pi-crew 0.9.41 → 0.9.42

package/src/state/atomic-write.ts

@@ -315,8 +315,13 @@ function isRetryableLinkError(error: unknown): boolean {
  * It atomically creates a hard link to the source. We then unlink the source.
  * This prevents TOCTOU attacks where an attacker plants a symlink at the
  * destination between the check and the rename operation.
+ *
+ * ST-8: this is the canonical symlink-safe rename helper used by both
+ * `atomicWriteFile` (sync) and `atomicWriteFileAsync` (async) paths. The
+ * helper is exported so any future caller can share the same symlink-safe
+ * rename semantics; keep this signature stable.
  */
-function renameWithLinkSync(tempPath: string, filePath: string, retries = 8): void {
+export function renameWithLinkSync(tempPath: string, filePath: string, retries = 8): void {
 	let lastError: unknown;
 	for (let attempt = 0; attempt <= retries; attempt++) {
 		try {
@@ -371,7 +376,12 @@ function renameWithLinkSync(tempPath: string, filePath: string, retries = 8): vo
 	throw lastError;
 }
 
-async function renameWithLinkAsync(tempPath: string, filePath: string, retries = 8): Promise<void> {
+/**
+ * ST-8: async twin of `renameWithLinkSync`. Exported so any future caller
+ * can share the same symlink-safe rename semantics as the primary
+ * `atomicWriteFileAsync` path.
+ */
+export async function renameWithLinkAsync(tempPath: string, filePath: string, retries = 8): Promise<void> {
 	let lastError: unknown;
 	for (let attempt = 0; attempt <= retries; attempt++) {
 		try {
@@ -496,21 +506,21 @@ export type WriteDurability = "full" | "best-effort";
 /** Options accepted by atomicWriteFile (forward-compatible string | object form). */
 export type AtomicWriteOptions =
 	| string // legacy: expectedHash
-	| { expectedHash?: string; durability?: WriteDurability };
+	| { expectedHash?: string; durability?: WriteDurability; mode?: number };
 
-function normalizeOptions(arg: unknown): { expectedHash?: string; durability: WriteDurability } {
-	if (typeof arg === "string") return { expectedHash: arg, durability: "full" };
+function normalizeOptions(arg: unknown): { expectedHash?: string; durability: WriteDurability; mode?: number } {
+	if (typeof arg === "string") return { expectedHash: arg, durability: "full", mode: undefined };
 	if (arg && typeof arg === "object") {
-		const o = arg as { expectedHash?: string; durability?: WriteDurability };
+		const o = arg as { expectedHash?: string; durability?: WriteDurability; mode?: number };
 		const durability: WriteDurability = o.durability === "best-effort" ? "best-effort" : "full";
-		return { expectedHash: o.expectedHash, durability };
+		return { expectedHash: o.expectedHash, durability, mode: o.mode };
 	}
-	return { durability: "full" };
+	return { durability: "full", mode: undefined };
 }
 
 export function atomicWriteFile(filePath: string, content: string, options?: AtomicWriteOptions): void {
 	cancelPendingCoalescedWrite(filePath);
-	const { durability } = normalizeOptions(options);
+	const { durability, mode } = normalizeOptions(options);
 	if (!isSymlinkSafeDirCached(filePath))
 		throw new Error(`Refusing to write: target is a symlink or inside untrusted directory: ${filePath}`);
 	// On Windows the parent directory may be referenced via a short-name alias
@@ -556,7 +566,7 @@ export function atomicWriteFile(filePath: string, content: string, options?: Ato
 	const O_NOFOLLOW = typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0;
 	let fd: number | undefined;
 	try {
-		fd = fs.openSync(tempPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | O_NOFOLLOW, 0o600);
+		fd = fs.openSync(tempPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | O_NOFOLLOW, mode ?? 0o600);
 		// Post-open verification: on Windows O_NOFOLLOW is 0, so verify FD is a regular file
 		const openedStat = fs.fstatSync(fd);
 		if (!openedStat.isFile()) {
@@ -747,6 +757,14 @@ let flushInProgress = 0;
  * Buffer a JSON write and flush it after `coalesceMs` ms (default 50).
  * Multiple writes to the same path within the window collapse to one disk write.
  *
+ * ST-7 escape hatch: pass `skipCoalesce: true` to bypass the buffer entirely
+ * and write synchronously via `atomicWriteJson`. Use for terminal task status
+ * transitions where a SIGKILL during the 50ms coalesce window must NOT lose
+ * the terminal status update — otherwise crash recovery would see "running"
+ * in tasks.json while events.jsonl already shows "completed", causing
+ * double-execution / zombie detection. Defaults to `false` (buffered write)
+ * so all existing callers preserve their behavior.
+ *
  * @see The coalescing caveat: a `readJsonFile` call between buffer and flush
  *      sees the previous on-disk content. Callers needing read-after-write
  *      must call `flushPendingAtomicWrites()` first or use `atomicWriteJson`.
@@ -754,9 +772,17 @@ let flushInProgress = 0;
 export function atomicWriteJsonCoalesced<T>(
 	filePath: string,
 	value: T,
-	coalesceMs = DEFAULT_ATOMIC_COALESCE_MS,
+	coalesceMs: number = DEFAULT_ATOMIC_COALESCE_MS,
 	options?: AtomicWriteOptions,
+	skipCoalesce: boolean = false,
 ): void {
+	// ST-7: bypass coalescing for callers that need durable synchronous
+	// semantics. atomicWriteJson goes through atomicWriteFile which uses
+	// renameWithLinkSync + fsync — fully durable, no SIGKILL window.
+	if (skipCoalesce) {
+		atomicWriteJson(filePath, value, options);
+		return;
+	}
 	const content = `${JSON.stringify(value, null, 2)}\n`;
 	const previous = pendingAtomicWrites.get(filePath);
 	if (previous) clearTimeout(previous.timer);

package/src/state/blob-store.ts

@@ -2,7 +2,6 @@ import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
-import { sleepSync } from "../utils/sleep.ts";
 import { atomicWriteFile, renameWithRetry } from "./atomic-write.ts";
 import { withFileLockSync } from "./locks.ts";
 
@@ -152,14 +151,9 @@ export function writeBlob(
 	// FIX: Write blob content FIRST, then metadata. If blob write fails, no orphan metadata.
 	// Previous order was metadata first, then blob - causing orphan metadata on blob failure.
 	let blobContentWritten = false;
-	try {
-		// Write blob content first (immutable, content-addressed)
-		atomicWriteBuffer(blobPath, Buffer.isBuffer(content) ? content : Buffer.from(content, "utf-8"));
-		blobContentWritten = true;
-	} catch (error) {
-		// Blob write failed - no metadata to clean up since we haven't written it yet
-		throw error;
-	}
+	// Write blob content first (immutable, content-addressed)
+	atomicWriteBuffer(blobPath, Buffer.isBuffer(content) ? content : Buffer.from(content, "utf-8"));
+	blobContentWritten = true;
 
 	// Metadata only after blob content is successfully written
 	// Issue 3 fix: Use two-phase commit for metadata - write to temp file first,

package/src/state/contracts.ts

@@ -44,7 +44,7 @@ export const TEAM_TASK_STATUS_TRANSITIONS: Readonly<Record<TeamTaskStatus, reado
 };
 
 /** @internal */
-const TEAM_EVENT_TYPES = [
+export const TEAM_EVENT_TYPES = [
 	"run.created",
 	"run.queued",
 	"run.planning",
@@ -56,6 +56,10 @@ const TEAM_EVENT_TYPES = [
 	"task.created",
 	"task.started",
 	"task.progress",
+	"hook.pre_step_started",
+	"hook.pre_step_completed",
+	"hook.pre_step_failed",
+	"hook.pre_step_optional_failed",
 	"task.blocked",
 	"task.green",
 	"task.red",

package/src/state/crew-init.ts

@@ -17,6 +17,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { atomicWriteFile } from "./atomic-write.ts";
 import { updateGitignore } from "./gitignore-manager.ts";
 
 // Re-export updateGitignore for backwards compatibility with tests.
@@ -238,12 +239,12 @@ export async function ensureCrewDirectory(cwd: string): Promise<void> {
 
 	for (const placeholder of placeholders) {
 		if (!fs.existsSync(placeholder)) {
-			fs.writeFileSync(placeholder, "", "utf-8");
+			atomicWriteFile(placeholder, "");
 		}
 	}
 
 	// 3. Write README.md (always overwrite to keep it current)
-	fs.writeFileSync(safeJoin(crewRoot, "README.md"), buildCrewReadme(), "utf-8");
+	atomicWriteFile(safeJoin(crewRoot, "README.md"), buildCrewReadme());
 
 	// 4. Update .gitignore at project root
 	const repoRoot = findProjectRoot(cwd);

package/src/state/decision-ledger.ts

@@ -1,5 +1,5 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { projectCrewRoot } from "../utils/paths.ts";
 import { assertSafePathId } from "../utils/safe-paths.ts";
 import { atomicWriteFile } from "./atomic-write.ts";

package/src/state/event-log-rotation.ts

@@ -220,7 +220,7 @@ export function rotateEventLogUnlocked(eventsPath: string): boolean {
 		// copyFileSync + writeFileSync("") ensures eventsPath ALWAYS exists
 		// (no missing-file window for concurrent readers).
 		fs.copyFileSync(eventsPath, archivePath);
-		fs.writeFileSync(eventsPath, "", "utf-8");
+		atomicWriteFile(eventsPath, "");
 		return true;
 	} catch (error) {
 		logInternalError("event-log.rotate", error, `eventsPath=${eventsPath}`);

package/src/state/event-log.ts

@@ -93,7 +93,7 @@ export function withEventLogLockSync<T>(eventsPath: string, fn: () => T, options
 	const pidFile = path.join(lockDir, "pid");
 	const start = Date.now();
 	// SECURITY (HIGH #2 fix): Reduced from 120s to 5s to prevent blocking the
-	// event loop indefinitely. 500 retries × 10ms = 5s max. After timeout, we
+	// event loop indefinitely. ~100 retries × 50ms ≈ 5s max. After timeout, we
 	// throw a clear error instead of blocking forever. This ensures AbortSignal
 	// handlers, SIGTERM, and graceful shutdown can fire within seconds.
 	const timeout = options?.timeoutMs ?? 5000;
@@ -109,7 +109,7 @@ export function withEventLogLockSync<T>(eventsPath: string, fn: () => T, options
 			// (reduced from 120s) is appropriate.
 			fs.mkdirSync(lockDir);
 			try {
-				fs.writeFileSync(pidFile, String(process.pid), "utf-8");
+				atomicWriteFile(pidFile, String(process.pid));
 			} catch {
 				/* best-effort */
 			}
@@ -162,7 +162,7 @@ export function withEventLogLockSync<T>(eventsPath: string, fn: () => T, options
 			} catch {
 				/* no pid file — mtime check above already handles it */
 			}
-			sleepSync(10);
+			sleepSync(50);
 		}
 	}
 	try {

package/src/state/gitignore-manager.ts

@@ -3,6 +3,7 @@
  * Only adds entries if not already present; preserves existing content.
  */
 import * as fs from "node:fs";
+import { atomicWriteFile } from "./atomic-write.ts";
 
 /**
  * Entries to add to .gitignore for .crew directory management.
@@ -25,7 +26,7 @@ const CREW_GITIGNORE_ENTRIES = [
  */
 export async function updateGitignore(gitignorePath: string): Promise<void> {
 	if (!fs.existsSync(gitignorePath)) {
-		fs.writeFileSync(gitignorePath, CREW_GITIGNORE_ENTRIES.join("\n") + "\n", "utf-8");
+		atomicWriteFile(gitignorePath, CREW_GITIGNORE_ENTRIES.join("\n") + "\n");
 		return;
 	}
 

package/src/state/health-store.ts

@@ -1,7 +1,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import type { ManifestSummary, RunHealth } from "../runtime/task-health.ts";
+import type { ManifestSummary } from "../runtime/task-health.ts";
 import { computeRunHealth } from "../runtime/task-health.ts";
+import { atomicWriteFile } from "./atomic-write.ts";
 
 // Relative to the crew root (`<cwd>/.crew`). BUG A fix (pts/2 hang
 // investigation 2026-06-16): this was `.crew/state/health`, which double-joined
@@ -41,7 +42,9 @@ export class HealthStore {
 		const dir = this.healthDir();
 		fs.mkdirSync(dir, { recursive: true });
 		const file = path.join(dir, `${manifest.runId}.json`);
-		fs.writeFileSync(file, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+		// ST-2: atomic (temp + rename + fsync) — a crash mid-writeFileSync would truncate
+		// the snapshot and loadAllSnapshots() silently skips unparseable files.
+		atomicWriteFile(file, JSON.stringify(snapshot, null, 2) + "\n");
 		return snapshot;
 	}
 

package/src/state/instinct-store.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { assertSafePathId } from "../utils/safe-paths.ts";
+import { atomicWriteFile } from "./atomic-write.ts";
 
 /**
  * Represents a learned instinct that guides agent behavior.
@@ -87,7 +88,13 @@ export class InstinctStore {
 	private appendInstinctToFile(filePath: string, instinct: Instinct): void {
 		const dir = path.dirname(filePath);
 		this.ensureDir(dir);
-		fs.appendFileSync(filePath, `${JSON.stringify(instinct)}\n`, "utf-8");
+		// ST-3: read existing + append + atomic rewrite. appendFileSync has no fsync and
+		// can interleave bytes on concurrent writes. Callers should wrap this in
+		// withFileLockSync(filePath) to serialize concurrent RMW on the same file.
+		const existing = fs.existsSync(filePath) ? this.readInstinctsFromFile(filePath) : [];
+		existing.push(instinct);
+		const content = existing.map((i) => JSON.stringify(i)).join("\n") + "\n";
+		atomicWriteFile(filePath, content);
 	}
 
 	/**
@@ -97,7 +104,9 @@ export class InstinctStore {
 		const dir = path.dirname(filePath);
 		this.ensureDir(dir);
 		const content = instincts.map((i) => JSON.stringify(i)).join("\n") + "\n";
-		fs.writeFileSync(filePath, content, "utf-8");
+		// ST-3: atomic write (temp + rename + fsync) — crash mid-writeFileSync truncates
+		// the JSONL and readInstinctsFromFile silently returns [] (all instincts lost).
+		atomicWriteFile(filePath, content);
 	}
 
 	/**

package/src/state/mailbox.ts

@@ -3,7 +3,6 @@ import * as path from "node:path";
 import { DEFAULT_MAILBOX } from "../config/defaults.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import { redactSecrets } from "../utils/redaction.ts";
-import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import { atomicWriteFile } from "./atomic-write.ts";
 import { withEventLogLockSync } from "./event-log.ts";
 import { withFileLockSync } from "./locks.ts";
@@ -184,13 +183,13 @@ function ensureRunMailbox(manifest: TeamRunManifest): void {
 			// Ensure parent dir exists (may have been lost due to race or
 			// Windows path normalization mismatch)
 			fs.mkdirSync(path.dirname(filePath), { recursive: true });
-			fs.writeFileSync(filePath, "", "utf-8");
+			atomicWriteFile(filePath, "");
 		}
 	}
 	const delivery = deliveryFile(manifest, true);
 	if (!fs.existsSync(delivery)) {
 		fs.mkdirSync(path.dirname(delivery), { recursive: true });
-		fs.writeFileSync(delivery, `${JSON.stringify({ messages: {}, updatedAt: new Date().toISOString() }, null, 2)}\n`, "utf-8");
+		atomicWriteFile(delivery, `${JSON.stringify({ messages: {}, updatedAt: new Date().toISOString() }, null, 2)}\n`);
 	}
 }
 
@@ -312,7 +311,7 @@ function rotateMailboxFileIfNeeded(filePath: string, thresholdBytes = MAILBOX_AR
 		const ts = new Date().toISOString().replace(/[:.]/g, "-");
 		const archivePath = `${filePath}.${ts}.archive.jsonl`;
 		fs.renameSync(filePath, archivePath);
-		fs.writeFileSync(filePath, "", "utf-8");
+		atomicWriteFile(filePath, "");
 		// FIX: Prune old archives so total per-direction count stays bounded.
 		pruneOldMailboxArchives(filePath);
 		return true;

package/src/state/observation-store.ts

@@ -1,16 +1,4 @@
-/**
- * Observation capture and compression system.
- *
- * Pattern origin: claude-mem — captures tool usage across sessions,
- * compresses via AI, injects into future sessions.
- *
- * This module provides the observation store and compression logic.
- * Actual capture hooks into the lifecycle events (Pattern 12).
- */
-
-import * as fs from "node:fs";
-import { appendFileSync, existsSync, readFileSync } from "node:fs";
-import * as path from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 import { logInternalError } from "../utils/internal-error.ts";
 import { atomicWriteJson } from "./atomic-write.ts";
 

package/src/state/run-cache.ts

@@ -2,7 +2,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { projectCrewRoot } from "../utils/paths.ts";
-import { atomicWriteFile } from "./atomic-write.ts";
+import { atomicWriteJson } from "./atomic-write.ts";
 import { withFileLockSync } from "./locks.ts";
 import type { TeamTaskState } from "./types.ts";
 
@@ -67,7 +67,7 @@ export function getCachedRun(cwd: string, cacheKey: string): CacheEntry | null {
 				}
 				const updatedIndex = JSON.parse(fs.readFileSync(indexPath, "utf-8")) as CacheIndex;
 				delete updatedIndex[cacheKey];
-				atomicWriteFile(indexPath, JSON.stringify(updatedIndex));
+				atomicWriteJson(indexPath, updatedIndex);
 			});
 			return null;
 		}
@@ -109,18 +109,18 @@ export function saveRunToCache(
 	};
 
 	const entryPath = path.join(dir, `${cacheKey}.json`);
-	fs.writeFileSync(entryPath, JSON.stringify(entry), "utf-8");
+	// ST-4: atomic entry write (was raw writeFileSync — inverted priority vs the index).
+	atomicWriteJson(entryPath, entry);
 
-	// Update index with atomic write: write to temp file then rename
+	// Update index under a file lock (prevents concurrent saveCache from racing on the
+	// RMW) and write atomically (unique temp + rename — fixes the fixed "index.json.tmp"
+	// name collision the old manual temp+rename had).
 	const indexPath = path.join(dir, "index.json");
-	const index: CacheIndex = fs.existsSync(indexPath) ? JSON.parse(fs.readFileSync(indexPath, "utf-8")) : {};
-
-	index[cacheKey] = entryPath;
-
-	// Atomic write: write to temp file first, then rename
-	const tempPath = path.join(dir, "index.json.tmp");
-	fs.writeFileSync(tempPath, JSON.stringify(index), "utf-8");
-	fs.renameSync(tempPath, indexPath);
+	withFileLockSync(indexPath, () => {
+		const index: CacheIndex = fs.existsSync(indexPath) ? JSON.parse(fs.readFileSync(indexPath, "utf-8")) : {};
+		index[cacheKey] = entryPath;
+		atomicWriteJson(indexPath, index);
+	});
 }
 
 /**

package/src/state/run-graph.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { projectCrewRoot } from "../utils/paths.ts";
 import { assertSafePathId } from "../utils/safe-paths.ts";
+import { atomicWriteFile } from "./atomic-write.ts";
 import type { TeamRunManifest, TeamTaskState } from "./types.ts";
 
 export interface RunGraphNode {
@@ -138,7 +139,7 @@ export function saveRunGraph(graph: RunGraph, cwd: string): string {
 	}
 
 	const graphPath = path.join(graphsDir, `${graph.runId}.json`);
-	fs.writeFileSync(graphPath, JSON.stringify(graph, null, 2), "utf-8");
+	atomicWriteFile(graphPath, JSON.stringify(graph, null, 2));
 
 	return graphPath;
 }

package/src/state/run-metrics.ts

@@ -66,7 +66,7 @@ export function collectRunMetrics(cwd: string, runId: string): RunMetrics | unde
 	// Duration: from run createdAt to updatedAt (manifest timestamps), or 0 if unavailable.
 	const createdAt = new Date(manifest.createdAt).getTime();
 	const updatedAt = new Date(manifest.updatedAt).getTime();
-	const durationMs = isNaN(createdAt) || isNaN(updatedAt) ? 0 : Math.max(0, updatedAt - createdAt);
+	const durationMs = Number.isNaN(createdAt) || Number.isNaN(updatedAt) ? 0 : Math.max(0, updatedAt - createdAt);
 
 	// Consistency score: proportion of tasks that completed successfully among all non-skipped tasks.
 	const nonSkippedTasks = tasks.filter((t) => t.status !== "skipped");

package/src/state/schedule.ts

@@ -10,6 +10,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { logInternalError } from "../utils/internal-error.ts";
+import { atomicWriteJson } from "./atomic-write.ts";
 
 import type { ScheduledTask, ScheduleStoreData } from "./types.ts";
 
@@ -112,7 +113,12 @@ export class ScheduleStore {
 	private save(): void {
 		try {
 			fs.mkdirSync(path.dirname(this.path), { recursive: true });
-			fs.writeFileSync(this.path, JSON.stringify(this.data, null, 2), "utf-8");
+			// Atomic (temp + rename + fsync) — matches the class docstring's "atomic JSON
+			// persistence" claim. A raw writeFileSync could truncate schedules.json on
+			// crash and the constructor silently resets to {jobs:[]} on parse failure.
+			// NOTE: this class is currently not instantiated in production (scheduling
+			// persists via settings-store updateCrewSettings); kept consistent for safety.
+			atomicWriteJson(this.path, this.data);
 		} catch (error) {
 			// FIX (Round 21, L1): Use logInternalError for consistency with
 			// the rest of the codebase. Previously console.warn may not be

package/src/state/state-store.ts

@@ -14,7 +14,6 @@ import { unregisterActiveRun } from "./active-run-registry.ts";
 import { atomicWriteJson, atomicWriteJsonAsync, atomicWriteJsonCoalesced, flushPendingAtomicWrites, readJsonFile } from "./atomic-write.ts";
 import { canTransitionRunStatus } from "./contracts.ts";
 import { appendEvent } from "./event-log.ts";
-import { HealthStore } from "./health-store.ts";
 import { withRunLock, withRunLockSync } from "./locks.ts";
 import type { TeamRunManifest, TeamTaskState } from "./types.ts";
 
@@ -477,9 +476,16 @@ export function saveRunTasks(manifest: TeamRunManifest, tasks: TeamTaskState[]):
  * (perf review 2026-07 F4) — now used by persistSingleTaskUpdate's
  * non-terminal checkpoint path; that caller calls flushPendingAtomicWrites()
  * before its read-modify-write load to defeat the stale-read window.
+ *
+ * ST-7: pass `skipCoalesce: true` for terminal task status transitions
+ * (completed/failed/cancelled/needs_attention/skipped) to bypass the
+ * 50ms coalesce window — a SIGKILL in that window would otherwise leave
+ * tasks.json stale (showing "running") while events.jsonl already shows
+ * the terminal event, causing false zombie detection / double-execution
+ * on crash recovery.
  */
 /** @internal */
-export function saveRunTasksCoalesced(manifest: TeamRunManifest, tasks: TeamTaskState[]): void {
+export function saveRunTasksCoalesced(manifest: TeamRunManifest, tasks: TeamTaskState[], skipCoalesce: boolean = false): void {
 	// FIX: Invalidate cache BEFORE atomic write to prevent stale cache serving.
 	invalidateRunCache(manifest.stateRoot);
 	try {
@@ -487,7 +493,7 @@ export function saveRunTasksCoalesced(manifest: TeamRunManifest, tasks: TeamTask
 	} catch {
 		return;
 	}
-	atomicWriteJsonCoalesced(manifest.tasksPath, tasks);
+	atomicWriteJsonCoalesced(manifest.tasksPath, tasks, undefined, undefined, skipCoalesce);
 }
 
 export async function saveRunTasksAsync(manifest: TeamRunManifest, tasks: TeamTaskState[]): Promise<void> {

package/src/state/tiered-eval.ts

@@ -142,7 +142,7 @@ export class TieredEvalRunner {
 		if (config?.tierConfigs) {
 			for (const [tierStr, tierConfig] of Object.entries(config.tierConfigs)) {
 				const tier = Number(tierStr) as EvalTier;
-				if (tierConfig && !isNaN(tier)) {
+				if (tierConfig && !Number.isNaN(tier)) {
 					this.tierConfigs[tier] = {
 						...this.tierConfigs[tier],
 						...tierConfig,

package/src/ui/dynamic-border.ts

@@ -9,6 +9,8 @@ export class DynamicCrewBorder {
 	private readonly theme: CrewTheme;
 	private readonly color?: (value: string) => string;
 	private readonly char: string;
+	private cachedWidth = -1;
+	private cachedLine = "";
 
 	constructor(theme: CrewTheme, options: DynamicCrewBorderOptions = {}) {
 		this.theme = theme;
@@ -17,9 +19,17 @@ export class DynamicCrewBorder {
 	}
 
 	render(width: number): string[] {
-		const line = this.char.repeat(Math.max(0, width));
-		return [this.color ? this.color(line) : this.theme.fg("border", line)];
+		const w = Math.max(0, width);
+		if (w !== this.cachedWidth) {
+			const line = this.char.repeat(w);
+			this.cachedLine = this.color ? this.color(line) : this.theme.fg("border", line);
+			this.cachedWidth = w;
+		}
+		return [this.cachedLine];
 	}
 
-	invalidate(): void {}
+	invalidate(): void {
+		this.cachedWidth = -1;
+		this.cachedLine = "";
+	}
 }

package/src/ui/live-conversation-overlay.ts

@@ -6,6 +6,7 @@
  */
 import type { LiveAgentHandle } from "../runtime/live-agent-manager.ts";
 import { pad, truncate } from "../utils/visual.ts";
+import { computeLiveDurationMs } from "./live-duration.ts";
 import { spinnerFrame } from "./spinner.ts";
 import { iconForStatus } from "./status-colors.ts";
 import type { CrewTheme } from "./theme-adapter.ts";
@@ -17,7 +18,6 @@ export class LiveConversationOverlay {
 	private scrollOffset = 0;
 	private autoScroll = true;
 	private closed = false;
-	private frame = 0;
 	private pollTimer: ReturnType<typeof setInterval> | undefined;
 	cachedLines: string[] = [];
 	// H-4 fix (code-review 2026-06-23): cap the in-memory line buffer to avoid
@@ -53,10 +53,12 @@ export class LiveConversationOverlay {
 				/* ignore */
 			}
 		}
-		// Also poll for summary updates
+		// Also poll for summary updates. Skip when the user has scrolled up
+		// (autoScroll === false): the summary refresh also bumps scrollOffset
+		// to the tail, which would yank the viewport out from under them.
 		this.pollTimer = setInterval(() => {
 			if (this.closed) return;
-			this.frame++;
+			if (!this.autoScroll) return;
 			try {
 				this.refreshSummary();
 			} catch {
@@ -82,31 +84,9 @@ export class LiveConversationOverlay {
 
 	private static readonly SUMMARY_PREFIX = "\u200B"; // zero-width space as summary sentinel
 
-	private safeElapsedMs(act: typeof this.handle.activity): number {
-		const rawStarted = act.startedAtMs || 0;
-		const rawCompleted = act.completedAtMs || 0;
-		const nowMs = Date.now();
-		const nowSec = Math.floor(nowMs / 1000);
-		// Simple fix: detect if value is Unix seconds and convert properly
-		const toMs = (v: number): number => {
-			if (v <= 0) return 0;
-			// If 10 digits (or 9 with recent), treat as seconds
-			if (v > 1000000000 && v < 10000000000) return v * 1000;
-			// If 13 digits, treat as ms
-			if (v > 100000000000 && v < 10000000000000) return v;
-			// Fallback: use as-is
-			return v;
-		};
-		const startedMs = toMs(rawStarted);
-		const completedMs = rawCompleted > 0 ? toMs(rawCompleted) : 0;
-		// Validate bounds
-		const isValidStarted = startedMs > 0 && startedMs < nowMs + 60000 && startedMs > nowMs - 3155692600000;
-		const isValidCompleted = completedMs === 0 || (completedMs > 0 && completedMs < nowMs + 60000);
-		return (isValidCompleted ? completedMs : nowMs) - (isValidStarted ? startedMs : nowMs);
-	}
 	private refreshSummary(): void {
 		const act = this.handle.activity;
-		const summary = `${LiveConversationOverlay.SUMMARY_PREFIX}[${act.turnCount} turns · ${act.toolUses} tools · ${(this.safeElapsedMs(act) / 1000).toFixed(1)}s]`;
+		const summary = `${LiveConversationOverlay.SUMMARY_PREFIX}[${act.turnCount} turns · ${act.toolUses} tools · ${(computeLiveDurationMs(act) / 1000).toFixed(1)}s]`;
 		const lastLine = this.cachedLines[this.cachedLines.length - 1];
 		if (lastLine?.startsWith(LiveConversationOverlay.SUMMARY_PREFIX)) {
 			this.cachedLines[this.cachedLines.length - 1] = summary;
@@ -140,7 +120,7 @@ export class LiveConversationOverlay {
 				: iconForStatus(this.handle.status);
 		const name = this.handle.agent ?? this.handle.taskId;
 		const act = this.handle.activity;
-		const elapsed = `${(this.safeElapsedMs(act) / 1000).toFixed(1)}s`;
+		const elapsed = `${(computeLiveDurationMs(act) / 1000).toFixed(1)}s`;
 		const headerParts: string[] = [];
 		if (act.maxTurns != null) headerParts.push(`turn ${act.turnCount}/${act.maxTurns}`);
 		else if (act.turnCount > 0) headerParts.push(`turn ${act.turnCount}`);

package/src/ui/live-duration.ts

@@ -21,8 +21,8 @@ function toMs(v: number): number {
 	if (v <= 0) return 0;
 	// 1e9 < seconds < 1e10  → seconds, scale up
 	if (v > 1_000_000_000 && v < 10_000_000_000) return v * 1000;
-	// 1e11 < ms < 1e13      → already ms
-	if (v > 100_000_000_000 && v < 10_000_000_000_000) return v;
+	// 1e10 < ms < 1e13      → already ms (>=10B seconds is 317+ years, implausible)
+	if (v > 10_000_000_000 && v < 10_000_000_000_000) return v;
 	return v;
 }