pi-crew 0.11.9 → 0.11.11

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-crew",
-	"version": "0.11.9",
+	"version": "0.11.11",
 	"description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
 	"author": "baphuongna",
 	"license": "MIT",

package/src/extension/async-notifier.ts

@@ -2,7 +2,7 @@ import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { readCrewAgents, saveCrewAgents } from "../runtime/crew-agent-records.ts";
 import { checkProcessLiveness, isActiveRunStatus } from "../runtime/process-status.ts";
 import { withRunLock } from "../state/coordination/locks.ts";
-import { appendEvent, readEventsCursor, type TeamEvent } from "../state/event-log/event-log.ts";
+import { appendEventAsync, readEventsCursor, type TeamEvent } from "../state/event-log/event-log.ts";
 import { loadRunManifestById, saveRunTasks, updateRunStatus } from "../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { logInternalError } from "../utils/internal-error.ts";
@@ -130,7 +130,10 @@ export async function markDeadAsyncRunIfNeeded(
 		if (!fresh || !isActiveRunStatus(fresh.manifest.status)) return undefined;
 		const failed = updateRunStatus(fresh.manifest, "failed", message);
 		markActiveTasksAndAgentsFailed(failed, message);
-		appendEvent(failed.eventsPath, {
+		// U2 (2026-10-10): awaited async append — the lock callback is async; the
+		// event lands after run.failed (sync updateRunStatus write above) in file
+		// order and is durable before the notifier tick resolves.
+		await appendEventAsync(failed.eventsPath, {
 			type: "async.died",
 			runId: failed.runId,
 			message,

package/src/extension/registration/commands/shared.ts

@@ -620,26 +620,16 @@ export async function openTeamDashboard(ctx: ExtensionContext): Promise<void> {
 			continue;
 		}
 		if (selection.action === "agent-transcript" && (await openTranscriptViewer(cmdCtx, selection.runId))) continue;
+		// F1 (2026-10-08): openLiveConversation now owns ALL not-found messaging
+		// with a runtime-aware notice (child-process/scaffold runs point at the
+		// transcript viewer; live-session runs keep "No live agent found"). Its
+		// old fall-through block here fired even on picker-cancel — removed.
 		if (selection.action === "agent-live" && (await openLiveConversation(cmdCtx, selection.runId))) continue;
 		// feat/agents-browser: `b` from the dashboard opens the unified Agents
 		// & Jobs overlay WITHOUT closing the loop — continue reopens the
 		// dashboard underneath, mirroring the transcript/live-conversation
 		// viewers. runId may be "" (no run selected — jobs-only view).
 		if (selection.action === "browser-open" && (await openAgentsJobsBrowser(cmdCtx))) continue;
-		if (selection.action === "agent-live") {
-			await notifyCommandResult(
-				cmdCtx,
-				commandText({
-					content: [
-						{
-							type: "text",
-							text: "No live agent found for this run.",
-						},
-					],
-				}),
-			);
-			continue;
-		}
 		const result =
 			selection.action === "api"
 				? await handleTeamTool(

package/src/extension/registration/viewers.ts

@@ -10,6 +10,7 @@ import { requestRenderTarget } from "../../ui/pi-ui-compat.ts";
 import { asCrewTheme } from "../../ui/theme-adapter.ts";
 // Lazy-loaded: DurableTranscriptViewer is 658ms — only needed for /crew transcript command
 import type { DurableTranscriptViewer as DurableTranscriptViewerType } from "../../ui/transcript-viewer.ts";
+import { notifyCommandResult } from "./command-utils.ts";
 
 async function getViewer(): Promise<typeof DurableTranscriptViewerType> {
 	// LAZY: DurableTranscriptViewer is 658ms — only needed for /crew transcript.
@@ -68,6 +69,22 @@ export async function openTranscriptViewer(
 	return true;
 }
 
+/**
+ * F1 (2026-10-08 full-tier battery): notice shown when `V` (live conversation)
+ * finds no live agent for a run. With the default child-process runtime the
+ * in-process live-agent registry is ALWAYS empty by design — agents run as
+ * child Pis and stream transcripts to disk, and only the (ADR-frozen)
+ * live-session runtime ever registers handles. The old generic "No live agent
+ * found" therefore read as a bug on every child-process run. Route the user
+ * to the surface that works instead of a dead end.
+ */
+export function liveConversationNotice(runtimeKind: string | undefined): string {
+	if (runtimeKind === "child-process" || runtimeKind === "scaffold") {
+		return `Live conversation requires the live-session runtime; this run executes via ${runtimeKind} and streams transcripts to disk. Press v (dashboard) or /team-transcript to follow along.`;
+	}
+	return "No live agent found for this run.";
+}
+
 /** R2: Open live conversation overlay for a running live-session agent. */
 export async function openLiveConversation(
 	ctx: ExtensionCommandContext,
@@ -78,7 +95,14 @@ export async function openLiveConversation(
 	if (!selected || !ctx.hasUI) return false;
 	const liveAgents = listLiveAgents();
 	const handle = liveAgents.find((h) => h.runId === selected.runId && (selected.taskId ? h.taskId === selected.taskId : true));
-	if (!handle) return false;
+	if (!handle) {
+		// F1: runtime-aware notice instead of a dead-end error. Contract change:
+		// `true` now also covers "answered with a notice" — `false` means the
+		// user cancelled the picker (or no UI), so callers stay silent on false.
+		const manifest = loadRunManifestById(ctx.cwd, selected.runId);
+		await notifyCommandResult(ctx, liveConversationNotice(manifest?.manifest.runtimeResolution?.kind));
+		return true;
+	}
 	const theme = asCrewTheme({});
 	await ctx.ui.custom<undefined>(
 		(tui, _theme, _keybindings, done) => {

package/src/extension/team-tool/cancel.ts

@@ -392,12 +392,11 @@ export async function handleCancel(params: TeamToolParamsValue, ctx: TeamContext
 		}
 		ctx.abortForegroundRun?.(fresh.manifest.runId);
 		for (const taskId of abortResult.abortedIds) {
-			// REVIEW FIX (2026-09-10): reverted M2b buffered conversion. Although
-			// task.cancelled is a TERMINAL type (buffered terminal path bypasses
-			// the 20ms buffer), that path still resolves via a microtask chain
-			// (flushPromise.then(appendEvent)) — NOT same-tick. Cancel tests and
-			// the immediately-following updateRunStatus reader need same-tick
-			// durability, so plain sync appendEvent (base behavior).
+			// U2 (2026-10-10): kept SYNC — inside the withRunLockSync callback (cannot
+			// await) and each task.cancelled must precede the run.cancelled written by
+			// the updateRunStatus call below (audit order); an appends-after-lock
+			// restructure would invert that order. Cancel tests read events after
+			// handleCancel resolves (2026-09-10 M2b revert reason stands).
 			appendEvent(fresh.manifest.eventsPath, {
 				type: "task.cancelled",
 				runId: fresh.manifest.runId,

package/src/runtime/attention-events.ts

@@ -18,6 +18,10 @@ export function appendTaskAttentionEvent(input: AppendTaskAttentionInput): boole
 			`${event.taskId ?? ""}:${event.data?.reason ?? ""}:${event.data?.activityState ?? ""}` === dedupKey,
 	);
 	if (duplicate) return false;
+	// U2 (2026-10-10): kept SYNC — the dedup check above reads the events tail
+	// in the SAME call; an async/delayed write would let a rapid second
+	// attention call (before the flush lands) pass dedup and emit a duplicate.
+	// Same-tick write makes read-your-own-writes load-bearing for correctness.
 	appendEvent(input.manifest.eventsPath, {
 		type: "task.attention",
 		runId: input.manifest.runId,

package/src/runtime/goal-workflow/dynamic-workflow-context.ts

@@ -370,6 +370,12 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				// in flight when it trips (they are killed by the cap abort below).
 				if (agentCount >= maxAgentCalls) {
 					// Durable record (dwf.log is the registered workflow-log event type).
+					// U2 (2026-10-10): kept SYNC — ctx closures are exercised DIRECTLY by
+					// unit tests that readEvents() synchronously right after the call
+					// (dynamic-workflow-context.test.ts rounds 12/14/18); no await boundary
+					// exists between a ctx call and those readers. The runner-level
+					// lifecycle events (dwf.started/completed/failed) ARE migrated —
+					// awaited appendEventAsync in dynamic-workflow-runner.ts.
 					appendEvent(manifest.eventsPath, {
 						type: "dwf.log",
 						runId: manifest.runId,
@@ -773,10 +779,12 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 			// Idempotency: same phase title → no event, no state change.
 			if (title === phaseState.currentPhase) return;
 			// Close out the previous open phase BEFORE the new one opens.
-			// REVIEW FIX (2026-09-10): reverted M2a buffered conversion — phase
-			// transitions are low-frequency AND read back synchronously (tests,
-			// checkpoint resume; dwf-setresult rounds 12/14/18 assert the events
-			// file immediately after the run).
+			// U2 (2026-10-10): kept SYNC — ctx closures are exercised DIRECTLY by
+			// unit tests that readEvents() synchronously right after the call
+			// (dynamic-workflow-context.test.ts); no await boundary exists between a
+			// ctx call and those readers. The runner-level lifecycle events ARE
+			// migrated (awaited appendEventAsync in dynamic-workflow-runner.ts).
+			// Close out the previous open phase BEFORE the new one opens.
 			if (phaseState.currentPhase !== undefined) {
 				appendEvent(manifest.eventsPath, {
 					type: "dwf.phase_completed",
@@ -800,7 +808,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 					);
 				}
 			}
-			// REVIEW FIX (2026-09-10): reverted M2a buffered conversion — see phase_completed.
+			// U2 (2026-10-10): kept SYNC — see the phase_completed note above.
 			appendEvent(manifest.eventsPath, {
 				type: "dwf.phase_started",
 				runId: manifest.runId,
@@ -815,7 +823,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 			if (wfState.logs.length < 1000) {
 				wfState.logs.push(text);
 			}
-			// REVIEW FIX (2026-09-10): reverted M2a buffered conversion — see phase().
+			// U2 (2026-10-10): kept SYNC — see the phase_completed note above.
 			appendEvent(manifest.eventsPath, {
 				type: "dwf.log",
 				runId: manifest.runId,

package/src/runtime/goal-workflow/dynamic-workflow-runner.ts

@@ -21,7 +21,7 @@ import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join } from "node:path";
 import { getCrewEnv } from "../../config/env-vars.ts";
-import { appendEvent } from "../../state/event-log/event-log.ts";
+import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
@@ -181,11 +181,13 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	// require, fs, child_process). Cloning a hostile repo and running its workflow = arbitrary
 	// code execution. Default-deny project workflows unless the user explicitly opts in via
 	// PI_CREW_TRUST_PROJECT_DWF=1. Builtin and user workflows proceed without restriction.
+	// U2 (2026-10-10): awaited appendEventAsync — the 2026-09-10 M2a revert
+	// was required by BUFFERED (20ms-delayed) writes; awaiting the direct async
+	// append keeps the read-your-writes contract (resume flow, dwf-setresult
+	// tests, status display all read events only after runDynamicWorkflow
+	// resolves) while dropping the sleepSync event-loop block.
 	if (workflow.source === "project" && getCrewEnv("PI_CREW_TRUST_PROJECT_DWF") !== "1") {
-		// REVIEW FIX (2026-09-10): DWF lifecycle events reverted from M2a
-		// buffered conversion — runner sites are read back synchronously
-		// (dwf-setresult tests, resume flow, status display after run end).
-		appendEvent(eventsPath, {
+		await appendEventAsync(eventsPath, {
 			type: "dwf.trust_denied",
 			runId: manifest.runId,
 			data: { workflow: workflow.name, source: workflow.source, script: scriptPath },
@@ -195,7 +197,7 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 		);
 	}
 
-	appendEvent(eventsPath, {
+	await appendEventAsync(eventsPath, {
 		type: "dwf.started",
 		runId: manifest.runId,
 		data: { workflow: workflow.name, script: scriptPath },
@@ -208,7 +210,7 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	const dwfStore = new DwfStore(manifest.stateRoot);
 	const resumedState = dwfStore.load();
 	if (resumedState) {
-		appendEvent(eventsPath, {
+		await appendEventAsync(eventsPath, {
 			type: "dwf.resumed",
 			runId: manifest.runId,
 			data: {
@@ -285,7 +287,7 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 		}
 	} catch (error) {
 		logInternalError("dynamic-workflow-runner.run", error, `runId=${manifest.runId}, workflow=${workflow.name}`);
-		appendEvent(eventsPath, {
+		await appendEventAsync(eventsPath, {
 			type: "dwf.failed",
 			runId: manifest.runId,
 			data: {
@@ -320,7 +322,7 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 	// last open phase is always terminated before dwf.completed.
 	const phaseState = getWorkflowPhaseState(ctx);
 	if (phaseState?.currentPhase !== undefined) {
-		appendEvent(eventsPath, {
+		await appendEventAsync(eventsPath, {
 			type: "dwf.phase_completed",
 			runId: manifest.runId,
 			data: { phase: phaseState.currentPhase },
@@ -328,7 +330,7 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 		phaseState.currentPhase = undefined;
 	}
 
-	appendEvent(eventsPath, {
+	await appendEventAsync(eventsPath, {
 		type: "dwf.completed",
 		runId: manifest.runId,
 		data: { workflow: workflow.name, summaryArtifact: summary.path },

package/src/runtime/group-join.ts

@@ -132,6 +132,9 @@ export function deliverGroupJoin(input: {
 				remaining,
 			},
 		});
+	// U2 (2026-10-10): kept SYNC — deliverGroupJoin is a sync API; group-join
+	// tests (and status display) fs.readFileSync(events.jsonl) immediately after
+	// it returns, so any delayed/async append would miss the events at read.
 	appendEvent(input.manifest.eventsPath, {
 		type: partial ? "agent.group_join.partial" : "agent.group_join.completed",
 		runId: input.manifest.runId,
@@ -145,6 +148,8 @@ export function deliverGroupJoin(input: {
 		},
 	});
 	if (existingMailbox)
+		// U2 (2026-10-10): kept SYNC — same sync-read contract as the completed/
+		// partial event above.
 		appendEvent(input.manifest.eventsPath, {
 			type: "agent.group_join.delivery_reused",
 			runId: input.manifest.runId,

package/src/runtime/live-session/live-session-runtime.ts

@@ -124,6 +124,15 @@ export interface LiveSessionSpawnInput {
 	workspaceId: string;
 	/** Phase 2: Output schema for validating yield data. */
 	outputSchema?: unknown;
+	/**
+	 * U3 test seam: optional pi-ai `Provider`-like object registered on the
+	 * created session's ModelRuntime immediately after session creation, before
+	 * anything streams. Lets tests run the REAL in-process live-session worker
+	 * key-free and network-free against `@earendil-works/pi-ai/providers/faux`
+	 * (tests construct the provider and pass it here; runtime code never
+	 * imports the faux module). Must stay undefined in production runs.
+	 */
+	modelProviderOverride?: unknown;
 }
 
 export interface LiveSessionRunResult {
@@ -179,6 +188,10 @@ type LiveSessionLike = {
 	bindExtensions?: (bindings?: Record<string, unknown>) => Promise<void>;
 	getActiveToolNames?: () => string[];
 	setActiveToolsByName?: (names: string[]) => void;
+	/** U3 test-seam surface: SDK AgentSession exposes its ModelRuntime here. */
+	modelRuntime?: {
+		registerNativeProvider?: (provider: unknown) => void;
+	};
 };
 
 function appendTranscript(filePath: string | undefined, event: unknown): void {
@@ -200,6 +213,26 @@ function isString(value: unknown): value is string {
 	return typeof value === "string";
 }
 
+/**
+ * U3 test seam: register a caller-supplied pi-ai `Provider` on the created
+ * session's ModelRuntime right after creation. Passive by design — no faux
+ * import lives in runtime code; tests construct the provider and pass it via
+ * `LiveSessionSpawnInput.modelProviderOverride`. No-op when no override is
+ * supplied or the session does not expose a ModelRuntime with
+ * `registerNativeProvider` (older/foreign SDK shapes).
+ */
+function applyModelProviderOverride(session: LiveSessionLike | undefined, provider: unknown): void {
+	if (!session || !provider) return;
+	const runtime = asRecord(session.modelRuntime);
+	const register = runtime?.registerNativeProvider;
+	if (typeof register !== "function") return;
+	try {
+		register.call(runtime, provider);
+	} catch (error) {
+		logInternalError("live-session.model-provider-override", error, "registerNativeProvider failed");
+	}
+}
+
 /**
  * Type-safe extractor for message role from streaming events.
  * Handles the case where message may be a Record with a role field.
@@ -845,7 +878,6 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 						settingsManager: mod.SettingsManager.create(input.task.cwd, agentDir),
 					}
 				: {}),
-			...(input.modelRegistry ? { modelRegistry: input.modelRegistry } : {}),
 			...(resolvedModel ? { model: resolvedModel } : {}),
 			...(effectiveThinking ? { thinkingLevel: effectiveThinking } : {}),
 			// R3-12: cycling/visibility scope = the fallback chain (see helper).
@@ -853,6 +885,10 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 			customTools,
 		});
 		session = created.session;
+		// U3: register the test-only provider override (faux E2E seam) before
+		// anything streams. No-op in production (modelProviderOverride stays
+		// undefined there).
+		applyModelProviderOverride(session, input.modelProviderOverride);
 		// P7 (perf): fire-and-forget — return value not needed, blocks the
 		// event loop less than the sync appendEvent under file-lock contention.
 		appendEventFireAndForget(input.manifest.eventsPath, {

package/src/runtime/plan-approval.ts

@@ -11,7 +11,7 @@
 import * as fs from "node:fs";
 import type { CrewRuntimeConfig } from "../config/config.ts";
 import { parsePlannerPlanOutput } from "../extension/plan-orchestrate.ts";
-import { appendEvent } from "../state/event-log/event-log.ts";
+import { appendEventAsync } from "../state/event-log/event-log.ts";
 import { appendPlanRevision, getCurrentPlanRecord, setPlanApproval } from "../state/stores/plan-store.ts";
 import { saveRunManifestAsync } from "../state/stores/state-store.ts";
 import type { PlanRecord, TeamRunManifest, TeamTaskState } from "../state/types.ts";
@@ -122,7 +122,10 @@ export async function ensurePlanApprovalRequested(manifest: TeamRunManifest, tas
 		plan: record ? { id: record.id, version: record.version } : manifest.plan,
 	};
 	await saveRunManifestAsync(updated);
-	appendEvent(updated.eventsPath, {
+	// U2 (2026-10-10): awaited async append — async fn with no same-tick reader;
+	// durable before ensurePlanApprovalRequested resolves (plan-approval tests
+	// read events after the await boundary).
+	await appendEventAsync(updated.eventsPath, {
 		type: "plan.approval_required",
 		runId: updated.runId,
 		taskId: planTask?.id,

package/src/runtime/recovery/crash-recovery.ts

@@ -5,7 +5,8 @@ import { DEFAULT_PATHS } from "../../config/defaults.ts";
 import { appendHookEvent, executeHook } from "../../hooks/registry.ts";
 import type { MetricRegistry } from "../../observability/metric-registry.ts";
 import { discoverRunLockFiles, sweepStaleLocks, withRunLock, withRunLockSync } from "../../state/coordination/locks.ts";
-import { appendEvent, scanSequence } from "../../state/event-log/event-log.ts";
+import type { AppendTeamEvent } from "../../state/event-log/event-log.ts";
+import { appendEvent, appendEventAsync, scanSequence } from "../../state/event-log/event-log.ts";
 import { readActiveRunRegistry, unregisterActiveRun } from "../../state/stores/active-run-registry.ts";
 import {
 	loadRunManifestById,
@@ -158,28 +159,41 @@ export async function applyRecoveryPlan(plan: RecoveryPlan, ctx: Pick<ExtensionC
 	// may have completed/cancelled the run in the meantime. Re-read inside the
 	// lock and derive every write from the FRESH snapshot; never reset a run that
 	// reached a terminal status.
+	// U2 (2026-10-10): recovery lifecycle events are captured under the sync run
+	// lock (payload derived from the fresh snapshot, as R14-4 requires) but
+	// appended via the awaited async primitive AFTER the lock — the sync lock
+	// callback cannot await, and awaiting outside keeps the read-your-writes
+	// contract (recovery-hooks tests read events.jsonl synchronously right after
+	// applyRecoveryPlan resolves) while dropping the sleepSync event-loop block.
+	let lifecycle: { eventsPath: string; event: AppendTeamEvent } | undefined;
 	withRunLockSync(loaded.manifest, () => {
 		const fresh = loadRunManifestById(ctx.cwd, plan.runId); // NOTE: inside withRunLockSync - consistent read
 		if (!fresh) throw new Error(`Run '${plan.runId}' not found.`);
 		if (fresh.manifest.status === "completed" || fresh.manifest.status === "failed" || fresh.manifest.status === "cancelled") {
 			// Run reached a terminal status while the recovery hook was running —
 			// do NOT reset it (no task reset, no status change).
-			appendEvent(fresh.manifest.eventsPath, {
-				type: "crew.run.recovery_skipped",
-				runId: plan.runId,
-				message: `Recovery skipped: run is already '${fresh.manifest.status}'`,
-				data: { status: fresh.manifest.status },
-			});
+			lifecycle = {
+				eventsPath: fresh.manifest.eventsPath,
+				event: {
+					type: "crew.run.recovery_skipped",
+					runId: plan.runId,
+					message: `Recovery skipped: run is already '${fresh.manifest.status}'`,
+					data: { status: fresh.manifest.status },
+				},
+			};
 			return;
 		}
 		appendHookEvent(fresh.manifest, hookReport);
 		if (hookReport.outcome === "block") {
-			appendEvent(fresh.manifest.eventsPath, {
-				type: "crew.run.recovery_blocked",
-				runId: plan.runId,
-				message: `Recovery blocked by hook: ${hookReport.reason ?? "run_recovery hook blocked the operation."}`,
-				data: { hookOutcome: "block", reason: hookReport.reason },
-			});
+			lifecycle = {
+				eventsPath: fresh.manifest.eventsPath,
+				event: {
+					type: "crew.run.recovery_blocked",
+					runId: plan.runId,
+					message: `Recovery blocked by hook: ${hookReport.reason ?? "run_recovery hook blocked the operation."}`,
+					data: { hookOutcome: "block", reason: hookReport.reason },
+				},
+			};
 			return;
 		}
 
@@ -203,17 +217,21 @@ export async function applyRecoveryPlan(plan: RecoveryPlan, ctx: Pick<ExtensionC
 				: task,
 		);
 		saveRunTasks(fresh.manifest, tasks);
-		appendEvent(fresh.manifest.eventsPath, {
-			type: "crew.run.resumed",
-			runId: plan.runId,
-			message: `Recovered ${plan.resumableTasks.length} interrupted task(s).`,
-			data: {
-				recoveredFromSeq: plan.lastEventSeq,
-				resumableTasks: plan.resumableTasks,
+		lifecycle = {
+			eventsPath: fresh.manifest.eventsPath,
+			event: {
+				type: "crew.run.resumed",
+				runId: plan.runId,
+				message: `Recovered ${plan.resumableTasks.length} interrupted task(s).`,
+				data: {
+					recoveredFromSeq: plan.lastEventSeq,
+					resumableTasks: plan.resumableTasks,
+				},
 			},
-		});
+		};
 		registry?.counter("crew.run.count", "Total runs by status").inc({ status: "resumed" });
 	});
+	if (lifecycle) await appendEventAsync(lifecycle.eventsPath, lifecycle.event);
 }
 
 export function declineRecoveryPlan(plan: RecoveryPlan, ctx: Pick<ExtensionContext, "cwd">): void {
@@ -226,6 +244,10 @@ export function declineRecoveryPlan(plan: RecoveryPlan, ctx: Pick<ExtensionConte
 		const fresh = loadRunManifestById(ctx.cwd, plan.runId); // NOTE: inside withRunLockSync - consistent read
 		if (!fresh) return;
 		// Log the event first — if appendEvent fails, state remains consistent.
+		// U2 (2026-10-10): kept SYNC — this event must land on disk BEFORE the
+		// run.cancelled written by the updateRunStatus call below it (audit order:
+		// decline reason precedes the terminal status); declineRecoveryPlan is a
+		// sync API with no await boundary to flush an async append.
 		appendEvent(fresh.manifest.eventsPath, {
 			type: "crew.run.recovery_declined",
 			runId: plan.runId,
@@ -335,6 +357,9 @@ export function cancelOrphanedRuns(
 			if (!fresh) return;
 			if (fresh.manifest.status !== "running" && fresh.manifest.status !== "blocked") {
 				// Status changed between initial check (line 109) and acquiring the lock — normal concurrent update, not an orphan
+				// U2 (2026-10-10): kept SYNC — cancelOrphanedRuns is a sync API (returns
+				// {cancelled,skipped} synchronously to session-start callers); no await
+				// boundary exists to flush an async append before those callers read events.
 				appendEvent(loaded.manifest.eventsPath, {
 					type: "crew.run.orphan_skip",
 					runId: manifest.runId,
@@ -374,6 +399,9 @@ export function cancelOrphanedRuns(
 				}
 			}
 			updateRunStatus(fresh.manifest, "cancelled", `Orphaned run: owner session ${ownerId} no longer exists`);
+			// U2 (2026-10-10): kept SYNC — must land AFTER run.cancelled (updateRunStatus
+			// above, still sync) for audit order, and cancelOrphanedRuns is a sync API
+			// with no await boundary to flush an async append.
 			appendEvent(fresh.manifest.eventsPath, {
 				type: "crew.run.orphan_cancelled",
 				runId: manifest.runId,
@@ -768,7 +796,10 @@ export async function reconcileAllStaleRuns(
 					void terminateLiveAgentsForRun(fresh.manifest.runId, "failed", appendEvent, fresh.manifest.eventsPath).catch((error) =>
 						logInternalError("crash-recovery.reconcile.terminate", error, `runId=${fresh.manifest.runId}`, "warn"),
 					);
-					appendEvent(fresh.manifest.eventsPath, {
+					// U2 (2026-10-10): awaited async append — the lock callback is async; the
+					// event lands after run.failed (sync updateRunStatus write above) in file
+					// order and is durable before reconcileAllStaleRuns resolves.
+					await appendEventAsync(fresh.manifest.eventsPath, {
 						type: "crew.run.reconciled_stale",
 						runId,
 						message: result.detail,

package/src/runtime/task-output-context.ts

@@ -548,9 +548,12 @@ function sanitizeFencedBody(body: string): string {
 	return body.replace(DEPENDENCY_CONTROL_CHAR_PATTERN, "").replace(/<\/dependency-context/g, "&lt;/dependency-context");
 }
 
-// ── Handoff budget (est-token cap on this layer) ─────────────────────────────
+// ── Handoff budget (effective-token cap on this layer: chars/4 heuristic ──
+// anchored upward by measured worker usage — U10) ─────────────────────────
 
-/** Default est-token budget for the dynamic.dependencyContext layer. */
+/** Default effective-token budget for the dynamic.dependencyContext layer
+ *  (tokens as measured by the chars/4 heuristic, floored by measured worker
+ *  usage where available — U10). */
 export const DEFAULT_HANDOFF_BUDGET_TOKENS = 1800;
 /** Budget ceiling: a resolved budget above this is treated as the off-switch
  *  (same semantics as ≤0 — clearly not a real handoff cap, so render
@@ -562,16 +565,58 @@ export const HANDOFF_SUMMARY_HEAD_CHARS = 240;
 /** Strict integer env syntax — "12abc" must NOT parse as 12. */
 const HANDOFF_BUDGET_ENV_RE = /^[+-]?\d+$/;
 
-/** Est tokens = chars/4 — the same heuristic as `estimateTokens` in
+/** Est tokens = chars/4 — the same heuristic as `estimateTokens(chars)` in
  *  src/runtime/task-runner/prompt-builder.ts (SR-02 breakdown). Duplicated
  *  here instead of imported: importing prompt-builder would pull its
  *  retrieval/workspace-tree graph into every task-output-context consumer
  *  (post-execution, aggregate outputs) for a one-line heuristic. Keep the
- *  two in sync if either changes. */
+ *  two in sync if either changes; the U10 max(heuristic, measured) combine
+ *  rule mirrors prompt-builder's `estimateTokens(chars, measuredTokens)`. */
 function estimateHandoffTokens(chars: number): number {
 	return Math.round(chars / 4);
 }
 
+/** U10 measured-token anchor: Σ measured `usage.outputTokens` over the deps
+ *  still rendered in FULL form. The usage record is the worker's REAL
+ *  tokenizer measurement (message_end usage persisted on the task state via
+ *  child-executor `parsedOutput?.usage ?? sessionUsage`, surfaced onto each
+ *  entry by `aggregateUsage`) — not an estimate. Only the model's OUTPUT
+ *  tokens count: they upper-bound the tokens of the result text whose
+ *  (≤32KB-truncated) inline rendering is what this layer injects downstream
+ *  (the session's INPUT tokens say nothing about the size of the text being
+ *  injected). Charging the upper bound is deliberately conservative per spec
+ *  U10's acceptance: when the worker reports MORE tokens than the heuristic,
+ *  the measured number governs (trim fires at least as early); the recovery
+ *  path is the compact form's artifact pointer.
+ *
+ *  Compact (`budgetTrimmed`) deps are deliberately NOT charged: their inline
+ *  body is a ≤240-char head + pointer, no longer the worker's output, so the
+ *  chars/4 heuristic on the small head is the honest measure — otherwise an
+ *  output-heavy dep could never fit any budget even fully trimmed. */
+function measuredHandoffTokens(context: DependencyOutputContext): number {
+	let measured = 0;
+	for (const dep of context.dependencies) {
+		if (dep.budgetTrimmed) continue;
+		measured += dep.usage?.outputTokens ?? 0;
+	}
+	return measured;
+}
+
+/** Measure a candidate context in EFFECTIVE tokens (U10): the chars/4
+ *  heuristic on the rendered body, floored by the measured-token anchor —
+ *  `max(heuristic, Σ measured output tokens of full-form deps)`, mirroring
+ *  the render byte-for-byte (same parts builder; `.trim()` matches the render
+ *  join). The max rule mirrors `estimateTokens(chars, measuredTokens)` in
+ *  prompt-builder.ts: a real measurement can only TIGHTEN the estimate
+ *  (spec U10 — the budget must never be exceeded when measured usage is
+ *  larger than the heuristic), never loosen it below the heuristic. */
+function measureHandoffTokens(context: DependencyOutputContext): number {
+	return Math.max(
+		estimateHandoffTokens(buildDependencyOutputBodyParts(context).join("\n").trim().length),
+		measuredHandoffTokens(context),
+	);
+}
+
 /** Budget active iff it is a positive finite number at or below the ceiling;
  *  ≤0 or >ceiling = off-switch (render untrimmed). */
 function handoffBudgetActive(budgetTokens: number): boolean {
@@ -668,18 +713,19 @@ function buildDependencyOutputBodyParts(context: DependencyOutputContext): strin
 	return parts;
 }
 
-/** Measure a candidate context in est tokens (chars/4), mirroring the render
- *  byte-for-byte (same parts builder; `.trim()` matches the render join). */
-function measureHandoffTokens(context: DependencyOutputContext): number {
-	return estimateHandoffTokens(buildDependencyOutputBodyParts(context).join("\n").trim().length);
-}
-
 /**
- * Handoff budget: trim the dependency-output context to an est-token
- * (chars/4) budget. PURE — no I/O, no env reads (callers pass the resolved
- * budget from {@link resolveHandoffBudgetTokens}); returns the input
- * reference unchanged when the budget is off (≤0 or >1_000_000) or the
- * context already fits.
+ * Handoff budget: trim the dependency-output context to an EFFECTIVE-token
+ * budget (U10). Effective tokens = max(chars/4 heuristic on the rendered
+ * body, Σ measured `usage.outputTokens` of full-form deps — real tokenizer
+ * numbers from message_end usage persisted on the task state). Measured
+ * usage can only tighten: when a worker reports MORE tokens than the
+ * heuristic estimates, the measured number governs and the trim fires at
+ * least as early as before (spec U10 acceptance — the budget is never
+ * exceeded in that direction); when usage is absent the pure heuristic
+ * applies unchanged (fallback). PURE — no I/O, no env reads (callers pass
+ * the resolved budget from {@link resolveHandoffBudgetTokens}); returns the
+ * input reference unchanged when the budget is off (≤0 or >1_000_000) or
+ * the context already fits.
  *
  * Trim policy (declaration order): dependencies are probed from ALL-full
  * downward — the largest prefix of dependencies that still fits keeps its