pi-crew 0.11.16 → 0.11.18

package/CHANGELOG.md

@@ -1,5 +1,233 @@
 # Changelog
 
+## [Unreleased]
+
+## [0.11.18] — U11 hybrid 2-tier worker + Δ-wave benches/gates + windows CI repair (2026-10-12)
+
+### Added
+
+- **bench(runtime): b15 — broker/scheduler task-array scan-cost microbench (Δ3)** — `bench/b15-broker-scan-cost.bench.ts` (b14 convention): measures the REAL scheduler paths (`taskGraphSnapshot`, `getReadyTasks`), a line-cited replica of the module-private `dagReadyTaskIds` call-site, the REAL crew-broker delegate/wait call-sites over a unix socket with an injected instant fake spawner, `loadRunManifestById` cold/warm floors, and the `scanZombieTempWorkspaces` walk at N=10/100/1000 in isolated mkdtemp homes. Scan-count instrumentation is bench-local (Array.prototype wrapped in-process only) — zero hot-file edits. **Δ3 verdict (bench-first rule): all 6 candidate index sites NOT-JUSTIFIED** — at realistic N≤11 tasks/run, scans cost 0.006-0.05 ms/call vs ms-scale I/O floors (loadCold 8.1 ms, DAG planner 28.8 ms @ n1000); even at 90× N, scans (0.86 ms) sit below the parse floor. **Held-lifetime audit closed no-op:** no structure is UNBOUNDED-RISK (details: `docs/perf/broker-scan-audit-2026-10-11.md`).
+- **feat(runtime): U11 — hybrid 2-tier worker model (embedded tier, DEFAULT-OFF)** — per-role opt-in to the EMBEDDED worker tier (in-process Pi session on the U4 live-session stack) with the subprocess tier kept as the default and automatic fallback:
+  - **Config** `runtime.embeddedWorkers {enabled, roles, maxConcurrent, faultThreshold}` (types + schema + lenient parse stay in sync, F19-1 discipline; all-invalid block collapses to undefined so a malformed config can never enable the tier). With the block absent/disabled, tier routing is a byte-identical no-op — no imports, no events, no budget reads (pinned by regression tests in both lanes).
+  - **Routing** (`resolveTaskRuntimeKind`, optional 5th input — every pre-U11 call site unchanged): an opted-in role upgrades a child-process resolution to live-session only. `isolationPolicy.isolatedRoles`, the scaffold kind, and the `PI_CREW_DEPTH > 0` nesting guard ALWAYS beat the opt-in (the depth rule is applied to the embedded upgrade itself — extended, never weakened). The legacy `runtime.mode: live-session` path is deliberately frozen (ADR 2026-08-15 (a)) — it gets no budget/ledger semantics.
+  - **Orchestration** (`task-runner/hybrid-tier.ts`, lazily imported only when the policy is enabled): fail-fast embedded ceiling (blast-radius bound, default `max(1, floor(worker-cap/2))`) → SHARED global worker slot (the exact `acquireWorkerSlot` semaphore the subprocess tier uses — no concurrency bypass; abort while queued takes no slot) → durable per-task fault ledger (`task.diagnostics.embeddedTier`, disk-merged freshest-count so retries/recovery see it) → automatic fallback to subprocess after `faultThreshold` counted faults (default 2; aborts and capacity rejections never count). `tier.decision` / `tier.fault` / `tier.fallback` events registered in `TEAM_EVENT_TYPES`. The subprocess fallback runs strictly sequentially after the live attempt resolved — the single-writer sink invariant is preserved.
+  - **Mitigations** (`live-session/embedded-tier.ts`, gated on `embeddedMitigations` passed only for embedded-routed tasks): (a) builtin-tools-only enforcement with verify-after-set and fail-closed degradation (no `mcp__*`, no extension drift); (b) provider `timeoutMs` clamp + restore on the session's ModelRuntime; (c) turn-count watchdog (bounded grace → dispose + escape); (d) session-side concurrency cap (fail-fast, never queue); ref-counted process `uncaughtException` guard (quarantine-all embedded sessions, host kept alive, 20-quarantine circuit breaker restores default crash behavior); ring-capped rate-limited memory metrics; factory-surface + global-state asserts (U4 pattern).
+  - **Fix round (2026-10-11, P1)**: provider-timeout registration is now ref-counted per (ModelRuntime, providerId) with wrapper-base chasing — concurrent embedded sessions share ONE ModelRuntime, and the original apply/restore could stack wrappers and permanently leak the embedded timeout clamp onto every later session on that runtime (silently — restore reported success). The registered wrapper now always delegates to the chased BASE provider at the min of the active clamps; the base is re-registered exactly when the last session leaves; any restore order is safe (pinned by two regression tests).
+- **docs(runtime): U11 DEFAULT-OFF policy guide** — `docs/usage.md` gains a "Hybrid 2-tier workers" section (config example, per-key semantics, the full safety model, fallback stickiness, `tier.*` / `live-session.embedded_*` observability) and the README config table documents `runtime.embeddedWorkers`.
+
+### Changed
+
+- **fix(utils): drop dead `hosted-git-info` branch in `parseGitUrl` — Δ2 gate allowlist back to strict** — the Δ2 finding's `require()` in `src/utils/git.ts` was verified to never resolve in ANY environment (undeclared, and in the repo checkout even the transitive path via peer `@earendil-works/pi-coding-agent` is unreachable from `src/`), so the hosted-parse candidate loops were dead code in every deployment and `parseGenericGitUrl` was the only path that ever executed. Removed the require, its types/loader, and both candidate loops (zero behavior change); `OPTIONAL_RUNTIME_REQUIRES` in `scripts/check-lazy-imports.mjs` is empty again — the gate is strict, resolving the "pending `optionalDependencies` decision" note in the Δ2 entry below.
+
+- **feat(scripts): Δ2 — declared-deps/lazy-import gate rewritten from regex to AST** (esbuild type-strip + acorn walk of `ImportDeclaration` / `export … from` / runtime `import()` / `require()`-`require.resolve()`, ports upstream check-runtime-deps semantics; per-entry budget `{maxFiles: 521, forbid: [test/, scripts/, docs/, dist/]}` for `index.bundle.ts`, ports upstream check-entry-graphs; `--root` fixture seam for tests) — closes every RR-021 residual regex blind spot; first run surfaced one real finding: `hosted-git-info` is an undeclared optional `require()` in `src/utils/git.ts` (resolves transitively via peer `@earendil-works/pi-coding-agent`; explicitly allowlisted in the gate pending an `optionalDependencies` decision).
+
+### Fixed
+
+- **fix(state): register 3 mailbox event types — CI `check:event-types --enforce` green** — `mailbox.send` (`crew-broker.ts:993`), `mailbox.pickup` and `mailbox.pickup_deduped` (`inbox-poll.ts`) were emitted but missing from `TEAM_EVENT_TYPES`, failing the CI registry-enforce gate (U5 exactly-once delivery audit trail; dedup key + receipt payload only — never message bodies). Bundle note: the registry const is tree-shaken from `dist/index.mjs` (fresh build byte-identical to the committed dist — `check-bundle-staleness --committed-hash` passes with no dist delta to commit).
+- **fix(test): fill 4 empty arrow-function bodies in `socket-path-fbat1.test.ts`** — comment-filled the `destroy: () => {}` / `net.createServer(() => {})` bodies that tripped biome `noEmptyBlockStatements` in CI; zero assertion changes.
+- **fix(test): `verify-gate-tool` Windows path assertion — exact string compare instead of `new RegExp(path)`** — building a RegExp from an absolute Windows path consumes the backslashes as regex escapes (`\t`→TAB, `\r`→CR, `\U`/`\p` identity-dropped), so the pattern could never match the literal path (windows-latest CI failure). Now `assert.equal` on the exact command string, plus a regression pin proving a raw-backslash RegExp does NOT match a Windows path.
+- **fix(test): U15 concurrent-dispose CI flake — fork-free busy loop closes the deferred-TERM-trap race** — with `while :; do sleep 1; done` there is a write→fork gap right after the readiness `echo`: dispose's group TERM lands inside that gap on loaded runners, dash defers the pending trap until the NEXT (post-signal) sleep dies (~1s) > `gracefulMs` 500, so SIGKILL beats the trap and the marker never appears (~30% flake; probe-pinned: failing runs always tReady<6ms, passing runs >20ms). `while :; do :; done` has no fork to straddle — dash runs the pending trap at the next simple-command boundary (ms), far inside the grace window. 11/11 pass locally.
+- **fix(state): stop unit-test runs leaking into the real user crew root** — the
+  test runner now isolates the crew home per suite (`scripts/test-runner.mjs`
+  sets BOTH `PI_CREW_HOME` and `PI_TEAMS_HOME` to a per-suite temp dir; PI_TEAMS_HOME
+  wins the mirror pair, so setting only one is silently defeatable; opt-out
+  `PI_CREW_TEST_NO_HOME_ISOLATION=1`; cleanup on all exit paths). Until now every
+  fixture that created a run from a bare `/tmp` cwd routed its state to
+  `~/.pi/agent/extensions/pi-crew/` via `scopeBaseRoot()`'s no-repo fallback — and
+  every live Pi session's async-notifier toasted those fixture failures as
+  `Error: pi-crew run failed: team_… (inline-seam-fixture/none)` (104 leaked run
+  dirs since June; quarantined + cleaned 2026-10-11).
+- **fix(run-index): hide terminal bare-temp-cwd runs from non-temp crew roots**
+  (defense-in-depth for the same leak) — `collectRuns()`'s 2.19 temp guard now
+  also covers the CWD dimension: in NON-temp roots (the real project/user roots)
+  a TERMINAL run whose cwd sits under a temp dir WITHOUT repo markers is a
+  test/isolated-workspace fixture parked by the no-repo fallback and is hidden.
+  Temp-root scans keep their original semantics (active runs liveness-gated,
+  terminal runs listed — prune/health consumers rely on it); temp cwds WITH repo
+  markers (deliberate /tmp projects, isolated worktrees) and active bare-temp-cwd
+  runs stay listed. By-ID resolution (`team status <runId>`) is unchanged.
+  Covered by `test/unit/extension/core/run-index-temp-cwd.test.ts`.
+
+### Docs
+
+- **docs(u12): upstream pi-durable tracking doc** — new
+  `docs/reviews/pi-upstream-tracking-u12.md` (living re-check log, rerun every pi npm
+  release). Records the U12 spec's 4 adoption triggers with verdicts pinned at upstream
+  `origin/main` = `cdaf6c227`: T1 banner/API-freeze NOT met (`README.md:3` banner stands,
+  `[Unreleased]` opens with 5 breaking bullets), T2 multi-process NOT met (everything still
+  under `packages/coding-agent/src/experimental/`, `PI_EXPERIMENTAL=1`-gated), T3 subagent
+  conversations via services NOT met (TODO open at `services/README.md:44`), T4 concurrency
+  cap MET via pi-crew's own `resolveBatchConcurrency` cap (upstream `cb4375493` changed the
+  pass algorithm, added no cap). Appends the 7-item blacklist of unreleased post-1.1.0 churn
+  from the 2026-10-11 delta §5, each with verbatim `[Unreleased]` changelog wording. Overall:
+  still track-only (1/4 vs ≥3/4 bar); exact-pin policy unchanged.
+
+## [0.11.17] — upgrade wave A: pi-1.1.0 adoption, central env registry, OSC 7501 program-status (2026-10-11)
+
+Implements the 10-item Wave A from `pi-crew-upgrade-research-round2.md` +
+`pi-crew-upgrade-research-round3-deep.md` (verification-backed anchors), built by 4
+lanes (W1 env/child-pi, W2 ui, W3 runtime fixes, W4 retrieval) in one shared worktree;
+finalize ran the full gate battery + real-test T1/T3 + a fresh Linux bench baseline.
+
+### Added
+
+- **feat(env): central env-forwarding registry (C-1)** — `src/config/env-allowlist-registry.ts`
+  now GENERATES `BACKGROUND_RUNNER_ENV_ALLOWLIST` (async-runner.ts) and `BASE_ALLOWLIST`
+  (child-pi-spawn.ts) from one decision table seeded from `config/env-vars.ts`; every
+  `CREW_ENV_VARS` key must carry an explicit forwarding decision (allowlist / explicit
+  channel / child-write / host-only / gap / test-only) — fail-fast at import + unit-tested
+  (no orphan entries, no dropped control vars). Content byte-identical to v0.11.16 plus the
+  one documented addition `PI_CREW_TOOLS_MODIFIERS`. Closes the incident class behind
+  2026-09-29 (`PI_CREW_MODEL` stripped) and `44d16d94` (STATE_BACKEND trio). Registry gaps
+  fixed: `PI_CREW_DELEGATE_ENABLED` + `PI_CREW_ASYNC_RUN` were live read/write sites missing
+  from env-vars.ts. 29 runner-read vars are classified known-gaps (surfaced via
+  `crewEnvForwardingGapReport()`) for a follow-up wave.
+- **feat(child-pi): adopt pi 1.1.0 `agent_settled.aborted` (L2-1)** — the rpc transport
+  feature-detects `record.aborted === true` (absent on ≤1.0.4 hosts → byte-identical legacy):
+  a host-cancelled settle now marks the run `aborted:true` / `crashClass:"cancelled"` (was:
+  healthy exit 0) and the worker is evicted from / never registered into the rpc pool — a
+  cancelled worker can no longer be revived as a healthy reuse candidate.
+- **feat(child-pi): opt-in pi 1.1.0 `+tool` modifier spawn syntax (L2-3)** —
+  `PI_CREW_TOOLS_MODIFIERS=1` (default OFF) + probed host pi ≥ 1.1.0 emits declared agent
+  tools: as `--tools +a,+b` (additive on the default surface; no CONTROL_TOOLS merge)
+  instead of the legacy replacement allowlist. **Decision — default OFF even though version
+  detection is reliable** (`probePiVersion()` memoized + threaded into arg build): the
+  additive syntax changes `tools:` SEMANTICS from a least-privilege replacement allowlist
+  (pinned by tests + the 2026-09-10 battery) to additive on the default surface — i.e. it
+  would WIDEN the worker tool surface on every 1.1.0+ host, and this workspace's peer dep
+  is still 1.0.4 (mixed fleet). Below-floor/unknown versions keep the legacy syntax
+  (strict-parser safety; 1.1.0 also forbids mixing plain names with modifiers).
+- **feat(ui): OSC 7501 program-status channel (B-1)** — `src/ui/program-status.ts` vendors
+  the upstream `@earendil-works/pi-tui` v1.1.0 wire format (MIT © 2025 Mario Zechner;
+  vendored — the peer dep has no 1.1.0 floor and `PROGRAM_STATUS_QUERY` is not re-exported;
+  never imported from the host). terminal-status.ts gains a third best-effort no-throw
+  channel (working / blocked+kind+message / idle / clear); the wiring derives blocked state
+  from durable runs — plan-approval pending, `ask`/wait park (`manifest.waitState`, 65-min
+  freshness matching the 1h broker deadline clamp), stuck-blocked subagent records — kind
+  `question` for all sources. Blocked now shows even with zero live-session agents
+  (child-process runs). crew-broker emits an in-process `mailbox_updated` wake after a
+  successful park (task.waiting / ask.requested never reach the live UI bus). Headless stays
+  no-op. Raw tty writer failures no longer propagate from any terminal-status path (no-throw
+  hardening, caught by the new C-8 rule-4 test).
+- **feat(ui): host `durationMs` for tool progress (B-3)** — `formatCompactToolProgress`
+  prefers an optional host-measured `durationMs` (pi ≥1.1.0 ToolRenderContext.durationMs;
+  used only when present + numeric + finite ≥ 0, value never trusted blindly) over
+  self-timing; fallback unchanged. Audit result: `outputPad` has 0 usages and no
+  `renderShell:"self"` sites exist in src — nothing added (no apply site).
+- **feat(ui): theme discovery delegates to `ctx.ui.getAllThemes()` (B-4)** — host list wins
+  when non-empty; empty (RPC-degraded `[]`), throwing, or missing API falls back to the
+  unchanged fs scan. Feature-detected shim in pi-ui-compat.ts (undefined = fallback).
+
+### Fixed
+
+- **bench: strip-types break from TS parameter properties (R3-1)** —
+  `LiveSessionHungToolError` used `constructor(readonly …)` which strip-only mode rejects →
+  `register-startup.bench` rc=1 + `bench-cold-start` strip arm failed since `c1621c20`.
+  Converted to plain fields assigned in the constructor body (public API unchanged).
+  Verified: register-startup rc 1→0; bench-cold-start strip arm 10/10 iters rc=0.
+- **paths: shared junk-literal guard blocks 'undefined'/'null'/'' (round 3)** — unset-var
+  expansion (`PI_CREW_HOME=$UNSET_VAR`) produced literal `"undefined"`/`"null"` that
+  anchored the config path (`config.ts resolveHomeDir`) and the run root
+  (`state-store createRunPaths`) into the garbage tree `undefined/.pi/…` (the stray
+  `pi-crew/undefined/` dir — verified 0 files via `find -type f`, deleted). New
+  `isJunkPathLiteral()` in `src/utils/paths.ts` (F4 pattern extended to 'null'); junk env
+  home → fallback `os.homedir()`; junk cwd → existing `Invalid cwd` error; legal paths
+  unchanged.
+- **surface(herdr): graceful close kills the worker by pid first (C-3 / TODO A2)** —
+  `closeSurface` graceful path now SIGTERMs the worker process tree via the existing
+  `killProcessTree` (group kill + SIGKILL escalation), waits a 3s grace, then still runs
+  `pane.close` as kill-tree fallback. Pid source is an injectable `resolveWorkerPid` seam
+  (host wires it from `manifest.surface.workerPids`; `pane.process_info` does not exist on
+  wire 0.8.2 — verified). All kill-by-pid steps are best-effort NO-THROW; the force path
+  and real `pane.close` error semantics are unchanged; default unwired = old behavior.
+  NOTE: the seam is DORMANT until the host wires `resolveWorkerPid` (resolve-surface /
+  doctor) — follow-up item.
+- **bench(b13): warm-cache case retired its junk-band query (R3-2)** — the warm query
+  ("verify package exports typecheck bundle", 5 abstract tokens) topped out at 0.42 under
+  the G23b floor `MIN_SUGGEST_SCORE=0.5`: a single keyword hit scores `(1/5)*0.6+0.3 =
+  0.42`, TIED with 40+ runtime-state grazers (`state/runs/**/03_verify/status.json`
+  matching "verify"), so the pre-G23b PASS had been satisfied by exactly the junk suggestions G23b
+  exists to block, with no ordering signal in the tie. Measured decision: NO floor value
+  separates the bands — real 1-hit gold (0.42) sits BELOW the grazer junk band (0.45–0.47;
+  on a 180-keyword real-run goal, 59,281/59,281 files scored >0 with max 0.473, all
+  grazers) — so "recalibrate the threshold" is refuted and **the floor stays 0.5**. The
+  bench query moved to the regime real per-task queries live in (module-path vocabulary,
+  multi-hit; G23b's own tuning note: "useful path-only scores reach ~0.64") and now ranks
+  true gold first (`retrieval-orchestrator.test.ts` 0.60 / `retrieval-orchestrator.ts`
+  0.56; 28 files ≥ floor). Regression pinned bench-harness-free in
+  `retrieval-orchestrator.test.ts` ("R3-2: warm cache (cached discovery, new keywords)
+  stays non-empty" + cached-discovery proof + every suggestion ≥ floor). b13 warm: FAIL
+  (files=0) → PASS (18–23ms, budget 400ms), deterministic ×3.
+- **test(goal): re-pin "model env forwards" to the central registry** — the cross-file pin
+  read async-runner.ts source for the old allowlist literals; it now asserts the
+  registry-consumption anchor + runtime allowlist membership (C-1 fallout, semantics
+  unchanged).
+- **chore: cleared pre-existing biome debt** — 5 files failed `format:check` and
+  `state-store-sqlite-parity.test.ts` carried 2 unused imports; all committed red at HEAD
+  `add29ff3` (left by earlier waves, untouched by Wave A lanes). Formatted + imports
+  removed so the release gates run green from a clean tree.
+
+### Changed
+
+- **bench baseline replaced: win32/v24.10.0 (2026-05-14) → linux/v22.23.1 (2026-10-11)** —
+  the old baseline was captured on another OS/node line and could never arbitrate Linux
+  regressions. Captured under residual external load (an out-of-run rustc build had just
+  finished; ~5-min load avg ~6 decaying to ~4 on 4 cores) — treat the first 15%-threshold
+  comparisons as advisory until re-captured on an idle machine. Full `npm run bench`
+  (b1–b13 + legacy suite): 184s, all green — b13 warm 18ms PASS (budget 400ms), cold 85ms.
+- **ci:fast stays bench-free (decision)** — considered adding a bench:smoke subset; NOT
+  added: the regression classes this wave hit are already covered by cheaper existing
+  gates (strip-types syntax → the `typecheck` strip-types import probe; b13 warm-cache →
+  the R3-2 unit pin inside npm test), bench timing assertions are machine-sensitive, and
+  the full bench (184s) would roughly triple the fast gate. `bench:check` remains the
+  deliberate comparison tool against the (now Linux) baseline.
+
+### Fix round (2026-10-11 C-8 review — 3 MAJOR wiring gaps closed)
+
+Post-verdict FIX_THEN_SHIP round: the review caught three "code đúng nhưng không
+wiring" gaps (feature built, producer/consumer never connected) plus two minors.
+All five closed; each fix carries a regression test that fails on the pre-fix tree
+(mutation-checked for MAJOR 1/2).
+
+- **fix(child-pi): host-aborted settle marks `exitStatus.cancelled` (MAJOR 1)** —
+  `buildExitStatus` reported `cancelled: abortRequested` only, so a pi-1.1.0
+  host-cancelled settle (`agent_settled.aborted:true`) kept `exitStatus.cancelled`
+  false: `evidenceStatusFor()` (which reads exactly that field, not `result.aborted`)
+  classified the worker "completed" and the `worker.cancelled` evidence event in
+  child-executor.ts never fired for host aborts. Now `abortRequested || hostAbortedSettle`
+  (consistent with the crash classification in the same close handler). Regression:
+  `child-pi-rpc-abort-settle.test.ts` asserts `exitStatus.cancelled === true` (fails
+  pre-fix) + `assemble-attempt-outcome.test.ts` pins the host-aborted shape
+  (exit 0, no error, cancelled flag) → "cancelled".
+- **fix(ui): team-tool progress binder feeds `durationMs` to the formatter (MAJOR 2)**
+  — B-3 taught `formatCompactToolProgress` to prefer a producer `durationMs`, but no
+  streaming binder supplied one (the field existed only on the render-side path). The
+  team tool binder now plumbs `durationMs: Date.now() - startedAt` on every tick.
+  Regression: `team-tool-progress-binder.test.ts` pins the spinner clock 600s into the
+  future — self-timing would report `elapsed=600s`; the producer value wins (`elapsed=0s`)
+  and the test fails the moment the wiring drops.
+- **fix(ui): `team-settings theme*` threads the host ctx into theme discovery
+  (MAJOR 3)** — B-4 built host delegation (`ctx.ui.getAllThemes()` wins when non-empty)
+  but both theme-branch call-sites in handle-settings.ts called `discoverPiThemes()`
+  bare, so the host list could never win from the tool surface. `TeamContext` now
+  carries the optional runtime `ui` (the tool-execute ctx is an ExtensionToolContext,
+  so `ui` was already riding along at runtime) and both call-sites pass it. Regression:
+  `theme-settings-routing.test.ts` pins delegate-when-ctx-nonempty (host-only theme
+  listed + switches; fs-only crew theme becomes "Unknown") AND fs-fallback khi ctx
+  rỗng (no `ui` / missing API / empty `[]` → on-disk crew themes still listed).
+- **chore(notice): attribution for the vendored OSC 7501 module (MINOR 1)** — NOTICE.md
+  now records `src/ui/program-status.ts` as adapted from `@earendil-works/pi-tui` v1.1.0
+  `packages/tui/src/program-status.ts` (MIT © 2025 Mario Zechner).
+- **chore: `.gitignore` gains `temp/` (MINOR 2)** — local scratch dir was untracked
+  noise (`?? temp/`) on every status; now ignored.
+- **Follow-up (MINOR 3, not fixed this round — deliberately out of fix-round scope):**
+  `src/extension/registration/terminal-status-wiring.ts:254-275` —
+  `deriveTerminalBlockedSignal` does sync fs reads (≤16 manifests + ≤50 subagent
+  JSONs) inside an eval that runs on every runEventBus event (250ms debounce) —
+  sync IO on the UI thread when a run is busy. Candidate fix: mtime-keyed cache or
+  async evaluation. Low severity (reviewer-flagged MINOR); tracked here for the next
+  wave.
+
 ## [0.11.16] — fix(bug #4): steer racing executor start no longer wiped by on-spawn truncate (2026-10-11)
 
 Third live-caught fix from the 2026-10-10 full battery (run team_20261010172900).

package/NOTICE.md

@@ -36,6 +36,15 @@ pipe).
 
 Current scaffold status: no substantial source files have been copied verbatim; implementation is a fresh scaffold based on documented design lessons.
 
+### OSC 7501 program-status wire format (2026-10-11)
+
+`src/ui/program-status.ts` is VENDORED (adapted) from upstream
+`@earendil-works/pi-tui` v1.1.0 `packages/tui/src/program-status.ts`
+(MIT © 2025 Mario Zechner). Upstream is a pure-declaration module (no
+imports); the vendoring rationale (no peer version floor + the symbol is not
+re-exported from the package root before 1.1.0) is documented in the file
+header and `src/ui/pi-ui-compat.ts`.
+
 ## crew-vibes font assets
 
 - `assets/runner-spritesheet.png` and the 16 runner glyphs (U+E700..U+E70F) traced

package/README.md

@@ -124,6 +124,7 @@ Most-used keys (full set: [docs/usage.md](docs/usage.md) · [schema.json](schema
 | Key | What it does |
 |-----|--------------|
 | `runtime.mode` 🔒 | `auto \| scaffold \| child-process \| live-session` — how workers execute |
+| `runtime.embeddedWorkers` | U11 hybrid tier, **DEFAULT-OFF**: opt roles into in-process (embedded) workers with 2-fault fallback to subprocess — see [docs/usage.md](docs/usage.md#hybrid-2-tier-workers-embedded-tier-u11-default-off) |
 | `executeWorkers` 🔒 | `false` = dry-run planning only, no child processes |
 | `asyncByDefault` 🔒 | detach every run by default (survives session switches) |
 | `limits.maxConcurrentWorkers` | hard cap on parallel workers |