pi-crew 0.10.3 → 0.10.4

package/docs/architecture.md

@@ -2,7 +2,7 @@
 
 `pi-crew` is a Pi package for coordinated multi-agent work. It is intentionally durable-first: every run is represented on disk, every task has a state record, and child workers stream progress into JSONL/status files so foreground sessions, background jobs, dashboards, and later restarts all read the same source of truth.
 
-**Current version:** v0.9.0 — 100+ rounds of code review hardening (see [CHANGELOG.md](../CHANGELOG.md)).
+**Current version:** v0.10.3 — 100+ rounds of code review hardening (see [CHANGELOG.md](../CHANGELOG.md)).
 
 ## Layers
 
@@ -79,11 +79,11 @@ The extension layer should remain thin: user input is normalized into tool param
 
 ### Task runner
 
-`src/runtime/task-runner.ts` executes one task. It prepares workspace/worktree context, renders a task prompt, chooses model candidates from Pi configuration, launches a child Pi process by default, and writes result artifacts. Scaffold mode is explicit dry-run only.
+`src/runtime/task-runner.ts` (thin entry, ~230 lines) executes one task; branch bodies live in `src/runtime/task-runner/` modules (`pre-execution.ts`, `child-executor.ts`, `post-execution.ts`, `live-executor.ts`, `scaffold-executor.ts`, …). It prepares workspace/worktree context, renders a task prompt, chooses model candidates from Pi configuration, launches a child Pi process by default, and writes result artifacts. Scaffold mode is explicit dry-run only.
 
 ### Child Pi runtime
 
-`src/runtime/child-pi.ts` is the default worker runtime. It:
+`src/runtime/child-pi/child-pi.ts` is the default worker runtime (split into the `src/runtime/child-pi/` module — `child-pi-spawn.ts`, `child-pi-streams.ts`, `child-pi-kill.ts`, `child-pi-steering.ts`, `child-pi-timers.ts`, `child-pi-transcript.ts`, `child-pi-constants.ts`). It:
 
 - launches real `pi` child processes,
 - hides Windows console windows with `windowsHide: true`,
@@ -98,7 +98,7 @@ The extension layer should remain thin: user input is normalized into tool param
 
 ### Concurrency and policy
 
-`src/runtime/concurrency.ts` picks batch size from explicit limits, team settings, workflow settings, or built-in defaults. User-provided `limits.maxConcurrentWorkers` is hard-capped by default to prevent local DoS; `limits.allowUnboundedConcurrency=true` is an explicit opt-out and emits an observability event.
+`src/runtime/scheduling/concurrency.ts` picks batch size from explicit limits, team settings, workflow settings, or built-in defaults. User-provided `limits.maxConcurrentWorkers` is hard-capped by default to prevent local DoS; `limits.allowUnboundedConcurrency=true` is an explicit opt-out and emits an observability event.
 
 `src/runtime/policy-engine.ts` applies closeout and safety policy decisions such as limit exceeded, failed task blocking, stale workers, and green-contract failures.
 

package/docs/commands-reference.md

@@ -41,6 +41,9 @@ Slash commands are manual actions triggered from the Pi chat. Autonomous tool us
 | `/team-mascot` | Toggle the mascot overlay |
 | **`/team-goal`** | **v0.9.0** Start autonomous goal loop (sub-actions: `start/status/pause/resume/stop/step/clear`) |
 | **`/workflows`** | **v0.9.0** List static + dynamic workflows (`.dwf.ts`) |
+| `/crew-view <runId> <taskId>` | Open an agent's live full-screen transcript view (thin alias for the inline-panel pane wiring; never switches sessions) |
+| `/crew-back` | Close the agent transcript view and return to the main conversation |
+| `/team-vibes [on\|off\|speed on\|off\|capacity on\|off]` | Toggle crew-vibes speed + context meters (on/off, speed, capacity) |
 
 **Removed (v0.10.1 docs hygiene):** `/team-orchestrate`, `/team-schedule`,
 `/team-scheduled`, `/team-search`, `/team-graph` — phantom entries; none of

package/docs/publishing.md

@@ -31,7 +31,19 @@ of the full ~6,500-test `npm run check` which takes minutes):
 npm run test:critical && npm run typecheck && npm run build:bundle
 ```
 
-4. Verify package contents:
+4. Verify dist is clean and current ("dist clean check", WI-1.3):
+
+```bash
+git status --short dist/                          # must print NOTHING (clean)
+node scripts/check-bundle-staleness.mjs --committed-hash   # must exit 0
+```
+
+A dirty or stale committed dist silently ships old code (the v0.9.x
+stale-bundle incident class). If either check fails: `npm run build:bundle`,
+then commit the bundle — `git add -f dist/ && git commit -- dist`
+(dist/ is gitignored, so `-f` is required).
+
+5. Verify package contents:
 
 ```bash
 npm pack --dry-run
@@ -44,7 +56,7 @@ Confirm bundled skills ship (the `real-test-pi-crew` skill references
 npm pack --dry-run 2>&1 | grep -E 'skills/|pty_probe'
 ```
 
-5. Verify local install in Pi:
+6. Verify local install in Pi:
 
 ```bash
 pi install ./pi-crew
@@ -52,7 +64,7 @@ pi install ./pi-crew
 /team-validate
 ```
 
-6. Publish when ready:
+7. Publish when ready:
 
 ```bash
 npm publish --access public

package/install.mjs

@@ -2,13 +2,32 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { pathToFileURL } from "node:url";
 
 const home = process.env.PI_TEAMS_HOME?.trim() || os.homedir();
 const agentDir = path.join(home, ".pi", "agent");
 const configPath = path.join(agentDir, "pi-crew.json");
 const legacyConfigPath = path.join(agentDir, "extensions", "pi-crew", "config.json");
-const defaultConfig = {
-  // Keep generated config non-invasive: runtime/limits use pi-crew internal defaults.
+
+/**
+ * Default config written to `~/.pi/agent/pi-crew.json` on fresh installs.
+ *
+ * WI-1b.2 (G17): this object is intentionally an embedded literal — install.mjs
+ * runs under bare `node` as the `pi-crew` bin (engines floor is >=22.0.0; .ts
+ * imports would require >=22.18 or `--experimental-strip-types`, which the npm
+ * bin shim cannot pass). Runtime jiti/esbuild loading was rejected as a
+ * postinstall failure surface; build-time codegen would need package.json /
+ * prepack wiring. Instead, drift is enforced by
+ * `test/unit/install-defaults-sync.test.ts`, which derives the source of truth
+ * from `src/config/defaults.ts` (DEFAULT_UI) and
+ * `src/config/config-validation.ts` (effectiveAutonomousConfig) and goes red
+ * the moment this literal diverges (mutation-demo verified).
+ *
+ * Keys mirror the curated subset in `src/extension/project-init.ts`
+ * (DEFAULT_PI_CREW_CONFIG) — deliberately non-invasive: runtime/limits use
+ * pi-crew internal defaults and are not pinned here.
+ */
+export const defaultConfig = {
   autonomous: {
     enabled: true,
     injectPolicy: true,
@@ -30,7 +49,9 @@ const defaultConfig = {
     }
   },
   ui: {
-    widgetPlacement: "aboveEditor",
+    // G17 drift fix (2026-09): was "aboveEditor" while DEFAULT_UI.widgetPlacement
+    // is "bottom" — fresh installs were pinning a stale default into user config.
+    widgetPlacement: "bottom",
     widgetMaxLines: 8,
     powerbar: true,
     dashboardPlacement: "center",
@@ -44,44 +65,74 @@ const defaultConfig = {
   }
 };
 
-fs.mkdirSync(agentDir, { recursive: true });
-if (!fs.existsSync(configPath)) {
-  if (fs.existsSync(legacyConfigPath)) {
-    fs.copyFileSync(legacyConfigPath, configPath);
-    console.log(`Migrated pi-crew global config to: ${configPath}`);
+/**
+ * Postinstall / bin behavior: create the agent dir, migrate or write the
+ * default global config, and print install + uninstall guidance.
+ * Kept side-effect-for-side-effect identical to the pre-refactor top-level
+ * script (WI-1b.2 refactor only moved it behind a main-guard).
+ */
+export function main() {
+  fs.mkdirSync(agentDir, { recursive: true });
+  if (!fs.existsSync(configPath)) {
+    if (fs.existsSync(legacyConfigPath)) {
+      fs.copyFileSync(legacyConfigPath, configPath);
+      console.log(`Migrated pi-crew global config to: ${configPath}`);
+    } else {
+      fs.writeFileSync(configPath, `${JSON.stringify(defaultConfig, null, 2)}\n`, "utf-8");
+      console.log(`Created default pi-crew global config: ${configPath}`);
+    }
   } else {
-    fs.writeFileSync(configPath, `${JSON.stringify(defaultConfig, null, 2)}\n`, "utf-8");
-    console.log(`Created default pi-crew global config: ${configPath}`);
+    console.log(`pi-crew global config already exists: ${configPath}`);
   }
-} else {
-  console.log(`pi-crew global config already exists: ${configPath}`);
+
+  console.log("\nInstall the published package in Pi with:");
+  console.log("  pi install npm:pi-crew");
+  console.log("\nFor local development from a cloned repo:");
+  console.log("  pi install .");
+  console.log("\nChild workers are enabled by default. For dry runs, set runtime.mode=scaffold or executeWorkers=false.");
+  console.log("To force-disable or force-enable workers in a shell, use PI_TEAMS_EXECUTE_WORKERS=0/1.");
+
+  // Side-effects warning (Issue #35): be upfront about what pi-crew writes and
+  // how to fully uninstall it. Nothing runs on install/registration itself; the
+  // writes below only happen when you explicitly invoke `team action=init`.
+  console.log("\n--- What pi-crew writes (and how to undo it) ---");
+  console.log("pi-crew itself writes nothing on install. The following only happens when you");
+  console.log("explicitly run `team action=init` in a project:");
+  console.log("  - A `.crew/` runtime state dir is created in the project (run history + artifacts).");
+  console.log("  - With --copy-builtins: bundled agents/teams/workflows are copied into the project.");
+  console.log("This install also created the global config above (`~/.pi/agent/pi-crew.json`).");
+  console.log("Note: pi-crew v0.8.14+ no longer injects a guidance block into AGENTS.md on init");
+  console.log("      (it was redundant — the `team` tool self-describes via tool registration).");
+  console.log("      Versions <0.8.14 did inject one; `team action=cleanup` removes it.");
+  console.log("\nFull uninstall (in order):");
+  console.log("  team action=cleanup dryRun=true       # preview what would be removed (project)");
+  console.log("  team action=cleanup                    # remove the AGENTS.md guidance block");
+  console.log("  team action=cleanup force=true         # also remove the .crew/ project state dir");
+  console.log("  team action=cleanup scope=user         # remove pi-crew user-scope junk");
+  console.log("                                          #   (~/.pi/agent/extensions/pi-crew/ + test .bak files)");
+  console.log("  team action=cleanup scope=user force=true  # also remove ~/.pi/agent/pi-crew.json");
+  console.log("  pi uninstall npm:pi-crew               # remove the package itself");
+  console.log("See the README 'Uninstall' section for details.");
 }
 
-console.log("\nInstall the published package in Pi with:");
-console.log("  pi install npm:pi-crew");
-console.log("\nFor local development from a cloned repo:");
-console.log("  pi install .");
-console.log("\nChild workers are enabled by default. For dry runs, set runtime.mode=scaffold or executeWorkers=false.");
-console.log("To force-disable or force-enable workers in a shell, use PI_TEAMS_EXECUTE_WORKERS=0/1.");
+/**
+ * Main-guard: run main() only when this file is executed directly
+ * (`node install.mjs` or via the npm `pi-crew` bin shim), never when imported
+ * as a module (e.g. by test/unit/install-defaults-sync.test.ts).
+ * realpathSync both sides: import.meta.url is the realpath (Node resolves
+ * symlinks by default), while argv[1] may be a symlinked bin path — e.g. the
+ * dev-install layout where node_modules/pi-crew symlinks into a source clone.
+ */
+function invokedDirectly() {
+  const invoked = process.argv[1];
+  if (!invoked) return false;
+  try {
+    return import.meta.url === pathToFileURL(fs.realpathSync(invoked)).href;
+  } catch {
+    return false;
+  }
+}
 
-// Side-effects warning (Issue #35): be upfront about what pi-crew writes and
-// how to fully uninstall it. Nothing runs on install/registration itself; the
-// writes below only happen when you explicitly invoke `team action=init`.
-console.log("\n--- What pi-crew writes (and how to undo it) ---");
-console.log("pi-crew itself writes nothing on install. The following only happens when you");
-console.log("explicitly run `team action=init` in a project:");
-console.log("  - A `.crew/` runtime state dir is created in the project (run history + artifacts).");
-console.log("  - With --copy-builtins: bundled agents/teams/workflows are copied into the project.");
-console.log("This install also created the global config above (`~/.pi/agent/pi-crew.json`).");
-console.log("Note: pi-crew v0.8.14+ no longer injects a guidance block into AGENTS.md on init");
-console.log("      (it was redundant — the `team` tool self-describes via tool registration).");
-console.log("      Versions <0.8.14 did inject one; `team action=cleanup` removes it.");
-console.log("\nFull uninstall (in order):");
-console.log("  team action=cleanup dryRun=true       # preview what would be removed (project)");
-console.log("  team action=cleanup                    # remove the AGENTS.md guidance block");
-console.log("  team action=cleanup force=true         # also remove the .crew/ project state dir");
-console.log("  team action=cleanup scope=user         # remove pi-crew user-scope junk");
-console.log("                                          #   (~/.pi/agent/extensions/pi-crew/ + test .bak files)");
-console.log("  team action=cleanup scope=user force=true  # also remove ~/.pi/agent/pi-crew.json");
-console.log("  pi uninstall npm:pi-crew               # remove the package itself");
-console.log("See the README 'Uninstall' section for details.");
+if (invokedDirectly()) {
+  main();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.10.3",
+  "version": "0.10.4",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",
@@ -68,7 +68,8 @@
   ],
   "scripts": {
     "check": "npm run ci",
-    "ci": "npm run check:lockfile-sync && npm run typecheck && npm run lint && npm run format:check && npm run check:conflict-markers && npm run check:decision-drift && npm run check:env-vars && npm run check:event-types && npm run check:lazy-imports && npm run check:bundle-staleness && npm run build:bundle && npm run check:bundle-size && npm run test:bundle && npm test && npm pack --dry-run",
+    "ci": "npm run check:lockfile-sync && npm run typecheck && npm run lint && npm run format:check && npm run check:conflict-markers && npm run check:decision-drift && npm run check:env-vars && npm run check:event-types && npm run check:lazy-imports && npm run check:wc-gate && npm run check:bundle-staleness && npm run build:bundle && npm run check:bundle-size && npm run test:bundle && npm test && npm pack --dry-run",
+    "ci:fast": "npm run check:lockfile-sync && npm run typecheck && npm run lint && npm run format:check && npm run check:conflict-markers && npm run check:decision-drift && npm run check:env-vars && npm run check:event-types && npm run check:lazy-imports && npm run check:wc-gate && npm run check:bundle-staleness && npm run build:bundle && npm run check:bundle-size && npm run test:bundle && npm run test:critical && npm pack --dry-run",
     "check:lockfile-sync": "node scripts/check-lockfile-sync.mjs",
     "check:lazy-imports": "node scripts/check-lazy-imports.mjs",
     "check:bundle-staleness": "node scripts/check-bundle-staleness.mjs",
@@ -81,10 +82,12 @@
     "lint": "biome check --linter-enabled=true --formatter-enabled=false --max-diagnostics=50 .",
     "format:check": "biome format .",
     "test": "npm run test:unit && npm run test:integration",
+    "test:full": "npm run test:unit && npm run test:integration && npm run test:integration:slow",
     "test:unit": "node scripts/test-runner.mjs --test-concurrency=4 --test-timeout=180000 --test-force-exit 'test/unit/**/*.test.ts'",
     "test:critical": "node scripts/test-runner.mjs --test-concurrency=4 --test-timeout=30000 --test-force-exit test/unit/runtime/broker/crew-broker-handshake.test.ts test/unit/runtime/broker/crew-broker-stale-socket.test.ts test/unit/runtime/broker/crew-broker-feature-flag.test.ts test/unit/runtime/broker/crew-broker-server-gate.test.ts test/unit/runtime/broker/crew-broker-client-fallback.test.ts test/unit/runtime/broker/crew-broker-mailbox-observer.test.ts test/unit/runtime/broker/crew-broker-close-during-reconnect.test.ts test/unit/runtime/broker/crew-broker-steer-dedup.test.ts test/unit/runtime/broker/crew-broker-symlink-steering.test.ts test/unit/ui/keybinding-map.parity.test.ts test/unit/ui/pi-tui-dispatch-probe.test.ts test/unit/utils/session-utils-extract.test.ts test/unit/config/config-schema-sync.test.ts test/unit/runtime/child-pi/child-pi-env-spread.test.ts",
     "test:watch": "node scripts/test-runner.mjs --watch --test-concurrency=4 --test-timeout=30000 'test/unit/**/*.test.ts'",
     "test:integration": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=300000 test/integration/*.test.ts",
+    "test:integration:slow": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=600000 test/integration/slow/*.test.ts",
     "test:system": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=180000 --test-force-exit test/system/*.e2e.test.ts",
     "test:smoke": "node scripts/test-runner.mjs --test-concurrency=1 --test-timeout=180000 test/smoke/*.smoke.ts",
     "test:spike": "node scripts/test-runner.mjs --test-concurrency=2 --test-timeout=120000 --test-force-exit test/runtime/scratchpad/*.test.ts",
@@ -106,7 +109,9 @@
     "profile:startup": "node scripts/profile-startup.mjs",
     "smoke:pi": "pi install .",
     "smoke:release": "node scripts/release-smoke.mjs",
-    "prepack": "node scripts/clean-strip-types.mjs"
+    "prepack": "node scripts/clean-strip-types.mjs",
+    "test:fast": "npm run test:critical && npm run test:bundle",
+    "check:wc-gate": "node scripts/wc-gate.mjs"
   },
   "exports": {
     "./schema.json": "./schema.json",

package/scripts/README.md

@@ -1,6 +1,7 @@
 # Scripts
 
-> **Note:** Many scripts in this directory are one-off fix scripts (e.g.,
-> `fix-*.cjs`, `patch-*.cjs`) that were used for specific migrations or
-> bugfixes and could be archived. Only `postinstall.mjs`, `build-bundle.mjs`,
+> **Note:** Some scripts in this directory are one-off fix/patch scripts
+> (e.g., `patch-*.cjs`) that were used for specific migrations or bugfixes
+> and could be archived. The 14 `fix-*.cjs` one-offs were removed in the
+> 2026-09 M1 hygiene sweep. Only `postinstall.mjs`, `build-bundle.mjs`,
 > and `watch-bundle.mjs` are actively used by the project.

package/skills/real-test-pi-crew/REPORT-TEMPLATE.md

@@ -37,6 +37,7 @@ This artifact exists so past runs are verifiable (see SKILL.md "Output report").
 | 10a surface E2E | ✅/❌/⏭️ | tmux 3/3 (spawn+self-close / kill-pane→degrade / doctor orphan) + herdr 3/3 — or skip reason per backend (no `$TMUX`/CI/no socket/in tmux for herdr) |
 | 10b live surface run | ✅/❌/⏭️ | `visibleAgents='<set>'`, pane ids+titles during run, `worker.surface_spawned`/`worker.surface_closed` events (+ no `surface.degraded`), panes auto-closed. NOTE: `manifest.surface.panes` is `{}` at run END even on success (released on pane close) — engage-evidence is the EVENTS + `manifest.surface.provider`/`workerPids` |
 | 10c herdr path | ✅/❌/⏭️ | ran in herdr pane / skipped (not in herdr pane) |
+| 11 remediation regression | ✅/❌/⏭️ | sub-checks run + evidence: 11a buffered-site census `<n>` files (full test:unit `<pass>/<tests>` if run) · 11b wc-gate max `<n>`/2000 + in `ci` · 11c validator warn `<key>` → severity · 11d slow tier 3 files disjoint · 11e nightly SMOKE not-set · 11f reject format sites · 11g widgetPlacement bottom · 11h twins 3× green · 11i dead-export 0 + MUST_INCLUDE 5 · 11j committed-hash OK |
 
 Legend: ✅ pass with evidence · ❌ fail (root cause below) · ⏭️ skipped (justify why)
 

package/skills/real-test-pi-crew/SKILL.md

@@ -32,14 +32,20 @@ triggers:
   - "delegate tool test"
   - "ask tool test"
   - "nested agent test"
-  - "tier 1 / tier 2 / tier 3 / tier 4 / tier 5 / tier 6 / tier 7 / tier 8 / tier 9 / tier 10"
+  - "tier 1 / tier 2 / tier 3 / tier 4 / tier 5 / tier 6 / tier 7 / tier 8 / tier 9 / tier 10 / tier 11"
+  - "read-your-writes"
+  - "delayed write regression"
+  - "coalesce regression"
+  - "wc-gate"
+  - "migration validator warning"
+  - "slow tier"
 ---
 
 # real-test-pi-crew
 
 End-to-end verification discipline for pi-crew changes. Distilled from the broker Phase-4 rollout (commits `1cb2dca` → `d599578` → `612e18b` → `4186284`, July 2026). The pain this skill prevents: shipping code that compiles + unit-tests-green but breaks in the user's live Pi session, or hangs the verifier worker.
 
-**When to use**: after any change to `src/runtime/broker/*.ts` (broker + tokens + issuer), `src/ui/`, `src/config/`, `src/extension/registration/lifecycle-handlers.ts`, `src/runtime/child-pi/*.ts` (worker spawn/kill/steering), `src/runtime/surface/*.ts` (MuxSurface providers, degrade, launch script), `src/prompt/*.ts` (worker-side tools: ask / message / delegate / surface-worker recorder), `src/runtime/goal-workflow/plan-templates.ts`, `src/runtime/team-runner.ts` or `src/runtime/task-runner/**` (scheduler / execution — Tier 7 smoke), `src/state/**` (durable state — Tier 7 + 9a events/status), `src/runtime/live-session/**` + `src/runtime/custom-tools/*` (live-session mode + worker custom tools), `src/schema/team-tool-schema.ts` (or any `Type.Unsafe({...})` schema definition), `src/extension/registration/team-tool.ts`, `workflows/*.workflow.md`, or before any commit touching these paths. Schema changes additionally require Tier 9 (feature battery) because the team tool's TypeBox schema is validated by pi-ai BEFORE the handler runs — a too-strict or malformed schema breaks every action silently. Surface changes additionally require Tier 10 (surface-mode battery) because surface is fail-closed: every failure degrades to headless and the run still goes green — only pane-level evidence proves the panes engaged.
+**When to use**: after any change to `src/runtime/broker/*.ts` (broker + tokens + issuer), `src/ui/`, `src/config/` (incl. `src/config/migration-validator.ts`), `src/extension/registration/lifecycle-handlers.ts`, `src/runtime/child-pi/*.ts` (worker spawn/kill/steering), `src/runtime/surface/*.ts` (MuxSurface providers, degrade, launch script), `src/prompt/*.ts` (worker-side tools: ask / message / delegate / surface-worker recorder), `src/runtime/goal-workflow/plan-templates.ts`, `src/runtime/team-runner.ts` or `src/runtime/task-runner/**` (scheduler / execution — Tier 7 smoke), `src/state/**` (durable state — Tier 7 + 9a events/status + **Tier 11a read-your-writes**), `src/runtime/live-session/**` + `src/runtime/custom-tools/*` (live-session mode + worker custom tools), `src/schema/team-tool-schema.ts` (or any `Type.Unsafe({...})` schema definition), `src/extension/registration/team-tool.ts`, `workflows/*.workflow.md`, `.github/workflows/*.yml` (CI env — Tier 11e), `scripts/wc-gate.mjs` (Tier 11b), or before any commit touching these paths. Schema changes additionally require Tier 9 (feature battery) because the team tool's TypeBox schema is validated by pi-ai BEFORE the handler runs — a too-strict or malformed schema breaks every action silently. Surface changes additionally require Tier 10 (surface-mode battery) because surface is fail-closed: every failure degrades to headless and the run still goes green — only pane-level evidence proves the panes engaged.
 
 > **Path map (2026-08-26 reorg + A1)**: `src/runtime/crew-broker*.ts` → `src/runtime/broker/`; `src/runtime/child-pi*.ts` → `src/runtime/child-pi/`; `src/runtime/plan-templates.ts` (flat) → `src/runtime/goal-workflow/plan-templates.ts`; NEW dirs `src/runtime/surface/` and `src/prompt/`. Test files moved with them (`test/unit/crew-broker-*.test.ts` → `test/unit/runtime/broker/`, `test/unit/keybinding-map.parity.test.ts` → `test/unit/ui/`, ...).
 
@@ -95,9 +101,10 @@ The skill maps to existing CI gates as follows:
 | `npm test:critical` (manual / pre-commit) | Tier 1 | n/a — not in CI by default |
 | `PI_CREW_BROKER=0 npm run test:critical` | Tier 2 (env kill switch path) | n/a — manual |
 | `npm run typecheck` | Tier 3 | `.github/workflows/*.yml` (every PR) |
-| Bundle-staleness check | Tier 3 last step | `scripts/check-bundle-staleness.mjs` |
-| Multi-OS CI | n/a (skill is local) | `.github/workflows/*.yml` — Linux + macOS + Windows |
-| Full `npm test` (>5 min) | n/a — too slow for in-loop | CI only |
+| `npm run check:wc-gate` | Tier 11b | **in BOTH `ci` and `ci:fast` scripts** (`package.json:71-72`) + explicit step in `.github/workflows/ci.yml:66-71` (since `09dda842` — was `ci:fast`-only, i.e. advisory) |
+| Bundle-staleness check | Tier 3 last step | `scripts/check-bundle-staleness.mjs`; `--committed-hash` mode = Tier 11j release gate |
+| Full `npm test` (= unit 819 files + integration 31) | n/a — too slow for in-loop | CI only; slow tier (3 files) is a SEPARATE glob `test:integration:slow` — only `npm run test:full` includes it |
+| `PI_CREW_SMOKE=1` env | Tier 11e | set ONLY in `weekly-smoke.yml` (auth-gated); nightly.yml deliberately does NOT (comment at `:24`) |
 
 To add Tier 1 to a pre-commit hook:
 
@@ -127,7 +134,7 @@ To add Tier 1 to CI as a fast-feedback gate (under 30s):
 
 **What**: run the curated 14-file fast subset.
 
-**Why this exists**: full `npm run test:unit` runs 810 files (was 642 at skill-writing time — it keeps growing), several minutes. Verifier worker response timeout would kill the worker mid-run → run = "hang". The fix (introduced in commit `1cb2dca`) splits out a `test:critical` subset covering exactly what changed in the broker/UI work.
+**Why this exists**: full `npm run test:unit` runs 819 files (was 642 at skill-writing time — it keeps growing), several minutes. Verifier worker response timeout would kill the worker mid-run → run = "hang". The fix (introduced in commit `1cb2dca`) splits out a `test:critical` subset covering exactly what changed in the broker/UI work.
 
 **How**:
 
@@ -591,6 +598,114 @@ herdr chỉ được detect khi **chính pi session đang chạy trong một her
 
 ---
 
+## Tier 11 — Remediation regression battery (v0.10.5 deep-review fixes)
+
+**What**: verify the v0.10.5 remediation invariants hold — the P0 read-your-writes revert (`b6eba80f`), the P1 enforcement/wiring hardening (`09dda842`), the broker doc-nit de-stack (`4ebd2ce4`), and the CI/test-tier reshuffle (`09dda842` + `2fb2b426`).
+
+**Why this is its own tier**: the remediation fixed bugs that ALL of Tiers 1–10 missed — 18 hidden test failures from a delayed-write conversion (test:critical contains no stores/dwf/recovery tests), a production default-drift (`ui.widgetPlacement`), a deterministic-red CI env (`PI_CREW_SMOKE=1` in nightly), and a gate that existed but was never enforced (wc-gate). These need their own pin checks so the same classes don't regress.
+
+**When required**: any change to `src/state/**` write paths (stores, atomic-write, event-log buffering), `src/config/migration-validator.ts` or its wiring, `scripts/wc-gate.mjs` or the `ci` scripts, `.github/workflows/*` env, `src/ui/settings-overlay.ts` / `handle-settings.ts` EFFECTIVE_DEFAULTS, or before a release cut.
+
+### 11a. Read-your-writes (the P0 revert core)
+
+**The rule (hard-won, `b6eba80f`)**: MỌI site có reader đồng bộ ngay sau write — test read-your-writes assertion, same-poll display, reload-inside-lock, cross-process reader — KHÔNG được convert sang buffered/coalesced, KỂ CẢ terminal-type buffered (flushPromise.then microtask chain ≠ same-tick). The WI-2.2 coalesce ("last value wins" + 50ms window) broke 3 public sync APIs: `plan-store loadPlanRecords`, `readOwnershipMap`, `loadRunManifestById` → 18 hidden test failures (plan-store 11, ownership-map 3, state-store 4).
+
+```bash
+# 1. stores stay on sync atomicWriteJson (coalesce reverted):
+grep -c "atomicWriteJson" src/state/stores/plan-store.ts src/state/stores/ownership-map.ts  # >=1 each
+# 2. terminal-state events are sync appendEvent (crash-recovery design comment at :221
+#    (file lives at src/runtime/recovery/crash-recovery.ts after the runtime reorg)
+grep -n "Log the event first" src/runtime/recovery/crash-recovery.ts   # design intent: sync
+# 3. buffered-site census — snapshot & audit:
+grep -rln "appendEventBuffered" src/ | wc -l   # 16 files / ~70 raw matches (incl. imports+definition) at v0.10.5; audited live conversions = 43; EVERY new site needs the reader-audit
+# 4. the full gate — test:critical has NO stores/dwf/recovery coverage:
+npm run test:unit    # 819 files, ~7500 tests, 15-18 min under load — MANDATORY after any delayed-write conversion program
+```
+
+### 11b. wc-gate enforcement (M4 done-gate)
+
+```bash
+npm run check:wc-gate                                  # exit 0, "max NNNN lines (limit 2000)"
+node -e "const p=require('./package.json').scripts; console.log(p.ci.includes('check:wc-gate'), p['ci:fast'].includes('check:wc-gate'))"  # true true
+grep -n "wc-gate" .github/workflows/ci.yml             # explicit step (since 09dda842; was ci:fast-only = advisory)
+```
+
+### 11c. Migration validator (M5 WI-5.6, warn-only)
+
+Wired in `register.ts:62-74` — AFTER `installChildProcessAbortShield`, BEFORE `startRuntimeWarmup`; `console.warn`, never throws (spec: "warning không fail").
+
+```bash
+# offline (no pi session needed):
+node --experimental-strip-types --no-warnings -e \
+  'import("./src/config/migration-validator.ts").then(m=>console.log(JSON.stringify(m.validateEnv({PI_CREW_BROKER_DIAG_UI:"1",PI_CREW_SAFE_BASH:"1"}))))'
+# expect: warnings[] with severity "removed" for BOTH keys; hasWarnings true
+# live: PI_CREW_BROKER_DIAG_UI=1 pi …  → startup prints "[pi-crew] 1 deprecated env var(s) in use:" and boots normally
+```
+
+### 11d. Slow-tier hygiene (M3 tiering)
+
+```bash
+ls test/integration/slow/    # exactly 3: full-feature-smoke, phase5-observability, ui-performance
+# the fast globs must NOT match slow/ (disjoint globs — test:full dup was a real bug):
+grep -o "'test/unit/\*\*/\*.test.ts'\|'test/integration/\*.test.ts'" package.json
+npm run test:integration:slow   # separate glob, 600s timeout
+```
+
+### 11e. Nightly env regression (deterministic-red trap)
+
+`PI_CREW_SMOKE=1` arms HB-003a real-binary smoke which needs a pi binary + `PI_AUTH_JSON` — GH runners have neither → deterministic red. It is set ONLY in `weekly-smoke.yml` (auth-gated arm).
+
+```bash
+grep -n "PI_CREW_SMOKE" .github/workflows/nightly.yml      # comment ONLY (":24 deliberately NOT setting")
+grep -n "PI_CREW_SMOKE" .github/workflows/weekly-smoke.yml # PI_CREW_SMOKE: "1" (:25)
+```
+
+### 11f. Event-log reject format
+
+Buffered-append rejections must carry `type=<event-type>[<distinguisher>]` so ops can bisect a failed append to its event kind:
+
+```bash
+grep -rn 'type=\${' src/prompt/scratchpad-lifecycle.ts src/runtime/finalize-run.ts
+# scratchpad-lifecycle:92  type=${type}
+# finalize-run:242        ternary escalate/policy.action · :260 recovery.escalated/recovery.attempted
+```
+
+### 11g. widgetPlacement G17 default-drift
+
+The drift: duplicated EFFECTIVE_DEFAULTS maps hardcoded `"aboveEditor"` while `defaults.ts`/`install.mjs`/`project-init` said `"bottom"` — the suite never compared them. NOTE `aboveEditor` remains a VALID enum value (schema/types/pi-widget mapping); only the DEFAULT was wrong.
+
+```bash
+grep -rn '"ui.widgetPlacement"' src/ui/settings-overlay.ts src/extension/team-tool/handle-settings.ts  # both :"bottom"
+# live: team-settings get ui.widgetPlacement → bottom
+```
+
+### 11h. Worktree-twins stability (flaky→fixed)
+
+Pre-fix flaked ~8% idle / ~50% under load (`try{return promise}finally{rmSync}` cleanup race); fixed by awaiting INSIDE the try. Run 3× consecutively — all green:
+
+```bash
+for i in 1 2 3; do node --experimental-strip-types --no-warnings --test test/unit/worktree/worktree-twins-contract.test.ts 2>&1 | grep -E "^# (pass|fail)"; done
+```
+
+### 11i. Export-surface + slash parity pinning
+
+```bash
+grep -nE "export.*(HELLO_DEADLINE_MS)|export \{ BROKER_PROTOCOL" src/runtime/broker/crew-broker.ts  # 0 hits (dead exports removed, 09dda842)
+grep -n "MUST_INCLUDE" test/unit/extension/slash-command-parity.test.ts   # 5 core: team-run, teams, team-help, crew-view, crew-brief
+```
+
+### 11j. Bundle committed-hash (release gate)
+
+Tier 3 checks disk-vs-session; this checks COMMITTED dist vs a fresh build — the gate that catches "src edited, bundle forgot":
+
+```bash
+node scripts/check-bundle-staleness.mjs --committed-hash   # "OK: committed dist matches a fresh build"
+```
+
+**Acceptance**: every sub-check above returns the expected value; 11a item 4 is the ONLY expensive one (mandatory after conversion programs, skippable for doc-only changes).
+
+---
+
 ## Anti-patterns (the cost is real, observed in this session)
 
 | Anti-pattern | Cost | Where fixed | Reference |
@@ -619,6 +734,12 @@ herdr chỉ được detect khi **chính pi session đang chạy trong một her
 | chain run with `workflow:"chain"` forwarded to steps | Every chain step fails in ~58ms with an EMPTY error string — looks like a parse failure but isn't. `chain-dispatch` forwards `params.workflow` ("chain") into executor overrides; each step then runs the "chain" workflow via the normal `executeTeamRun` path and fails fast + silently. | Open (issue #44) | Omit `workflow` when invoking `action:'run' chain=...` — chain then runs 2/2 success (~308s). See `docs/bugs/chain-workflow-forward-quirk.md`. |
 | **Env allow-list strip mux vars — async surface chết ở tầng env, không phải tầng gate** (battery 2026-08-30 Finding 2): gate async-run đã bỏ nhưng `BACKGROUND_RUNNER_ENV_ALLOWLIST` vẫn strip `TMUX`/`HERDR_*` → detached runner thấy `no-mux` → async headless mãi mãi. Gate telemetry (`asyncRun:true` trong env snapshot) nói đúng — không gate async — nhưng env detection fail vì biến bị cắt trước khi process chào. Unit test allow-list không catch (list "đúng" theo nghĩa cũ); chỉ async run LIVE với mux mới lộ. | `f0a41a16` (2026-08-30) | Mọi env var mà `src/runtime/surface/*` đọc phải có trong `BACKGROUND_RUNNER_ENV_ALLOWLIST` (pin test `test/unit/runtime/core/async-runner.test.ts` "forwards mux env"). Thêm env detection mới → thêm vào allow-list + pin test cùng lúc. |
 | **`set <array-key> []` là no-op** (battery 2026-08-30 Finding 3): `parseStringList` normalize `[]` → `undefined` → patch mất key → `mergeConfig` giữ list cũ trên đĩa; `Effective` hiển thị sai giá trị đã set. `unset` vẫn hoạt động (workaround). | `5a31ccf6` (2026-08-30) | `[]` tường minh là GIÁ TRỊ, không phải unset. Test round-trip: set → get → soi config trên đĩa (test/unit/config/surface-config.test.ts F3 block). |
+| **Convert write-site sang buffered/coalesced khi CÓ reader đồng bộ ngay sau write** (P0 remediation 2026-09-10, `b6eba80f`): 29 site bị revert. WI-2.2 coalesce ("last value wins" + 50ms window) làm hỏng 3 public sync APIs (plan-store `loadPlanRecords`, `readOwnershipMap`, `loadRunManifestById`) → 18 hidden test failures mà test:critical KHÔNG bắt (không chứa stores/dwf/recovery). Kể cả terminal-type `appendEventBuffered` vẫn qua `flushPromise.then(...)` microtask chain → KHÔNG same-tick → cancel.ts task.cancelled phải revert về sync. | `b6eba80f` | **Read-your-writes exclusion rule**: reader-after-write = never convert (any flush-latency > 0 breaks the contract). Sau MỌI conversion program: full `npm run test:unit` bắt buộc. Xem Tier 11a. |
+| **Gate tồn tại nhưng không được enforce** (P1 remediation, `09dda842`): wc-gate wired chỉ vào `ci:fast` — full `ci` script và tất cả GitHub workflows không chạy nó → một commit phình crew-broker.ts quá 2000 dòng vẫn PR-green. "Có script check" ≠ "gate được enforce". | `09dda842` | Gate mới phải vào: (1) script `ci`, (2) workflow yml step, (3) done-criteria của skill. Xem Tier 11b. |
+| **Set CI env cho arm không có dependency của nó** (P0/P1 remediation): `PI_CREW_SMOKE=1` trong nightly.yml arm HB-003a cần pi binary + `PI_AUTH_JSON` — GH runner không có → deterministic red, không phải flake. | `b6eba80f` | Mỗi env var CI: liệt kê dependency (binary/auth/socket) trước khi set; arm auth-gated (weekly-smoke) mới được set. Xem Tier 11e. |
+| **Fix finding của reviewer mà không tự verify** (deep review 2026-09-10): 1 trong 4 HIGH findings là false positive — "background-runner exit-loss" thực tế được cover bởi EL-2 `flushBufferedQueuesSync()` (sync lock + appendFileSync + fsync) trên `process.on("exit")` tại event-log.ts:1227. Fix theo finding mù quáng sẽ ĐÃ THÊM regression. | n/a (process) | Mọi finding trước khi fix: trace counter-evidence (exit handlers, sync flush paths). Finding = hypothesis, không phải fact. |
+| **Duplicated defaults map drift (G17-class)** (P0 remediation, `b6eba80f`): 2 bản EFFECTIVE_DEFAULTS (`settings-overlay.ts`, `handle-settings.ts`) hardcode `"aboveEditor"` trong khi nguồn chân lý (defaults.ts/install.mjs) nói `"bottom"` — suite không có test so 2 bản với nhau, drift sống sót qua 7500 tests. | `b6eba80f` | Defaults phải có MỘT nguồn chân lý, hoặc test so các bản sao. Live probe: `team-settings get <key>`. Xem Tier 11g. |
+| **Test vacuous — assert trên fixture chứ không trên wiring** (P1 remediation, `09dda842`): migration-validator test 2 từng assert key tự chế không có trong registry → luôn pass dù validator chưa được wire vào registerPiTeams. | `09dda842` | Test phải dùng key THẬT từ registry (`PI_CREW_BROKER_DIAG_UI` severity "removed"), và wiring test phải prove call-site (register.ts:68), không chỉ prove pure function. |
 
 ---
 
@@ -647,6 +768,7 @@ When a tier fails, the recovery is usually quick. Match the symptom to the cause
 | `ask` tool fast-fails "proceed with best judgment" | `broker.waitMethodsEnabled: false` somewhere (user config can re-close the default) | `team-settings get broker.waitMethodsEnabled`; expect `true` (default since `ceb9a68d`); grep events.jsonl for `policy.action` |
 | `delegate` rejects with a policy message | By design when depth cap hit (`maxDepth: 4`) or `nesting.enabled: false` in USER config (sensitive — project cannot flip) | Check depth in the rejection payload; `delegate.rejected` event in events.jsonl confirms the structured (non-silent) path |
 | herdr provider never engages | pi is not itself running inside a herdr pane (design: no socket guessing) | Run pi inside herdr, then `runtime.surface.mode` auto/`herdr`; verify `~/.config/herdr/herdr.sock` responds |
+| Surface run >5 phút bị stale-reconcile giết oan (worker khỏe, pane sống) | F1 (đã fix f12f4f5d + af2f8eb4): recorder chỉ flush ở turn boundary → lastSeen đóng băng giữa turn; reconciler cũ time-based không pid-gate. **Bẫy đa host**: MỘT pi session chạy bundle cũ cũng đủ giết run của session khác (sweep quét mọi runs) — tát cả host phải cùng version | Kiểm tra mọi pi process cùng bundle (`ps` lstart vs dist mtime); `PI_CREW_DEBUG_STALE=1` sidecar /tmp/pi-crew-f1-debug.log ghi mọi verdict STALE để bắt hung thủ; kỳ vọng sidecar rỗng khi mọi host đã fix |
 
 ## Performance budget (per-tier soft limits)
 
@@ -774,6 +896,15 @@ Use this to answer "đủ full tính năng chưa?" without re-deriving. Every us
 | Doctor / health / zombies + orphan panes | `src/extension/team-tool/doctor.ts` | 9a doctor + T10a test #3 |
 | Model fallback chain | `src/config/types.ts` (modelFallback) | unit tests + 9b sync run (auto-tail chay ngầm) |
 | State perf (fsync coalescing, event-log tail) | `src/state/` | bench `scripts/run-bench.mjs` (b5/b11-b13) — không cần battery live |
+| Delayed-write conversions / read-your-writes (v0.10.5 remediation) | `src/state/` atomic-write, `appendEventBuffered` sites | T11a (stores sync + census + full test:unit gate) |
+| wc-gate ≤ 2000 lines (M4 done-gate) | `scripts/wc-gate.mjs` | T11b + CI (`ci` script + ci.yml step) |
+| Migration validator (deprecated env warn) | `src/config/migration-validator.ts`, wired `register.ts:68` | T11c (offline validateEnv + live startup warn) |
+| Slow tier (3 heavy tests) | `test/integration/slow/` | T11d (disjoint globs + separate run) |
+| CI env sanity (SMOKE arm) | `.github/workflows/nightly.yml` / `weekly-smoke.yml` | T11e (grep pins) |
+| Event-log reject format | `scratchpad-lifecycle.ts:92`, `finalize-run.ts:242,260` | T11f |
+| ui.widgetPlacement default | `settings-overlay.ts:351`, `handle-settings.ts:43` | T11g + live team-settings get |
+| Worktree twins contract | `src/worktree/worktree-manager.ts` | T11h (3× consecutive runs) |
+| Bundle committed-hash gate | `scripts/check-bundle-staleness.mjs --committed-hash` | T11j |
 
 ---
 
@@ -790,6 +921,9 @@ The skill mentions specific commits, line numbers, and version pins. As the code
 | Verify Tier 7 verifier prompts still say `test:critical` | Each workflow file edit | `grep "Run FAST checks" workflows/*.workflow.md` |
 | Verify Tier 10 surface refs | Each `src/runtime/surface/**` edit | `ls test/system/surface-*.e2e.test.ts` + grep `MAX_SURFACE_WORKERS` in resolve-surface.ts — cap/config shape may drift between A1 → A2 |
 | Verify herdr wire details | Each herdr release bump | `herdr api schema --json` vs `src/runtime/surface/herdr-provider.ts` (envelope/pane.read source/1-conn-per-request were verified on herdr 0.8.2) |
+| Verify Tier 11 census numbers | Each `src/state/**` write-path commit | `grep -rln "appendEventBuffered" src/ \| wc -l` — update the 16-file / 43-conversion anchor in 11a when it drifts |
+| Verify wc-gate still enforced | Each `package.json` / ci.yml edit | `node -e "require('./package.json').scripts.ci.includes('check:wc-gate')"` + grep ci.yml — a gate removed from `ci` reverts to advisory |
+| Verify migration-validator wiring | Each `register.ts` refactor | `grep -n validateEnv src/extension/register.ts` — must stay after `installChildProcessAbortShield`, before `startRuntimeWarmup`, warn-only |
 
 The skill does NOT need to be updated for every commit — only when the cited lines/files move. Consider it a "living reference" not a "live spec".
 
@@ -836,6 +970,18 @@ tmux list-panes -a -F '#{pane_id} #{pane_title} #{pane_pid}'  # during run: pane
 #   E2E suite (must run inside tmux):
 node --experimental-strip-types --test --test-concurrency=1 --test-timeout=120000 test/system/surface-tmux.e2e.test.ts
 #   doctor orphan panes: team action='doctor' focus='zombies'
+# Tier 11 (v0.10.5 remediation regression)
+npm run check:wc-gate                                          # 11b: exit 0, max <= 2000
+node -e "const p=require('./package.json').scripts; console.log(p.ci.includes('check:wc-gate'))"  # 11b: true
+node --experimental-strip-types --no-warnings -e 'import("./src/config/migration-validator.ts").then(m=>console.log(JSON.stringify(m.validateEnv({PI_CREW_BROKER_DIAG_UI:"1"}))))'  # 11c
+ls test/integration/slow/                                      # 11d: 3 files
+grep -n "PI_CREW_SMOKE" .github/workflows/nightly.yml          # 11e: comment only, NOT set
+grep -rn 'type=\${' src/prompt/scratchpad-lifecycle.ts         # 11f: reject format
+grep -rn '"ui.widgetPlacement"' src/ui/settings-overlay.ts src/extension/team-tool/handle-settings.ts  # 11g: bottom
+for i in 1 2 3; do node --experimental-strip-types --no-warnings --test test/unit/worktree/worktree-twins-contract.test.ts 2>&1 | grep -E '^# (pass|fail)'; done  # 11h
+grep -rln 'appendEventBuffered' src/ | wc -l                   # 11a: census (16 files @ v0.10.5)
+node scripts/check-bundle-staleness.mjs --committed-hash      # 11j: OK
+#   11a full gate (after ANY delayed-write conversion program): npm run test:unit  # ~7500 tests, 15-18 min
 ```
 
 ---
@@ -854,6 +1000,7 @@ Before claiming "tested":
 - [ ] Tier 9: feature battery — **required if you touched `src/schema/team-tool-schema.ts`, `src/extension/registration/team-tool.ts`, any `Type.Unsafe({...})` schema, or any armed-role tool list (`agents/*.md` / `src/config/role-tools.ts`)**. 9a read-only batch all return clean; one probe per 9b spawn path (sync / async / chain / `Agent` / `crew_agent`+`get_subagent_result`) completes with `consistency=1`. Run 9c–9f only when the change touches their code path; **at least one full 9c/9e/9f sweep per release is recommended so the battery stays proven** (see `real-test-2026-08-11-scratchpad-I-batch.md`); 9d (destructive) requires explicit user confirmation. **After every run: `git status` to catch unauthorized agent edits.**
 - [ ] **Output report**: save `docs/real-test/reports/real-test-<YYYY-MM-DD>-<slug>.md` from `skills/real-test-pi-crew/REPORT-TEMPLATE.md`, filled DURING the run with per-tier evidence (counts/md5/runId) — not reconstructed from memory afterward. This is what makes past runs verifiable instead of trust-the-summary.
 - [ ] Tier 10: surface battery — **required if you touched `src/runtime/surface/**`, `src/prompt/surface-worker.ts`, the surface branch of `src/runtime/child-pi/child-pi.ts`, or the surface config keys**. 10a E2E 3/3 per backend available (tmux trong tmux; herdr ngoài tmux + socket sống — skip vì thiếu mux là correct-by-design nhưng KHÔNG tính pass cho backend đó); 10b live run với session ĐÃ reload bundle mới (xem Anti-patterns "file-md5 only") + `visibleAgents` set + pane-level evidence (pane id/title during run, `worker.surface_spawned`/`worker.surface_closed` events, pane auto-closed after — KHÔNG dùng `manifest.surface.panes` làm evidence engage, xem Anti-patterns "panes == {}"); 10c herdr live chỉ khi pi chạy trong herdr pane (skip kèm lý do nếu không).
+- [ ] Tier 11: remediation regression battery — **required if you touched `src/state/**` write paths, `migration-validator.ts`/its wiring, `scripts/wc-gate.mjs` or `ci` scripts, `.github/workflows/*` env, EFFECTIVE_DEFAULTS maps, or you are cutting a release**. Sub-checks a–j per Tier 11; 11a item 4 (full `test:unit`) mandatory after any delayed-write conversion program, skippable for doc-only changes. Record: buffered-site census count, wc-gate max, staleness `--committed-hash` result.
 
 **"All tiers pass" is a claim that needs per-row evidence.** Tier 9 means 9a **and** 9b **and** whichever of 9c–9f applies to the change — not "9a passed, therefore 9 passed". Tier 10 means pane-level evidence exists, not "run went green" (surface fail-closes to headless on every failure, so green proves nothing). If any required item above is unchecked or lacks concrete evidence (a number, an md5, a runId, a pane id), the answer to "is it tested?" is **no** — say so explicitly instead of rounding up to "pass".