pi-crew 0.11.4 → 0.11.6

package/src/runtime/task-runner/post-execution.ts

@@ -131,6 +131,7 @@ export async function finalizeTaskResult(ctx: TaskExecutionContext, execResult:
 	const skillNames = ctx.skillNames;
 	const skillPaths = ctx.skillPaths;
 	const promptArtifact = ctx.promptArtifact;
+	const breakdownArtifact = ctx.breakdownArtifact;
 	const inputsArtifact = ctx.inputsArtifact;
 	const skillArtifact = ctx.skillArtifact;
 	const coordinationArtifact = ctx.coordinationArtifact;
@@ -166,7 +167,6 @@ export async function finalizeTaskResult(ctx: TaskExecutionContext, execResult:
 			error: undefined,
 			claim: undefined,
 			heartbeat: touchWorkerHeartbeat(task.heartbeat ?? createWorkerHeartbeat(task.id), { alive: false }),
-			workerExitStatus: terminalEvidence.at(-1)?.exitStatus,
 			terminalEvidence: terminalEvidence.length ? [...(task.terminalEvidence ?? []), ...terminalEvidence] : task.terminalEvidence,
 			diagnostics: {
 				...(task.diagnostics ?? {}),
@@ -544,7 +544,6 @@ export async function finalizeTaskResult(ctx: TaskExecutionContext, execResult:
 		resultArtifact,
 		claim: undefined,
 		heartbeat: touchWorkerHeartbeat(task.heartbeat ?? createWorkerHeartbeat(task.id), { alive: false }),
-		workerExitStatus: terminalEvidence.at(-1)?.exitStatus,
 		terminalEvidence: terminalEvidence.length ? [...(task.terminalEvidence ?? []), ...terminalEvidence] : task.terminalEvidence,
 		...(logArtifact ? { logArtifact } : {}),
 		...(transcriptArtifact ? { transcriptArtifact } : {}),
@@ -623,6 +622,7 @@ export async function finalizeTaskResult(ctx: TaskExecutionContext, execResult:
 		artifacts: [
 			...manifest.artifacts,
 			promptArtifact,
+			...(breakdownArtifact ? [breakdownArtifact] : []),
 			...(resultArtifact ? [resultArtifact] : []),
 			inputsArtifact,
 			coordinationArtifact,

package/src/runtime/task-runner/pre-execution.ts

@@ -23,7 +23,6 @@ import { logInternalError } from "../../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
 import type { PreparedTaskWorkspace } from "../../worktree/worktree-manager.ts";
 import { prepareTaskWorkspaceAsync } from "../../worktree/worktree-manager.ts";
-import { reserveControlChannel } from "../agent-control.ts";
 import { emptyCrewAgentProgress, recordFromTask, upsertCrewAgent } from "../crew-agent-records.ts";
 import type { CrewRuntimeKind } from "../crew-agent-runtime.ts";
 import type { registerStreamBridge } from "../event-stream-bridge.ts";
@@ -71,6 +70,8 @@ export interface TaskExecutionContext {
 	skillPaths: string[] | undefined;
 	prompt: string;
 	promptArtifact: ArtifactDescriptor;
+	/** G18: prompt-breakdown artifact descriptor (undefined when PI_CREW_PROMPT_BREAKDOWN off). */
+	breakdownArtifact?: ArtifactDescriptor;
 	inputsArtifact: ArtifactDescriptor;
 	skillArtifact: ArtifactDescriptor | undefined;
 	coordinationArtifact: ArtifactDescriptor;
@@ -150,12 +151,18 @@ export async function prepareTaskExecutionContext(
 		startedAt: new Date().toISOString(),
 		claim: createTaskClaim(`task-runner:${input.task.id}`),
 		heartbeat: createWorkerHeartbeat(input.task.id),
+		// NEW-3 (SDD-4 W-D) note: deliberately NO pid here — at prepare time the
+		// worker does not exist yet (spawn happens later in child-executor.ts).
+		// The singleton path's real pid arrives via checkpoint.childPid
+		// (child-executor "child-spawned" checkpoint), which the
+		// `heartbeat?.pid ?? checkpoint?.childPid` consumers already read as a
+		// fallback. Do NOT stamp process.pid here — that is the orchestrator, and
+		// it outlives the worker, which would blind the stale-reconciler's
+		// PID-liveness gate forever.
 		agentProgress: input.task.agentProgress ?? emptyCrewAgentProgress(),
 		// Lifetime usage accumulator — survives compaction unlike session.stats
 		lifetimeUsage: { input: 0, output: 0, cacheWrite: 0 },
 		...(dependencyContextText ? { dependencyContextText } : {}),
-		// Reserve control channel before spawn so cancel/steer can target this task immediately
-		controlReservation: reserveControlChannel(input.task.id, manifest.runId),
 	} as TeamTaskState;
 	let tasks = updateTask(input.tasks, task);
 	// T2/R4 (ADR-4 §3 single-writer linkage): record on the CURRENT plan
@@ -343,27 +350,32 @@ export async function prepareTaskExecutionContext(
 	// SR-02 phase 1: per-section breakdown artifact (opt-in via
 	// PI_CREW_PROMPT_BREAKDOWN=1). Adds the SYSTEM-side pieces the prompt
 	// builder cannot see (agent definition, skills, pre-step output).
-	if (promptBreakdownEnabled()) {
-		const sections: Record<string, number> = {
-			"system.agentDefinition": input.agent?.systemPrompt?.length ?? 0,
-			...(promptResult.sections ?? {}),
-			"dynamic.preStepOutput": preStepOutput?.length ?? 0,
-		};
-		writeArtifact(manifest.artifactsRoot, {
-			kind: "metadata",
-			relativePath: `metadata/${task.id}.prompt-breakdown.json`,
-			content: `${JSON.stringify(
-				Object.fromEntries(
-					Object.entries(sections)
-						.filter(([, chars]) => chars > 0)
-						.map(([name, chars]) => [name, { chars, estTokens: estimateTokens(chars) }]),
-				),
-				null,
-				2,
-			)}\n`,
-			producer: "prompt-breakdown",
-		});
-	}
+	// G18 (SDD Buổi-1 WI-3 follow-up): capture the descriptor so it flows
+	// through ctx into the manifest artifacts index — otherwise the
+	// `breakdown` team-tool action cannot find it on real runs.
+	const breakdownArtifact: ArtifactDescriptor | undefined = promptBreakdownEnabled()
+		? (() => {
+				const sections: Record<string, number> = {
+					"system.agentDefinition": input.agent?.systemPrompt?.length ?? 0,
+					...(promptResult.sections ?? {}),
+					"dynamic.preStepOutput": preStepOutput?.length ?? 0,
+				};
+				return writeArtifact(manifest.artifactsRoot, {
+					kind: "metadata",
+					relativePath: `metadata/${task.id}.prompt-breakdown.json`,
+					content: `${JSON.stringify(
+						Object.fromEntries(
+							Object.entries(sections)
+								.filter(([, chars]) => chars > 0)
+								.map(([name, chars]) => [name, { chars, estTokens: estimateTokens(chars) }]),
+						),
+						null,
+						2,
+					)}\n`,
+					producer: "prompt-breakdown",
+				});
+			})()
+		: undefined;
 
 	const collectedJsonEvents: Record<string, unknown>[] | undefined = collectYieldEvents ? [] : undefined;
 
@@ -415,6 +427,7 @@ export async function prepareTaskExecutionContext(
 			skillPaths,
 			prompt,
 			promptArtifact,
+			breakdownArtifact,
 			inputsArtifact,
 			skillArtifact,
 			coordinationArtifact,

package/src/runtime/task-runner/retrieval-orchestrator.ts

@@ -31,6 +31,27 @@ export const MAX_SUGGESTED_FILES = 10;
 /** Minimum files suggested when retrieval returns anything. */
 export const MIN_SUGGESTED_FILES = 5;
 
+/**
+ * G23b (2026-10-02): minimum retrieval score for a file to be suggested.
+ *
+ * Rationale — the legacy `score > 0` floor in the byPath pass only keeps
+ * out zero-score files, so generic path-keyword grazers sail through and
+ * fill the top-10. Live evidence (run team_20261002065548, the small-wins
+ * batch this fix ships in): 10 junk suggestions scoring 0.45–0.46 (paths
+ * grazing generic tokens like "template", "security", "skill", "md",
+ * "ts", "source") were injected into worker context ahead of any useful
+ * file. 0.5 sits above that observed junk band while still admitting
+ * genuinely relevant path-only matches (useful path-only scores reach
+ * ~0.64; HIGH_RELEVANCE_THRESHOLD=0.7 stays convergence-only). Applied
+ * BEFORE the top-N cap/slice so junk can never occupy a slot even when
+ * the qualified set is small.
+ *
+ * Tuning: recalibrate against real-run evidence if the junk band shifts
+ * above 0.5 or gold files start scoring below — and update the G23b
+ * pinning tests in the same change (they import this constant).
+ */
+export const MIN_SUGGEST_SCORE = 0.5;
+
 /** Stopwords dropped during keyword tokenization (lowercase comparison). */
 // PERF round 3: expanded from 14 function words to the common verb/pronoun/
 // filler set. These multiply the scoring cost (keywords × files × passes)
@@ -492,8 +513,13 @@ export async function runRetrievalCycle(task: string, goal: string, cwd: string)
 	const converged = hasConverged(evaluations);
 	// Sort by score desc, take top N (5..10).
 	evaluations.sort((a, b) => b.relevance - a.relevance);
-	const cap = Math.min(MAX_SUGGESTED_FILES, Math.max(MIN_SUGGESTED_FILES, evaluations.length));
-	const top = evaluations.slice(0, cap).map((e) => ({
+	// G23b: drop sub-floor keyword-grazers BEFORE the cap/slice so junk can
+	// never occupy a top-N slot. Sub-floor evaluations stay in `evaluations`
+	// above — convergence only counts ≥0.7 hits over always-empty
+	// missingContext, so filtering here cannot change `converged`.
+	const qualified = evaluations.filter((e) => e.relevance >= MIN_SUGGEST_SCORE);
+	const cap = Math.min(MAX_SUGGESTED_FILES, Math.max(MIN_SUGGESTED_FILES, qualified.length));
+	const top = qualified.slice(0, cap).map((e) => ({
 		path: path.isAbsolute(e.path) ? path.relative(cwd, e.path) : e.path,
 		score: e.relevance,
 		reason: e.reason,

package/src/schema/team-tool-schema.ts

@@ -376,6 +376,27 @@ const sharedFields = {
 			},
 		),
 	),
+	// SDD-3 W-C G13: agent-call cap for dynamic-workflow runs. A run is always
+	// bounded — unset falls back to DEFAULT_MAX_AGENT_CALLS (200) in the ctx;
+	// tripping the cap terminates the run with a structured reason instead of
+	// the blind 30-min script timeout. Same loose-numeric shape as tokenBudget.
+	maxAgentCalls: Type.Optional(
+		Type.Union(
+			[
+				Type.Literal(""),
+				Type.Number({
+					description:
+						"Cap on ctx.agent() invocations per dynamic-workflow run (steps ≡ agent calls). Default 200 when unset. Tripping the cap terminates the run with a structured agent-call-cap reason. Overrides workflow.maxAgentCalls.",
+					minimum: 1,
+				}),
+				Type.String({ pattern: NUMERIC_STRING_RE }),
+			],
+			{
+				description:
+					"Cap on ctx.agent() invocations per dynamic-workflow run (steps ≡ agent calls). Default 200 when unset. Tripping the cap terminates the run with a structured agent-call-cap reason. Overrides workflow.maxAgentCalls.",
+			},
+		),
+	),
 	args: Type.Optional(Type.Any()),
 	analysis: Type.Optional(
 		Type.String({
@@ -398,7 +419,7 @@ const sharedFields = {
 	),
 };
 
-// ─── Domain action unions (10+16+7+16+6 = 55 actions) ──────────────────────
+// ─── Domain action unions (10+17+7+17+6 = 57 actions) ──────────────────────
 
 const ACTION_DESCRIPTION = "Team action. Defaults to 'list' when omitted.";
 
@@ -411,6 +432,7 @@ const STATUS_ACTIONS = [
 	"get",
 	"events",
 	"artifacts",
+	"breakdown",
 	"summary",
 	"graph",
 	"search",
@@ -586,6 +608,10 @@ export interface TeamToolParamsValue {
 	runKind?: "team-run" | "goal-loop" | "dynamic-workflow";
 	/** Per-workflow token budget for dynamic-workflow runs (round-14 P1-2). */
 	tokenBudget?: number;
+	/** Cap on ctx.agent() invocations per dynamic-workflow run (SDD-3 W-C G13).
+	 *  Unset → DEFAULT_MAX_AGENT_CALLS (200); tripping the cap terminates the
+	 *  run with a structured agent-call-cap reason. */
+	maxAgentCalls?: number;
 	/** Typed workflow arguments for .dwf.ts scripts, accessible via ctx.args<T>() (round-14 P1-5). */
 	args?: unknown;
 	/** Inline analysis/context notes from the calling session. Persisted to

package/src/state/contracts.ts

@@ -94,6 +94,17 @@ export const TEAM_EVENT_TYPES = [
 	"async.stale",
 	"task.waiting",
 	"task.resumed",
+	// G5 (deep-review 2026-10-01): respond-delivery observability. The leader
+	// previously had NO confirmation that a mailbox respond reached the worker:
+	// `respond_delivered` fires at the broker's wait.resolve ack when the parked
+	// worker reports it PICKED UP the questionId-tagged response (terminal
+	// outcome "answered" — timed-out/aborted resolves are NOT deliveries);
+	// `respond_missed` fires root-side when the respond discriminator finds the
+	// waiting worker dead (delivery rides the requeue+inject path instead).
+	// Neither transitions run state — sibling ask.answered/task.resumed carry
+	// the lifecycle; these two carry only the delivery verdict.
+	"task.respond_delivered",
+	"task.respond_missed",
 	"task.retried",
 	// WP-2/R2 waiting-producer (ADR-0 2026-08-17-waiting-producer-ask item 10):
 	// `ask` tool lifecycle — requested on park acceptance, answered on delivery
@@ -231,6 +242,10 @@ export const TEAM_EVENT_TYPES = [
 	"run.forget_requested",
 	"run.goal_achievement",
 	"run.resume_requested",
+	// SDD-3 W-C G4 (team-tool.ts handleResume): forced resume of a FOREIGN-owned
+	// run — ownership was bypassed with force:true (liveness was NOT bypassable;
+	// live runs are refused before this event can fire). Security-audit trace.
+	"run.resume_forced_foreign",
 	// Runtime/surface resolution
 	"runtime.resolved",
 	"surface.degraded",
@@ -249,6 +264,7 @@ export const TEAM_EVENT_TYPES = [
 	"task.retry_attempt",
 	"task.budget_fair_share",
 	"task.model_dropped",
+	"task.mcp_enforcement_degraded",
 	"task.output_validation",
 	"task.steer_queued",
 	"task.steer_dropped",

package/src/state/crew-init.ts

@@ -276,6 +276,116 @@ function computeCrewRoot(cwd: string): string {
 	return fs.existsSync(piDir) ? safeJoin(piDir, "teams") : crewDir;
 }
 
+/**
+ * G23c (2026-10-02): sweep an empty legacy `.pi/teams` residue once the
+ * project has migrated to the `.crew/` layout.
+ *
+ * When `.crew/` exists, `computeCrewRoot` resolves to `.crew/` and the
+ * legacy `.pi/teams/` tree from an older pi-crew version is never revisited
+ * — dead residue stays on disk forever (plan §G23c: "0 code dọn"). This
+ * sweep is deliberately CONSERVATIVE because it deletes from the user's
+ * workspace:
+ *
+ *   1. Fires ONLY when the active crew root is the `.crew` layout AND
+ *      `<repoRoot>/.pi/teams` exists (a live legacy root is never touched).
+ *   2. Removes the legacy tree ONLY when it is a bare pi-crew skeleton:
+ *      known pi-crew directory names at every depth, and only placeholder
+ *      files (`.gitkeep` anywhere; `README.md`/`.gitignore` at the root).
+ *      Every entry is content-checked before anything is deleted.
+ *   3. Any real data — a run manifest under `state/`, artifact content, a
+ *      user-authored agent/workflow file, an unknown entry — keeps the
+ *      residue in place with ONE info log line: auto-migrating run state
+ *      would change the run-lookup path, which is too risky for an
+ *      automatic sweep (leader/user decision).
+ *   4. Never touches anything under `.pi/` other than the `teams/` path
+ *      itself — the `.pi` parent and all siblings (`.pi/agent`, ...) stay.
+ *
+ * Self-contained by design: inline helpers only, no new module imports.
+ * Any failure inside the sweep is logged and swallowed — init must never
+ * break because the residue could not be inspected.
+ */
+
+/** Directory names pi-crew itself creates/uses under a crew root (any depth).
+ *  Sources: ensureCrewDirectory (state/subagents/runs/artifacts/cache/graphs/
+ *  audit), project-init.ts (agents/teams/workflows/imports), and the legacy
+ *  .gitignore entries in gitignore-manager.ts (worktrees/imports). */
+const LEGACY_TEAMS_SKELETON_DIRS = new Set([
+	"state",
+	"subagents",
+	"runs",
+	"artifacts",
+	"cache",
+	"graphs",
+	"audit",
+	"worktrees",
+	"agents",
+	"teams",
+	"workflows",
+	"imports",
+]);
+
+/** Placeholder files pi-crew itself writes at the crew-root level. */
+const LEGACY_TEAMS_SKELETON_ROOT_FILES = new Set(["README.md", ".gitignore"]);
+
+/**
+ * True when `root` holds no data: every directory has a pi-crew skeleton
+ * name and every file is a pi-crew placeholder. Anything else — run
+ * manifests, artifacts, user agent/workflow content, unknown entries —
+ * returns false (the caller then keeps the residue).
+ */
+function isBareLegacyTeamsSkeleton(root: string): boolean {
+	const walk = (dir: string, depth: number): boolean => {
+		let entries: fs.Dirent[];
+		try {
+			entries = fs.readdirSync(dir, { withFileTypes: true });
+		} catch {
+			// Unreadable => assume data; never delete what we cannot inspect.
+			return false;
+		}
+		for (const entry of entries) {
+			if (entry.isDirectory()) {
+				if (!LEGACY_TEAMS_SKELETON_DIRS.has(entry.name)) return false;
+				if (!walk(safeJoin(dir, entry.name), depth + 1)) return false;
+			} else if (entry.isFile() || entry.isSymbolicLink()) {
+				// `.gitkeep` placeholders are written at any depth; README.md and
+				// .gitignore only at the crew-root level. Any other file (run
+				// manifest, artifact, user content) counts as data.
+				if (entry.name === ".gitkeep") continue;
+				if (depth === 0 && LEGACY_TEAMS_SKELETON_ROOT_FILES.has(entry.name)) continue;
+				return false;
+			} else {
+				// Sockets/FIFOs/devices — unknown => keep.
+				return false;
+			}
+		}
+		return true;
+	};
+	return walk(root, 0);
+}
+
+/** See the G23c block comment above. Returns silently when there is nothing
+ *  safe to sweep. */
+function sweepLegacyTeamsResidue(cwd: string, activeCrewRoot: string): void {
+	try {
+		const repoRoot = findProjectRoot(cwd) ?? cwd;
+		const legacyTeamsDir = safeJoin(repoRoot, ".pi", "teams");
+		// Sweep only when the ACTIVE layout is `.crew` (computeCrewRoot did NOT
+		// resolve to the legacy root) and a legacy tree actually exists.
+		if (activeCrewRoot === legacyTeamsDir || !fs.existsSync(legacyTeamsDir)) return;
+		if (isBareLegacyTeamsSkeleton(legacyTeamsDir)) {
+			// Exact-path removal of `.pi/teams` only — the `.pi` parent and
+			// every sibling under it stay untouched.
+			fs.rmSync(legacyTeamsDir, { recursive: true, force: true });
+			return;
+		}
+		console.info(
+			`[pi-crew] legacy ${legacyTeamsDir} still contains data — kept in place (auto-migration would change the run-lookup path); remove manually once you no longer need it`,
+		);
+	} catch (error) {
+		console.info(`[pi-crew] legacy .pi/teams residue sweep skipped: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+
 /**
  * Ensure the .crew directory structure exists with all required subdirectories,
  * placeholder files, README, and .gitignore entries.
@@ -287,6 +397,10 @@ function computeCrewRoot(cwd: string): string {
 export async function ensureCrewDirectory(cwd: string): Promise<void> {
 	const crewRoot = computeCrewRoot(cwd);
 
+	// G23c: once `.crew/` is the active layout, sweep an empty legacy
+	// `.pi/teams` skeleton left behind by an older pi-crew version.
+	sweepLegacyTeamsResidue(cwd, crewRoot);
+
 	// 1. Create directory structure
 	const dirs = [
 		crewRoot,

package/src/state/stores/active-run-registry.ts

@@ -16,6 +16,12 @@ const BINARY_MAGIC = Buffer.from("PICREW2BIN", "utf-8");
 /** Binary format version for forward compatibility. */
 const BINARY_VERSION = 1;
 
+/** Staleness horizon (2.19 / FIX Issue 2): entries — non-async ones, and async
+ * ones guarding against PID reuse — whose manifest last write is older than
+ * this are filtered as not alive. Exported so resume-liveness consumers
+ * (team-tool.ts) share the exact horizon instead of mirroring a copy. */
+export const ACTIVE_RUN_STALE_MS = 30 * 60_000;
+
 export interface ActiveRunRegistryEntry {
 	runId: string;
 	cwd: string;
@@ -334,16 +340,17 @@ function filterAliveEntries(entries: ActiveRunRegistryEntry[]): {
 					if (code !== "ESRCH" && code !== "ENOENT") return false;
 					return false;
 				}
-				// FIX Issue 2: Async runs older than 30 min are stale even if PID is alive.
-				// This guards against PID reuse after the original process exits.
+				// FIX Issue 2: Async runs older than the staleness horizon are stale even if
+				// PID is alive. This guards against PID reuse after the original process exits.
 				const updatedAt = typeof raw.updatedAt === "string" ? Date.parse(raw.updatedAt) : NaN;
-				if (Number.isFinite(updatedAt) && Date.now() - updatedAt > 30 * 60 * 1000) return false;
+				if (Number.isFinite(updatedAt) && Date.now() - updatedAt > ACTIVE_RUN_STALE_MS) return false;
 			}
-			// 2.19 — Stale non-async run: live-session/scaffold runs older than 30 min
-			// Without this, test runs that crash/leak would stay in the registry forever.
+			// 2.19 — Stale non-async run: live-session/scaffold runs older than the
+			// staleness horizon. Without this, test runs that crash/leak would stay in
+			// the registry forever.
 			if (!raw.async) {
 				const updatedAt = typeof raw.updatedAt === "string" ? Date.parse(raw.updatedAt) : NaN;
-				if (Number.isFinite(updatedAt) && Date.now() - updatedAt > 30 * 60 * 1000) return false;
+				if (Number.isFinite(updatedAt) && Date.now() - updatedAt > ACTIVE_RUN_STALE_MS) return false;
 			}
 		} catch {
 			return false;

package/src/state/types.ts

@@ -638,7 +638,6 @@ export interface TeamTaskState {
 	heartbeat?: WorkerHeartbeatState;
 	checkpoint?: TaskCheckpointState;
 	attempts?: TaskAttemptState[];
-	workerExitStatus?: WorkerExitStatus;
 	terminalEvidence?: OperationTerminalEvidence[];
 	taskPacket?: TaskPacket;
 	verification?: VerificationEvidence;
@@ -675,7 +674,6 @@ export interface TeamTaskState {
 		retryCount?: number;
 		lastDecision?: PolicyDecision;
 	};
-	controlReservation?: ControlReservation;
 
 	/** Structured diagnostics per task (ASI pattern from pi-autoresearch). */
 	diagnostics?: Record<string, unknown>;
@@ -713,12 +711,6 @@ export interface TeamTaskState {
 	};
 }
 
-export interface ControlReservation {
-	reservedAt: string;
-	controllerId: string;
-	acceptsControlEvents: boolean;
-}
-
 /**
  * A task scheduled to fire on a cron expression, interval, or one-shot.
  * Persisted at `<cwd>/.crew/state/schedules/<sessionId>.json`.

package/src/ui/goal-flag.ts

@@ -0,0 +1,44 @@
+/**
+ * G19 (W-E Phase 1): shared goal-achievement surfacing helpers.
+ *
+ * `manifest.goalAchieved` (set once by `applyGoalAchievement` at run
+ * completion) had ZERO readers — the false-green verdict was persisted but
+ * never shown. These helpers are the single render rule so every surface
+ * (team-tool status, widget label, dashboard rows, live sidebar) agrees:
+ *
+ * - NEVER render while the run is still active (verdict is not final).
+ * - `true`  → silent (a green run needs no extra noise).
+ * - `false` / `"unknown"` → ⚠ warning (false-green / not verified).
+ * - `undefined` → silent (legacy runs created before the assessment existed,
+ *   or goal-loop assessment not enabled).
+ */
+
+import { isTerminalRunStatus, type TeamRunStatus } from "../state/contracts.ts";
+
+/** True when the run is terminal AND the goal was NOT confirmed achieved. */
+export function isGoalNotAchieved(run: { status?: string; goalAchieved?: boolean | "unknown" }): boolean {
+	if (run.status === undefined) return false;
+	if (!isTerminalRunStatus(run.status as TeamRunStatus)) return false;
+	return run.goalAchieved === false || run.goalAchieved === "unknown";
+}
+
+/** Short suffix for one-line labels (widget title, dashboard row, sidebar). */
+export function goalFlagSuffix(run: { status?: string; goalAchieved?: boolean | "unknown" }): string {
+	return isGoalNotAchieved(run) ? " ⚠" : "";
+}
+
+/**
+ * Full status line for team-tool status output. Empty string when silent
+ * (non-terminal, achieved, or never assessed). Includes the false-green note
+ * (the reason string recorded by `applyGoalAchievement`) when present.
+ */
+export function goalAchievedStatusLabel(run: {
+	status?: string;
+	goalAchieved?: boolean | "unknown";
+	goalAchievementNote?: string;
+}): string {
+	if (!isGoalNotAchieved(run)) return "";
+	const verdict = run.goalAchieved === "unknown" ? "unknown (not verified)" : "not achieved";
+	const note = run.goalAchievementNote ? ` — ${run.goalAchievementNote}` : "";
+	return `Goal achieved: ⚠ ${verdict}${note}`;
+}

package/src/ui/live-run-sidebar.ts

@@ -9,6 +9,7 @@ import { aggregateUsage, formatTokens } from "../state/usage.ts";
 import { readJsonFileCoalesced } from "../utils/file-coalescer.ts";
 import { truncate } from "../utils/visual.ts";
 import { formatCount, teamWorkflowLabel } from "./format-helpers.ts";
+import { goalFlagSuffix } from "./goal-flag.ts";
 import { DASHBOARD_KEYS } from "./keybinding-map.ts";
 import { ACTIVE, canopyLine, formatHint, RAIL, type RailSlot, railLine, sectionLine, shortId, statusSlot } from "./rail.ts";
 import type { OverlaySchedulerHandle } from "./shared-overlay-scheduler.ts";
@@ -230,6 +231,9 @@ export class LiveRunSidebar {
 			// user sees *why* a run ended without having to switch panes. The reason
 			// is already computed on the consumed snapshot (cancellationReason).
 			const TERMINAL_WITH_REASON = ["failed", "cancelled", "stopped"];
+			// G19 (W-E Phase 1): goal false-green flag on terminal runs — same rule
+			// as the team-tool status output; never rendered while still running.
+			const goalSuffix = goalFlagSuffix(run) ? " · ⚠ goal" : "";
 			const reasonSuffix =
 				TERMINAL_WITH_REASON.includes(run.status) && snapshot?.cancellationReason
 					? ` · ${truncate(snapshot.cancellationReason, 40)}`
@@ -241,7 +245,7 @@ export class LiveRunSidebar {
 					"border",
 					this.theme.fg(
 						"muted",
-						`${shortId(run.runId)} · ${run.status ?? "?"}${reasonSuffix} · ${run.workspaceMode ?? "single"}`,
+						`${shortId(run.runId)} · ${run.status ?? "?"}${reasonSuffix}${goalSuffix} · ${run.workspaceMode ?? "single"}`,
 					),
 					this.theme,
 					budget,

package/src/ui/pi-ui-compat.ts

@@ -36,6 +36,8 @@ export function setWorkingIndicator(ctx: UiContext, options?: WorkingIndicatorOp
 	if (typeof fn === "function") fn.call(ctx.ui, options);
 }
 
+/** Install or update an extension widget slot.
+ * No-op when the host UI predates the `setWidget` API. */
 export function setExtensionWidget(
 	ctx: UiContext,
 	key: string,
@@ -43,7 +45,9 @@ export function setExtensionWidget(
 	options?: WidgetOptionsWithPersist,
 ): void {
 	const { persist: _persist, ...widgetOptions } = options ?? {};
-	ctx.ui.setWidget(key, content as never, widgetOptions as WidgetOptions);
+	const record = maybeRecord(ctx.ui);
+	const fn = record?.setWidget;
+	if (typeof fn === "function") fn.call(ctx.ui, key, content as never, widgetOptions as WidgetOptions);
 }
 
 /**
@@ -66,12 +70,25 @@ export function setFooter(ctx: UiContext | undefined, factory: FooterFactory | u
 	if (typeof fn === "function") fn.call(ctx.ui, factory as never);
 }
 
+/** Show a custom focused component.
+ * When the host UI predates (or mangles) the `custom` API, resolves `undefined`
+ * instead of rejecting or hanging: the sole caller today
+ * (src/extension/registration/ui.ts) already fire-and-forgets via
+ * `void showCustom(...)`, so a rejected or never-settling promise would only
+ * surface as an unhandled rejection. */
 export function showCustom<T>(ctx: UiContext, factory: CustomFactory<T>, options?: CustomOptions): Promise<T> {
-	const custom = ctx.ui.custom as unknown as GenericCustom;
+	const record = maybeRecord(ctx.ui);
+	const fn = record?.custom;
+	if (typeof fn !== "function") return Promise.resolve(undefined as T);
+	const custom = fn as unknown as GenericCustom;
 	return custom<T>(factory, options);
 }
 
+/** Set a status fallback line.
+ * No-op when the host UI predates the `setStatus` API. */
 export function setStatusFallback(ctx: UiContext, key: string, lines: string | readonly string[] | undefined, segment?: string): void {
 	const text = typeof lines === "string" ? lines : lines ? [...lines].join("\n") : undefined;
-	ctx.ui.setStatus(segment ? `${key}:${segment}` : key, text);
+	const record = maybeRecord(ctx.ui);
+	const fn = record?.setStatus;
+	if (typeof fn === "function") fn.call(ctx.ui, segment ? `${key}:${segment}` : key, text);
 }

package/src/ui/run-dashboard.ts

@@ -29,6 +29,7 @@ import { renderProgressPane } from "./dashboard-panes/progress-pane.ts";
 import { renderScheduleDetails, renderSchedulesPane } from "./dashboard-panes/schedules-pane.ts";
 import { renderTranscriptPane } from "./dashboard-panes/transcript-pane.ts";
 import { formatCount, teamWorkflowLabel } from "./format-helpers.ts";
+import { goalFlagSuffix } from "./goal-flag.ts";
 import { type DashboardKeyAction, dashboardActionForKey } from "./keybinding-map.ts";
 import { HelpOverlay } from "./overlays/help-overlay.ts";
 import { ACTIVE, CURSOR, canopyLine, formatHint, gaugeBar, overflowHint, RAIL, railLine, sectionLine } from "./rail.ts";
@@ -448,7 +449,7 @@ function runLabel(
 	// survive; team/workflow/step clip) rather than the goal. Optional `maxW`
 	// enables the goal-aware truncation; legacy 3-arg callers (dev patch
 	// scripts) get the untruncated full label.
-	const head = `${marker} ${icon} ${run.runId.slice(-8)} ${status}`;
+	const head = `${marker} ${icon} ${run.runId.slice(-8)} ${status}${goalFlagSuffix(run)}`;
 	const meta = `${teamWorkflowLabel(run.team, run.workflow)} · ${step}`;
 	const goal = sanitizeLine(run.goal ?? "");
 	if (maxW === undefined) return sanitizeLine(`${head} · ${meta} · ${goal}`);

package/src/ui/widget/widget-model.ts

@@ -12,6 +12,7 @@ import type { ManifestCache } from "../../runtime/manifest-cache.ts";
 import { isDisplayActiveRun } from "../../runtime/process-status.ts";
 import { reconcileAllStaleRuns } from "../../runtime/recovery/crash-recovery.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
+import { goalFlagSuffix } from "../goal-flag.ts";
 import { ACTIVE, RAIL, shortId } from "../rail.ts";
 import type { RunSnapshotCache } from "../snapshot-types.ts";
 import type { WidgetRun } from "./widget-types.ts";
@@ -128,6 +129,9 @@ export function statusSummary(runs: WidgetRun[]): string {
 export function shortRunLabel(run: TeamRunManifest): string {
 	const team = (run.team ?? "").trim();
 	const workflow = (run.workflow ?? "").trim();
-	if (team && workflow && team !== workflow) return `${team}/${workflow}`;
-	return team || workflow || shortId(run.runId);
+	// G19 (W-E Phase 1): append the ⚠ goal flag when a TERMINAL run did not
+	// achieve its goal (false-green surfacing) — silent otherwise, so active
+	// runs and green runs never flicker.
+	const label = team && workflow && team !== workflow ? `${team}/${workflow}` : team || workflow || shortId(run.runId);
+	return `${label}${goalFlagSuffix(run)}`;
 }