pi-crew 0.11.1 → 0.11.4

package/src/state/stores/state-store.ts

@@ -21,7 +21,7 @@ import {
 import { canTransitionRunStatus } from "../contracts.ts";
 import { withRunLock, withRunLockSync } from "../coordination/locks.ts";
 import { appendEvent } from "../event-log/event-log.ts";
-import type { TeamRunManifest, TeamTaskState } from "../types.ts";
+import type { RunModelContext, TeamRunManifest, TeamTaskState } from "../types.ts";
 import { CURRENT_SCHEMA_VERSION } from "../types.ts";
 import { unregisterActiveRun } from "./active-run-registry.ts";
 import { extractTaskArray, loadTasksWithRecovery, loadTasksWithRecoveryAsync, quarantineCorruptFile } from "./manifest-io.ts";
@@ -193,19 +193,37 @@ function resolveRunStateRoot(cwd: string, runId: string): string | undefined {
 	const now = Date.now();
 	const cached = runStateRootCache.get(key);
 	if (cached && cached.expiresAt > now) return cached.root;
-	const runsRoot = path.join(scopeBaseRoot(cwd), DEFAULT_PATHS.state.runsSubdir);
-	const scopedPath = resolveContainedRelativePath(runsRoot, runId, "runId");
-	try {
-		resolveRealContainedPath(runsRoot, runId);
-	} catch {
-		return undefined;
-	}
-	if (runStateRootCache.size >= RUN_STATE_ROOT_CACHE_MAX) {
-		const oldest = runStateRootCache.keys().next().value;
-		if (oldest !== undefined) runStateRootCache.delete(oldest);
+	// F-L1 (2026-09-22): listing (run-index scopedRunRoots) UNIONS the user and
+	// project run roots, but this resolution used scopeBaseRoot's single XOR
+	// pick — a run living under the OTHER root (e.g. created by another cwd or
+	// before the repo got a marker) listed fine yet FAILED every by-ID lookup:
+	// team status / prune / forget / scheduler provenance all returned "not
+	// found". Try the primary root first (hot path unchanged — one contained
+	// resolve + cache hit), then fall back to the other root. The no-repo case
+	// never falls back to a project path, mirroring scopedRunRoots' `if
+	// (projectRoot)` guard — resolution sees exactly what listing sees.
+	const candidates = useProjectState(cwd) ? [projectCrewRoot(cwd), userCrewRoot()] : [userCrewRoot()];
+	for (const root of candidates) {
+		const runsRoot = path.join(root, DEFAULT_PATHS.state.runsSubdir);
+		const scopedPath = resolveContainedRelativePath(runsRoot, runId, "runId");
+		// resolveRealContainedPath deliberately ACCEPTS a missing target (write-path
+		// semantics: ENOENT is fine, only symlink/escape violations throw) — so
+		// existence must be probed explicitly. Without this, the primary root
+		// always "wins" with a phantom path and the fallback can never run.
+		if (!fs.existsSync(path.join(scopedPath, DEFAULT_PATHS.state.manifestFile))) continue;
+		try {
+			resolveRealContainedPath(runsRoot, runId);
+		} catch {
+			continue; // symlink/escape violation under this root — try the other
+		}
+		if (runStateRootCache.size >= RUN_STATE_ROOT_CACHE_MAX) {
+			const oldest = runStateRootCache.keys().next().value;
+			if (oldest !== undefined) runStateRootCache.delete(oldest);
+		}
+		runStateRootCache.set(key, { root: scopedPath, expiresAt: now + RUN_STATE_ROOT_TTL_MS });
+		return scopedPath;
 	}
-	runStateRootCache.set(key, { root: scopedPath, expiresAt: now + RUN_STATE_ROOT_TTL_MS });
-	return scopedPath;
+	return undefined;
 }
 
 // PERF (2026-08-24): the artifacts containment verdict (existsSync + lstat +
@@ -239,7 +257,13 @@ function validateRunManifestPaths(cwd: string, runId: string, manifest: TeamRunM
 		manifest.eventsPath !== path.join(stateRoot, "events.jsonl")
 	)
 		return false;
-	const artifactsParent = path.join(scopeBaseRoot(cwd), DEFAULT_PATHS.state.artifactsSubdir);
+	// F-L1 (2026-09-22): derive the artifacts parent from the RESOLVED stateRoot's
+	// base root (…/<base>/state/runs/<runId>), not scopeBaseRoot — cross-root
+	// runs (state under the fallback root, artifacts written beside it at
+	// creation) must validate against their OWN root; scopeBaseRoot would
+	// reject every fallback-resolved run and keep it invisible by ID.
+	const baseRoot = path.resolve(stateRoot, "..", "..", "..");
+	const artifactsParent = path.join(baseRoot, DEFAULT_PATHS.state.artifactsSubdir);
 	const expectedArtifactsRoot = resolveContainedRelativePath(artifactsParent, runId, "runId");
 	if (manifest.artifactsRoot !== expectedArtifactsRoot) return false;
 	// PERF (2026-08-24): memoized verdict — see artifactsVerdictCache above.
@@ -409,9 +433,20 @@ export function createRunManifest(params: {
 	runKind?: "team-run" | "goal-loop" | "dynamic-workflow";
 	/** round-14 P1-5: typed workflow arguments for .dwf.ts scripts (ctx.args<T>()). */
 	args?: unknown;
+	/** Deterministic-capture support (2026-09-22): pin the run ID and/or clock
+	 * so tools like docs/ui-samples/capture.ts produce byte-stable output.
+	 * Defaults preserve current behavior (generated id, wall clock). */
+	runId?: string;
+	now?: () => Date;
+	/** Model routing snapshot (Finding #1, battery 2026-09-29): detached runs
+	 * re-enter through background-runner with no ExtensionContext, so the
+	 * caller's model override / inherited session model / auth-filtered
+	 * catalogue must be persisted on the manifest at creation time.
+	 * Omitted when undefined so old manifests stay byte-identical. */
+	modelContext?: RunModelContext;
 }): { manifest: TeamRunManifest; tasks: TeamTaskState[]; paths: RunPaths } {
-	const paths = createRunPaths(params.cwd);
-	const now = new Date().toISOString();
+	const paths = createRunPaths(params.cwd, params.runId);
+	const now = (params.now ? params.now() : new Date()).toISOString();
 	const tasks = params.workflow ? createTasksFromWorkflow(paths.runId, params.workflow, params.team, params.cwd, params.goal) : [];
 	const manifest: TeamRunManifest = {
 		schemaVersion: CURRENT_SCHEMA_VERSION,
@@ -433,6 +468,7 @@ export function createRunManifest(params: {
 		...(params.ownerSessionId ? { ownerSessionId: params.ownerSessionId } : {}),
 		runKind: params.runKind ?? "team-run",
 		...(params.args !== undefined ? { args: params.args } : {}),
+		...(params.modelContext ? { modelContext: params.modelContext } : {}),
 	};
 	fs.mkdirSync(paths.stateRoot, { recursive: true });
 	fs.mkdirSync(paths.artifactsRoot, { recursive: true });
@@ -479,7 +515,12 @@ export function createRunManifest(params: {
 	return { manifest, tasks, paths };
 }
 
-export function saveRunManifest(manifest: TeamRunManifest): void {
+export function saveRunManifest(manifest: TeamRunManifest, options?: { allowTerminalExit?: boolean }): TeamRunManifest {
+	// Finding 8 (2026-09-23): terminal-preserve at the WRITE layer. Mid-flight
+	// savers (task-runner artifact/progress writes carrying a stale in-memory
+	// "running" manifest) previously overwrote an externally-written terminal
+	// status; merge/finalize had their own guards but every other save site did
+	// not. Guard here so NO raw save can erase a terminal disk status.
 	// FIX: Capture the cached tasks array + mtime/size BEFORE we invalidate the
 	// cache. The previous implementation re-read tasks.json from disk after the
 	// manifest write (a JSON.parse + fs.readFileSync per call), which defeated
@@ -502,12 +543,13 @@ export function saveRunManifest(manifest: TeamRunManifest): void {
 	// which is always safe.
 	invalidateRunCache(manifest.stateRoot);
 	const manifestPath = path.join(manifest.stateRoot, "manifest.json");
+	const effective = preserveDiskTerminalStatus(manifest, options?.allowTerminalExit);
 	// REVIEW FIX (2026-09-10): reverted WI-2.2's coalesced conversion —
 	// saveRunManifest is a SYNCHRONOUS persist by name/contract (tests assert
 	// it, broker loadRunManifestById is a cross-process reader, and the
 	// statSync-based cache repopulation below needs the real post-write
 	// mtime/size). The 50ms coalesce window broke all three.
-	atomicWriteJson(manifestPath, manifest);
+	atomicWriteJson(manifestPath, effective);
 	// FIX: Re-populate cache with actual mtime/size so loadRunManifestById
 	// doesn't miss the cache on next read. Without this, every load until
 	// TTL expires would hit disk because cached 0 !== any real mtime.
@@ -516,16 +558,17 @@ export function saveRunManifest(manifest: TeamRunManifest): void {
 	// fresh tasks should call saveRunTasks or loadRunTasks separately.
 	const manifestStat = fs.statSync(manifestPath);
 	setManifestCache(manifest.stateRoot, {
-		manifest,
+		manifest: effective,
 		tasks: cachedTasks,
 		manifestMtimeMs: manifestStat.mtimeMs,
 		manifestSize: manifestStat.size,
 		tasksMtimeMs: cachedTasksMtimeMs,
 		tasksSize: cachedTasksSize,
 	});
+	return effective;
 }
 
-export async function saveRunManifestAsync(manifest: TeamRunManifest): Promise<void> {
+export async function saveRunManifestAsync(manifest: TeamRunManifest, options?: { allowTerminalExit?: boolean }): Promise<TeamRunManifest> {
 	// FIX: Capture cached tasks array + mtime/size BEFORE invalidating, same
 	// rationale as the sync saveRunManifest above. The async path previously
 	// always set tasks: [] with mtime/size 0, so any cache hit was guaranteed
@@ -538,7 +581,8 @@ export async function saveRunManifestAsync(manifest: TeamRunManifest): Promise<v
 	// after a crash. See saveRunManifest for full explanation.
 	invalidateRunCache(manifest.stateRoot);
 	const manifestPath = path.join(manifest.stateRoot, "manifest.json");
-	await atomicWriteJsonAsync(manifestPath, manifest);
+	const effective = preserveDiskTerminalStatus(manifest, options?.allowTerminalExit);
+	await atomicWriteJsonAsync(manifestPath, effective);
 	// FIX: Re-populate cache with actual mtime/size. See saveRunManifest.
 	// RACE GUARD: another concurrent async save (OPT-02) may unlink+rewrite
 	// manifest.json between our atomicWriteJsonAsync and this stat. If stat
@@ -553,13 +597,14 @@ export async function saveRunManifestAsync(manifest: TeamRunManifest): Promise<v
 		manifestStat = { mtimeMs: 0, size: 0 };
 	}
 	setManifestCache(manifest.stateRoot, {
-		manifest,
+		manifest: effective,
 		tasks: cachedTasks,
 		manifestMtimeMs: manifestStat.mtimeMs,
 		manifestSize: manifestStat.size,
 		tasksMtimeMs: cachedTasksMtimeMs,
 		tasksSize: cachedTasksSize,
 	});
+	return effective;
 }
 
 /**
@@ -803,6 +848,44 @@ function saveManifestAndTasksAtomicSync(manifest: TeamRunManifest, tasks: TeamTa
 export interface UpdateRunStatusOptions {
 	data?: Record<string, unknown>;
 	metadata?: Parameters<typeof appendEvent>[1]["metadata"];
+	/** Finding 8 (2026-09-23): allow leaving a TERMINAL disk status (resume is the
+	 * only legitimate terminal-exit flow). Defaults to false — a raw save with an
+	 * in-memory "running" manifest must never erase an externally-written
+	 * cancelled/failed/completed status (live race team_20260923175042: cancel
+	 * 17:51:08 → intermediate task-runner save re-wrote "running" → finalize
+	 * completed — the cancel was fully erased). */
+	allowTerminalExit?: boolean;
+}
+
+/** Finding 8: statuses a disk write must never silently leave. Mirrors
+ * isRunTerminalPreserved (merge-loop.ts) — kept local to avoid a runtime dep
+ * from the store layer to the runtime layer. */
+const DISK_TERMINAL_STATUSES: ReadonlySet<TeamRunManifest["status"]> = new Set(["cancelled", "failed", "completed"]);
+
+/** Finding 8 write-layer guard: if the DISK manifest is terminal and the
+ * incoming write carries a NON-terminal status (the erase class — a mid-flight
+ * saver with a stale in-memory "running" manifest), preserve the disk
+ * status/summary/updatedAt while keeping every other incoming field (artifacts,
+ * usage, surface…). Terminal→terminal re-decisions (e.g. cancelling a run that
+ * just completed — pinned by resume-cancel.test.ts) are LEGITIMATE and pass
+ * through; they are governed by canTransitionRunStatus at the updateRunStatus
+ * layer. Returns the effective manifest to persist. */
+function preserveDiskTerminalStatus(manifest: TeamRunManifest, allowTerminalExit: boolean | undefined): TeamRunManifest {
+	if (allowTerminalExit) return manifest;
+	// Terminal→terminal re-decisions pass through (governed by
+	// canTransitionRunStatus at the updateRunStatus layer); the guard applies
+	// ONLY to the erase class: a NON-terminal incoming status over terminal disk.
+	if (DISK_TERMINAL_STATUSES.has(manifest.status)) return manifest;
+	try {
+		const manifestPath = path.join(manifest.stateRoot, "manifest.json");
+		// Raw read (no cache): cross-process cancel writes must be seen NOW.
+		const raw = fs.readFileSync(manifestPath, "utf-8");
+		const disk = JSON.parse(raw) as TeamRunManifest;
+		if (!DISK_TERMINAL_STATUSES.has(disk.status) || disk.status === manifest.status) return manifest;
+		return { ...manifest, status: disk.status, summary: disk.summary, updatedAt: disk.updatedAt };
+	} catch {
+		return manifest; // no disk manifest yet (create) or unreadable — normal write
+	}
 }
 
 export function updateRunStatus(
@@ -820,7 +903,21 @@ export function updateRunStatus(
 		updatedAt: new Date().toISOString(),
 		summary: summary ?? manifest.summary,
 	};
-	saveRunManifest(updated);
+	// Finding 8 (2026-09-23): the write-layer guard may PRESERVE a terminal disk
+	// status (an external cancel/reconciler write the in-memory manifest never
+	// saw). In that case do NOT emit run.<status>, do NOT flip the manifest —
+	// record the refusal and return the preserved state. Resume passes
+	// allowTerminalExit for its legitimate cancelled→running transition.
+	const saved = saveRunManifest(updated, { allowTerminalExit: options.allowTerminalExit });
+	if (saved.status !== status) {
+		appendEvent(saved.eventsPath, {
+			type: "run.terminal_preserved",
+			runId: saved.runId,
+			message: `Preserved terminal status '${saved.status}'; refused in-memory transition to '${status}'.`,
+			data: { preserved: saved.status, refused: status },
+		});
+		return saved;
+	}
 	// Unregister from active-run-index when run reaches a terminal status.
 	// Without this, stale entries accumulate (e.g. integration tests in /tmp) and
 	// Pi UI shows ghost "queued" runs that are actually completed/failed/cancelled.

package/src/state/types.ts

@@ -543,6 +543,10 @@ export interface GoalLoopState {
 	nextTurnFeedback?: string;
 	/** The team-run of the current in-flight turn (for cancel/steer). */
 	currentRunId?: string;
+	/** GL-1b (2026-09-22): why the last turn (or the loop itself) failed —
+	 * persisted at goal level because turn-run dirs are pruned (keep=10 at
+	 * session start) and otherwise the reason becomes unrecoverable. */
+	lastTurnError?: string;
 	verdicts: GoalVerdict[];
 	history: {
 		runId: string;

package/src/ui/dashboard-panes/agents-pane.ts

@@ -116,13 +116,16 @@ export function renderAgentsPane(snapshot: RunUiSnapshot | undefined, options: R
 	// One pinned clock (D6-T4) for the whole pane render.
 	const nowMs = options.nowMs ?? Date.now();
 
-	const realAgents = snapshot.agents.filter((a) =>
-		isRealAgent(
-			a,
-			liveForRun.find((h) => h.taskId === a.taskId),
-			nowMs,
-		),
-	);
+	// RR-021 WI-4.3c: first-wins Map keyed by taskId — the two `.find` sites
+	// below (real-agent filter + per-agent handle) must keep seeing the SAME
+	// (first) matching handle, so the build guards with has() instead of set()
+	// overwriting later duplicates.
+	const liveByTaskId = new Map<string, (typeof liveForRun)[number]>();
+	for (const handle of liveForRun) {
+		if (!liveByTaskId.has(handle.taskId)) liveByTaskId.set(handle.taskId, handle);
+	}
+
+	const realAgents = snapshot.agents.filter((a) => isRealAgent(a, liveByTaskId.get(a.taskId), nowMs));
 	const lineCount = Math.min(realAgents.length, 12);
 	const label =
 		realAgents.length !== snapshot.agents.length
@@ -135,7 +138,7 @@ export function renderAgentsPane(snapshot: RunUiSnapshot | undefined, options: R
 	lines.push(`${completed}/${total} tasks · ${label}`);
 
 	for (const agent of realAgents.slice(0, 12)) {
-		const liveHandle = liveForRun.find((h) => h.taskId === agent.taskId);
+		const liveHandle = liveByTaskId.get(agent.taskId);
 		const icon = agentGlyph(agent.status, agent.taskId);
 		const role = `${agent.role ?? "?"}`;
 
@@ -178,8 +181,17 @@ export function renderAgentsPane(snapshot: RunUiSnapshot | undefined, options: R
 				stats.push(liveHandle.modelName);
 			}
 		} else if (agent.startedAt) {
-			const ms = nowMs - new Date(agent.startedAt).getTime();
-			if (Number.isFinite(ms)) stats.push(alignMetric(formatDuration(ms), DURATION_METRIC_WIDTH));
+			// Tier 13 (2026-09-21): a FINISHED agent's span must end at completedAt,
+			// never at the wall clock. The naive `nowMs - startedAt` made every
+			// completed agent of an old run inflate forever — the dashboard showed
+			// `01_explore … 29m39s` while the tool card showed the real `8m22s` for
+			// the same agent. Mirror computeLiveDurationMs: prefer a sane completedAt,
+			// else fall back to now; never emit a negative or absurd span.
+			const startedMs = new Date(agent.startedAt).getTime();
+			const rawCompleted = agent.completedAt ? new Date(agent.completedAt).getTime() : Number.NaN;
+			const completedMs = Number.isFinite(rawCompleted) && rawCompleted >= startedMs && rawCompleted <= nowMs ? rawCompleted : nowMs;
+			const ms = completedMs - startedMs;
+			if (Number.isFinite(ms) && ms >= 0) stats.push(alignMetric(formatDuration(ms), DURATION_METRIC_WIDTH));
 		}
 
 		const statsStr = stats.length ? ` · ${stats.join(" ")}` : "";

package/src/ui/heartbeat-aggregator.ts

@@ -32,6 +32,32 @@ function isActiveTask(task: TeamTaskState): boolean {
 	return task.status === "running";
 }
 
+/**
+ * FINDING 5 (2026-09-23 battery): health ticks must count task statuses from
+ * DISK truth, not the (possibly lagging) snapshot cache. A worker parked on
+ * `ask` transitions running → waiting on disk while the cached snapshot can
+ * still show `running` — in that window the parked worker counted as
+ * active-without-heartbeat and fired a false "dead worker" notification (live:
+ * run team_20260923100114, 01_explore parked on ask, later answered+resumed).
+ *
+ * Overlay FRESH task statuses (and heartbeats) from disk onto the cached
+ * snapshot before summarizing. Returns the ORIGINAL snapshot object when
+ * nothing diverged (cheap identity check — callers use it to decide cache
+ * invalidation), or a shallow copy with the diverging tasks replaced.
+ */
+export function overlayFreshTaskStatuses(snapshot: RunUiSnapshot, freshTasks: TeamTaskState[]): RunUiSnapshot {
+	if (freshTasks.length === 0) return snapshot;
+	const freshById = new Map(freshTasks.map((task) => [task.id, task]));
+	let diverged = false;
+	const tasks = snapshot.tasks.map((task) => {
+		const fresh = freshById.get(task.id);
+		if (!fresh || (fresh.status === task.status && fresh.heartbeat === task.heartbeat)) return task;
+		diverged = true;
+		return { ...task, status: fresh.status, heartbeat: fresh.heartbeat };
+	});
+	return diverged ? { ...snapshot, tasks } : snapshot;
+}
+
 export function summarizeHeartbeats(snapshot: RunUiSnapshot, opts: HeartbeatSummaryOptions = {}): HeartbeatSummary {
 	const staleMs = opts.staleMs ?? 60_000;
 	const deadMs = opts.deadMs ?? 5 * 60_000;
@@ -55,6 +81,14 @@ export function summarizeHeartbeats(snapshot: RunUiSnapshot, opts: HeartbeatSumm
 	const runTerminal = isTerminalRunStatus(snapshot.manifest.status);
 	for (const task of snapshot.tasks) {
 		if (runTerminal || !isActiveTask(task)) continue;
+		// Guest-child tasks (delegate subagents, agent === "delegate") have no
+		// heartbeat channel — they never write task.heartbeat and complete in
+		// seconds; their lifecycle is owned by delegate.requested/admitted/
+		// completed broker events. Counting them here fired a false "N worker(s)
+		// missing heartbeat" ambient for every delegate-using run (live:
+		// team_20260926033657_2b6c6d2610b26d9d, 2026-09-26 battery — same
+		// gc-blindness root shape as the heartbeat-watcher fix).
+		if (task.agent === "delegate") continue;
 		const heartbeat = task.heartbeat;
 		if (!heartbeat) {
 			summary.missing += 1;

package/src/ui/inline-panel/index.ts

@@ -277,7 +277,7 @@ export function installInlinePanel(pi: ExtensionAPI, ctx: ExtensionContext, uiCo
 					// (lazy import: viewers.ts pulls the state-store chain and must stay
 					// off this module's startup path — AGENTS.md lazy boundary).
 					onOpenBrowser: () => {
-						void import("../../extension/registration/viewers.ts").then((m) => m.openAgentsJobsBrowser(ctx));
+						void import("../../extension/registration/viewers.ts").then((m) => m.openAgentsJobsBrowser(ctx)); // LAZY: defer agents-jobs browser until opened
 					},
 				});
 			});

package/src/ui/keybinding-map.ts

@@ -33,6 +33,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { type KeyId, matchesKey } from "@earendil-works/pi-tui";
 import { getCrewEnv } from "../config/env-vars.ts";
+import { projectCrewRoot } from "../utils/paths.ts";
 import { keyOf } from "./key-utils.ts";
 
 export const DASHBOARD_KEYS = {
@@ -41,6 +42,8 @@ export const DASHBOARD_KEYS = {
 	help: ["?"],
 	root: {
 		summary: ["u"],
+		/** US-020: cancel the selected run (2-step confirm in the dashboard). */
+		cancel: ["x"],
 		artifacts: ["a"],
 		api: ["i"],
 		agents: ["d"],
@@ -112,6 +115,7 @@ export type DashboardKeyAction =
 	| "live-conversation"
 	| "reload"
 	| "browser"
+	| "cancel"
 	| "pane-agents"
 	| "pane-progress"
 	| "pane-mailbox"
@@ -256,6 +260,9 @@ const DEFAULT_BINDINGS: readonly KeyBinding[] = [
 	// safe; inside the browser overlay itself "p" is free because overlays
 	// are mutually exclusive (see keybinding-map.ts header note).
 	{ keys: DASHBOARD_KEYS.root.browser, action: "browser" },
+	// US-020: x → cancel the selected run (unscoped; the schedules pane's X
+	// delete is pane-scoped uppercase — pass-1 exact match keeps them distinct).
+	{ keys: DASHBOARD_KEYS.root.cancel, action: "cancel" },
 	{ keys: DASHBOARD_KEYS.pane.agents, action: "pane-agents" },
 	{ keys: DASHBOARD_KEYS.pane.progress, action: "pane-progress" },
 	{ keys: DASHBOARD_KEYS.pane.mailbox, action: "pane-mailbox" },
@@ -418,7 +425,10 @@ export type KeybindingOverride = Partial<Record<DashboardKeyAction | OverlayBind
 const KEYBINDINGS_ENV = "PI_CREW_KEYBINDINGS";
 
 /** Every dispatched action + every `overlay:*` binding is a valid override target. */
-const VALID_OVERRIDE_ACTIONS: ReadonlySet<string> = new Set<string>([...DEFAULT_BINDINGS.map((b) => b.action), ...OVERLAY_BINDING_KEYS]);
+export const VALID_OVERRIDE_ACTIONS: ReadonlySet<string> = new Set<string>([
+	...DEFAULT_BINDINGS.map((b) => b.action),
+	...OVERLAY_BINDING_KEYS,
+]);
 
 /** Coerce an unknown parsed value into a safe {@link KeybindingOverride}. */
 function parseKeybindingOverride(raw: unknown): KeybindingOverride {
@@ -541,10 +551,17 @@ function computeEffectiveBindings(overrides: KeybindingOverride): EffectiveBindi
 	return { bindings, overlayBindings, reverted: [...reverted] };
 }
 
-/** Read the `keybindings` section from `<cwd>/.crew/config.json`. */
+/**
+ * Read the `keybindings` section from the project config.
+ *
+ * RR-020 Fix 4: resolve via `projectCrewRoot(cwd)` instead of a literal
+ * `<cwd>/.crew` — the config lives in whichever layout the project actually
+ * uses (`.crew/` or `.pi/teams/`), so a `.pi/teams` project's keybinding
+ * overrides are no longer silently ignored.
+ */
 function readConfigKeybindings(cwd: string): KeybindingOverride {
 	try {
-		const raw: unknown = JSON.parse(fs.readFileSync(path.join(cwd, ".crew", "config.json"), "utf-8"));
+		const raw: unknown = JSON.parse(fs.readFileSync(path.join(projectCrewRoot(cwd), "config.json"), "utf-8"));
 		if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
 		return parseKeybindingOverride((raw as Record<string, unknown>).keybindings);
 	} catch {
@@ -565,7 +582,8 @@ function readEnvKeybindings(): KeybindingOverride {
 
 function configKeybindingsMtime(cwd: string): number | undefined {
 	try {
-		return fs.statSync(path.join(cwd, ".crew", "config.json")).mtimeMs;
+		// RR-020 Fix 4: same layout-resolved config path as readConfigKeybindings.
+		return fs.statSync(path.join(projectCrewRoot(cwd), "config.json")).mtimeMs;
 	} catch {
 		return undefined;
 	}

package/src/ui/live-conversation-overlay.ts

@@ -62,11 +62,14 @@ export class LiveConversationOverlay {
 	private handle: LiveAgentHandle;
 	private theme: CrewTheme;
 
-	constructor(handle: LiveAgentHandle, theme: CrewTheme, columns = 80, rows = 24) {
+	private readonly nowMs: () => number;
+
+	constructor(handle: LiveAgentHandle, theme: CrewTheme, columns = 80, rows = 24, nowMs?: () => number) {
 		this.handle = handle;
 		this.theme = theme;
 		this.columns = columns;
 		this.rows = rows;
+		this.nowMs = nowMs ?? Date.now;
 		// R8: Subscribe to real session events if available
 		const session = handle.session as Record<string, unknown>;
 		if (typeof session.subscribe === "function") {
@@ -117,7 +120,7 @@ export class LiveConversationOverlay {
 
 	private refreshSummary(): void {
 		const act = this.handle.activity;
-		const summary = `${LiveConversationOverlay.SUMMARY_PREFIX}[${formatCount(act.turnCount ?? 0, "turn")} · ${formatCount(act.toolUses ?? 0, "tool")} · ${(computeLiveDurationMs(act) / 1000).toFixed(1)}s]`;
+		const summary = `${LiveConversationOverlay.SUMMARY_PREFIX}[${formatCount(act.turnCount ?? 0, "turn")} · ${formatCount(act.toolUses ?? 0, "tool")} · ${(computeLiveDurationMs(act, this.nowMs()) / 1000).toFixed(1)}s]`;
 		const lastLine = this.cachedLines[this.cachedLines.length - 1];
 		if (lastLine?.startsWith(LiveConversationOverlay.SUMMARY_PREFIX)) {
 			this.cachedLines[this.cachedLines.length - 1] = summary;
@@ -267,7 +270,7 @@ export class LiveConversationOverlay {
 		if (act.maxTurns != null) parts.push(`turn ${act.turnCount ?? 0}/${act.maxTurns}`);
 		else if ((act.turnCount ?? 0) > 0) parts.push(`turn ${act.turnCount}`);
 		if ((act.toolUses ?? 0) > 0) parts.push(formatCount(act.toolUses ?? 0, "tool"));
-		parts.push(`${(computeLiveDurationMs(act) / 1000).toFixed(1)}s`);
+		parts.push(`${(computeLiveDurationMs(act, this.nowMs()) / 1000).toFixed(1)}s`);
 		try {
 			const ctxPct = this.handle.session.getSessionStats?.()?.contextUsage?.percent;
 			if (ctxPct != null) {

package/src/ui/render-diff.ts

@@ -1,7 +1,20 @@
-import * as Diff from "diff";
+import { createRequire } from "node:module";
+import type { Change } from "diff";
 import type { CrewTheme } from "./theme-adapter.ts";
 import { asCrewTheme } from "./theme-adapter.ts";
 
+// RR-021 WI-2.1: the `diff` package was eagerly imported module-scope with a
+// wildcard (pulling the whole namespace into every UI load). Only diffWords is
+// used at runtime — lazy sync accessor on first use (model: ui/syntax-highlight.ts).
+// `Change` is a type-only import (erased at compile time, zero runtime cost).
+const require = createRequire(import.meta.url);
+type DiffModule = typeof import("diff");
+let cachedDiff: DiffModule | undefined;
+function diffModule(): DiffModule {
+	if (!cachedDiff) cachedDiff = require("diff") as DiffModule;
+	return cachedDiff;
+}
+
 interface ParsedDiffLine {
 	prefix: string;
 	lineNum: string;
@@ -36,8 +49,8 @@ const WORD_DIFF_MIN_SIM = 0.15;
  * characters relative to the longer of the two strings, using word-level
  * diff to identify the common (unchanged) parts. Returns a value in [0, 1].
  */
-function computeSimilarity(oldContent: string, newContent: string, wordDiff?: Diff.Change[]): number {
-	const parts = wordDiff ?? Diff.diffWords(oldContent, newContent);
+function computeSimilarity(oldContent: string, newContent: string, wordDiff?: Change[]): number {
+	const parts = wordDiff ?? diffModule().diffWords(oldContent, newContent);
 	let commonChars = 0;
 	for (const part of parts) {
 		if (!part.removed && !part.added) {
@@ -53,9 +66,9 @@ function renderIntraLineDiff(
 	theme: CrewTheme,
 	oldContent: string,
 	newContent: string,
-	wordDiff?: Diff.Change[],
+	wordDiff?: Change[],
 ): { removedLine: string; addedLine: string } {
-	const parts = wordDiff ?? Diff.diffWords(oldContent, newContent);
+	const parts = wordDiff ?? diffModule().diffWords(oldContent, newContent);
 	let removedLine = "";
 	let addedLine = "";
 	let isFirstRemoved = true;
@@ -137,7 +150,7 @@ export function renderDiff(diffText: string, options: RenderDiffOptions = {}): s
 				const newContent = replaceTabs(addedLines[0]!.content);
 				// PERF (2026-08-24): diffWords is the expensive call and was run
 				// TWICE on identical inputs (similarity + render). One pass, shared.
-				const wordDiff = Diff.diffWords(oldContent, newContent);
+				const wordDiff = diffModule().diffWords(oldContent, newContent);
 				const similarity = computeSimilarity(oldContent, newContent, wordDiff);
 				if (similarity >= WORD_DIFF_MIN_SIM) {
 					const { removedLine, addedLine } = renderIntraLineDiff(theme, oldContent, newContent, wordDiff);