pi-crew 0.9.20 → 0.9.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.9.20",
+  "version": "0.9.22",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",

package/src/extension/cross-extension-rpc.ts

@@ -1,9 +1,9 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { TeamToolParamsValue } from "../schema/team-tool-schema.ts";
 import { resolveContainedPath } from "../utils/safe-paths.ts";
+import { withHmacVerification } from "./rpc-hmac.ts";
 // Lazy-loaded to avoid pulling team-tool.ts (and its entire runtime chain) into module load.
 import type { handleTeamTool as HandleTeamToolFn } from "./team-tool.ts";
-import { withHmacVerification } from "./rpc-hmac.ts";
 
 let _cachedHandleTeamTool: typeof HandleTeamToolFn | undefined;
 async function handleTeamTool(
@@ -137,7 +137,7 @@ function isAllowedRpcRunParams(params: TeamToolParamsValue): {
 	return { ok: true };
 }
 
-function on(events: EventBusLike, channel: string, handler: (raw: unknown) => void): () => void {
+function on(events: EventBusLike, channel: string, handler: (raw: any) => unknown): () => void {
 	const unsub = events.on(channel, handler);
 	return typeof unsub === "function" ? unsub : () => {};
 }
@@ -184,7 +184,20 @@ export function registerPiCrewRpc(
 					const ctx = getCtx();
 					if (!ctx) throw new Error("No active pi-crew session context.");
 					// Validate payload: only allow known fields from TeamToolParamsValue
-					const ALLOWED_RPC_RUN_KEYS = new Set(["goal", "team", "workflow", "async", "cwd", "config", "skill", "model"]);
+					const ALLOWED_RPC_RUN_KEYS = new Set([
+						"goal",
+						"team",
+						"workflow",
+						"async",
+						"cwd",
+						"config",
+						"skill",
+						"model",
+						"budgetTotal",
+						"budgetWarning",
+						"budgetAbort",
+						"budgetUnlimited",
+					]);
 					let params: TeamToolParamsValue;
 					if (raw && typeof raw === "object" && !Array.isArray(raw)) {
 						const filtered: Record<string, unknown> = {

package/src/extension/team-tool/run.ts

@@ -12,7 +12,7 @@ import { createRunManifest, loadRunManifestById, updateRunStatus } from "../../s
 import { allTeams, discoverTeams } from "../../teams/discover-teams.ts";
 import { allWorkflows, discoverWorkflows } from "../../workflows/discover-workflows.ts";
 import { validateWorkflowForTeam } from "../../workflows/validate-workflow.ts";
-import { assertCleanLeader, findGitRoot } from "../../worktree/worktree-manager.ts";
+import { assertCleanLeaderAsync, findGitRootAsync } from "../../worktree/worktree-manager.ts";
 
 // eslint-disable-next-line @typescript-eslint/no-unused-vars -- type-only import for TS inference
 const _typeCheck: typeof ExecuteTeamRunFn = null as never as typeof ExecuteTeamRunFn;
@@ -226,7 +226,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	let resolvedCtx = ctx;
 	if (workingDir) {
 		try {
-			const gitRoot = findGitRoot(workingDir);
+			const gitRoot = await findGitRootAsync(workingDir);
 			if (gitRoot && gitRoot !== workingDir) {
 				resolvedCtx = { ...ctx, cwd: gitRoot };
 			}
@@ -241,7 +241,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	if (params.workspaceMode === "worktree") {
 		let gitRoot: string | undefined;
 		try {
-			gitRoot = findGitRoot(resolvedCtx.cwd);
+			gitRoot = await findGitRootAsync(resolvedCtx.cwd);
 		} catch {
 			// not a git repo
 		}
@@ -256,7 +256,7 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 		const preCheckConfig = loadConfig(resolvedCtx.cwd);
 		if (preCheckConfig.config.requireCleanWorktreeLeader !== false) {
 			try {
-				assertCleanLeader(gitRoot);
+				await assertCleanLeaderAsync(gitRoot);
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err);
 				return result(
@@ -573,10 +573,31 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 	const executedConfig = effectiveRunConfig(loadedConfig.config, params.config);
 	const runtime = await resolveCrewRuntime(executedConfig);
 	const runtimeResolution = runtimeResolutionState(runtime);
+	// DEBUG: log what we received (gated to avoid stdout pollution in production)
+	if (process.env.PI_CREW_DEBUG_BUDGET === "1") {
+		console.log(
+			"[DEBUG budget] params keys:",
+			Object.keys(params),
+			"budgetTotal:",
+			params.budgetTotal,
+			"budgetWarning:",
+			params.budgetWarning,
+			"budgetAbort:",
+			params.budgetAbort,
+		);
+	}
 	const executionManifest = {
 		...updatedManifest,
 		runtimeResolution,
 		runConfig: executedConfig,
+		// Persist budget config on the manifest so it's observable post-run
+		// (events.jsonl, status reads, audits). The team-runner reads these
+		// from the input, but persisting them means consumers can verify
+		// enforcement was armed without re-parsing the original call params.
+		...(params.budgetTotal !== undefined ? { budgetTotal: params.budgetTotal } : {}),
+		...(params.budgetWarning !== undefined ? { budgetWarning: params.budgetWarning } : {}),
+		...(params.budgetAbort !== undefined ? { budgetAbort: params.budgetAbort } : {}),
+		...(params.budgetUnlimited !== undefined ? { budgetUnlimited: params.budgetUnlimited } : {}),
 		updatedAt: new Date().toISOString(),
 	};
 	atomicWriteJson(paths.manifestPath, executionManifest);
@@ -862,6 +883,10 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 					metricRegistry: ctx.metricRegistry,
 					onJsonEvent: ctx.onJsonEvent,
 					workspaceId: ctx.sessionId ?? ctx.cwd,
+					budgetTotal: params.budgetTotal,
+					budgetWarning: params.budgetWarning,
+					budgetAbort: params.budgetAbort,
+					budgetUnlimited: params.budgetUnlimited,
 				});
 			} finally {
 				unregisterActiveRun(updatedManifest.runId);
@@ -1006,6 +1031,10 @@ export async function handleRun(params: TeamToolParamsValue, ctx: TeamContext):
 			metricRegistry: ctx.metricRegistry,
 			onJsonEvent: ctx.onJsonEvent,
 			workspaceId: ctx.cwd,
+			budgetTotal: params.budgetTotal,
+			budgetWarning: params.budgetWarning,
+			budgetAbort: params.budgetAbort,
+			budgetUnlimited: params.budgetUnlimited,
 		});
 	} finally {
 		unregisterActiveRun(updatedManifest.runId);

package/src/runtime/background-runner.ts

@@ -714,6 +714,9 @@ async function main(): Promise<void> {
 				switch (manifest.runKind ?? "team-run") {
 					default: {
 						// Existing "team-run" path — unchanged behavior.
+						// Forward budget fields from manifest (set by team-tool/run.ts
+						// from params.budgetTotal/etc.) so the team-runner's
+						// checkPerTaskBudget guard actually arms.
 						result = await executeTeamRun({
 							manifest,
 							tasks,
@@ -728,6 +731,10 @@ async function main(): Promise<void> {
 							reliability: runConfig.reliability,
 							workspaceId: manifest.ownerSessionId ?? manifest.cwd,
 							signal: abortController.signal,
+							...(manifest.budgetTotal !== undefined ? { budgetTotal: manifest.budgetTotal } : {}),
+							...(manifest.budgetWarning !== undefined ? { budgetWarning: manifest.budgetWarning } : {}),
+							...(manifest.budgetAbort !== undefined ? { budgetAbort: manifest.budgetAbort } : {}),
+							...(manifest.budgetUnlimited !== undefined ? { budgetUnlimited: manifest.budgetUnlimited } : {}),
 						});
 						break;
 					}

package/src/runtime/dynamic-workflow-context.ts

@@ -32,7 +32,7 @@ import { appendMailboxMessage, readMailbox } from "../state/mailbox.ts";
 import type { TeamRunManifest } from "../state/types.ts";
 import type { TeamConfig } from "../teams/team-config.ts";
 import { logInternalError } from "../utils/internal-error.ts";
-import { cleanupAgentWorktree, prepareAgentWorktree } from "../worktree/worktree-manager.ts";
+import { cleanupAgentWorktreeAsync, prepareAgentWorktreeAsync } from "../worktree/worktree-manager.ts";
 import { runChildPi } from "./child-pi.ts";
 import type { DwfCheckpointState } from "./dwf-state-store.ts";
 import { mapConcurrent } from "./parallel-utils.ts";
@@ -342,7 +342,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				// when worktree creation is unavailable (no git repo, dirty leader).
 				let agentCwd = manifest.cwd;
 				if (call.worktree === true) {
-					const wt = prepareAgentWorktree(manifest, `dwf-agent-${Date.now()}-${randomBytes(4).toString("hex")}`);
+					const wt = await prepareAgentWorktreeAsync(manifest, `dwf-agent-${Date.now()}-${randomBytes(4).toString("hex")}`);
 					if (wt?.worktreePath) {
 						agentCwd = wt.cwd;
 						worktreePath = wt.worktreePath;
@@ -431,7 +431,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				// — a leak must never crash the workflow.
 				if (worktreePath) {
 					try {
-						cleanupAgentWorktree(manifest, worktreePath, worktreeBranch);
+						await cleanupAgentWorktreeAsync(manifest, worktreePath, worktreeBranch);
 					} catch (cleanupError) {
 						logInternalError("dynamic-workflow-context.worktree-cleanup", cleanupError, `worktreePath=${worktreePath}`);
 					}

package/src/runtime/task-runner.ts

@@ -20,7 +20,7 @@ import type {
 import { logInternalError } from "../utils/internal-error.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
-import { captureWorktreeDiff, captureWorktreeDiffStat, prepareTaskWorkspace } from "../worktree/worktree-manager.ts";
+import { captureWorktreeDiffAsync, captureWorktreeDiffStatAsync, prepareTaskWorkspaceAsync } from "../worktree/worktree-manager.ts";
 import { reserveControlChannel } from "./agent-control.ts";
 import { appendTaskAttentionEvent } from "./attention-events.ts";
 import { buildSyntheticTerminalEvidence, cancellationReasonFromSignal } from "./cancellation.ts";
@@ -122,7 +122,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 	let streamBridge: ReturnType<typeof registerStreamBridge> | undefined;
 	try {
 		streamBridge = registerStreamBridge(manifest.runId);
-		const workspace = prepareTaskWorkspace(manifest, input.task, input.step.seedPaths);
+		const workspace = await prepareTaskWorkspaceAsync(manifest, input.task, input.step.seedPaths);
 		const worktree =
 			workspace.worktreePath && workspace.branch
 				? {
@@ -905,7 +905,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 			? writeArtifact(manifest.artifactsRoot, {
 					kind: "diff",
 					relativePath: `diffs/${task.id}.diff`,
-					content: captureWorktreeDiff(workspace.worktreePath),
+					content: await captureWorktreeDiffAsync(workspace.worktreePath),
 					producer: task.id,
 				})
 			: undefined;
@@ -913,7 +913,7 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 			? writeArtifact(manifest.artifactsRoot, {
 					kind: "metadata",
 					relativePath: `metadata/${task.id}.diff-stat.json`,
-					content: `${JSON.stringify({ ...captureWorktreeDiffStat(workspace.worktreePath), syntheticPaths: workspace.syntheticPaths ?? [], nodeModulesLinked: workspace.nodeModulesLinked ?? false }, null, 2)}\n`,
+					content: `${JSON.stringify({ ...(await captureWorktreeDiffStatAsync(workspace.worktreePath)), syntheticPaths: workspace.syntheticPaths ?? [], nodeModulesLinked: workspace.nodeModulesLinked ?? false }, null, 2)}\n`,
 					producer: task.id,
 				})
 			: undefined;

package/src/runtime/team-runner.ts

@@ -13,7 +13,7 @@ import { HealthStore } from "../state/health-store.ts";
 import { withRunLock } from "../state/locks.ts";
 import { loadRunManifestById, saveRunManifest, saveRunManifestAsync, saveRunTasksAsync, updateRunStatus } from "../state/state-store.ts";
 import type { ArtifactDescriptor, PolicyDecision, TaskAttemptState, TeamRunManifest, TeamTaskState } from "../state/types.ts";
-import { aggregateUsage, formatUsage } from "../state/usage.ts";
+import { aggregateUsage, formatTokens, formatUsage } from "../state/usage.ts";
 import type { TeamConfig } from "../teams/team-config.ts";
 import { logInternalError } from "../utils/internal-error.ts";
 import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
@@ -130,6 +130,60 @@ export interface ExecuteTeamRunInput {
 	onJsonEvent?: (taskId: string, runId: string, event: unknown) => void;
 	/** Workspace where this run was initiated — used for session-scoped live-agent visibility. */
 	workspaceId: string;
+	/** Total token budget for the run. When set, enables per-task budget enforcement. */
+	budgetTotal?: number;
+	/** Budget warning threshold as a fraction (0-1). Default: 0.8 (80%). */
+	budgetWarning?: number;
+	/** Budget abort threshold as a fraction (0-1). Default: 0.95 (95%). */
+	budgetAbort?: number;
+	/** When true, skip budget enforcement entirely. */
+	budgetUnlimited?: boolean;
+}
+
+/**
+ * Result of a per-task budget check against cumulative run usage.
+ */
+export interface PerTaskBudgetCheckResult {
+	/** Whether the abort threshold was exceeded. */
+	abort: boolean;
+	/** Whether the warning threshold was exceeded. */
+	warning: boolean;
+	/** IDs of tasks that exceeded their fair share (>50% of remaining budget). */
+	fairShareViolators: string[];
+	/** Total tokens used so far. */
+	totalUsed: number;
+}
+
+/**
+ * Check cumulative token usage against per-task budget thresholds.
+ * Returns a structured result — callers decide how to act (warn vs abort).
+ *
+ * Exported for unit testing.
+ */
+export function checkPerTaskBudget(
+	tasks: TeamTaskState[],
+	budgetTotal: number,
+	budgetWarning: number,
+	budgetAbort: number,
+	fairShareFraction = 0.5,
+): PerTaskBudgetCheckResult {
+	const usage = aggregateUsage(tasks);
+	const totalUsed = (usage?.input ?? 0) + (usage?.output ?? 0) + (usage?.cacheWrite ?? 0);
+	const abort = totalUsed >= budgetAbort * budgetTotal;
+	const warning = !abort && totalUsed >= budgetWarning * budgetTotal;
+	const remainingBudget = Math.max(0, budgetTotal - totalUsed);
+	const fairShareThreshold = remainingBudget * fairShareFraction;
+	const fairShareViolators: string[] = [];
+	for (const task of tasks) {
+		if (!task.usage) continue;
+		const taskTotal = (task.usage.input ?? 0) + (task.usage.output ?? 0) + (task.usage.cacheWrite ?? 0);
+		// Only flag tasks that individually consumed a significant portion of the
+		// budget (>10% of total) AND exceeded the fair share of remaining budget.
+		if (fairShareThreshold > 0 && taskTotal > fairShareThreshold && taskTotal > budgetTotal * 0.1) {
+			fairShareViolators.push(task.id);
+		}
+	}
+	return { abort, warning, fairShareViolators, totalUsed };
 }
 
 function findStep(workflow: WorkflowConfig, task: TeamTaskState): WorkflowStep {
@@ -586,6 +640,18 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 		input.executeWorkers ? "Executing team workflow." : "Creating workflow prompts and placeholder results.",
 	);
 
+	// Persist budget fields on the manifest so all subsequent saveRunManifest
+	// calls (there are many in executeTeamRunCore) preserve the budget config.
+	// Without this, the spread in updateRunStatus and other transformations
+	// can drop budget fields before they reach the persistence layer.
+	if (input.budgetTotal !== undefined) manifest.budgetTotal = input.budgetTotal;
+	if (input.budgetWarning !== undefined) manifest.budgetWarning = input.budgetWarning;
+	if (input.budgetAbort !== undefined) manifest.budgetAbort = input.budgetAbort;
+	if (input.budgetUnlimited !== undefined) manifest.budgetUnlimited = input.budgetUnlimited;
+	if (manifest.budgetTotal !== undefined && manifest.budgetTotal > 0 && !manifest.budgetUnlimited) {
+		saveRunManifest(manifest);
+	}
+
 	void registerRunPromise(manifest.runId);
 
 	// FIX (Round 15, regression): Start a team-level heartbeat so the stale
@@ -1444,6 +1510,69 @@ async function executeTeamRunCore(
 			wfMachine = { ...wfMachine, currentPhaseIndex: pi + 1 };
 		}
 
+		// Per-task budget enforcement: check cumulative usage after each batch merge.
+		// This prevents a single task from consuming 100% of the budget before
+		// abort triggers (the goal-loop only checks at turn boundaries).
+		if (input.budgetTotal !== undefined && input.budgetTotal > 0 && input.budgetUnlimited !== true) {
+			const warnThreshold = input.budgetWarning ?? 0.8;
+			const abortThreshold = input.budgetAbort ?? 0.95;
+			const budgetCheck = checkPerTaskBudget(tasks, input.budgetTotal, warnThreshold, abortThreshold);
+
+			if (budgetCheck.abort) {
+				const message = `Per-task budget abort threshold exceeded: ${formatTokens(budgetCheck.totalUsed)}/${formatTokens(input.budgetTotal)} (${Math.round((budgetCheck.totalUsed / input.budgetTotal) * 100)}%)`;
+				console.warn(`[team-runner] ${message}`);
+				await appendEventAsync(manifest.eventsPath, {
+					type: "run.budget_abort",
+					runId: manifest.runId,
+					message,
+					data: {
+						budgetTotal: input.budgetTotal,
+						budgetUsed: budgetCheck.totalUsed,
+						threshold: "abort",
+					},
+				});
+				tasks = markBlocked(tasks, `Budget abort threshold exceeded: ${message}`);
+				await saveRunTasksAsync(manifest, tasks);
+				manifest = updateRunStatus(manifest, "failed", message);
+				return { manifest, tasks };
+			}
+
+			if (budgetCheck.warning) {
+				const message = `Per-task budget warning threshold crossed: ${formatTokens(budgetCheck.totalUsed)}/${formatTokens(input.budgetTotal)} (${Math.round((budgetCheck.totalUsed / input.budgetTotal) * 100)}%)`;
+				console.warn(`[team-runner] ${message}`);
+				await appendEventAsync(manifest.eventsPath, {
+					type: "run.budget_warning",
+					runId: manifest.runId,
+					message,
+					data: {
+						budgetTotal: input.budgetTotal,
+						budgetUsed: budgetCheck.totalUsed,
+						threshold: "warning",
+					},
+				});
+			}
+
+			// Fair-share warning: flag tasks that consumed >50% of remaining budget
+			// without killing them mid-execution.
+			for (const violatorId of budgetCheck.fairShareViolators) {
+				const violator = tasks.find((t) => t.id === violatorId);
+				if (!violator) continue;
+				const taskTotal = (violator.usage?.input ?? 0) + (violator.usage?.output ?? 0) + (violator.usage?.cacheWrite ?? 0);
+				const message = `Task '${violatorId}' consumed ${formatTokens(taskTotal)} (${Math.round((taskTotal / input.budgetTotal) * 100)}% of total budget) — exceeds fair share`;
+				console.warn(`[team-runner.fair-share] ${message}`);
+				await appendEventAsync(manifest.eventsPath, {
+					type: "task.budget_fair_share",
+					runId: manifest.runId,
+					taskId: violatorId,
+					message,
+					data: {
+						budgetTotal: input.budgetTotal,
+						taskUsage: taskTotal,
+					},
+				});
+			}
+		}
+
 		const cancelledResult = results.find((item) => item.manifest.status === "cancelled");
 		if (cancelledResult || input.signal?.aborted) {
 			const reason = input.signal?.aborted ? cancellationReasonFromSignal(input.signal) : undefined;

package/src/runtime/tool-output-pruner.ts

@@ -90,8 +90,10 @@ export interface PruneResult {
 // Token estimation (rough char/4 heuristic, matching gajae-code)
 // ---------------------------------------------------------------------------
 
+import { countTokens } from "../utils/token-counter.ts";
+
 function estimateTokens(text: string): number {
-	return Math.ceil(text.length / 4);
+	return countTokens(text);
 }
 
 // ---------------------------------------------------------------------------
@@ -146,7 +148,7 @@ function createPrunedNotice(tokens: number, entry: ToolResultEntry): string {
 	const generic = `[Output pruned — ${tokens} tokens]`;
 	const digest = resultDigest(entry.toolName, entry.content, entry.isError);
 	if (!digest) return generic;
-	const genericTokens = Math.ceil(generic.length / 4);
+	const genericTokens = countTokens(generic);
 	const maxTokens = Math.max(genericTokens, Math.floor(genericTokens * DIGEST_NOTICE_TOKEN_CAP_MULTIPLIER));
 	const prefix = `[Output pruned — ${tokens} tokens; `;
 	const suffix = "]";
@@ -303,7 +305,7 @@ export function pruneToolOutputs(results: ToolResultEntry[], config: PruneConfig
 			entry,
 			tokens,
 			notice,
-			savings: Math.max(0, tokens - Math.ceil(notice.length / 4)),
+			savings: Math.max(0, tokens - countTokens(notice)),
 		});
 		accumulatedTokens += tokens;
 	}

package/src/state/event-log.ts

@@ -350,6 +350,11 @@ export function checkSequenceGaps(eventsPath: string): { missing: number }[] {
  * from firing and degrading live-agent responsiveness.
  */
 export function appendEvent(eventsPath: string, event: AppendTeamEvent): TeamEvent {
+	// NOTE: appendEvent is a sync function that uses withEventLogLockSync (sleepSync).
+	// It cannot route through appendEventBuffered because the buffer timer requires
+	// the event loop to fire, which sleepSync blocks. Both terminal and non-terminal
+	// events use the direct sync path here. For non-terminal events, callers should
+	// prefer appendEventAsync (which routes through the buffer for coalesced writes).
 	return withEventLogLockSync(eventsPath, () => appendEventInsideLock(eventsPath, event));
 }
 
@@ -405,6 +410,15 @@ export function resetEventLogMode(): void {
  * foreground-control, etc.), prefer this over the sync `appendEvent()`.
  */
 export async function appendEventAsync(eventsPath: string, event: AppendTeamEvent): Promise<TeamEvent> {
+	// Non-terminal events: route through buffer for coalesced writes (20ms default).
+	// This eliminates per-event fsync + persistSequence overhead for high-frequency events.
+	// The buffer timer is kept alive (ref'd) so standalone contexts (tests, short-lived
+	// scripts) get their events flushed before the loop drains — no per-event keepAlive
+	// intervals needed (which previously starved the event loop at high fan-out).
+	if (!TERMINAL_EVENT_TYPES.has(event.type)) {
+		return appendEventBuffered(eventsPath, event);
+	}
+	// Terminal events: direct async path for immediate durability guarantee
 	const queueKey = eventsPath;
 	const prev = asyncQueues.get(queueKey) ?? Promise.resolve();
 	const next = prev.then(async (): Promise<TeamEvent> => {
@@ -600,6 +614,131 @@ export async function appendEventAsync(eventsPath: string, event: AppendTeamEven
  * `withEventLogLockSync` for `eventsPath`. Used by `appendEventBuffered` to
  * write a whole batch of pending events under a single lock acquire.
  */
+/**
+ * Batch variant used by the buffered flush path. Computes metadata for each
+ * event, writes the whole batch in a single appendFileSync + fsync, persists
+ * the sequence sidecar once with the last seq, and updates the sequence cache
+ * once. Resolves each item with its finalized event (carrying the assigned
+ * seq). This collapses N fsyncs into 1 for the buffered write path, which is
+ * the entire point of buffering — the previous per-event fsync made buffer
+ * coalescing useless and added ~30ms/event on tmpfs.
+ */
+async function appendEventBatchInsideLock(eventsPath: string, queue: BufferedAppend[]): Promise<void> {
+	if (queue.length === 0) return;
+	fs.mkdirSync(path.dirname(eventsPath), { recursive: true });
+
+	// Pre-flight size check (mirrors appendEventInsideLock). We do it once for
+	// the batch instead of once per event.
+	try {
+		if (fs.existsSync(eventsPath)) {
+			const stat = fs.statSync(eventsPath);
+			if (stat.size > MAX_EVENTS_BYTES) {
+				try {
+					const prepared = prepareCompaction(eventsPath);
+					if (prepared) applyCompactionUnlocked(eventsPath, prepared);
+				} catch (error) {
+					logInternalError("event-log.batch-immediate-compact", error, `eventsPath=${eventsPath}`);
+				}
+				if (fs.existsSync(eventsPath) && fs.statSync(eventsPath).size > MAX_EVENTS_BYTES) {
+					rotateEventLogUnlocked(eventsPath);
+				}
+			}
+		}
+	} catch (error) {
+		logInternalError("event-log.batch-size-check", error, `eventsPath=${eventsPath}`);
+	}
+
+	// Phase 1: compute metadata + JSON lines for every event in the batch.
+	// Initialize nextSeq ONCE from nextSequence (or the first event's baseMetadata.seq),
+	// then increment locally for each subsequent event in the batch. Calling
+	// nextSequence() per-event would re-read file stat/sidecar with no writes
+	// in between — every call would see the same file state and return the same
+	// seq, breaking the "unique monotonic seq" contract. The cache update +
+	// persistSequence at the end refreshes the sidecar to the last assigned seq.
+	const startingSeq = queue[0]?.event.metadata?.seq ?? nextSequence(eventsPath);
+	let nextSeq = startingSeq;
+	const finalized: { item: BufferedAppend; line: string; fullEvent: TeamEvent }[] = [];
+	let lastSeq = 0;
+	for (const item of queue) {
+		const baseMetadata = item.event.metadata;
+		const seq = baseMetadata?.seq ?? nextSeq++;
+		let metadata: TeamEventMetadata = {
+			seq,
+			provenance: baseMetadata?.provenance ?? "team_runner",
+			...(baseMetadata?.parentEventId ? { parentEventId: baseMetadata.parentEventId } : {}),
+			...(baseMetadata?.attemptId ? { attemptId: baseMetadata.attemptId } : {}),
+			...(baseMetadata?.branchId ? { branchId: baseMetadata.branchId } : {}),
+			...(baseMetadata?.causationId ? { causationId: baseMetadata.causationId } : {}),
+			...(baseMetadata?.correlationId ? { correlationId: baseMetadata.correlationId } : {}),
+			...(baseMetadata?.sessionIdentity ? { sessionIdentity: baseMetadata.sessionIdentity } : {}),
+			...(baseMetadata?.ownership ? { ownership: baseMetadata.ownership } : {}),
+			...(baseMetadata?.nudgeId ? { nudgeId: baseMetadata.nudgeId } : {}),
+			...(baseMetadata?.confidence ? { confidence: baseMetadata.confidence } : {}),
+		};
+		const fullEvent: TeamEvent = {
+			time: new Date().toISOString(),
+			...item.event,
+			metadata,
+		};
+		if (baseMetadata?.fingerprint || TERMINAL_EVENT_TYPES.has(fullEvent.type)) {
+			metadata = {
+				...metadata,
+				fingerprint: baseMetadata?.fingerprint ?? computeEventFingerprint(fullEvent),
+			};
+			fullEvent.metadata = metadata;
+		}
+		finalized.push({ item, line: `${JSON.stringify(redactSecrets(fullEvent))}\n`, fullEvent });
+		lastSeq = seq;
+	}
+
+	// Phase 2: single appendFileSync + single fsync + single persistSequence.
+	// Before this fix, each event in the batch triggered its own fsync, which
+	// was the dominant cost on tmpfs and CI runners.
+	try {
+		if (fs.existsSync(eventsPath) && fs.statSync(eventsPath).size > MAX_EVENTS_BYTES) {
+			logInternalError(
+				"event-log.size-limit",
+				new Error(`events file ${eventsPath} exceeds ${MAX_EVENTS_BYTES} bytes after compaction`),
+				`eventsPath=${eventsPath}`,
+			);
+			// Reject the batch — caller will surface the error per item.
+			for (const { item } of finalized) item.reject(new Error("event log size limit exceeded"));
+			return;
+		}
+	} catch (error) {
+		logInternalError("event-log.batch-size-check-post", error, `eventsPath=${eventsPath}`);
+	}
+
+	fs.appendFileSync(eventsPath, finalized.map((f) => f.line).join(""), "utf-8");
+	const fd = fs.openSync(eventsPath, "r+");
+	try {
+		fs.fsyncSync(fd);
+	} catch {
+		// EPERM on Windows CI: best-effort flush
+	} finally {
+		fs.closeSync(fd);
+	}
+	persistSequence(eventsPath, lastSeq);
+
+	// Phase 3: cache update + resolve all promises.
+	try {
+		const stat = fs.statSync(eventsPath);
+		if (sequenceCache.size >= MAX_SEQUENCE_CACHE_ENTRIES) {
+			evictOldestSequenceCacheEntries();
+		}
+		sequenceCache.set(eventsPath, {
+			size: stat.size,
+			mtimeMs: stat.mtimeMs,
+			seq: lastSeq,
+			lastAccessMs: Date.now(),
+		});
+	} catch (error) {
+		logInternalError("event-log.batch-cache-update", error, `eventsPath=${eventsPath}`);
+	}
+
+	for (const { item, fullEvent } of finalized) item.resolve(fullEvent);
+}
+
 function appendEventInsideLock(eventsPath: string, event: AppendTeamEvent): TeamEvent {
 	fs.mkdirSync(path.dirname(eventsPath), { recursive: true });
 	const baseMetadata = event.metadata;
@@ -766,8 +905,15 @@ export function appendEventBuffered(eventsPath: string, event: AppendTeamEvent,
 		queue.push({ event, resolve, reject });
 		bufferedQueues.set(eventsPath, queue);
 		if (!bufferedTimers.has(eventsPath)) {
-			const timer = setTimeout(() => flushOneEventLogBuffer(eventsPath), bufferMs);
-			timer.unref();
+			// Wrap flush in async IIFE so the returned Promise is awaited (avoids
+			// "floating promise" warnings under --test-force-exit and prevents
+			// the timer from being treated as done before the flush actually
+			// completes its async work).
+			const timer = setTimeout(() => {
+				flushOneEventLogBuffer(eventsPath).catch((error) => {
+					logInternalError("event-log.buffered-flush", error, `eventsPath=${eventsPath}`);
+				});
+			}, bufferMs);
 			bufferedTimers.set(eventsPath, timer);
 		}
 	});
@@ -812,15 +958,12 @@ async function flushOneEventLogBuffer(eventsPath: string): Promise<void> {
 		// FIX (Issue 2): Use async lock instead of withEventLogLockSync to avoid
 		// blocking the event loop. The sync lock uses sleepSync which blocks for
 		// up to 5s and prevents AbortSignal handlers from firing.
+		// FIX (P0 follow-up): Batch the file write + fsync + persistSequence across
+		// the whole queue. Previously each event triggered its own fsyncSync,
+		// turning 100 buffered events into 100 fsyncs (~3s on tmpfs). Now we do
+		// 1 appendFileSync + 1 fsync + 1 persistSequence for the whole batch.
 		await withEventLogLockAsync(eventsPath, async () => {
-			for (const item of queue) {
-				try {
-					const ev = appendEventInsideLock(eventsPath, item.event);
-					item.resolve(ev);
-				} catch (error) {
-					item.reject(error);
-				}
-			}
+			await appendEventBatchInsideLock(eventsPath, queue);
 		});
 	} catch (error) {
 		// Lock acquire failed — fail every queued item so callers can fall back.
@@ -848,13 +991,26 @@ export function appendEventFireAndForget(eventsPath: string, event: AppendTeamEv
 // Auto-flush on process exit so buffered events do not silently leak.
 // Defense-in-depth: SIGTERM/SIGINT use setImmediate so the handler returns
 // immediately and the main thread is not blocked by sync I/O.
+// FIX (P0 follow-up): Only call flushEventLogBuffer() / drainAsyncQueues() if
+// there is actually pending work. Calling them unconditionally creates a new
+// floating Promise that the test runner detects under --test-force-exit,
+// failing tests with "Promise resolution is still pending but the event loop
+// has already resolved" even when the test body completed cleanly.
 process.on("exit", () => {
-	flushEventLogBuffer();
+	if (bufferedQueues.size > 0) {
+		flushEventLogBuffer().catch(() => {
+			/* best-effort flush on exit */
+		});
+	}
 	// FIX (Issue 1): Drain asyncQueues on exit to minimize event loss.
 	// In-flight async writes are awaited (via Promise.allSettled) before
 	// the map is cleared. This reduces but does not eliminate event loss
 	// on crash — SIGKILL (kill -9) cannot be intercepted.
-	drainAsyncQueues();
+	if (asyncQueues.size > 0) {
+		drainAsyncQueues().catch(() => {
+			/* best-effort drain on exit */
+		});
+	}
 	asyncQueues.clear();
 });
 process.on("SIGTERM", () => setImmediate(() => flushEventLogBuffer()));

package/src/state/types.ts

@@ -208,6 +208,11 @@ export interface TeamRunManifest {
 	runKind?: "team-run" | "goal-loop" | "dynamic-workflow";
 	/** round-14 P1-5: typed workflow arguments accessible in .dwf.ts scripts via ctx.args<T>(). Any JSON value; default {} when unset. */
 	args?: unknown;
+	/** Per-run token budget snapshot. budgetTotal is the cap; budgetWarning/budgetAbort are fractions in [0,1] at which the team-runner emits run.budget_warning / run.budget_abort. budgetUnlimited=true opts out of enforcement. Optional for backward compat. */
+	budgetTotal?: number;
+	budgetWarning?: number;
+	budgetAbort?: number;
+	budgetUnlimited?: boolean;
 	summary?: string;
 	policyDecisions?: PolicyDecision[];
 	/** #2 (assessment): goal-achievement verdict — kills the silent false-green. */