pi-crew 0.10.1 → 0.10.3

package/src/config/config-merge.ts

@@ -31,7 +31,8 @@ export function mergeConfig(base: PiTeamsConfig, override: PiTeamsConfig): PiTea
 	}
 	if (base.nesting || override.nesting) {
 		// ADR-5: per-key user-wins deep merge — a partial user-side nesting block
-		// (e.g. just maxSlots) must not erase DEFAULT_NESTING.enabled=false.
+		// (e.g. just maxSlots) must not erase DEFAULT_NESTING.enabled (true since
+		// the D8 flip; explicit user false still wins as the kill switch).
 		merged.nesting = {
 			...(base.nesting ?? {}),
 			...withoutUndefined((override.nesting ?? {}) as Record<string, unknown>),
@@ -59,6 +60,15 @@ export function mergeConfig(base: PiTeamsConfig, override: PiTeamsConfig): PiTea
 				...withoutUndefined((override.runtime?.modelFallback ?? {}) as Record<string, unknown>),
 			};
 		}
+		// Spec v0.7 §8.1 (Task 6): same per-key treatment for the surface
+		// block — a user surface with only visibleAgents must not wholesale-
+		// erase a project surface.mode (the WP-2/R2 bug class).
+		if (base.runtime?.surface || override.runtime?.surface) {
+			merged.runtime.surface = {
+				...(base.runtime?.surface ?? {}),
+				...withoutUndefined((override.runtime?.surface ?? {}) as Record<string, unknown>),
+			};
+		}
 	}
 	if (base.control || override.control) {
 		merged.control = {

package/src/config/config-validation.ts

@@ -23,6 +23,7 @@ import type {
 	CrewUiConfig,
 	CrewWorktreeConfig,
 	GoalWrapWorkflowConfig,
+	PersistenceConfig,
 	PiTeamsAutonomousConfig,
 	PiTeamsAutonomyProfile,
 	PiTeamsConfig,
@@ -155,7 +156,13 @@ function parseProfile(value: unknown): PiTeamsAutonomyProfile | undefined {
 
 function parseStringList(value: unknown): string[] | undefined {
 	const items = parseWithSchema(Type.Array(Type.String()), value);
-	if (!items || items.length === 0) return undefined;
+	if (!items) return undefined;
+	// F3 (real-test 2026-08-30-post-tab-layout-live, Finding 3): an explicit
+	// empty array is a VALUE ("nobody"/"none"), not "unset" — dropping it here
+	// made `team-settings set <key> []` a no-op that silently kept the previous
+	// list on disk. Whitespace-only entries below still collapse to undefined
+	// (unchanged legacy behavior).
+	if (items.length === 0) return [];
 	const normalized = items.map((entry) => entry.trim()).filter((entry) => entry.length > 0);
 	return normalized.length > 0 ? normalized : undefined;
 }
@@ -281,6 +288,24 @@ function parseIsolationPolicy(value: unknown): CrewRuntimeConfig["isolationPolic
 	};
 }
 
+/** Mux-surface policy (spec v0.7 §8.1) — mirrors the isolationPolicy parse
+ *  shape: unknown literals are dropped field-wise (never thrown), and an
+ *  all-invalid block collapses to undefined. */
+function parseSurfacePolicy(value: unknown): CrewRuntimeConfig["surface"] | undefined {
+	const obj = asRecord(value);
+	if (!obj) return undefined;
+	const mode = parseWithSchema(
+		Type.Union([Type.Literal("auto"), Type.Literal("tmux"), Type.Literal("herdr"), Type.Literal("off")]),
+		obj.mode,
+	);
+	const visibleAgents = parseStringList(obj.visibleAgents);
+	if (mode === undefined && visibleAgents === undefined) return undefined;
+	return {
+		...(mode !== undefined ? { mode } : {}),
+		...(visibleAgents !== undefined ? { visibleAgents } : {}),
+	};
+}
+
 /**
  * F19-1 (Round 19 parity): runtime.modelFallback was declared in types.ts and the
  * schema (PiTeamsModelFallbackConfigSchema) but parseRuntimeConfig never emitted
@@ -338,6 +363,7 @@ function parseRuntimeConfig(value: unknown): CrewRuntimeConfig | undefined {
 		excludeContextBash: parseWithSchema(Type.Boolean(), obj.excludeContextBash),
 		agentExtensions: parseStringList(obj.agentExtensions),
 		isolationPolicy: parseIsolationPolicy(obj.isolationPolicy),
+		surface: parseSurfacePolicy(obj.surface),
 		modelFallback: parseModelFallbackConfig(obj.modelFallback),
 	};
 	return Object.values(runtime).some((entry) => entry !== undefined) ? runtime : undefined;
@@ -384,6 +410,18 @@ function parseBrokerConfig(value: unknown): CrewBrokerConfig | undefined {
 	return Object.values(broker).some((entry) => entry !== undefined) ? broker : undefined;
 }
 
+/** PERF round 2, Task 3: state-layer persistence parser. Opt-in only;
+ *  the default (false) is layered in loadConfig via DEFAULT_PERSISTENCE,
+ *  so a missing block here means "not set", never "false" by default. */
+function parsePersistenceConfig(value: unknown): PersistenceConfig | undefined {
+	const obj = asRecord(value);
+	if (!obj) return undefined;
+	const persistence: PersistenceConfig = {
+		skipTasksFsync: parseWithSchema(Type.Boolean(), obj.skipTasksFsync),
+	};
+	return Object.values(persistence).some((entry) => entry !== undefined) ? persistence : undefined;
+}
+
 function parseWorktreeConfig(value: unknown): CrewWorktreeConfig | undefined {
 	const obj = asRecord(value);
 	if (!obj) return undefined;
@@ -456,11 +494,17 @@ function parseAgentOverride(value: unknown): AgentOverrideConfig | undefined {
 function parseUiConfig(value: unknown): CrewUiConfig | undefined {
 	const obj = asRecord(value);
 	if (!obj) return undefined;
-	const rawWidgetPlacement = parseWithSchema(Type.Union([Type.Literal("aboveEditor"), Type.Literal("belowEditor")]), obj.widgetPlacement);
+	const rawWidgetPlacement = parseWithSchema(
+		Type.Union([Type.Literal("aboveEditor"), Type.Literal("belowEditor"), Type.Literal("bottom")]),
+		obj.widgetPlacement,
+	);
 	const rawDashboardPlacement = parseWithSchema(Type.Union([Type.Literal("center"), Type.Literal("right")]), obj.dashboardPlacement);
+	const rawRowStyle = parseWithSchema(Type.Union([Type.Literal("compact"), Type.Literal("detailed")]), obj.widgetRowStyle);
 	const ui: CrewUiConfig = {
 		widgetPlacement: rawWidgetPlacement,
 		widgetMaxLines: parsePositiveInteger(obj.widgetMaxLines, 50),
+		widgetRowStyle: rawRowStyle,
+		inlinePanel: parseWithSchema(Type.Boolean(), obj.inlinePanel),
 		powerbar: parseWithSchema(Type.Boolean(), obj.powerbar),
 		dashboardPlacement: rawDashboardPlacement,
 		dashboardWidth: parseIntegerInRange(obj.dashboardWidth, 32, 120),
@@ -670,6 +714,7 @@ export function parseConfig(raw: unknown): PiTeamsConfig {
 		otlp: parseOtlpConfig(obj.otlp),
 		ui: parseUiConfig(obj.ui),
 		broker: parseBrokerConfig(obj.broker),
+		persistence: parsePersistenceConfig(obj.persistence),
 	};
 }
 

package/src/config/config.ts

@@ -7,8 +7,8 @@ import { logInternalError } from "../utils/internal-error.ts";
 import { projectCrewRoot, projectPiRoot } from "../utils/paths.ts";
 import { mergeConfig } from "./config-merge.ts";
 import { parseConfig, parseConfigWithWarnings } from "./config-validation.ts";
-import { DEFAULT_BROKER, DEFAULT_NESTING, resolveBrokerEnvOverride } from "./defaults.ts";
-import { getCrewEnv } from "./env-vars.ts";
+import { DEFAULT_BROKER, DEFAULT_NESTING, DEFAULT_PERSISTENCE, resolveBrokerEnvOverride } from "./defaults.ts";
+import { getCrewEnv, getCrewEnvBool } from "./env-vars.ts";
 import { sanitizeProjectConfig } from "./sanitize-project-config.ts";
 
 // 2.9: interface types extracted to ./types.ts; re-export for back-compat.
@@ -45,6 +45,7 @@ import type {
 	CrewBrokerConfig,
 	CrewNestingConfig,
 	LoadedPiTeamsConfig,
+	PersistenceConfig,
 	PiTeamsAutonomousConfig,
 	PiTeamsConfig,
 	SavedPiTeamsConfig,
@@ -225,8 +226,9 @@ export function projectPiCrewJsonPath(cwd: string): string {
  * config block, or default.
  */
 
-/** ADR-5 §10: layer DEFAULT_NESTING under any user-set keys — the
- *  fail-closed enabled=false default must hold when no nesting block exists. */
+/** ADR-5 §10: layer DEFAULT_NESTING under any user-set keys — the default-on
+ *  enabled=true (D8 flip) must hold when no nesting block exists, and an
+ *  explicit user `enabled: false` still wins as the kill switch. */
 function applyNestingDefaults(parsed: CrewNestingConfig | undefined): CrewNestingConfig {
 	return { ...DEFAULT_NESTING, ...parsed };
 }
@@ -235,6 +237,21 @@ function applyBrokerEnvOverrideAndDefaults(parsed: CrewBrokerConfig | undefined)
 	return { ...DEFAULT_BROKER, ...envOverridden };
 }
 
+/**
+ * Resolve the persistence section (perf round 2, Task 3).
+ * Precedence: env `PI_CREW_PERSISTENCE_SKIP_TASKS_FSYNC` ("1"/"true") BEATS a
+ * config `persistence.skipTasksFsync`; config beats the DEFAULT_PERSISTENCE
+ * default (false). Mirrors resolveBrokerEnvOverride's env-beats-config shape.
+ */
+function resolvePersistenceEnvOverrideAndDefaults(parsed: PersistenceConfig | undefined): PersistenceConfig {
+	const envOverride = getCrewEnvBool("PI_CREW_PERSISTENCE_SKIP_TASKS_FSYNC");
+	return {
+		...DEFAULT_PERSISTENCE,
+		...parsed,
+		...(envOverride === undefined ? {} : { skipTasksFsync: envOverride }),
+	};
+}
+
 function unsetPath(record: Record<string, unknown>, dottedPath: string): void {
 	const parts = dottedPath.split(".").filter(Boolean);
 	if (parts.length === 0) return;
@@ -377,15 +394,20 @@ export function loadConfig(cwd?: string): LoadedPiTeamsConfig {
 			// the enabled flag even when no broker block is configured.
 			broker: applyBrokerEnvOverrideAndDefaults(config.broker),
 			nesting: applyNestingDefaults(config.nesting),
+			// PERF round 2, Task 3: env beats config, config beats the default.
+			persistence: resolvePersistenceEnvOverrideAndDefaults(config.persistence),
 		},
 		warnings: warnings.length > 0 ? warnings : undefined,
 	};
+	// PERF (2026-08-24): readCacheMtimes stats up to 4 files per call and ran
+	// twice back-to-back here (guard + store). Compute once.
+	const storeMtimes = readCacheMtimes(cacheParts);
 	// Only cache when at least one of the watched paths exists — this avoids
 	// pinning stale empty results when a user later creates one of these files
 	// in the cache window. mtime stat below picks up the new file (it appears
 	// in currentMtimes but not in cached.mtimes) and triggers a re-parse.
-	if (Object.keys(readCacheMtimes(cacheParts)).length > 0) {
-		setConfigCache(cacheKey, result, readCacheMtimes(cacheParts));
+	if (Object.keys(storeMtimes).length > 0) {
+		setConfigCache(cacheKey, result, storeMtimes);
 	}
 	return result;
 }

package/src/config/defaults.ts

@@ -129,8 +129,15 @@ export const DEFAULT_UI = {
 	refreshMs: 1000,
 	notifierIntervalMs: 5000,
 	widgetDefaultFrameMs: 1000,
-	widgetPlacement: "aboveEditor" as const,
+	// The crew widget (agent rows + hint + main row) docks BELOW the editor,
+	// matching pi-subtask's subtask panel — the transcript pane separately
+	// mounts above the editor, exactly like pi-subtask's fork view.
+	// The dock renders at the very bottom of the screen, below the crew-vibes
+	// quota/meter footer (falls back to belowEditor when no footer sink exists).
+	widgetPlacement: "bottom" as const,
 	widgetMaxLines: 8,
+	widgetRowStyle: "compact" as const,
+	inlinePanel: true,
 	powerbar: true,
 	dashboardPlacement: "center" as const,
 	dashboardWidth: 72,
@@ -187,24 +194,49 @@ export const DEFAULT_BROKER = {
 	maxFrameBytes: 262144,
 	outboundQueueCap: 256,
 	/** WP-2/R2 (ADR-0 docs/decisions/2026-08-17-waiting-producer-ask item 7):
-	 *  capability gate for the broker's `wait.*` methods. DEFAULT FALSE —
-	 *  fail-closed until WP-2 completes, then flipped to true. While false,
+	 *  capability gate for the broker's `wait.*` methods. FLIPPED TO TRUE
+	 *  (2026-08-26): WP-2 completed and its battery landed, so the ADR-0
+	 *  "then flipped to true" step is now done — ask works out of the box.
+	 *  (Before this flip, every production ask was rejected policy-disabled
+	 *  whenever no user config existed — the feature slept silently.) Set
+	 *  `broker.waitMethodsEnabled: false` to re-close. While false,
 	 *  wait.request/wait.resolve are rejected with a policy-disabled error
 	 *  AND a policy.action event in events.jsonl (never silent). */
-	waitMethodsEnabled: false,
+	waitMethodsEnabled: true,
 } as const;
 
 /**
  * Governed-nesting defaults (ADR-5 docs/decisions/2026-08-17-governed-nesting.md §10).
- * `enabled` is DEFAULT FALSE — fail-closed until WP-5 completes (B3 battery +
- * security sign-off), then flipped to true. While false, the `delegate`
- * surface rejects with a structured policy message and a `delegate.rejected`
- * event in events.jsonl (never silent). `maxSlots` default is computed at the
- * spawn policy from the global worker semaphore: max(1, floor(globalSem/2)).
+ * `enabled` is DEFAULT TRUE since D8 (spec v0.7, 2026-08-26): the WP-5
+ * completion gate (B3 battery + security sign-off) passed and Task 3 opened
+ * the `delegate` role gate for every role, so nested spawning — child creates
+ * child — is on out of the box. The security border moved to the depth cap
+ * (maxDepth 4) + the nested-slot budget; `nesting.enabled: false` in USER
+ * config (sensitive — project config cannot flip it) closes the surface, and
+ * while closed `delegate` rejects with a structured policy message plus a
+ * `delegate.rejected` event in events.jsonl (never silent). `maxSlots` default
+ * is computed at the spawn policy from the global worker semaphore:
+ * max(1, floor(globalSem/2)).
  */
 export const DEFAULT_NESTING = {
-	enabled: false,
-	maxDepth: 2,
+	enabled: true,
+	// D8 (spec v0.7): nested spawning open — child creates child. Kept in
+	// lockstep with DEFAULT_MAX_CREW_DEPTH (pi-args) so the broker-admission
+	// depth gate and the spawn-side cap can never disagree.
+	maxDepth: 4,
+} as const;
+
+/**
+ * State-layer persistence defaults (perf round 2, Task 3).
+ * `skipTasksFsync` is DEFAULT FALSE — opt-in only. Because the flag is
+ * consumed at the save site in the state layer, `loadConfig` must READ it
+ * (not default-on-borrow): the flag affects the cost of every non-terminal
+ * tasks checkpoint, so it must never silently flip from "fsync" to "no
+ * fsync" due to a config default alone. Env `PI_CREW_PERSISTENCE_SKIP_TASKS_FSYNC`
+ * ("1"/"true") beats config; config beats this default.
+ */
+export const DEFAULT_PERSISTENCE = {
+	skipTasksFsync: false,
 } as const;
 
 /**

package/src/config/env-vars.ts

@@ -270,8 +270,8 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 	PI_CREW_INTERRUPT_GUARD_INTERVAL_MS: {
 		name: "PI_CREW_INTERRUPT_GUARD_INTERVAL_MS",
 		parser: "int",
-		default: 250,
-		doc: "interrupt-guard poll interval; default 250ms (background-runner.ts:217)",
+		default: 1000,
+		doc: "interrupt-guard poll interval; default 1000ms (background-runner.ts:217)",
 	},
 	PI_CREW_MAX_RUN_MS: {
 		name: "PI_CREW_MAX_RUN_MS",
@@ -323,6 +323,11 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 		name: "PI_CREW_PLAN_UI",
 		doc: "'1' enables the Plan dashboard pane (7) + plans snapshot slice (WP-7/R7)",
 	},
+	PI_CREW_PERSISTENCE_SKIP_TASKS_FSYNC: {
+		name: "PI_CREW_PERSISTENCE_SKIP_TASKS_FSYNC",
+		parser: "boolean",
+		doc: "'1'/'true' writes non-terminal tasks checkpoints best-effort (no fsync; 50ms coalesce kept, only durability skipped); terminal transitions stay full (defaults.ts, config.ts persistence.skipTasksFsync)",
+	},
 	PI_CREW_TRUST_PROJECT_DWF: {
 		name: "PI_CREW_TRUST_PROJECT_DWF",
 		doc: "'1' allows project-sourced .dwf.ts workflows (dynamic-workflow-runner.ts:154)",
@@ -390,6 +395,10 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 		name: "PI_CREW_ASK_ENABLED",
 		doc: "'1' enables the worker-side ask tool — dormant-until-env gate (written UNCONDITIONALLY by child-pi-spawn.ts, read by prompt-runtime.ts per ADR-0 WP-2 item 2)",
 	},
+	PI_CREW_MSG_ENABLED: {
+		name: "PI_CREW_MSG_ENABLED",
+		doc: "'1' enables the worker-side message tool (D9/§15.2) — dormant-until-env gate (written UNCONDITIONALLY by child-pi-spawn.ts, read by prompt-runtime.ts)",
+	},
 	PI_CREW_STATE_ROOT: {
 		name: "PI_CREW_STATE_ROOT",
 		doc: "run stateRoot for the ask-tool mailbox poll (<stateRoot>/mailbox; written by child-pi-spawn.ts, read by prompt-runtime.ts per ADR-0 WP-2 item 2)",
@@ -398,6 +407,22 @@ export const CREW_ENV_VARS: Record<string, CrewEnvVarSpec> = {
 		name: "PI_CREW_BROKER_RUN_ID",
 		doc: "broker run id; aliases PI_CREW_RUN_ID (scratchpad-lifecycle.ts:81, crew-broker-child.ts:51)",
 	},
+	PI_CREW_AGENT_EVENTS_PATH: {
+		name: "PI_CREW_AGENT_EVENTS_PATH",
+		doc: "per-agent events log (<stateRoot>/agents/<taskId>/events.jsonl) written by the surface worker recorder (surface-worker.ts; derived by prepareSurfaceSpawn)",
+	},
+	PI_CREW_AUTO_EXIT: {
+		name: "PI_CREW_AUTO_EXIT",
+		doc: "'1' → the worker shuts its session down after the final settled turn — spec §5.2 D7 (written by prepareSurfaceSpawn, read by surface-worker.ts)",
+	},
+	PI_CREW_SURFACE: {
+		name: "PI_CREW_SURFACE",
+		doc: "surface provider kind for this worker ('tmux'|'herdr') — arms the worker-side recorder/parent-guard (written by prepareSurfaceSpawn.ts:214, read by surface-worker.ts)",
+	},
+	PI_CREW_PARENT_START_TIME: {
+		name: "PI_CREW_PARENT_START_TIME",
+		doc: "parent starttime ticks (/proc/<pid>/stat field 22) captured at spawn — pid-reuse-safe parent-guard comparison (written by prepareSurfaceSpawn.ts:223, read by surface-worker.ts)",
+	},
 	PI_CREW_ARTIFACTS_ROOT: {
 		name: "PI_CREW_ARTIFACTS_ROOT",
 		doc: "artifacts root for scratchpad containment (scratchpad-lifecycle.ts:228/281)",

package/src/config/role-tools.ts

@@ -90,9 +90,11 @@ export const ROLE_TOOL_CONFIGS: Record<string, RoleToolConfig> = {
 		scratchpad: true,
 	},
 
-	// Test Engineer - Can write tests (F1: hyphenated key)
+	// Test Engineer - Can write tests (F1: hyphenated key). Tool list mirrors
+	// agents/test-engineer.md frontmatter (T3 binding, commit c25dfbe2):
+	// search tools + delegate for spawning depth-1 helpers.
 	"test-engineer": {
-		tools: ["read", "edit", "write", "bash", "ls", "scratchpad", "ask"],
+		tools: ["read", "edit", "write", "bash", "ls", "glob", "grep", "find", "scratchpad", "ask", "delegate"],
 		excludeTools: ["web"],
 		// Phase 1 scratchpad: build/run test suites with state across cells.
 		scratchpad: true,

package/src/config/types.ts

@@ -85,6 +85,21 @@ export interface CrewRuntimeConfig {
 	};
 	/** Mark certain bash commands as excludeFromContext to reduce context tokens. Default: false */
 	excludeContextBash?: boolean;
+	/**
+	 * Mux-surface policy (mux-surface spec v0.7 §8.1): WHERE worker processes
+	 * live — a pane in tmux/herdr or headless child processes. Surface only
+	 * picks the process home; scheduler, broker, and state-on-disk are
+	 * unaffected. Not sensitive — any config tier may set it.
+	 */
+	surface?: {
+		/** auto = detect tmux/herdr and use panes when present, else headless.
+		 *  "tmux"/"herdr" force a backend (detect fail → headless + warning
+		 *  event, never a throw). "off" disables panes entirely. Default: "auto". */
+		mode?: "auto" | "tmux" | "herdr" | "off";
+		/** Exact-match agent/role names that get a surface pane; ["*"] = all.
+		 *  Default: [] in A1 (surface visible to nobody until opted in). */
+		visibleAgents?: string[];
+	};
 	/** Subagent model fallback policy: auto-tail ordering, cap, credential filtering, default model. */
 	modelFallback?: CrewModelFallbackConfig;
 }
@@ -143,8 +158,26 @@ export interface GoalWrapWorkflowConfig {
 }
 
 export interface CrewUiConfig {
-	widgetPlacement?: "aboveEditor" | "belowEditor";
+	/**
+	 * Where the crew dock (agents list) renders:
+	 *  - `aboveEditor` / `belowEditor`: pi's widget slots around the prompt;
+	 *  - `bottom`: inside the crew-vibes footer, BELOW the quota/meter lines
+	 *    (the very bottom of the screen). Falls back to `belowEditor` when
+	 *    crew-vibes is not active (no footer sink).
+	 */
+	widgetPlacement?: "aboveEditor" | "belowEditor" | "bottom";
 	widgetMaxLines?: number;
+	/**
+	 * Per-agent row layout in the widget. `compact` is one width-budgeted line
+	 * per agent; `detailed` keeps the two-line tree (name row + activity row).
+	 */
+	widgetRowStyle?: "compact" | "detailed";
+	/**
+	 * Keyboard-navigable agent rows under the prompt (`↓` from an empty prompt).
+	 * Requires owning pi's editor component, so it yields to any other extension
+	 * that already installed a custom editor.
+	 */
+	inlinePanel?: boolean;
 	powerbar?: boolean;
 	dashboardPlacement?: "center" | "right";
 	dashboardWidth?: number;
@@ -295,6 +328,27 @@ export interface PiTeamsConfig {
 	 * `delegate.rejected` event (never silent).
 	 */
 	nesting?: CrewNestingConfig;
+	/** State-layer persistence knobs (perf round 2, Task 3). Opt-in only. */
+	persistence?: PersistenceConfig;
+}
+
+/** State-layer persistence knobs (perf round 2, Task 3). */
+export interface PersistenceConfig {
+	/**
+	 * Opt-in (default `false`): write non-terminal tasks checkpoints with
+	 * `durability:"best-effort"` (no fsync) while KEEPING the 50ms coalesced
+	 * write grouping — only the durability of the flush changes, not its
+	 * timing. tasks.json is fully reconstructible from the fsync'd event log,
+	 * so a crash loses at most the tail of an in-flight checkpoint and
+	 * recovers from events.jsonl. Terminal task transitions (completed/failed/
+	 * cancelled/needs_attention/skipped) ALWAYS stay full-durability
+	 * regardless of this flag.
+	 * Set via env `PI_CREW_PERSISTENCE_SKIP_TASKS_FSYNC` (`"1"`/`"true"`) or
+	 * config `persistence.skipTasksFsync`. Env beats config; default false.
+	 * @see src/state/stores/state-store.ts saveRunTasksCoalesced
+	 * @see src/runtime/task-runner/state-helpers.ts persistSingleTaskUpdate
+	 */
+	skipTasksFsync?: boolean;
 }
 
 /** Governed-nesting config (ADR-5). */

package/src/extension/crew-cleanup.ts

@@ -1,5 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { cleanupAllTrackedTempDirs } from "../runtime/model/pi-args.ts";
+import { isSessionSwitchInFlight } from "../ui/inline-panel/view-session-store.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 
 // NOTE: globalProgressTracker import kept for documentation but not directly used
@@ -67,6 +68,18 @@ export function registerCleanupHandler(pi: ExtensionAPI, opts?: { disposeTermina
 		console.log("[pi-crew] Session shutdown - cleaning up resources");
 
 		try {
+			// Navigational switches (pi's own resume/new/fork) tear the session
+			// down on purpose — the user is only LOOKING at a different pi
+			// session; foreground team runs + their workers share this process
+			// and must keep running (P0: "jumping into any session stops the
+			// run" — exit 143 signature). Killing them here bypasses child-pi's
+			// abort flags, so the worker exit reads as an "unexpected
+			// code=143 signal=null" and the run is cancelled. Same contract as
+			// stopSessionBoundSubagents and the run-deadline caller-abort
+			// suppression; on REAL shutdowns (quit/reload) the flag is unset
+			// and this cleanup still drains the registry, as does the
+			// process-exit hook (tryRegisterSessionCleanup) when pi dies.
+			if (isSessionSwitchInFlight()) return;
 			// Kill all child-pi processes
 			await cleanupChildProcesses();
 

package/src/extension/crew-vibes/footer.ts

@@ -1,7 +1,9 @@
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { getFooterDockProvider } from "../../ui/dock-footer.ts";
 import { requestRenderTarget } from "../../ui/pi-ui-compat.ts";
 import { asCrewTheme, type CrewTheme } from "../../ui/theme-adapter.ts";
+import { colorWidgetLine, renderLines } from "../../ui/widget/widget-renderer.ts";
 import { truncateToWidth, visibleWidth } from "../../utils/visual.ts";
 import type { CrewVibesConfig } from "./config.ts";
 import type { ProviderUsage } from "./provider-usage.ts";
@@ -280,11 +282,28 @@ class CrewVibesFooter implements FooterComponent {
 		return [truncateToWidth(cap, width, "…"), this.rightAlign(quota, width)];
 	}
 
+	/** Dock lines registered by the crew widget (`widgetPlacement: "bottom"`):
+	 *  painted as the very last block of the footer, below the quota/meters.
+	 *  The provider returns RAW lines; we color them with this footer's theme
+	 *  (same per-line palette the widget would have used) and truncate to the
+	 *  real render width. */
+	private buildDockLines(width: number): string[] {
+		const provider = getFooterDockProvider();
+		if (!provider) return [];
+		const raw = provider(width);
+		if (raw.length === 0) return [];
+		return renderLines(
+			raw.map((line, index) => colorWidgetLine(line, index, this.theme)),
+			width,
+		).map((line) => truncateToWidth(line, width, "…"));
+	}
+
 	render(width: number): string[] {
 		const lines = [this.buildPwdLine(width), this.buildStatsLine(width)];
 		const statusLine = this.buildStatusLine(width);
 		if (statusLine) lines.push(statusLine);
 		lines.push(...this.buildMeterLines(width));
+		lines.push(...this.buildDockLines(width));
 		return lines;
 	}
 }

package/src/extension/crew-vibes/index.ts

@@ -19,6 +19,7 @@ function safeUiCall(scope: string, fn: () => void): void {
 	}
 }
 
+import { setFooterDockSinkActive } from "../../ui/dock-footer.ts";
 import { type CrewVibesConfig, loadConfig, saveConfig } from "./config.ts";
 import { intervalForSpeed } from "./figures.ts";
 import { type CrewVibesFooterSource, createCrewVibesFooter } from "./footer.ts";
@@ -91,11 +92,18 @@ export function registerCrewVibes(pi: ExtensionAPI): void {
 	function installFooter(ctx: ExtensionContext): void {
 		if (!ctx?.hasUI) return;
 		if (!metersActive()) {
-			safeUiCall("clear-footer", () => setFooter(ctx, undefined));
+			safeUiCall("clear-footer", () => {
+				// The crew dock can no longer render at the very bottom — the
+				// widget falls back to pi's belowEditor slot automatically.
+				setFooterDockSinkActive(false);
+				setFooter(ctx, undefined);
+			});
 			return;
 		}
 		safeUiCall("install-footer", () => {
 			setFooter(ctx, (tui, theme, footerData) => createCrewVibesFooter({ tui, theme, footerData, ctx, source: footerSource }));
+			// The footer can now host the crew dock below the quota lines.
+			setFooterDockSinkActive(true);
 			requestRender(ctx);
 		});
 	}
@@ -245,6 +253,7 @@ export function registerCrewVibes(pi: ExtensionAPI): void {
 			stopFooterTimer();
 			stopCapacityTimer();
 			stopProviderTimer();
+			setFooterDockSinkActive(false);
 			setFooter(ctx, undefined);
 			clearVibesStatus(ctx);
 			return;
@@ -370,6 +379,7 @@ export function registerCrewVibes(pi: ExtensionAPI): void {
 		stopFooterTimer();
 		stopCapacityTimer();
 		stopProviderTimer();
+		setFooterDockSinkActive(false);
 		setFooter(ctx, undefined);
 		clearVibesStatus(ctx);
 	});

package/src/extension/register.ts

@@ -21,6 +21,7 @@ import { loadConfig } from "../config/config.ts";
 import { startRuntimeWarmup } from "../runtime/model/runtime-warmup.ts";
 import { primePeerDep } from "../runtime/peer-dep.ts";
 import { deployBundledThemes } from "../ui/deploy-bundled-themes.ts";
+import { installChildProcessAbortShield } from "../utils/child-process-shield.ts";
 import { resetTimings, time } from "../utils/timings.ts";
 import { registerAutonomousPolicy } from "./autonomous-policy.ts";
 import { registerContextStatusInjection } from "./context-status-injection.ts";
@@ -52,6 +53,13 @@ export function registerPiTeams(pi: ExtensionAPI): void {
 	resetTimings();
 	time("register:start");
 
+	// MUST run before any team run can start: guarantees every signal-spawned
+	// child in the process has an 'error' listener so Node's abort-after-exit
+	// AbortError dispatches instead of being rethrown on the next tick as an
+	// uncaughtException that kills pi (see child-process-shield.ts for the
+	// full crash chain — /crew-view mid-run crash).
+	installChildProcessAbortShield();
+
 	startRuntimeWarmup();
 	primePeerDep().catch(() => undefined);
 	deployBundledThemes();

package/src/extension/registration/command-registration.ts

@@ -31,6 +31,7 @@ export function registerPiCommands(pi: ExtensionAPI, ctx: RegistrationContext):
 		getManifestCache: ctx.getManifestCache,
 		getRunSnapshotCache: ctx.getRunSnapshotCache,
 		getMetricRegistry: () => ctx.observabilityState.metricRegistry,
+		getCurrentSessionFile: () => ctx.currentCtx?.sessionManager?.getSessionFile?.(),
 		uiState: ctx.uiState,
 		dismissNotifications: () => {
 			ctx.widgetState.notificationCount = 0;

package/src/extension/registration/commands/run.ts

@@ -17,7 +17,21 @@ export function registerRunCommands(pi: ExtensionAPI, deps: RegisterTeamCommands
 				abortForegroundRun: deps.abortForegroundRun,
 				onRunStarted: undefined,
 			});
-			await notifyCommandResult(ctx, commandText(result));
+			// A foreground run can span a session switch (e.g. the user opens
+			// an agent view mid-run and the run finishes there). The captured
+			// ctx is stale after the switch: ANY access to it (even reading a
+			// field) throws pi's "This extension ctx is stale ..." error, which
+			// pi then prints into whichever session is active. Probe
+			// defensively and skip the notification when the session moved on
+			// (the result is still visible via /team-status).
+			try {
+				const capturedFile = ctx.sessionManager?.getSessionFile?.();
+				const currentFile = deps.getCurrentSessionFile?.();
+				if (capturedFile && currentFile && capturedFile !== currentFile) return;
+				await notifyCommandResult(ctx, commandText(result));
+			} catch {
+				// Stale ctx during the probe or notify — nothing to do here.
+			}
 		},
 	});
 

package/src/extension/registration/commands/shared.ts

@@ -80,6 +80,14 @@ export interface RegisterTeamCommandsDeps {
 	getMetricRegistry?: () => MetricRegistry | undefined;
 	uiState?: UiState;
 	dismissNotifications?: () => void;
+	/**
+	 * The session file of the CURRENT session (RegistrationContext.currentCtx).
+	 * Commands whose handler can span a session switch — team-run awaits the
+	 * whole foreground run — use this after the await to detect that the
+	 * captured ctx is stale and skip notifications that pi would drop with a
+	 * "ctx is stale" error.
+	 */
+	getCurrentSessionFile?: () => string | undefined;
 }
 
 // Lazy-loaded UI module cache — avoids importing 900ms+ of UI at Pi startup.

package/src/extension/registration/foreground-run-controller.ts

@@ -20,6 +20,7 @@ import { setWorkingIndicator } from "../../ui/pi-ui-compat.ts";
 import { requestPowerbarUpdate } from "../../ui/powerbar-publisher.ts";
 import { updateCrewWidget } from "../../ui/widget/index.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
+import { safeAbort } from "../../utils/safe-abort.ts";
 import type { RegistrationContext } from "./registration-types.ts";
 
 /**
@@ -36,7 +37,10 @@ export function installForegroundRunController(pi: ExtensionAPI, ctx: Registrati
 	ctx.abortForegroundRun = (runId) => {
 		const controller = ctx.foregroundTeamRunControllers.get(runId);
 		if (!controller) return false;
-		controller.abort();
+		// safe-abort: cancel can race a completed run whose spawned children
+		// already exited — Node's child_process signal listener would throw
+		// AbortError out of abort() and kill the host (uncaughtException).
+		safeAbort(controller, "fg-run.abort-by-run-id");
 		return true;
 	};
 }
@@ -142,7 +146,11 @@ function startForegroundRunImpl(
 						.catch((error) => logInternalError("register.foreground-watchdog", error, `runId=${runId}`));
 				}
 				const ownerCurrent = ctx.isContextCurrent(extensionCtx, ownerGeneration);
-				if (extensionCtx.hasUI) {
+				// The owner ctx can go stale while the run is in flight (e.g. the
+				// user opened an agent session view via /crew-view and the run
+				// finishes there): the `hasUI` getter THROWS on a stale ctx, so
+				// it must only be touched for the still-current owner.
+				if (ownerCurrent && extensionCtx.hasUI) {
 					try {
 						setWorkingIndicator(extensionCtx);
 						extensionCtx.ui.setWorkingMessage();