pi-crew 0.11.1 → 0.11.2

package/src/ui/run-dashboard.ts

@@ -10,7 +10,7 @@ import { readCrewAgents } from "../runtime/crew-agent-records.ts";
 import type { CrewAgentRecord } from "../runtime/crew-agent-runtime.ts";
 import { getLiveAgentContextPercent } from "../runtime/live-session/live-agent-manager.ts";
 import { isPlanApprovalPending } from "../runtime/plan-approval.ts";
-import { isDisplayActiveRun, isLikelyOrphanedActiveRun } from "../runtime/process-status.ts";
+import { isActiveRunStatus, isDisplayActiveRun, isLikelyOrphanedActiveRun } from "../runtime/process-status.ts";
 import type { ScheduledJob } from "../runtime/scheduling/scheduler.ts";
 import type { TeamRunManifest, TeamTaskState, UsageState } from "../state/types.ts";
 import { aggregateUsage } from "../state/usage.ts";
@@ -94,6 +94,27 @@ export interface RunDashboardOptions {
  */
 let lastActivePane: "agents" | "progress" | "mailbox" | "output" | "health" | "metrics" | "plan" | "schedules" = "agents";
 
+/**
+ * US-020 AC-2: the selected run SURVIVES dashboard close/reopen (the shared.ts
+ * action loop re-creates RunDashboard after every done() selection — enter on
+ * a run opens its detail, escape returns, and the cursor is where it was).
+ * Persisted per-process like lastActivePane; restored by runId on construct.
+ */
+let lastSelectedRunId: string | undefined;
+
+/** @internal — test isolation hook. US-020 AC-2 persists the cursor in
+ * module-level state (lastSelectedRunId) so it survives close/reopen cycles,
+ * but that state ALSO leaks across RunDashboard instances within one process:
+ * an E2E brute-force that constructs a fresh dashboard per iteration inherits
+ * the previous iteration's cursor, and with wrap-navigation the driven
+ * selection lands somewhere else entirely (measured: count=9 offset=8 restored
+ * run-007 → 8 'j' wraps to run-006, not run-008). Tests that need a clean
+ * cursor call this before constructing. */
+export function __test__resetDashboardState(): void {
+	lastSelectedRunId = undefined;
+	lastActivePane = "agents";
+}
+
 export type RunDashboardAction =
 	| "status"
 	| "summary"
@@ -118,7 +139,8 @@ export type RunDashboardAction =
 	| "schedule-disable"
 	| "schedule-run-now"
 	| "schedule-remove"
-	| "notifications-dismiss";
+	| "notifications-dismiss"
+	| "cancel";
 export interface RunDashboardSelection {
 	runId: string;
 	action: RunDashboardAction;
@@ -496,6 +518,11 @@ export class RunDashboard implements DashboardComponent {
 	private scheduleSelected = 0;
 	private scheduleDetails = false;
 	private scheduleDeleteArmed = false;
+	/** US-020 (run cancel): 2-step confirm-gate + refusal status line —
+	 * mirrors the schedules delete gate (first x arms, second x dispatches,
+	 * any other key disarms; a non-running selection refuses with a line). */
+	private runCancelArmed = false;
+	private runCancelRefused = false;
 	private scheduleJobsCache: { at: number; jobs: ScheduledJob[]; hiddenCount: number } | undefined;
 	private runs: TeamRunManifest[];
 	private readonly done: (selection: RunDashboardSelection | undefined) => void;
@@ -523,6 +550,15 @@ export class RunDashboard implements DashboardComponent {
 			? runs.filter((run) => !run.ownerSessionId || run.ownerSessionId === options.workspaceId)
 			: runs;
 		this.runs = filteredRuns;
+		// US-020 AC-2: restore the cursor to the previously selected run (if it
+		// is still in the list) so escape-return keeps the user's place.
+		if (lastSelectedRunId) {
+			// groupedRuns rows include GROUP LABELS ("Active"/"Recent") — index
+			// into the SELECTABLE rows only (the same projection navigation uses).
+			const selectable = groupedRuns(filteredRuns, options.snapshotCache).filter((rowItem) => rowItem.run);
+			const idx = selectable.findIndex((rowItem) => rowItem.run?.runId === lastSelectedRunId);
+			if (idx >= 0) this.selected = idx;
+		}
 		this.done = done;
 		this.theme = asCrewTheme(theme);
 		this.options = options;
@@ -814,16 +850,30 @@ export class RunDashboard implements DashboardComponent {
 					canopyLine({
 						word: "DASHBOARD",
 						subject: formatCount(this.runs.length, "run"),
+						// US-020: the cancel hint joins the canopy only when the budget
+						// has room — at narrow widths the canopy prefers the run-count
+						// subject over hints, and the 5th hint ellipsized it (regression
+						// caught by run-dashboard.test.ts's 80-col canonical canopy).
 						right: formatHint([
 							["1-8", "pane"],
 							[["up", "down"], "move"],
 							["enter", "select"],
+							...(budget >= 96 ? ([["x", "cancel"]] as const) : []),
 							["?", "help"],
 						]),
 						theme: this.theme,
 						budget,
 					}),
 				);
+				// US-020: run-cancel confirm gate / refusal status line —
+				// rendered right under the canopy so it is visible in EVERY pane
+				// (schedule-delete's warning is pane-8-only by design; run cancel
+				// is a root action).
+				if (this.runCancelArmed) {
+					lines.push(row(fg("warning", `⚠ x again to CANCEL '${this.selectedRunId() ?? "(none)"}' · any other key disarms`)));
+				} else if (this.runCancelRefused) {
+					lines.push(row(fg("dim", "nothing to cancel — the selected run is not active")));
+				}
 
 				if (this.runs.length === 0) {
 					// F-7: actionable empty state instead of a bare "No runs.".
@@ -1076,7 +1126,16 @@ export class RunDashboard implements DashboardComponent {
 			this.scheduleDeleteArmed = false;
 			this.invalidate();
 		}
+		// US-020: the run-cancel confirm gate disarms on any non-cancel key
+		// (schedule-delete precedent), and a stale refusal line clears.
+		if (this.runCancelArmed && action !== "cancel") {
+			this.runCancelArmed = false;
+			this.invalidate();
+		}
+		if (this.runCancelRefused && action !== "cancel") this.runCancelRefused = false;
 		const selectedRunId = this.selectedRunId();
+		// US-020 AC-2: keep the cursor across close/reopen cycles.
+		if (selectedRunId) lastSelectedRunId = selectedRunId;
 		if (action === "close") {
 			this.done(undefined);
 			return;
@@ -1085,6 +1144,36 @@ export class RunDashboard implements DashboardComponent {
 			this.done(selectedRunId ? { runId: selectedRunId, action: "status" } : undefined);
 			return;
 		}
+		// US-020: cancel the SELECTED run — dedicated branch (plan-approve
+		// precedent) so a stray keystroke can never close the dashboard via
+		// done(undefined). 2-step confirm gate: first x arms (render shows the
+		// warning line), second x dispatches the existing cancel channel; a
+		// non-running selection refuses with a status line (AC-3) — the guard
+		// mutation target.
+		if (action === "cancel") {
+			const run = selectedRunFromGrouped(this.runs, this.selected, this.options.snapshotCache);
+			const manifest = run ? (snapshotFor(run, this.options.snapshotCache)?.manifest ?? run) : undefined;
+			if (this.runCancelArmed) {
+				this.runCancelArmed = false;
+				if (manifest && isActiveRunStatus(manifest.status)) {
+					this.done({ runId: manifest.runId, action: "cancel" });
+				} else {
+					this.runCancelRefused = true;
+					this.invalidate();
+				}
+				return;
+			}
+			this.runCancelRefused = manifest ? !isActiveRunStatus(manifest.status) : false;
+			if (this.runCancelRefused) {
+				this.invalidate();
+				return;
+			}
+			if (manifest) {
+				this.runCancelArmed = true;
+				this.invalidate();
+			}
+			return;
+		}
 		// WP-3 (H4-subset): plan approval keys. Deliberately a DEDICATED branch
 		// (not the generic union block below) because plan actions must gate on
 		// the selected run actually being parked on a pending approval — a
@@ -1177,10 +1266,14 @@ export class RunDashboard implements DashboardComponent {
 			this.planDiff = !this.planDiff;
 			this.invalidate();
 			return;
-		} else if (action === "up") this.selected = Math.max(0, this.selected - 1);
-		else if (action === "down") {
+		} else if (action === "up" || action === "down") {
+			// US-020 AC-1: WRAP at the list edges (was: hard clamp). An empty list
+			// must not divide by zero — stay at 0.
 			const selectableCount = groupedRuns(this.runs, this.options.snapshotCache).filter((row) => row.run).length;
-			this.selected = Math.min(Math.max(0, selectableCount - 1), this.selected + 1);
+			if (selectableCount > 0) {
+				this.selected =
+					action === "up" ? (this.selected - 1 + selectableCount) % selectableCount : (this.selected + 1) % selectableCount;
+			}
 		}
 		if (action) {
 			lastActivePane = this.activePane;

package/src/ui/run-snapshot-cache.ts

@@ -27,6 +27,13 @@ export interface RunSnapshotCache extends RunSnapshotCacheBase {
 	preloadAllStale(runIds: string[]): Promise<void>;
 	/** Task 17 (perf/review-2026-08-24): watcher-facing coalesced async refresh. */
 	scheduleRefresh(runId: string): void;
+	/**
+	 * F13 (RR-018): true once dispose() has run. Callers that retain the cache
+	 * (RegistrationContext.getManifestCache/getRunSnapshotCache) use this to
+	 * recreate a FRESH instance even when the cwd is unchanged — a disposed
+	 * instance must never be handed back just because `cacheCwd` still matches.
+	 */
+	isDisposed(): boolean;
 }
 
 /** WP-7 (R7): the plans slice + Plan pane load only when this flag is set —
@@ -840,6 +847,9 @@ export function createRunSnapshotCache(cwd: string, options: RunSnapshotCacheOpt
 	const recentEventsLimit = options.recentEvents ?? DEFAULT_RECENT_EVENTS;
 	const recentOutputLimit = options.recentOutputLines ?? DEFAULT_RECENT_OUTPUT_LINES;
 	const entries = new Map<string, CacheEntry>();
+	// F13 (RR-018): liveness flag — dispose() flips it so cache holders can
+	// detect a disposed instance and recreate instead of reusing it.
+	let disposed = false;
 
 	function touch(runId: string, entry: CacheEntry): RunUiSnapshot {
 		entry.lastAccessMs = Date.now();
@@ -883,7 +893,7 @@ export function createRunSnapshotCache(cwd: string, options: RunSnapshotCacheOpt
 		let tasks: TeamTaskState[];
 		let agents: CrewAgentRecord[];
 		try {
-			// R10-4 (docs/refactor-plan.review.md §ROUND 10): sync/async parity.
+			// R10-4 (docs/archive/refactor-plan.review.md §ROUND 10): sync/async parity.
 			// loadRunManifestById already returns tasks validated against the
 			// current tasks.json (mtime+size+generation check in state-store),
 			// so the old readTasks() re-read only doubled tasks.json I/O per
@@ -1143,9 +1153,16 @@ export function createRunSnapshotCache(cwd: string, options: RunSnapshotCacheOpt
 			return new Map([...entries.entries()].map(([key, entry]) => [key, entry.snapshot]));
 		},
 		dispose(): void {
+			// F13: idempotent — a second dispose must be a no-op, never a throw
+			// (cleanup paths can race a lazy cache swap).
+			if (disposed) return;
+			disposed = true;
 			unsubscribe();
 			inFlightRefreshes.clear();
 			entries.clear();
 		},
+		isDisposed(): boolean {
+			return disposed;
+		},
 	};
 }

package/src/ui/spinner.ts

@@ -1,7 +1,31 @@
 export const SUBAGENT_SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"] as const;
 export const SUBAGENT_SPINNER_FRAME_MS = 160;
 
-export function spinnerBucket(now = Date.now(), frameMs = SUBAGENT_SPINNER_FRAME_MS): number {
+// Clock source indirection (2026-09-22): spinner phase is derived from wall
+// time at ~30 call sites that don't thread an injectable `now` through their
+// render signatures. Deterministic consumers (docs/ui-samples/capture.ts,
+// tests) swap the source once at startup instead of refactoring every
+// signature; production keeps the real clock. Same pattern as the `__test__`
+// hooks in state-store.
+let spinnerClockSource: () => number = Date.now;
+
+/** @internal — swap the spinner clock source. Returns the previous source
+ * (pass it back to restore). Production default is Date.now. */
+export function __setSpinnerClockSource(source: () => number): () => number {
+	const previous = spinnerClockSource;
+	spinnerClockSource = source;
+	return previous;
+}
+
+/** The spinner clock as a shared read: elapsed-time fallbacks that have no
+ * injected `now` (tool-progress, record durations) read it here so deterministic
+ * captures pin BOTH spinner phase and elapsed text with one hook. Production
+ * default stays Date.now(). */
+export function spinnerClockNow(): number {
+	return spinnerClockSource();
+}
+
+export function spinnerBucket(now = spinnerClockSource(), frameMs = SUBAGENT_SPINNER_FRAME_MS): number {
 	return Math.floor(now / Math.max(1, frameMs));
 }
 
@@ -11,7 +35,7 @@ function hashKey(key: string): number {
 	return hash;
 }
 
-export function spinnerFrame(key = "", now = Date.now()): string {
+export function spinnerFrame(key = "", now = spinnerClockSource()): string {
 	const offset = key ? hashKey(key) % SUBAGENT_SPINNER_FRAMES.length : 0;
 	return SUBAGENT_SPINNER_FRAMES[(spinnerBucket(now) + offset) % SUBAGENT_SPINNER_FRAMES.length] ?? SUBAGENT_SPINNER_FRAMES[0];
 }

package/src/ui/tool-progress-formatter.ts

@@ -1,5 +1,6 @@
 import type { CrewAgentRecord } from "../runtime/crew-agent-runtime.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
+import { spinnerClockNow } from "./spinner.ts";
 
 export interface ToolProgressInput {
 	/** Subagent record id or synthetic agent label shown in the header. */
@@ -177,7 +178,7 @@ function taskCounts(tasks: TeamTaskState[] | undefined): string | undefined {
  * the chat widget overlay does not jitter.
  */
 export function formatCompactToolProgress(input: ToolProgressInput): string {
-	const elapsedSec = Math.max(0, Math.round((Date.now() - input.startedAt) / 1000));
+	const elapsedSec = Math.max(0, Math.round((spinnerClockNow() - input.startedAt) / 1000));
 	const head = input.agentId ? `${PROGRESS_FORMAT.agentKey}=${input.agentId}` : PROGRESS_FORMAT.agentKey;
 	// Emitted from PROGRESS_FORMAT so the parser can never drift from the wire format.
 	const lines: string[] = [

package/src/ui/tool-renderers/brief-mode.ts

@@ -8,6 +8,7 @@
 
 import type { CrewAgentRecord } from "../../runtime/crew-agent-runtime.ts";
 import { formatDuration, formatTokens, truncLine } from "../format-helpers.ts";
+import { spinnerClockNow } from "../spinner.ts";
 import type { CrewTheme } from "../theme-adapter.ts";
 
 // ── State ──────────────────────────────────────────────────────────────
@@ -149,7 +150,7 @@ function computeTotalDuration(records: CrewAgentRecord[]): number {
 	for (const r of records) {
 		if (r.startedAt) {
 			const start = new Date(r.startedAt).getTime();
-			const end = r.completedAt ? new Date(r.completedAt).getTime() : Date.now();
+			const end = r.completedAt ? new Date(r.completedAt).getTime() : spinnerClockNow();
 			if (Number.isFinite(start) && Number.isFinite(end)) total += Math.max(0, end - start);
 		}
 	}

package/src/ui/tool-renderers/index.ts

@@ -46,7 +46,7 @@ import {
 	statusSlot,
 	truncVisual,
 } from "../rail.ts";
-import { spinnerFrame } from "../spinner.ts";
+import { spinnerClockNow, spinnerFrame } from "../spinner.ts";
 import type { CrewTheme } from "../theme-adapter.ts";
 import { parseCompactToolProgress } from "../tool-progress-formatter.ts";
 import { briefToolResult, isBrief } from "./brief-mode.ts";
@@ -206,7 +206,7 @@ function renderTeamResult(result: Record<string, unknown>, options: unknown, the
 	if (isPartial && !ctx.expanded) {
 		const parsed = parseStreamingProgress(extractContentText(result?.content));
 		if (parsed) {
-			const spinner = theme.fg("accent", spinnerFrame(String(Date.now())));
+			const spinner = theme.fg("accent", spinnerFrame(String(spinnerClockNow())));
 			const elapsed = theme.fg("dim", formatDuration(parsed.elapsedMs));
 			const lines: string[] = [];
 
@@ -550,7 +550,7 @@ function computeTotalDuration(records: CrewAgentRecord[]): number {
 function computeRecordDuration(r: CrewAgentRecord): number {
 	if (!r.startedAt) return 0;
 	const start = new Date(r.startedAt).getTime();
-	const end = r.completedAt ? new Date(r.completedAt).getTime() : Date.now();
+	const end = r.completedAt ? new Date(r.completedAt).getTime() : spinnerClockNow();
 	if (!Number.isFinite(start) || !Number.isFinite(end)) return 0;
 	return Math.max(0, end - start);
 }

package/src/utils/incremental-reader.ts

@@ -157,7 +157,7 @@ export function readLinesSince(filePath: string, state: IncrementalReadState): I
 			totalRead += bytesRead;
 		}
 
-		const content = buf.toString("utf-8", 0, totalRead);
+		const content = buf.subarray(0, totalRead);
 		const lines: string[] = [];
 		let lineCount = state.lineCount;
 		let committedOffset = state.byteOffset;
@@ -165,8 +165,16 @@ export function readLinesSince(filePath: string, state: IncrementalReadState): I
 		let searchFrom = 0;
 		let newlineIdx: number;
 
-		while ((newlineIdx = content.indexOf("\n", searchFrom)) !== -1) {
-			const lineText = content.slice(searchFrom, newlineIdx);
+		// F07 / RR-017: scan the BUFFER, not a decoded string. A string index is a
+		// CHARACTER index, so using it as a byte offset silently mis-commits the
+		// watermark on any multi-byte UTF-8 line (Vietnamese diacritics, emoji,
+		// CJK): the next read then restarts mid-line and produces a corrupt line
+		// (measured: a delta read of a 4-line file returned one `raw` garbage
+		// event plus the three real ones). Byte offsets are what the API promises,
+		// so `Buffer.indexOf(0x0a)` is the correct scan and decoding happens only
+		// per complete line.
+		while ((newlineIdx = content.indexOf(0x0a, searchFrom)) !== -1) {
+			const lineText = content.toString("utf-8", searchFrom, newlineIdx);
 			committedOffset = state.byteOffset + newlineIdx + 1;
 			searchFrom = newlineIdx + 1;
 			if (lineText.length > 0) {

package/src/utils/paths.ts

@@ -3,6 +3,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { getCrewEnv } from "../config/env-vars.ts";
+import { PROJECT_DIR_MARKERS, PROJECT_FILE_MARKERS } from "./project-markers.ts";
 
 // NEW-P1/NEW-P2 (perf): packageRoot() and userPiRoot() are invariant for a
 // process lifetime but each call did statSync/readFileSync/lstatSync (10-15+
@@ -111,17 +112,9 @@ export function userPiRoot(): string {
 	return resolved;
 }
 
-const PROJECT_DIR_MARKERS = [".git", ".pi", ".crew", ".hg", ".svn", ".factory", ".omc"];
-const PROJECT_FILE_MARKERS = [
-	"package.json",
-	"pyproject.toml",
-	"Cargo.toml",
-	"go.mod",
-	"pom.xml",
-	"composer.json",
-	"build.gradle",
-	"build.gradle.kts",
-];
+// Marker lists live in ./project-markers.ts (RR-020 Fix 1) so that
+// src/state/crew-init.ts:findProjectRoot() cannot drift from this resolver
+// again — the drift produced two different project roots for one cwd.
 
 // 2.10 — cache findRepoRoot results so repeated lookups during render ticks
 // (loadConfig, state-store helpers, powerbar, snapshot-cache, ...) skip the
@@ -180,7 +173,14 @@ export function findRepoRoot(cwd: string): string | undefined {
 	// newly-created test directories and shouldn't propagate as a crash.
 	let startKey: string;
 	try {
-		startKey = fs.realpathSync(cwd);
+		// Canonicalize with .native (long-name form on Windows). The home/temp
+		// boundaries in computeRepoRoot are canonicalized with realpathSync.native
+		// too — a non-native start preserves 8.3 short names (RUNNER~1) on win32,
+		// so the walk chain NEVER textually matches the long-name boundary and
+		// escapes the sandbox, latching onto an ancestor marker (live CI: runs
+		// created under a sandboxed home landed in the REAL home's .pi/teams).
+		// On Linux/macOS native and non-native resolve identically.
+		startKey = fs.realpathSync.native(cwd);
 	} catch (error) {
 		if ((error as NodeJS.ErrnoException).code === "ENOENT") {
 			startKey = path.resolve(cwd);
@@ -252,3 +252,85 @@ export function projectCrewRoot(cwd: string): string {
 export function userCrewRoot(): string {
 	return path.join(userPiRoot(), "extensions", "pi-crew");
 }
+
+/**
+ * Relative path of the run-state directory under a pi-crew root, per layout:
+ *   - `.crew`        → `<root>/.crew/state/runs`        (classic layout)
+ *   - `.pi/teams`    → `<root>/.pi/teams/state/runs`    (`.pi`-based layout)
+ * Mirrors `projectCrewRoot`'s layout choice, so scanners can recognise the
+ * SAME two layouts the rest of pi-crew writes.
+ */
+export const RUN_STATE_RUNS_SUBPATHS = [path.join(".crew", "state", "runs"), path.join(".pi", "teams", "state", "runs")];
+
+/** Layout dirs derived from RUN_STATE_RUNS_SUBPATHS — the single list (a
+ *  literal copy here is exactly the drift Fix 1 killed for project markers). */
+const RUN_STATE_LAYOUT_DIRS = RUN_STATE_RUNS_SUBPATHS.map((rel) => path.dirname(path.dirname(rel)));
+
+/** Layout dirs split into components for the per-component symlink walk
+ *  (cold-verify F-1: lstat only sees the FINAL path component, so for the
+ *  `.pi/teams` layout the intermediate `.pi` was never checked). */
+const RUN_STATE_LAYOUT_SEGMENTS = RUN_STATE_LAYOUT_DIRS.map((layout) => layout.split(/[\\/]+/).filter(Boolean));
+
+/** True when `p` exists and is NOT a symlink (dir-or-file). A planted symlink
+ *  never passes: scanners must reject rather than trust it. */
+function existsNoSymlink(p: string): boolean {
+	try {
+		return !fs.lstatSync(p).isSymbolicLink();
+	} catch {
+		return false;
+	}
+}
+
+/** True when EVERY component of `path.join(dir, ...segments)` exists and is
+ *  not a symlink. lstat rejects only the FINAL component, so intermediate
+ *  symlinks must be walked component-by-component — cold-verify F-1 reproduced
+ *  out-of-tree read AND write through `ws/.pi -> /outside` because `.pi` was
+ *  intermediate in all three lstat calls of the earlier fix. */
+function existsSymlinkFreePath(dir: string, segments: string[]): boolean {
+	let current = dir;
+	for (const seg of segments) {
+		current = path.join(current, seg);
+		if (!existsNoSymlink(current)) return false;
+	}
+	return true;
+}
+
+/**
+ * True when `dir` holds pi-crew run state under EITHER supported layout
+ * (`.crew/` or `.pi/teams/`) — used by /tmp debris scanners so a temp
+ * workspace with live `.pi/teams/state/runs` state is not deleted.
+ *
+ * A SYMLINKED layout dir never counts: scanners must be able to reject a
+ * planted symlink instead of treating it as protection.
+ */
+export function hasRunStateLayout(dir: string): boolean {
+	for (const segments of RUN_STATE_LAYOUT_SEGMENTS) {
+		if (existsSymlinkFreePath(dir, segments)) return true;
+	}
+	return false;
+}
+
+/**
+ * Resolve the run-state dir (`<layout>/state/runs`) that actually exists under
+ * `dir`, checking BOTH supported layouts. Returns undefined when neither
+ * layout has a runs dir (i.e. `dir` holds no pi-crew run state).
+ *
+ * Symlink policy matches `hasRunStateLayout` (cold-verify correction: the
+ * first version used existsSync, which FOLLOWS symlinks — a planted
+ * `.crew`/`.pi/teams`/`state/runs` symlink let stale-reconciler and
+ * health-monitor read — and reconcile — run manifests OUTSIDE the scanned
+ * tree). Both the layout dir and the runs dir itself must be symlink-free.
+ */
+export function findRunStateDir(dir: string): string | undefined {
+	for (const segments of RUN_STATE_LAYOUT_SEGMENTS) {
+		// Cold-verify F-1/F-A: EVERY component must be symlink-free — lstat only
+		// sees the final path component, so intermediate symlinks (`.pi` of the
+		// `.pi/teams` layout, the middle `state`, …) were traversed transparently
+		// and let scanners READ and WRITE run manifests OUTSIDE the scanned tree
+		// (reproduced: reconcileOrphanedTempWorkspaces flipped an outside manifest
+		// running→cancelled through both a `.crew/state` and a `.pi` symlink).
+		if (!existsSymlinkFreePath(dir, [...segments, "state", "runs"])) continue;
+		return path.join(dir, ...segments, "state", "runs");
+	}
+	return undefined;
+}

package/src/utils/project-markers.ts

@@ -0,0 +1,40 @@
+/**
+ * project-markers.ts — SINGLE source of truth for the project-root marker lists.
+ *
+ * Why this module exists (RR-020 Fix 1): the marker lists were duplicated and
+ * had DRIFTED apart:
+ *   - `src/utils/paths.ts` (computeRepoRoot) used 15 markers (.pi/.crew/
+ *     .factory/.omc + 8 build-file markers)
+ *   - `src/state/crew-init.ts` (findProjectRoot) used 7 markers (.git/.hg/.svn
+ *     + package.json/pyproject.toml/Cargo.toml/go.mod)
+ * For cwd=`parent/subproject` where `parent/.git` and `parent/subproject/.pi`
+ * exist, paths.ts resolved the root to `subproject` (→ `subproject/.pi/teams`)
+ * while crew-init.ts walked past `.pi` up to `parent/.git` (→ `parent/.crew`),
+ * so ONE run could end up with TWO roots (`run-intent.ts` → ensureCrewDirectory).
+ * Both resolvers now read the lists from here.
+ *
+ * CONTRACT — do not break:
+ *   - NO imports at all (plain string[] literals only). `crew-init.ts` is
+ *     dynamically `import()`'d from concurrent child Pi subprocesses and under
+ *     load jiti's ESM/CJS interop can leave namespace bindings `undefined`
+ *     (issue #28). Importing anything here (even `node:path`) would re-introduce
+ *     that race for the very module that was hardened against it.
+ *   - Values must stay IDENTICAL to the historical `paths.ts` lists — they are
+ *     the widest set, so unifying on them never resolves a root LOWER than
+ *     before (the direction that would break existing projects).
+ */
+
+/** Directory names that mark a project root. */
+export const PROJECT_DIR_MARKERS = [".git", ".pi", ".crew", ".hg", ".svn", ".factory", ".omc"];
+
+/** Build-system file names that mark a project root. */
+export const PROJECT_FILE_MARKERS = [
+	"package.json",
+	"pyproject.toml",
+	"Cargo.toml",
+	"go.mod",
+	"pom.xml",
+	"composer.json",
+	"build.gradle",
+	"build.gradle.kts",
+];