";
 }
+function isCorruptStatusError(error, statusPath) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.startsWith(`Failed to parse async status file '${statusPath}'`)
+        || message.startsWith(`Failed to validate async status file '${statusPath}'`);
+}
+// A corrupt indexed status is retried on every read. Emit a warning only when
+// its observed file identity or parse outcome changes, like active-run diagnostics.
+const reportedCorruptTerminalStatus = new Map();
+function warnCorruptTerminalStatus(runId, statusPath, error, onCorruptStatus) {
+    let fileSignature = "unavailable";
+    try {
+        const stat = fs.statSync(statusPath);
+        fileSignature = `${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}:${stat.ino}`;
+    }
+    catch (statError) {
+        if (statError.code !== "ENOENT")
+            throw statError;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    const signature = `${fileSignature}\n${message}`;
+    if (reportedCorruptTerminalStatus.get(statusPath) === signature)
+        return;
+    reportedCorruptTerminalStatus.set(statusPath, signature);
+    const warning = `Skipping indexed terminal run '${runId}' with corrupt status at '${statusPath}': ${message}`;
+    if (onCorruptStatus)
+        onCorruptStatus(warning);
+    else
+        console.error(`[pi-subagents] ${warning}`);
+}
 function indexRoot(asyncDirRoot) {
     return path.join(asyncDirRoot, TERMINAL_RUN_INDEX_DIR);
 }
@@ -99,8 +128,10 @@ function sessionDirs(asyncDirRoot, sessionId) {
         throw error;
     }
 }
-function recentMarkerFiles(dirs, limit) {
+function recentMarkerFiles(dirs, limit, endedAfter) {
     return dirs.flatMap(markerFiles)
+        // The name starts with the run's end time, so an old run is skipped without reading its marker.
+        .filter((marker) => endedAfter === undefined || !(Number(marker.name.slice(0, TIMESTAMP_WIDTH)) < endedAfter))
         .sort((left, right) => right.name.localeCompare(left.name))
         .slice(0, limit)
         .map((marker) => path.join(marker.dir, marker.name));
@@ -135,7 +166,7 @@ export function readTerminalRunToolCallIndex(asyncDirRoot, toolCallId) {
 }
 export function readRecentTerminalRunIndex(asyncDirRoot, options = {}) {
     const limit = options.limit === undefined ? Number.POSITIVE_INFINITY : Math.max(0, Math.floor(options.limit));
-    const candidates = recentMarkerFiles(sessionDirs(asyncDirRoot, options.sessionId), limit);
+    const candidates = recentMarkerFiles(sessionDirs(asyncDirRoot, options.sessionId), limit, options.endedAfter);
     const runIds = [];
     const seen = new Set();
     for (const marker of candidates) {
@@ -152,7 +183,17 @@ export function readRecentTerminalRunIndex(asyncDirRoot, options = {}) {
             continue;
         }
         const asyncDir = path.join(asyncDirRoot, entry.runId);
-        const status = readStatus(asyncDir);
+        const statusPath = path.join(asyncDir, "status.json");
+        let status;
+        try {
+            status = readStatus(asyncDir);
+        }
+        catch (error) {
+            if (!isCorruptStatusError(error, statusPath))
+                throw error;
+            warnCorruptTerminalStatus(entry.runId, statusPath, error, options.onCorruptStatus);
+            continue;
+        }
         if (!status || !isTerminalState(status.state) || status.sessionId !== entry.sessionId || (status.runId && status.runId !== entry.runId)) {
             removeInvalidMarker(marker);
             continue;

package/src/runs/foreground/async-stop-action.js

@@ -44,6 +44,8 @@ function sealPausedRun(asyncDir, status, resultsDir) {
             sessionId: status.sessionId,
             asyncDir,
             ...(status.completionOwnerId ? { completionOwnerId: status.completionOwnerId } : {}),
+            ...(status.completionOwnerProcess ? { completionOwnerProcess: status.completionOwnerProcess } : {}),
+            ...(status.parentWorkflowRunId ? { parentWorkflowRunId: status.parentWorkflowRunId } : {}),
             ...(status.toolCallId ? { toolCallId: status.toolCallId } : {}),
             results: (status.steps ?? []).map((step) => ({
                 agent: step.agent,
@@ -146,7 +148,7 @@ export function stopAsyncRun(state, runId, kill, location, childId) {
     if (!target)
         return null;
     const status = reconcileAsyncRun(target.asyncDir, { kill }).status;
-    // A workflow relaunched with options.reuseFrom stops the exact child run it re-attached, whichever session launched it.
+    // A relaunched workflow stops the exact child run it re-attached from its relaunch chain, whichever session launched it.
     if (state.currentSessionId && !ownsRun(state.currentSessionId, status?.sessionId) && location?.reattachedRunId !== target.asyncId) {
         return {
             content: [{ type: "text", text: `Async run '${target.asyncId}' was not found in the active session.` }],

package/src/runs/foreground/execution.js

@@ -46,6 +46,7 @@ import { buildInProcessChildLaunch, createReportedChildSessionInput } from "../s
 import { childSessionFactory, childSessionHasQueuedMessages, projectChildSessionEventForJson } from "../shared/child-session.js";
 import { reconcileAttemptUsage } from "../shared/usage-reconciliation.js";
 import { clearProviderRetry, observeProviderDiagnostics, snapshotProviderDiagnostics } from "../../shared/provider-diagnostics.js";
+import { isRexLocalMachine } from "../shared/rex-machine.js";
 const artifactOutputByResult = new WeakMap();
 const acceptanceOutputByResult = new WeakMap();
 function emptyUsage() {
@@ -441,7 +442,9 @@ async function runSingleAttempt(runtimeCwd, agent, task, model, options, shared)
         };
         return result;
     }
-    const mutationSnapshot = options.machine ? { source: "tracked-files", trackedOnly: true, cwd: options.cwd ?? runtimeCwd, dirtyFiles: [], fingerprints: {}, unavailable: "Local Git evidence is not authoritative for a pane-native remote run." } : snapshotTrackedMutations(options.cwd ?? runtimeCwd);
+    // A machine 'local' child edits this disk, so its local Git evidence is authoritative, as for an unplaced run.
+    const mutationCwd = isRexLocalMachine(options.machine) ? options.machine.cwd : options.cwd ?? runtimeCwd;
+    const mutationSnapshot = options.machine && !isRexLocalMachine(options.machine) ? { source: "tracked-files", trackedOnly: true, cwd: mutationCwd, dirtyFiles: [], fingerprints: {}, unavailable: "Local Git evidence is not authoritative for a pane-native remote run." } : snapshotTrackedMutations(mutationCwd);
     let structuredOutputToolInvoked = false;
     let structuredOutputMessageStartIndex;
     let toolAvailabilityError;
@@ -1259,7 +1262,7 @@ async function runSingleAttempt(runtimeCwd, agent, task, model, options, shared)
             toolAvailabilityError = toolDiagnosticError;
             result.runtimeAcknowledgedExtensions = capture.runtimeAcknowledgedExtensions();
             if (session?.machineEvidence)
-                result.nativeMachine = { provider: "herdr", machineId: session.machineEvidence.machineId, ...(session.machineEvidence.initial ? { initialGit: session.machineEvidence.initial } : {}), ...(session.machineEvidence.final ? { finalGit: session.machineEvidence.final } : {}) };
+                result.nativeMachine = { provider: session.machineEvidence.provider, machineId: session.machineEvidence.machineId, ...(session.machineEvidence.initial ? { initialGit: session.machineEvidence.initial } : {}), ...(session.machineEvidence.final ? { finalGit: session.machineEvidence.final } : {}) };
             let closeError = result.error ?? toolDiagnosticError ?? assistantError;
             const promptErrorMessage = promptError === undefined ? undefined : promptError instanceof Error ? promptError.message : String(promptError);
             if (promptError !== undefined)
@@ -1533,7 +1536,7 @@ async function runSingleAttempt(runtimeCwd, agent, task, model, options, shared)
         durationMs: progress.durationMs,
     };
     const remoteGitChanged = result.nativeMachine?.initialGit && result.nativeMachine.finalGit ? result.nativeMachine.initialGit.head !== result.nativeMachine.finalGit.head || result.nativeMachine.initialGit.dirty !== result.nativeMachine.finalGit.dirty : undefined;
-    const mutationEvidence = result.nativeMachine ? { source: "tracked-files", trackedOnly: true, changedFiles: [], attemptedMutation: remoteGitChanged === true, ...(remoteGitChanged === undefined ? { unavailable: "Remote Git before/after evidence was incomplete." } : {}) } : collectTrackedMutationEvidence(mutationSnapshot, options.cwd ?? runtimeCwd);
+    const mutationEvidence = result.nativeMachine && !isRexLocalMachine(options.machine) ? { source: "tracked-files", trackedOnly: true, changedFiles: [], attemptedMutation: remoteGitChanged === true, ...(remoteGitChanged === undefined ? { unavailable: "Remote Git before/after evidence was incomplete." } : {}) } : collectTrackedMutationEvidence(mutationSnapshot, mutationCwd);
     const acceptanceOutput = getFinalOutput(result.messages ?? []);
     const structuredText = result.structuredOutput === undefined ? undefined : JSON.stringify(result.structuredOutput, null, 2);
     let fullOutput = stripAcceptanceReport(acceptanceOutput);

package/src/runs/foreground/foreground-history.d.ts

@@ -1,11 +1,25 @@
-import type { SubagentState } from "../../shared/types.ts";
+import type { ForegroundResumeChild, ForegroundResumeRun, SubagentState } from "../../shared/types.ts";
 export declare const MAX_REMEMBERED_FOREGROUND_RUNS = 50;
-export declare function persistForegroundRunHistory(state: SubagentState, options?: {
+export declare const FOREGROUND_OWNER_EXITED_STOP_ERROR = "Subagent stopped because the Pi process that ran it exited before the run finished.";
+/**
+ * Saves one foreground run to its own history file. A run with a `running` child is a launch-time
+ * record; the run's final save replaces it.
+ */
+export declare function persistForegroundRun(run: ForegroundResumeRun, options?: {
     resultsDir?: string;
     limit?: number;
 }): void;
+/** Drops this process's `running` record for a launch that threw, so it never loads as interrupted. */
+export declare function discardRunningForegroundRun(runId: string, options?: {
+    resultsDir?: string;
+}): void;
+/** For a record with a `running` child: its owning Pi process is gone. */
+export declare function ownerConfirmedDead(run: ForegroundResumeRun): boolean;
+/** State text for a remembered child; a child cut off by a Pi exit names the resume target. */
+export declare function foregroundChildStateLabel(run: Pick<ForegroundResumeRun, "runId">, child: Pick<ForegroundResumeChild, "status" | "error" | "sessionFile">): string;
 export declare function restoreForegroundRunHistory(state: SubagentState, options?: {
     resultsDir?: string;
     sessionId?: string | null;
     limit?: number;
+    observeForeign?: (run: ForegroundResumeRun) => void;
 }): number;