pi-crew 0.11.26 → 0.11.28

package/CHANGELOG.md

@@ -6,6 +6,35 @@
 
 - **fix(gate): RT24-F1 root-gate config/autonomy read over-block** — `rootGateBlockReason` counted the `args` subcommand carrier as a config patch key, so worker-origin `config {args:"show"}` READS were rejected as "writes user-scope config" (live-caught in the v0.11.24 real-test battery; docblock promised reads open). `args` added to the carrier-key sets for `config` and `autonomy`; unknown junk keys stay write-classified (fail-closed). Pinned: reads with carrier keys open, writes hidden behind the same key still gated (`unset`/patch keys), user config byte-untouched. Live-verified end-to-end (fresh `pi -p`, worker env): read allowed + dumps config; `unset` write gate-blocked verbatim "root-session required".
 
+## [0.11.28] — Residual quality wave: prune-anchor silence, 6 flake classes hardened, LOW-tail fixes
+
+### Fixed
+- **Session-start prune noise (C2, live-proven)**: every stale run whose artifacts dir was already age-cleaned printed one `artifact-store.prune-anchor ENOENT … skipping N descriptor(s)` warn per boot. A missing anchor dir means nothing under it can exist to delete — that is success-shaped silence now; every other anchor failure (symlink anchor, non-directory, permissions) keeps the visible warn. Fail-closed behavior unchanged (nothing deleted).
+- **6 load-flake classes hardened** (each previously caused a real red on publish/CI/pre-push): R6-9 embedded-tier usage (poll turn-1 `message_end` instead of a fixed 1.5s sleep — also fixes the blast racing guard arming), stale-ctx-publish (condition polls instead of fixed flushes), round24 in-lock perf bounds + event-log append-lock/inline-guard bounds (adaptive control-fs-op scaling, capped below the deadlock/lock-timeout signatures that fail on their own), recordWaitPolicyRejection (poll the durable append landing), rpc parent-abort (abort after the fixture traces `run-start`, not a fixed 150ms).
+- **R14-C3**: DWF checkpoints now stamp a `dispatchContext {modelOverride, team}` fingerprint; resuming with a different model/team emits `dwf.resume_context_mismatch` instead of silently replaying old-model results (fail-open with visibility).
+- **R14-C4**: scheduler `add()` emits the `added` event with the post-`arm()` job state — a past-dated `once` job no longer announces itself as enabled after being disabled.
+- **R2-L-A1**: `loadRunManifestById` (sync + async) maps a vanished manifest (ENOENT mid-sweep) to `undefined` instead of aborting the caller's whole best-effort recovery sweep.
+- **R2-L-A2**: an unexpected realpath failure while validating `PI_TEAMS_PI_BIN` now says explicitly that the explicit pin was IGNORED and default resolution takes over.
+- **R2-L-B9**: the theme-adapter polling fallback holds only a `WeakRef` to the theme and self-terminates after collection — abandoned subscriptions no longer pin the theme with a permanent 1s poll.
+
+### Changed
+- **R2-L-B10 (documented)**: interval-scheduled jobs re-arm after run completion, so the effective period is `intervalMs + run duration` — deliberate no-overlap design, now recorded at the arm site.
+
+### Closed (no bug)
+- **`manifest.usage = null` (battery 2026-10-19 observation #3)**: false premise — the field does not exist and nothing reads it; `task.usage` is populated on real runs and every token surface (run summary, powerbar, agents pane) is fed correctly. Battery report corrected.
+
+## [0.11.27] — Residual backlog: chain DSL constructs now have real consumers (`:N` loops, `--with-context`, positional args) + `--timeout` wired
+
+### Fixed
+- **R14-C1 tail / M3-F (silent no-op DSL features)**: the chain parser accepted `:N`, `--with-context`, and quoted positional args, and the runner dutifully parked them in `step.context` — where nothing ever read them. A user writing `polish:3` got ONE run, silently. All three now have real consumers:
+  - `:N` executes N sequential iterations (chain is sequential by contract). Each iteration is its own `ChainStepResult` (`name#k` for k>1), so a failing iteration stays visible; the R14-C5 success predicate counts planned EXECUTIONS, so a chain that breaks inside a loop cannot pass unexecuted iterations off as done. `:N` is clamped to 1..10 at the parser — clamped, not thrown, because a throw would fall back to the simple splitter and turn `step:99` into ONE literal step named "step:99" (the exact R14-C1 corruption class).
+  - `--with-context` forwards the previous step's FULL worker output (`__chainPrevOutput`, capped 20k chars) — distinct from the default `__chainHistory` channel, which carries only size-capped handoff summaries. Rendered as a `# Previous Step Output (--with-context)` block in the next step's goal.
+  - Quoted positional args append to the step goal: `"research" "topic X"` → goal "research topic X".
+- **R14-C2 (dead `--timeout` flag + unit confusion)**: `--timeout` parsed into `step.timeout` that no consumer ever read, with a seconds value compared against a 1000-day ms bound. Now: parsed as seconds 1..86400 (1 day), forwarded as `runParams.timeoutMs` into the step's run — honored by the CORE-8 unified deadline (params > config `limits.maxRunMinutes` > 1h default) for foreground runs.
+
+### Verified
+- Pins: parser clamp (0→1, 99→10) · 3-iteration loop with visible `#k` results · in-loop failure breaks the chain (planned-execution accounting — mutation-pinned: reverting to `spec.steps.length` accounting turns the loop test RED) · `continueOnError` runs remaining iterations · args→goal · `--with-context` full-output forwarding + 20k cap + absence without flag · timeout seconds→ms + 1-day boundary + `__chainStepTimeoutMs` packet channel · executor renders the prev-output block and forwards `timeoutMs` (absent flag → no key).
+
 ## [0.11.26] — Fix: verifier verdict consumer blocked runs whose verifier returned a prose verdict (live-caught by the post-release real-test battery)
 
 ### Fixed