pi-crew 0.11.1 → 0.11.2

package/src/state/event-log/cursor.ts

@@ -114,6 +114,10 @@ export function readEvents(eventsPath: string): TeamEvent[] {
 
 export interface EventCursorOptions {
 	sinceSeq?: number;
+	/** Delivery cap for one read. When `limit` truncates the result, `events` is
+	 *  a PREFIX of everything available — resume from the returned `nextSeq`
+	 *  (never from `nextByteOffset`; see the continuation contract on
+	 *  `readEventsCursor`). */
 	limit?: number;
 	fromByteOffset?: number;
 	/** R-03: generation the caller captured on its previous read. When set, a
@@ -528,6 +532,30 @@ export function clearEventsCursorTailCache(eventsPath?: string): void {
 	cursorTailCache.delete(eventsPath);
 }
 
+/**
+ * Read team events with an optional incremental anchor (`sinceSeq`) plus a
+ * delivery cap (`limit`).
+ *
+ * Continuation / backpressure contract (BR-08):
+ *  - `nextSeq` is the continuation token for events that CARRY `metadata.seq`
+ *    (scheduler-emitted events): the max seq among the events DELIVERED by
+ *    this call — never a watermark past an undelivered event. Resume with
+ *    `{ sinceSeq: nextSeq }` (`>` comparison) to receive the rest.
+ *    LIMITS (cold-verify correction — documented, not fixed here): events
+ *    WITHOUT `metadata.seq` (e.g. the worker progress channel) are filtered
+ *    out of the sinceSeq path entirely, and DUPLICATE seqs cannot be paged
+ *    through by seq. Those cases need the `fromByteOffset` anchor.
+ *  - `total` is the number of events AVAILABLE for this read (after the
+ *    sinceSeq filter, before the `limit` slice) — EXCEPT that the tail cap
+ *    (TAIL_EVENT_CAP) may drop a prefix first, in which case `total` counts
+ *    only the retained suffix.
+ *  - `nextByteOffset` is an OPTIONAL incremental-read accelerator, and is only
+ *    returned when it is a SAFE resume anchor: on the `fromByteOffset` path it
+ *    is OMITTED whenever `limit` truncated the delta, because the underlying
+ *    offset then points past the ENTIRE delta (undelivered tail included) —
+ *    resuming from it would silently skip events. The default (non-byte)
+ *    path never returns it at all.
+ */
 export function readEventsCursor(eventsPath: string, options: EventCursorOptions = {}): EventCursorResult {
 	// Incremental byte-offset path: read only new bytes since last known offset
 	if (options.fromByteOffset !== undefined) {
@@ -558,11 +586,19 @@ export function readEventsCursor(eventsPath: string, options: EventCursorOptions
 		const limit = positiveInteger(options.limit);
 		const events = limit !== undefined ? merged.slice(0, limit) : merged;
 		const returnedMaxSeq = events.reduce((max, event) => Math.max(max, event.metadata?.seq ?? 0), sinceSeq);
+		// BR-08: `newState.byteOffset` sits past the ENTIRE delta read above —
+		// including the events the `limit` slice just dropped. Handing that back
+		// as `nextByteOffset` let a caller resume PAST events it never saw (silent
+		// loss: the delta read then returns an empty tail). Only expose the
+		// accelerator when this call delivered the whole delta; under truncation
+		// the caller must continue from `nextSeq` (see the doc comment on
+		// readEventsCursor).
+		const deliveredWholeDelta = limit === undefined || merged.length <= limit;
 		return {
 			events,
 			nextSeq: returnedMaxSeq,
 			total: merged.length,
-			nextByteOffset: newState.byteOffset,
+			...(deliveredWholeDelta ? { nextByteOffset: newState.byteOffset } : {}),
 			generation: liveGen,
 		};
 	}

package/src/state/event-log/event-log-rotation.ts

@@ -169,18 +169,83 @@ export interface CompactionResult {
  * 6. Return compaction stats
  */
 export function compactEventLog(eventsPath: string, config?: Partial<RotationConfig>): CompactionResult | undefined {
-	const prepared = prepareCompaction(eventsPath, config);
-	if (!prepared) return undefined;
-	// FIX: Wrap entire read-compact-write-recover sequence in lock to prevent
-	// event loss during compaction. Without lock, events can be appended between
-	// read and write, lost silently.
+	// US-001 (2026-09-22): lock-scope reduction. The expensive part is the READ +
+	// parse of the whole log (prepareCompaction). It is read-only, so it does NOT
+	// need the append lock: hold the lock ONLY for the write+recover phase
+	// (applyCompactionUnlocked), which is what must be atomic w.r.t. appends.
+	//
+	// Why this is safe: appenders take the SAME lock, so an append can only land
+	// before our prepareCompaction read or after our applyCompactionUnlocked
+	// write — never inside the write. applyCompactionUnlocked already re-reads
+	// after the write and splices back any events that arrived in the window
+	// (C2 recovery), so no event is lost; it only becomes slightly more likely to
+	// splice, which is exactly the case it was built for.
+	//
+	// No concurrent-rotator guard is needed: this function is fully SYNCHRONOUS
+	// (prepareCompaction and withEventLogLockSync both block), so two calls on the
+	// same path cannot interleave within a process. An in-flight flag was tried
+	// and removed — it was untestable dead code (mutation survived), and the
+	// synchronous execution already serializes rotators. Cross-process rotators
+	// are serialized by the on-disk lock in withEventLogLockSync.
 	//
 	// NOTE (Round 24 BUG 1): callers ALREADY holding the event-log lock (e.g.
-	// appendEventInsideLock in event-log.ts) must call applyCompactionUnlocked
+	// appendEventInsideLock in event-log.ts) must still call applyCompactionUnlocked
 	// directly — calling compactEventLog from inside the lock deadlocks (the
 	// mkdir lock is not re-entrant → 5s timeout → compaction never ran → the
 	// log grew unbounded until events were silently dropped past 50MB).
-	return withEventLogLockSync(eventsPath, () => applyCompactionUnlocked(eventsPath, prepared));
+	const prepared = prepareCompaction(eventsPath, config);
+	if (!prepared) return undefined;
+	return compactPreparedEventLog(eventsPath, prepared);
+}
+
+/**
+ * US-001 phase 3 — the LOCKED write phase, extracted so the read→write race is
+ * deterministically testable: a caller (test) can run prepareCompaction, append
+ * to the file (simulating another process landing events in the window), then
+ * call this and assert nothing was lost.
+ *
+ * prepareCompaction reads OUTSIDE the lock, so an appender may have added events
+ * between that read and this write. applyCompactionUnlocked writes exactly
+ * `prepared.lines` (the kept window from the snapshot), which would CLOBBER those
+ * newer events; its C2 recovery only re-splices events that were in `kept`, not
+ * ones it never saw. So under the lock we read the bytes appended after the
+ * snapshot offset and append them to the write. Appenders hold the same lock,
+ * so this read is a complete tail snapshot.
+ */
+export function compactPreparedEventLog(
+	eventsPath: string,
+	prepared: { lines: string; originalSize: number; originalCount: number; kept: TeamEvent[] },
+): CompactionResult | undefined {
+	return withEventLogLockSync(eventsPath, () => {
+		const merged = { ...prepared, lines: prepared.lines + readTailSince(eventsPath, prepared.originalSize) };
+		return applyCompactionUnlocked(eventsPath, merged);
+	});
+}
+
+/**
+ * US-001: return the raw text appended to `filePath` after `offset`, or "" when
+ * nothing was appended / the file was replaced by a smaller one (a foreign
+ * rotation — caller then proceeds without a splice, which is the pre-US-001
+ * behaviour). Must be called while holding the event-log lock.
+ */
+function readTailSince(filePath: string, offset: number): string {
+	try {
+		const size = fs.statSync(filePath).size;
+		if (size <= offset) return "";
+		const fd = fs.openSync(filePath, "r");
+		try {
+			const length = size - offset;
+			const buf = Buffer.alloc(length);
+			const read = fs.readSync(fd, buf, 0, length, offset);
+			const tail = buf.subarray(0, read).toString("utf-8");
+			// Only splice complete lines (a partial trailing write would corrupt JSONL).
+			return tail.endsWith("\n") ? tail : tail.slice(0, tail.lastIndexOf("\n") + 1);
+		} finally {
+			fs.closeSync(fd);
+		}
+	} catch {
+		return "";
+	}
 }
 
 /** Round 24 (BUG 1): the lock-free pre-read for compaction. Safe to run

package/src/state/stores/active-run-registry.ts

@@ -61,6 +61,14 @@ function removeStaleRegistryLock(lockPath: string, staleMs: number): boolean {
 }
 
 function withRegistryLock<T>(fn: () => T): T {
+	// US-010 (2026-09-22): sleepSync below is INTENTIONAL — this lock is sync-only
+	// (fn is synchronous, and its callers at :352/:378 are sync). Converting the
+	// backoff to `await sleep` here would repeat the documented v0.9.26
+	// starvation: the sync spinner's sleepSync blocks the event loop while an
+	// in-process async holder's `await`-based release can never run. The lock is
+	// held only for a sub-millisecond read-modify-write and the loop is bounded by
+	// a 10s deadline, so blocking is bounded and rare (contention is cross-process
+	// only). See src/state/event-log/sequence-cache.ts:270 for the same reasoning.
 	const filePath = registryLockPath();
 	const staleMs = 30_000;
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -84,7 +92,11 @@ function withRegistryLock<T>(fn: () => T): T {
 			break;
 		} catch (error) {
 			const code = (error as NodeJS.ErrnoException).code;
-			if (code !== "EEXIST") throw error;
+			// Windows lock contention surfaces as EPERM/EACCES/EBUSY (not EEXIST) while
+			// another handle holds the lock file open — cross-process contention in
+			// CI (run 36019884258). Treat as contention: bounded retry via the 10s
+			// deadline below, mirroring isLockContention() in coordination/locks.ts.
+			if (code !== "EEXIST" && code !== "EPERM" && code !== "EACCES" && code !== "EBUSY") throw error;
 			if (!removeStaleRegistryLock(filePath, staleMs) && Date.now() > deadline)
 				throw new Error("Active-run registry is locked by another operation.");
 			sleepSync(Math.min(250, 25 * 2 ** attempt));

package/src/state/stores/state-store.ts

@@ -193,19 +193,37 @@ function resolveRunStateRoot(cwd: string, runId: string): string | undefined {
 	const now = Date.now();
 	const cached = runStateRootCache.get(key);
 	if (cached && cached.expiresAt > now) return cached.root;
-	const runsRoot = path.join(scopeBaseRoot(cwd), DEFAULT_PATHS.state.runsSubdir);
-	const scopedPath = resolveContainedRelativePath(runsRoot, runId, "runId");
-	try {
-		resolveRealContainedPath(runsRoot, runId);
-	} catch {
-		return undefined;
-	}
-	if (runStateRootCache.size >= RUN_STATE_ROOT_CACHE_MAX) {
-		const oldest = runStateRootCache.keys().next().value;
-		if (oldest !== undefined) runStateRootCache.delete(oldest);
+	// F-L1 (2026-09-22): listing (run-index scopedRunRoots) UNIONS the user and
+	// project run roots, but this resolution used scopeBaseRoot's single XOR
+	// pick — a run living under the OTHER root (e.g. created by another cwd or
+	// before the repo got a marker) listed fine yet FAILED every by-ID lookup:
+	// team status / prune / forget / scheduler provenance all returned "not
+	// found". Try the primary root first (hot path unchanged — one contained
+	// resolve + cache hit), then fall back to the other root. The no-repo case
+	// never falls back to a project path, mirroring scopedRunRoots' `if
+	// (projectRoot)` guard — resolution sees exactly what listing sees.
+	const candidates = useProjectState(cwd) ? [projectCrewRoot(cwd), userCrewRoot()] : [userCrewRoot()];
+	for (const root of candidates) {
+		const runsRoot = path.join(root, DEFAULT_PATHS.state.runsSubdir);
+		const scopedPath = resolveContainedRelativePath(runsRoot, runId, "runId");
+		// resolveRealContainedPath deliberately ACCEPTS a missing target (write-path
+		// semantics: ENOENT is fine, only symlink/escape violations throw) — so
+		// existence must be probed explicitly. Without this, the primary root
+		// always "wins" with a phantom path and the fallback can never run.
+		if (!fs.existsSync(path.join(scopedPath, DEFAULT_PATHS.state.manifestFile))) continue;
+		try {
+			resolveRealContainedPath(runsRoot, runId);
+		} catch {
+			continue; // symlink/escape violation under this root — try the other
+		}
+		if (runStateRootCache.size >= RUN_STATE_ROOT_CACHE_MAX) {
+			const oldest = runStateRootCache.keys().next().value;
+			if (oldest !== undefined) runStateRootCache.delete(oldest);
+		}
+		runStateRootCache.set(key, { root: scopedPath, expiresAt: now + RUN_STATE_ROOT_TTL_MS });
+		return scopedPath;
 	}
-	runStateRootCache.set(key, { root: scopedPath, expiresAt: now + RUN_STATE_ROOT_TTL_MS });
-	return scopedPath;
+	return undefined;
 }
 
 // PERF (2026-08-24): the artifacts containment verdict (existsSync + lstat +
@@ -239,7 +257,13 @@ function validateRunManifestPaths(cwd: string, runId: string, manifest: TeamRunM
 		manifest.eventsPath !== path.join(stateRoot, "events.jsonl")
 	)
 		return false;
-	const artifactsParent = path.join(scopeBaseRoot(cwd), DEFAULT_PATHS.state.artifactsSubdir);
+	// F-L1 (2026-09-22): derive the artifacts parent from the RESOLVED stateRoot's
+	// base root (…/<base>/state/runs/<runId>), not scopeBaseRoot — cross-root
+	// runs (state under the fallback root, artifacts written beside it at
+	// creation) must validate against their OWN root; scopeBaseRoot would
+	// reject every fallback-resolved run and keep it invisible by ID.
+	const baseRoot = path.resolve(stateRoot, "..", "..", "..");
+	const artifactsParent = path.join(baseRoot, DEFAULT_PATHS.state.artifactsSubdir);
 	const expectedArtifactsRoot = resolveContainedRelativePath(artifactsParent, runId, "runId");
 	if (manifest.artifactsRoot !== expectedArtifactsRoot) return false;
 	// PERF (2026-08-24): memoized verdict — see artifactsVerdictCache above.
@@ -409,9 +433,14 @@ export function createRunManifest(params: {
 	runKind?: "team-run" | "goal-loop" | "dynamic-workflow";
 	/** round-14 P1-5: typed workflow arguments for .dwf.ts scripts (ctx.args<T>()). */
 	args?: unknown;
+	/** Deterministic-capture support (2026-09-22): pin the run ID and/or clock
+	 * so tools like docs/ui-samples/capture.ts produce byte-stable output.
+	 * Defaults preserve current behavior (generated id, wall clock). */
+	runId?: string;
+	now?: () => Date;
 }): { manifest: TeamRunManifest; tasks: TeamTaskState[]; paths: RunPaths } {
-	const paths = createRunPaths(params.cwd);
-	const now = new Date().toISOString();
+	const paths = createRunPaths(params.cwd, params.runId);
+	const now = (params.now ? params.now() : new Date()).toISOString();
 	const tasks = params.workflow ? createTasksFromWorkflow(paths.runId, params.workflow, params.team, params.cwd, params.goal) : [];
 	const manifest: TeamRunManifest = {
 		schemaVersion: CURRENT_SCHEMA_VERSION,
@@ -479,7 +508,12 @@ export function createRunManifest(params: {
 	return { manifest, tasks, paths };
 }
 
-export function saveRunManifest(manifest: TeamRunManifest): void {
+export function saveRunManifest(manifest: TeamRunManifest, options?: { allowTerminalExit?: boolean }): TeamRunManifest {
+	// Finding 8 (2026-09-23): terminal-preserve at the WRITE layer. Mid-flight
+	// savers (task-runner artifact/progress writes carrying a stale in-memory
+	// "running" manifest) previously overwrote an externally-written terminal
+	// status; merge/finalize had their own guards but every other save site did
+	// not. Guard here so NO raw save can erase a terminal disk status.
 	// FIX: Capture the cached tasks array + mtime/size BEFORE we invalidate the
 	// cache. The previous implementation re-read tasks.json from disk after the
 	// manifest write (a JSON.parse + fs.readFileSync per call), which defeated
@@ -502,12 +536,13 @@ export function saveRunManifest(manifest: TeamRunManifest): void {
 	// which is always safe.
 	invalidateRunCache(manifest.stateRoot);
 	const manifestPath = path.join(manifest.stateRoot, "manifest.json");
+	const effective = preserveDiskTerminalStatus(manifest, options?.allowTerminalExit);
 	// REVIEW FIX (2026-09-10): reverted WI-2.2's coalesced conversion —
 	// saveRunManifest is a SYNCHRONOUS persist by name/contract (tests assert
 	// it, broker loadRunManifestById is a cross-process reader, and the
 	// statSync-based cache repopulation below needs the real post-write
 	// mtime/size). The 50ms coalesce window broke all three.
-	atomicWriteJson(manifestPath, manifest);
+	atomicWriteJson(manifestPath, effective);
 	// FIX: Re-populate cache with actual mtime/size so loadRunManifestById
 	// doesn't miss the cache on next read. Without this, every load until
 	// TTL expires would hit disk because cached 0 !== any real mtime.
@@ -516,16 +551,17 @@ export function saveRunManifest(manifest: TeamRunManifest): void {
 	// fresh tasks should call saveRunTasks or loadRunTasks separately.
 	const manifestStat = fs.statSync(manifestPath);
 	setManifestCache(manifest.stateRoot, {
-		manifest,
+		manifest: effective,
 		tasks: cachedTasks,
 		manifestMtimeMs: manifestStat.mtimeMs,
 		manifestSize: manifestStat.size,
 		tasksMtimeMs: cachedTasksMtimeMs,
 		tasksSize: cachedTasksSize,
 	});
+	return effective;
 }
 
-export async function saveRunManifestAsync(manifest: TeamRunManifest): Promise<void> {
+export async function saveRunManifestAsync(manifest: TeamRunManifest, options?: { allowTerminalExit?: boolean }): Promise<TeamRunManifest> {
 	// FIX: Capture cached tasks array + mtime/size BEFORE invalidating, same
 	// rationale as the sync saveRunManifest above. The async path previously
 	// always set tasks: [] with mtime/size 0, so any cache hit was guaranteed
@@ -538,7 +574,8 @@ export async function saveRunManifestAsync(manifest: TeamRunManifest): Promise<v
 	// after a crash. See saveRunManifest for full explanation.
 	invalidateRunCache(manifest.stateRoot);
 	const manifestPath = path.join(manifest.stateRoot, "manifest.json");
-	await atomicWriteJsonAsync(manifestPath, manifest);
+	const effective = preserveDiskTerminalStatus(manifest, options?.allowTerminalExit);
+	await atomicWriteJsonAsync(manifestPath, effective);
 	// FIX: Re-populate cache with actual mtime/size. See saveRunManifest.
 	// RACE GUARD: another concurrent async save (OPT-02) may unlink+rewrite
 	// manifest.json between our atomicWriteJsonAsync and this stat. If stat
@@ -553,13 +590,14 @@ export async function saveRunManifestAsync(manifest: TeamRunManifest): Promise<v
 		manifestStat = { mtimeMs: 0, size: 0 };
 	}
 	setManifestCache(manifest.stateRoot, {
-		manifest,
+		manifest: effective,
 		tasks: cachedTasks,
 		manifestMtimeMs: manifestStat.mtimeMs,
 		manifestSize: manifestStat.size,
 		tasksMtimeMs: cachedTasksMtimeMs,
 		tasksSize: cachedTasksSize,
 	});
+	return effective;
 }
 
 /**
@@ -803,6 +841,44 @@ function saveManifestAndTasksAtomicSync(manifest: TeamRunManifest, tasks: TeamTa
 export interface UpdateRunStatusOptions {
 	data?: Record<string, unknown>;
 	metadata?: Parameters<typeof appendEvent>[1]["metadata"];
+	/** Finding 8 (2026-09-23): allow leaving a TERMINAL disk status (resume is the
+	 * only legitimate terminal-exit flow). Defaults to false — a raw save with an
+	 * in-memory "running" manifest must never erase an externally-written
+	 * cancelled/failed/completed status (live race team_20260923175042: cancel
+	 * 17:51:08 → intermediate task-runner save re-wrote "running" → finalize
+	 * completed — the cancel was fully erased). */
+	allowTerminalExit?: boolean;
+}
+
+/** Finding 8: statuses a disk write must never silently leave. Mirrors
+ * isRunTerminalPreserved (merge-loop.ts) — kept local to avoid a runtime dep
+ * from the store layer to the runtime layer. */
+const DISK_TERMINAL_STATUSES: ReadonlySet<TeamRunManifest["status"]> = new Set(["cancelled", "failed", "completed"]);
+
+/** Finding 8 write-layer guard: if the DISK manifest is terminal and the
+ * incoming write carries a NON-terminal status (the erase class — a mid-flight
+ * saver with a stale in-memory "running" manifest), preserve the disk
+ * status/summary/updatedAt while keeping every other incoming field (artifacts,
+ * usage, surface…). Terminal→terminal re-decisions (e.g. cancelling a run that
+ * just completed — pinned by resume-cancel.test.ts) are LEGITIMATE and pass
+ * through; they are governed by canTransitionRunStatus at the updateRunStatus
+ * layer. Returns the effective manifest to persist. */
+function preserveDiskTerminalStatus(manifest: TeamRunManifest, allowTerminalExit: boolean | undefined): TeamRunManifest {
+	if (allowTerminalExit) return manifest;
+	// Terminal→terminal re-decisions pass through (governed by
+	// canTransitionRunStatus at the updateRunStatus layer); the guard applies
+	// ONLY to the erase class: a NON-terminal incoming status over terminal disk.
+	if (DISK_TERMINAL_STATUSES.has(manifest.status)) return manifest;
+	try {
+		const manifestPath = path.join(manifest.stateRoot, "manifest.json");
+		// Raw read (no cache): cross-process cancel writes must be seen NOW.
+		const raw = fs.readFileSync(manifestPath, "utf-8");
+		const disk = JSON.parse(raw) as TeamRunManifest;
+		if (!DISK_TERMINAL_STATUSES.has(disk.status) || disk.status === manifest.status) return manifest;
+		return { ...manifest, status: disk.status, summary: disk.summary, updatedAt: disk.updatedAt };
+	} catch {
+		return manifest; // no disk manifest yet (create) or unreadable — normal write
+	}
 }
 
 export function updateRunStatus(
@@ -820,7 +896,21 @@ export function updateRunStatus(
 		updatedAt: new Date().toISOString(),
 		summary: summary ?? manifest.summary,
 	};
-	saveRunManifest(updated);
+	// Finding 8 (2026-09-23): the write-layer guard may PRESERVE a terminal disk
+	// status (an external cancel/reconciler write the in-memory manifest never
+	// saw). In that case do NOT emit run.<status>, do NOT flip the manifest —
+	// record the refusal and return the preserved state. Resume passes
+	// allowTerminalExit for its legitimate cancelled→running transition.
+	const saved = saveRunManifest(updated, { allowTerminalExit: options.allowTerminalExit });
+	if (saved.status !== status) {
+		appendEvent(saved.eventsPath, {
+			type: "run.terminal_preserved",
+			runId: saved.runId,
+			message: `Preserved terminal status '${saved.status}'; refused in-memory transition to '${status}'.`,
+			data: { preserved: saved.status, refused: status },
+		});
+		return saved;
+	}
 	// Unregister from active-run-index when run reaches a terminal status.
 	// Without this, stale entries accumulate (e.g. integration tests in /tmp) and
 	// Pi UI shows ghost "queued" runs that are actually completed/failed/cancelled.

package/src/state/types.ts

@@ -543,6 +543,10 @@ export interface GoalLoopState {
 	nextTurnFeedback?: string;
 	/** The team-run of the current in-flight turn (for cancel/steer). */
 	currentRunId?: string;
+	/** GL-1b (2026-09-22): why the last turn (or the loop itself) failed —
+	 * persisted at goal level because turn-run dirs are pruned (keep=10 at
+	 * session start) and otherwise the reason becomes unrecoverable. */
+	lastTurnError?: string;
 	verdicts: GoalVerdict[];
 	history: {
 		runId: string;

package/src/ui/dashboard-panes/agents-pane.ts

@@ -178,8 +178,17 @@ export function renderAgentsPane(snapshot: RunUiSnapshot | undefined, options: R
 				stats.push(liveHandle.modelName);
 			}
 		} else if (agent.startedAt) {
-			const ms = nowMs - new Date(agent.startedAt).getTime();
-			if (Number.isFinite(ms)) stats.push(alignMetric(formatDuration(ms), DURATION_METRIC_WIDTH));
+			// Tier 13 (2026-09-21): a FINISHED agent's span must end at completedAt,
+			// never at the wall clock. The naive `nowMs - startedAt` made every
+			// completed agent of an old run inflate forever — the dashboard showed
+			// `01_explore … 29m39s` while the tool card showed the real `8m22s` for
+			// the same agent. Mirror computeLiveDurationMs: prefer a sane completedAt,
+			// else fall back to now; never emit a negative or absurd span.
+			const startedMs = new Date(agent.startedAt).getTime();
+			const rawCompleted = agent.completedAt ? new Date(agent.completedAt).getTime() : Number.NaN;
+			const completedMs = Number.isFinite(rawCompleted) && rawCompleted >= startedMs && rawCompleted <= nowMs ? rawCompleted : nowMs;
+			const ms = completedMs - startedMs;
+			if (Number.isFinite(ms) && ms >= 0) stats.push(alignMetric(formatDuration(ms), DURATION_METRIC_WIDTH));
 		}
 
 		const statsStr = stats.length ? ` · ${stats.join(" ")}` : "";

package/src/ui/heartbeat-aggregator.ts

@@ -32,6 +32,32 @@ function isActiveTask(task: TeamTaskState): boolean {
 	return task.status === "running";
 }
 
+/**
+ * FINDING 5 (2026-09-23 battery): health ticks must count task statuses from
+ * DISK truth, not the (possibly lagging) snapshot cache. A worker parked on
+ * `ask` transitions running → waiting on disk while the cached snapshot can
+ * still show `running` — in that window the parked worker counted as
+ * active-without-heartbeat and fired a false "dead worker" notification (live:
+ * run team_20260923100114, 01_explore parked on ask, later answered+resumed).
+ *
+ * Overlay FRESH task statuses (and heartbeats) from disk onto the cached
+ * snapshot before summarizing. Returns the ORIGINAL snapshot object when
+ * nothing diverged (cheap identity check — callers use it to decide cache
+ * invalidation), or a shallow copy with the diverging tasks replaced.
+ */
+export function overlayFreshTaskStatuses(snapshot: RunUiSnapshot, freshTasks: TeamTaskState[]): RunUiSnapshot {
+	if (freshTasks.length === 0) return snapshot;
+	const freshById = new Map(freshTasks.map((task) => [task.id, task]));
+	let diverged = false;
+	const tasks = snapshot.tasks.map((task) => {
+		const fresh = freshById.get(task.id);
+		if (!fresh || (fresh.status === task.status && fresh.heartbeat === task.heartbeat)) return task;
+		diverged = true;
+		return { ...task, status: fresh.status, heartbeat: fresh.heartbeat };
+	});
+	return diverged ? { ...snapshot, tasks } : snapshot;
+}
+
 export function summarizeHeartbeats(snapshot: RunUiSnapshot, opts: HeartbeatSummaryOptions = {}): HeartbeatSummary {
 	const staleMs = opts.staleMs ?? 60_000;
 	const deadMs = opts.deadMs ?? 5 * 60_000;
@@ -55,6 +81,14 @@ export function summarizeHeartbeats(snapshot: RunUiSnapshot, opts: HeartbeatSumm
 	const runTerminal = isTerminalRunStatus(snapshot.manifest.status);
 	for (const task of snapshot.tasks) {
 		if (runTerminal || !isActiveTask(task)) continue;
+		// Guest-child tasks (delegate subagents, agent === "delegate") have no
+		// heartbeat channel — they never write task.heartbeat and complete in
+		// seconds; their lifecycle is owned by delegate.requested/admitted/
+		// completed broker events. Counting them here fired a false "N worker(s)
+		// missing heartbeat" ambient for every delegate-using run (live:
+		// team_20260926033657_2b6c6d2610b26d9d, 2026-09-26 battery — same
+		// gc-blindness root shape as the heartbeat-watcher fix).
+		if (task.agent === "delegate") continue;
 		const heartbeat = task.heartbeat;
 		if (!heartbeat) {
 			summary.missing += 1;

package/src/ui/keybinding-map.ts

@@ -33,6 +33,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { type KeyId, matchesKey } from "@earendil-works/pi-tui";
 import { getCrewEnv } from "../config/env-vars.ts";
+import { projectCrewRoot } from "../utils/paths.ts";
 import { keyOf } from "./key-utils.ts";
 
 export const DASHBOARD_KEYS = {
@@ -41,6 +42,8 @@ export const DASHBOARD_KEYS = {
 	help: ["?"],
 	root: {
 		summary: ["u"],
+		/** US-020: cancel the selected run (2-step confirm in the dashboard). */
+		cancel: ["x"],
 		artifacts: ["a"],
 		api: ["i"],
 		agents: ["d"],
@@ -112,6 +115,7 @@ export type DashboardKeyAction =
 	| "live-conversation"
 	| "reload"
 	| "browser"
+	| "cancel"
 	| "pane-agents"
 	| "pane-progress"
 	| "pane-mailbox"
@@ -256,6 +260,9 @@ const DEFAULT_BINDINGS: readonly KeyBinding[] = [
 	// safe; inside the browser overlay itself "p" is free because overlays
 	// are mutually exclusive (see keybinding-map.ts header note).
 	{ keys: DASHBOARD_KEYS.root.browser, action: "browser" },
+	// US-020: x → cancel the selected run (unscoped; the schedules pane's X
+	// delete is pane-scoped uppercase — pass-1 exact match keeps them distinct).
+	{ keys: DASHBOARD_KEYS.root.cancel, action: "cancel" },
 	{ keys: DASHBOARD_KEYS.pane.agents, action: "pane-agents" },
 	{ keys: DASHBOARD_KEYS.pane.progress, action: "pane-progress" },
 	{ keys: DASHBOARD_KEYS.pane.mailbox, action: "pane-mailbox" },
@@ -418,7 +425,10 @@ export type KeybindingOverride = Partial<Record<DashboardKeyAction | OverlayBind
 const KEYBINDINGS_ENV = "PI_CREW_KEYBINDINGS";
 
 /** Every dispatched action + every `overlay:*` binding is a valid override target. */
-const VALID_OVERRIDE_ACTIONS: ReadonlySet<string> = new Set<string>([...DEFAULT_BINDINGS.map((b) => b.action), ...OVERLAY_BINDING_KEYS]);
+export const VALID_OVERRIDE_ACTIONS: ReadonlySet<string> = new Set<string>([
+	...DEFAULT_BINDINGS.map((b) => b.action),
+	...OVERLAY_BINDING_KEYS,
+]);
 
 /** Coerce an unknown parsed value into a safe {@link KeybindingOverride}. */
 function parseKeybindingOverride(raw: unknown): KeybindingOverride {
@@ -541,10 +551,17 @@ function computeEffectiveBindings(overrides: KeybindingOverride): EffectiveBindi
 	return { bindings, overlayBindings, reverted: [...reverted] };
 }
 
-/** Read the `keybindings` section from `<cwd>/.crew/config.json`. */
+/**
+ * Read the `keybindings` section from the project config.
+ *
+ * RR-020 Fix 4: resolve via `projectCrewRoot(cwd)` instead of a literal
+ * `<cwd>/.crew` — the config lives in whichever layout the project actually
+ * uses (`.crew/` or `.pi/teams/`), so a `.pi/teams` project's keybinding
+ * overrides are no longer silently ignored.
+ */
 function readConfigKeybindings(cwd: string): KeybindingOverride {
 	try {
-		const raw: unknown = JSON.parse(fs.readFileSync(path.join(cwd, ".crew", "config.json"), "utf-8"));
+		const raw: unknown = JSON.parse(fs.readFileSync(path.join(projectCrewRoot(cwd), "config.json"), "utf-8"));
 		if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
 		return parseKeybindingOverride((raw as Record<string, unknown>).keybindings);
 	} catch {
@@ -565,7 +582,8 @@ function readEnvKeybindings(): KeybindingOverride {
 
 function configKeybindingsMtime(cwd: string): number | undefined {
 	try {
-		return fs.statSync(path.join(cwd, ".crew", "config.json")).mtimeMs;
+		// RR-020 Fix 4: same layout-resolved config path as readConfigKeybindings.
+		return fs.statSync(path.join(projectCrewRoot(cwd), "config.json")).mtimeMs;
 	} catch {
 		return undefined;
 	}

package/src/ui/live-conversation-overlay.ts

@@ -62,11 +62,14 @@ export class LiveConversationOverlay {
 	private handle: LiveAgentHandle;
 	private theme: CrewTheme;
 
-	constructor(handle: LiveAgentHandle, theme: CrewTheme, columns = 80, rows = 24) {
+	private readonly nowMs: () => number;
+
+	constructor(handle: LiveAgentHandle, theme: CrewTheme, columns = 80, rows = 24, nowMs?: () => number) {
 		this.handle = handle;
 		this.theme = theme;
 		this.columns = columns;
 		this.rows = rows;
+		this.nowMs = nowMs ?? Date.now;
 		// R8: Subscribe to real session events if available
 		const session = handle.session as Record<string, unknown>;
 		if (typeof session.subscribe === "function") {
@@ -117,7 +120,7 @@ export class LiveConversationOverlay {
 
 	private refreshSummary(): void {
 		const act = this.handle.activity;
-		const summary = `${LiveConversationOverlay.SUMMARY_PREFIX}[${formatCount(act.turnCount ?? 0, "turn")} · ${formatCount(act.toolUses ?? 0, "tool")} · ${(computeLiveDurationMs(act) / 1000).toFixed(1)}s]`;
+		const summary = `${LiveConversationOverlay.SUMMARY_PREFIX}[${formatCount(act.turnCount ?? 0, "turn")} · ${formatCount(act.toolUses ?? 0, "tool")} · ${(computeLiveDurationMs(act, this.nowMs()) / 1000).toFixed(1)}s]`;
 		const lastLine = this.cachedLines[this.cachedLines.length - 1];
 		if (lastLine?.startsWith(LiveConversationOverlay.SUMMARY_PREFIX)) {
 			this.cachedLines[this.cachedLines.length - 1] = summary;
@@ -267,7 +270,7 @@ export class LiveConversationOverlay {
 		if (act.maxTurns != null) parts.push(`turn ${act.turnCount ?? 0}/${act.maxTurns}`);
 		else if ((act.turnCount ?? 0) > 0) parts.push(`turn ${act.turnCount}`);
 		if ((act.toolUses ?? 0) > 0) parts.push(formatCount(act.toolUses ?? 0, "tool"));
-		parts.push(`${(computeLiveDurationMs(act) / 1000).toFixed(1)}s`);
+		parts.push(`${(computeLiveDurationMs(act, this.nowMs()) / 1000).toFixed(1)}s`);
 		try {
 			const ctxPct = this.handle.session.getSessionStats?.()?.contextUsage?.percent;
 			if (ctxPct != null) {