pi-crew 0.11.18 → 0.11.19

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [0.11.19] — pi-durable wave: events.jsonl durability, run-lock socket dual-guard, usage ledger, verify-gate determinism (2026-10-13)
+
+Spec-driven delivery of the pi-durable research wave (packets U22/U16/U21/U13-ADJ/U9-ADJ + D4) against upstream pi-durable `a4d040d30`. Full SDD record: `../sdd-pi-durable-2026-10-13/` (SPEC + 6 đính chính, WORKITEMS W0–W31, GATES ~21 evidence rows); live battery: `docs/real-test/reports/real-test-2026-10-13-battery-live-session.md`. 15 implementation commits `85917a44`..`1acd01e7` on `d29df7dd`, merged fast-forward 2026-10-13.
+
+### Added
+
+- **feat(state): U22 — torn-vs-poison unified scanner + sticky sidecar markers for events.jsonl** — every read path (`parseJsonlEvents` full-read, cursor/tail incremental reads) now classifies corruption identically: a **torn** final line (no trailing newline — crash mid-append) is skipped non-stickily for this read only, while a **poison** complete-but-unparseable line is recorded in a sidecar `<events>.poison.jsonl` (`{lineIndex, byteOffset, reason, firstSeen}`) and skipped directly on later reads without re-parsing. Marker **lifetime is bound to the file instance it describes** (review-round M1, found independently by two reviewers): log rotation MOVES the sidecar alongside the archive, compaction DELETES it, and every marker hit is re-parsed once before skipping — a line that parses means the marker is stale and gets pruned, which also self-heals injected/stale same-path markers. Cap 1000 entries → last-resort whole-file quarantine (`.corrupt-<ts>` rename, `quarantineCorruptFile` pattern); `sweepOldArchives` now sweeps `<archive>.poison.jsonl` too. Result metadata gains optional `tornTail`/`poisonSkipped`; clean files are read bit-for-bit as before.
+- **feat(state): U22-b0 — worker-atomic-writer hardening** — fsync of the temp file AND its directory on every rename publish; per-request timeout (env `PI_CREW_WORKER_ATOMIC_TIMEOUT_MS`, default 10000) so a hung worker thread can never wedge the append queue; `on("exit")` drain of in-flight requests; temp-dir cache; worker-side append opens with `O_NOFOLLOW` (non-win32) closing the TOCTOU symlink-swap window between the main-side guard and the worker-side open (review F3). Opt-in surface unchanged.
+- **feat(state): U21 — run-lock dual-guard (file→socket)** — new `src/state/coordination/process-lock.ts` (adapted from `@earendil-works/chord` `manager.ts` MIT — see `NOTICE.md`): abstract-namespace unix socket `\0pi-crew-<sha256ns>` on Linux, tmp-file socket + `accepting()` probe takeover of leftovers on other platforms; `EADDRINUSE` maps to a structured `ProcessLockHeldError {reason:"locked"}`. `withRunLock` (async) acquires the socket AFTER the file lock as a second guard for hosts where file locks are weak (NFS etc.); socket-held contention releases the file token and continues the existing WAIT/backoff within the `staleMs*2` deadline (D1: live-holder steal stays a warn, never a dual-entry). Release order is socket-then-file with `try/finally` so a socket release failure cannot leak the file token (review FIX-4). The re-entrance token is registered IMMEDIATELY after file acquisition, before the socket listen macrotask — closing the window where a same-process contender saw an "invisible" token and stole a live holder's corpse (RR-011). `withRunLockSync` remains file-only by design (a sync path cannot await listen — documented deviation). Env `PI_CREW_RUN_LOCK_SOCKET` (default ON; `0` restores pre-U21 behavior bit-for-bit).
+- **feat(runtime): U13-ADJ — verify-gate determinism layer 3 + never-fail-task belt** — env `PI_CREW_VERIFY_DETERMINISM` (default OFF). When ON and the gate is enabled, after the default checks (typecheck, test:critical) the most critical check is re-run once; PASS→FAIL (or FAIL→PASS) downgrades that check's verdict to **INCONCLUSIVE** ("deterministic-check: flaky <name>"), never FAILED, and executor death on the rerun is INCONCLUSIVE as well. No rerun when checks already FAILED. The verifier prompt no longer asserts build state as "ground truth" after an executor error — it renders the state as UNKNOWN (prompt-bias gap). The belt around verifier spawn now also wraps the skip-path `writeArtifact` (FS errors degrade to a logged warning, never a task failure), and the finalizer is hoisted OUT of the belt's try so a finalizer throw propagates instead of falling through to a verifier spawn after a skip (review M2).
+- **feat(runtime): U9-ADJ — retry-loop no-progress detection hook + attempt ownership fields** — `RetryHooks` gains an optional `noProgress({attempt, lastResult, previousResult, durationMsLast})` predicate (caller-defined semantics; executor stays generic): consulted after a failed attempt that `shouldRetry` approved, a `true` verdict stops the loop with a distinct `no_progress` reason; a throwing hook is treated as false and logged, never crashes. Dormant by construction — no production caller yet (wired for the F4 timeout packet). `TaskAttemptState` gains optional additive `owner`/`intent` fields; both the tasks.json and sqlite validators accept them.
+
+### Fixed
+
+- **fix(runtime): U16 — usage ledger 2-tier (embedded + subprocess)** — the embedded-tier usage read was dead on BOTH branches (`session.getStats` never existed in the SDK; the `session.stats` fallback property neither), so `liveResult.usage` was always `undefined` for SDK sessions. Now reads `session.getSessionStats?.()` (the real SDK method) and delegates to the single unified parser `usageFromValue` (session-usage.ts): nested `tokens.{input,output,cacheRead,cacheWrite}` + `cost` (accepts BOTH the SDK session-level `cost: number` and the message-level `cost: {…, total}` object — `cost.total` wins), flat legacy shapes still parse, and the nested-key allowlist regains `"message"` (dropped by an earlier refactor but accepted by the historical `pi-json-output` parser). `lifetimeUsage` in the child executor now accumulates `cacheRead` and `cost` (not just input/output/cacheWrite), and `compactUsage` always keeps a stable `cost` key (0 when unseen) so ledger consumers see a stable schema. Live-verified end to end: run tasks.json carries `cacheRead` + numeric `cost` from message-level cost objects, and `team action=summary` renders them.
+- **fix(build): US-011 — strip-types regression from a TS parameter property** — `WorkerRequestBookkeeper` used `constructor(private …)`, which `--experimental-strip-types` (the child test/bench path) cannot transform — every strip-only load died. Parameter properties remain banned in `src/` (R3-1 recurrence; caught by the FOLLOWING phase's gate, not the author's — the rule "run one spawn-child test file after any constructor-syntax phase" is now in the real-test skill).
+- **fix(deps): D4 — pin `pi-tui` to a version window** — peerDependency `>=1.0.4 <2.0.0` (floor for the vendored OSC-7501 wire format + `PROGRAM_STATUS_QUERY`, cap against a 2.x breaking change) and devDependency pinned exact `1.0.4`. Deviation from the spec's "exact peer pin": a floor+cap avoids install conflicts with pi 1.2.x hosts that ship their own pi-tui.
+
+### Changed
+
+- **chore(gates): lazy-import budget ratchet 523→525** — the two new state modules (`poison-marker.ts`, `process-lock.ts`) are legitimate new entries in the `index.bundle.ts` graph; budget bumped with justification (the ratchet stays strict otherwise).
+- **chore(build): `dist/index.mjs` is now committed for release commits** — `check-bundle-staleness --committed-hash` requires the shipped bundle to match a fresh rebuild bit-for-bit (T11j); release commits carry the built artifact (md5 `c197855f917997a404ae39111d8ccfdc`, 1735.0 KB).
+
 ## [0.11.18] — U11 hybrid 2-tier worker + Δ-wave benches/gates + windows CI repair (2026-10-12)
 
 ### Added

package/NOTICE.md

@@ -45,6 +45,19 @@ imports); the vendoring rationale (no peer version floor + the symbol is not
 re-exported from the package root before 1.1.0) is documented in the file
 header and `src/ui/pi-ui-compat.ts`.
 
+### Process-lock socket guard (2026-10-13)
+
+`src/state/coordination/process-lock.ts` is adapted from
+`@earendil-works/chord` (MIT), `packages/chord/src/manager.ts:82-170 @
+a4d040d30` — processLock adapted from @earendil-works/chord (MIT),
+packages/chord/src/manager.ts:82-170 @ a4d040d30. No code was copied verbatim;
+the adaptation renames the socket namespace (`pi-crew-`), drops the
+env-passing lock-inheritance mechanism (pi-crew derives lock names from run
+dir paths and never passes lock state through child env), unrefs the
+listening socket so a held lock cannot keep the extension host alive, and
+adds typed contention errors. See the file header for the full adaptation
+list.
+
 ## crew-vibes font assets
 
 - `assets/runner-spritesheet.png` and the 16 runner glyphs (U+E700..U+E70F) traced