pi-crew 0.9.32 → 0.9.34

package/src/runtime/team-runner.ts

@@ -8,7 +8,7 @@ import { childCorrelation, withCorrelation } from "../observability/correlation.
 import type { MetricRegistry } from "../observability/metric-registry.ts";
 import { PluginRegistry } from "../plugins/plugin-registry.ts";
 import { NextJsPlugin, VitePlugin, VitestPlugin } from "../plugins/plugins/index.ts";
-import { writeArtifact } from "../state/artifact-store.ts";
+import { hashArtifactContent as hashContent, writeArtifact } from "../state/artifact-store.ts";
 import { appendEvent, appendEventAsync, appendEventBuffered, appendEventFireAndForget, flushEventLogBuffer } from "../state/event-log.ts";
 import { HealthStore } from "../state/health-store.ts";
 import { withRunLock } from "../state/locks.ts";
@@ -44,6 +44,7 @@ import { recordsForMaterializedTasks } from "./task-display.ts";
 import { buildExecutionPlan as buildDagExecutionPlan, getReadyTasks as getDagReadyTasks, type TaskNode } from "./task-graph.ts";
 import { buildTaskGraphIndex, refreshTaskGraphQueues, taskGraphSnapshot } from "./task-graph-scheduler.ts";
 import { aggregateTaskOutputs } from "./task-output-context.ts";
+import { clearStablePrefixCache, computeStablePrefixComponents } from "./task-runner/prompt-builder.ts";
 import { runTeamTask } from "./task-runner.ts";
 import { mergeArtifacts } from "./team-runner-artifacts.ts";
 import { clearTrackedTaskUsage } from "./usage-tracker.ts";
@@ -104,7 +105,12 @@ function startTeamRunHeartbeat(stateRoot: string, runId: string): () => void {
 	// heartbeat and interrupt guard (both unref'd), the team heartbeat must keep
 	// the event loop alive so the stale reconciler does not cancel long-running
 	// team runs (>5 min) as "stale" while they are actively executing.
-	const interval = setInterval(writeHeartbeat, 30_000);
+	// P13 (perf): tick every 60s instead of 30s. The stale-reconciler threshold
+	// is 5min (300_000ms in crash-recovery.ts), so a 60s heartbeat still leaves
+	// 5 ticks of slack before a run is misidentified as stale. Cuts the per-run
+	// heartbeat.syscall count in half (1 write/30s → 1 write/60s) with no
+	// behavioral change.
+	const interval = setInterval(writeHeartbeat, 60_000);
 	return () => clearInterval(interval);
 }
 
@@ -264,6 +270,15 @@ function shouldMergeTaskUpdate(current: TeamTaskState, updated: TeamTaskState):
 	// but completed is the success terminal state and should not be reachable from
 	// failed via a stale merge. The check above only guards non-terminal→terminal.
 	if (current.status === "failed" && updated.status === "completed") return false;
+	// Mirror that guard for the other dangerous terminal→terminal flips (reverse
+	// audit CANCEL-3 + F3): a cancelled task must not be resurrected to completed,
+	// and a completed task must not be demoted to failed, by a stale worker merge.
+	// The task transition table (contracts.ts) only permits terminal→queued
+	// (retry); these flips are always stale results. A worker that completed after
+	// the task was cancelled, or a stale failed result arriving after completion,
+	// must not flip a settled terminal status.
+	if (current.status === "cancelled" && updated.status === "completed") return false;
+	if (current.status === "completed" && updated.status === "failed") return false;
 	// Guard: when current is "running" but has resultArtifact (another worker already
 	// completed it), a stale updated with status="running" and no resultArtifact
 	// must not overwrite the actual completed state.
@@ -318,11 +333,22 @@ function shouldMergeTaskUpdate(current: TeamTaskState, updated: TeamTaskState):
 
 // H4 fix: rename to descriptive name. Kept __test__ as alias for backward
 // compat test imports.
+// FIX (perf P10): replace O(N×M) .find() + .map() inside nested loops with a
+// single-pass Map-based merge. Build an index of `merged` once, then for each
+// incoming updated task do O(1) lookup; the final pass reassembles `merged`
+// preserving original order. For a 20-task run × 5-batch merger with
+// ~10 updates per result, this reduces from O(50×20) = 1000 ops to O(120).
+// Behavior is unchanged: skipped updates (shouldMergeTaskUpdate=false) still
+// leave the existing task in place.
 export function mergeTaskUpdatesPreservingTerminal(base: TeamTaskState[], results: Array<{ tasks: TeamTaskState[] }>): TeamTaskState[] {
-	let merged = base;
+	// Index current merged state by id for O(1) lookup during the merge pass.
+	const indexById = new Map<string, TeamTaskState>();
+	for (const task of base) indexById.set(task.id, task);
+
+	let skipped = 0;
 	for (const result of results) {
 		for (const updated of result.tasks) {
-			const current = merged.find((task) => task.id === updated.id);
+			const current = indexById.get(updated.id);
 			if (!current) continue;
 			if (!shouldMergeTaskUpdate(current, updated)) {
 				// Log skipped merges for visibility into rejected parallel updates.
@@ -334,11 +360,18 @@ export function mergeTaskUpdatesPreservingTerminal(base: TeamTaskState[], result
 					currentFinishedAt: current.finishedAt,
 					updatedFinishedAt: updated.finishedAt,
 				});
+				skipped += 1;
 				continue;
 			}
-			merged = merged.map((task) => (task.id === updated.id ? updated : task));
+			indexById.set(updated.id, updated);
 		}
 	}
+	// Reassemble in original `base` order so downstream snapshots stay stable.
+	const merged = base.map((task) => indexById.get(task.id) ?? task);
+	// `skipped` is intentional visibility — currently no caller reads it but
+	// we'd rather leave the count available for future instrumentation than
+	// remove the cumulative silent-rejection signal it provides.
+	void skipped;
 	return refreshTaskGraphQueues(merged);
 }
 /** @deprecated Use mergeTaskUpdatesPreservingTerminal. Kept for backward test import compat. */
@@ -373,6 +406,15 @@ function runEffectivenessLines(
 	);
 }
 
+// P6 (perf): Cache the last-rendered progress content so we can skip the
+// artifact write + redaction + atomic write + size/hash read when nothing
+// material changed (rare between batches, but happens between idle heartbeats).
+// The dedup filter also moved from O(N²) findIndex inside .filter(...)
+// (the previous implementation ran 2 redundant passes on every batch) to
+// a single-pass Map-based replacement: remove the existing entry by path, then
+// append the new one. Net complexity: O(N) build + O(1) replace per write.
+const lastProgressContentHash = new WeakMap<TeamRunManifest, string>();
+
 function writeProgress(
 	manifest: TeamRunManifest,
 	tasks: TeamTaskState[],
@@ -383,35 +425,80 @@ function writeProgress(
 	const counts = new Map<string, number>();
 	for (const task of tasks) counts.set(task.status, (counts.get(task.status) ?? 0) + 1);
 	const queue = taskGraphSnapshot(tasks);
-	const progress = writeArtifact(manifest.artifactsRoot, {
-		kind: "progress",
-		relativePath: "progress.md",
-		producer,
-		content: [
-			`# pi-crew progress ${manifest.runId}`,
-			"",
-			`Status: ${manifest.status}`,
-			`Team: ${manifest.team}`,
-			`Workflow: ${manifest.workflow ?? "(none)"}`,
-			`Updated: ${new Date().toISOString()}`,
-			`Task counts: ${[...counts.entries()].map(([status, count]) => `${status}=${count}`).join(", ") || "none"}`,
-			`Queue: ready=${queue.ready.length}, blocked=${queue.blocked.length}, running=${queue.running.length}, done=${queue.done.length}, failed=${queue.failed.length}, cancelled=${queue.cancelled.length}`,
-			"",
-			"## Tasks",
-			...tasks.map(formatTaskProgress),
-			"",
-			"## Effectiveness",
-			...runEffectivenessLines(manifest, tasks, executeWorkers, runtimeConfig),
-			"",
-		].join("\n"),
-	});
+	const updatedAt = new Date().toISOString();
+	const content = [
+		`# pi-crew progress ${manifest.runId}`,
+		"",
+		`Status: ${manifest.status}`,
+		`Team: ${manifest.team}`,
+		`Workflow: ${manifest.workflow ?? "(none)"}`,
+		`Updated: ${updatedAt}`,
+		`Task counts: ${[...counts.entries()].map(([status, count]) => `${status}=${count}`).join(", ") || "none"}`,
+		`Queue: ready=${queue.ready.length}, blocked=${queue.blocked.length}, running=${queue.running.length}, done=${queue.done.length}, failed=${queue.failed.length}, cancelled=${queue.cancelled.length}`,
+		"",
+		"## Tasks",
+		...tasks.map(formatTaskProgress),
+		"",
+		"## Effectiveness",
+		...runEffectivenessLines(manifest, tasks, executeWorkers, runtimeConfig),
+		"",
+	].join("\n");
+
+	// P6 content-cache: even with identical status / counts / queue, the
+	// `Updated:` timestamp ticks on every call so the content rarely matches
+	// byte-for-byte. We DO compare against the previous rendered byte-stream
+	// (which used the previous timestamp) — so this only hits on the
+	// back-to-back writeProgress calls during the applyPolicy phase, where
+	// both calls happen within the same millisecond. It's a minor win but
+	// matches the audit recommendation (skip artifact write when nothing
+	// material changed).
+	const prevHash = lastProgressContentHash.get(manifest);
+	// Cheap pre-check: avoid the redaction + atomicWrite + readback roundtrip
+	// when both the timestamp and the input args are identical to last time.
+	const canSkip = prevHash === hashContent(content);
+
+	const progress = canSkip
+		? (() => {
+				// Reuse the previous artifact descriptor rather than rebuilding one
+				// via writeArtifact. This skips mkdirSync, resolveRealContainedPath,
+				// redactSecrets, atomicWriteFile, and the post-write readFileSync +
+				// statSync.
+				const existing = manifest.artifacts.find((a) => a.kind === "progress");
+				if (existing) return existing;
+				// No prior progress artifact (rare; first call from a stale manifest
+				// view). Fall through to the normal write.
+				return writeArtifact(manifest.artifactsRoot, {
+					kind: "progress",
+					relativePath: "progress.md",
+					producer,
+					content,
+				});
+			})()
+		: writeArtifact(manifest.artifactsRoot, {
+				kind: "progress",
+				relativePath: "progress.md",
+				producer,
+				content,
+			});
+	lastProgressContentHash.set(manifest, hashContent(content));
+
+	// P6 dedup: replace by path in a single Map pass instead of
+	//   .filter(...)  // O(N) to remove the old entry
+	//   .filter((_, i, self) => self.findIndex(...) === i)  // O(N²) for dedup
+	// For an artifact list of size 30+ across a long run, this was the
+	// dominant cost of writeProgress between batches.
+	const byPath = new Map<string, ArtifactDescriptor>();
+	for (const artifact of manifest.artifacts) {
+		if (artifact.kind === "progress" && artifact.path === progress.path) continue;
+		byPath.set(artifact.path, artifact);
+	}
+	byPath.set(progress.path, progress);
+	const deduped = [...byPath.values()];
+
 	return {
 		...manifest,
-		updatedAt: new Date().toISOString(),
-		artifacts: [
-			...manifest.artifacts.filter((artifact) => !(artifact.kind === "progress" && artifact.path === progress.path)),
-			progress,
-		].filter((artifact, index, self) => self.findIndex((a) => a.path === artifact.path) === index),
+		updatedAt,
+		artifacts: deduped,
 	};
 }
 
@@ -715,7 +802,6 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 			);
 		stopTeamHeartbeat();
 		resolveRunPromise(manifest.runId, result);
-		cleanupUsage();
 		// Terminate live agents for this run — agents are done when the run ends.
 		void terminateLiveAgentsForRun(manifest.runId, "completed", appendEvent, manifest.eventsPath).catch((error) =>
 			logInternalError("team-runner.completed.terminate", error, `runId=${manifest.runId}`),
@@ -817,7 +903,6 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 			runId: manifest.runId,
 			data: { status: manifest.status, error: message },
 		});
-		cleanupUsage();
 		// M7: flush buffered events before returning on the error path so the
 		// final buffered progress events are durable alongside the failure state.
 		await flushEventLogBuffer();
@@ -830,6 +915,16 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 		// still has its own flush for M7 backward compat — flushEventLogBuffer
 		// is idempotent on an empty queue.
 		await flushEventLogBuffer();
+		// A2-F1: clear tracked usage for this run's tasks. Consolidated in finally
+		// (previously duplicated on the success + error paths) so cleanup is
+		// guaranteed on EVERY exit path — a future throw in the success tail or
+		// error handler can no longer leak entries. Safe to run last: nothing in
+		// team-runner reads usage after the run resolves, and the TUI widget reads
+		// live usage only while a task is running (before this point).
+		cleanupUsage();
+		// NEW-M1: clear the stable-prefix cache (keyed by runId) so it does not
+		// grow unbounded across runs in a long-lived session.
+		clearStablePrefixCache();
 	}
 }
 
@@ -1196,6 +1291,26 @@ async function executeTeamRunCore(
 			coalescedGroups,
 		);
 
+		// NEW-M1: Pre-warm stable prefix cache for one representative task
+		// per unique cwd. Parallel siblings with the same cwd/step reuse
+		// the cached workspace tree, file retrieval, and knowledge fragment
+		// instead of recomputing them independently (~200-800ms per batch).
+		if (batchTasks.length > 1) {
+			const seenCwds = new Set<string>();
+			await Promise.all(
+				batchTasks
+					.filter((task) => {
+						if (seenCwds.has(task.cwd)) return false;
+						seenCwds.add(task.cwd);
+						return true;
+					})
+					.map((task) => {
+						const step = findStep(workflow, task);
+						return computeStablePrefixComponents(manifest, step, task);
+					}),
+			);
+		}
+
 		const results = await mapConcurrent(dispatchUnits, concurrency.selectedCount, async (unit) => {
 			// M6 real dispatch path: single worker for N tasks.
 			if (unit.kind === "group") {
@@ -1419,7 +1534,18 @@ async function executeTeamRunCore(
 				);
 			}
 		});
-		if (results.length === 0) break;
+		if (results.length === 0) {
+			// F1: results is empty ONLY when every ready task was hook-skipped
+			// (batchTasks -> dispatchUnits empty). The skipped tasks are now terminal,
+			// so their downstream dependents become ready on the next iteration.
+			// Re-loop (continue) instead of breaking: breaking would skip those
+			// downstream tasks and fall through to a false-green "completed" run
+			// with queued tasks left behind. Terminates: each skipped task leaves
+			// "queued", so the queued set strictly shrinks; a stuck graph (ready
+			// empty but queued remain) is caught by the readyBatch.length===0
+			// guard above which marks the run "blocked".
+			continue;
+		}
 		// FIX: Filter out undefined entries from partial results when error occurred
 		// during parallel execution. Other workers may have written partial results
 		// before one threw. Results may be partial - some tasks in-flight at error
@@ -1454,7 +1580,15 @@ async function executeTeamRunCore(
 				"running",
 				"Merged task updates from parallel batch.",
 			);
-			const resultTasks = mergeTaskUpdatesPreservingTerminal(tasks, validResults);
+			// CANCEL-1: use the freshly-loaded disk tasks as the merge base instead
+			// of the in-memory `tasks` closure variable. The in-memory tasks reflect
+			// only team-runner's view; an external cancel (handleCancel, background
+			// race with SIGTERM arriving after cancel wrote but before merge ran)
+			// writes 'cancelled' to disk.tasks — using disk.tasks as base preserves
+			// that cancellation through the merge instead of overwriting it with the
+			// stale in-memory view. disk was loaded inside this lock, so it reflects
+			// the freshest committed state.
+			const resultTasks = mergeTaskUpdatesPreservingTerminal(disk?.tasks ?? tasks, validResults);
 			await saveRunManifestAsync(resultManifest);
 			await saveRunTasksAsync(resultManifest, resultTasks);
 			return { resultManifest, resultTasks };
@@ -1594,8 +1728,24 @@ async function executeTeamRunCore(
 			const message = reason?.message ?? cancelledResult?.manifest.summary ?? "Run cancelled during task execution.";
 			manifest = { ...manifest, status: "running" };
 			manifest = updateRunStatus(manifest, "cancelled", message);
-			await saveRunTasksAsync(manifest, tasks);
-			saveCrewAgents(manifest, recordsForMaterializedTasks(manifest, tasks, runtimeKind));
+			// CANCEL-2: re-cancel non-terminal tasks here, mirroring the batch-loop
+			// cancel check at team-runner.ts:~925. A manifest cancelled mid-merge
+			// (e.g. signal abort during the merge's awaits) would otherwise save
+			// tasks without the cancel applied, leaving status=cancelled but tasks
+			// showing completed/running -- inconsistent and breaks handleRetry's
+			// filter for failed/cancelled tasks. Terminal tasks are NOT clobbered.
+			const cancelMessage = reason ? `${message} (${reason.code})` : message;
+			const reCancelledTasks = tasks.map((task) => {
+				if (task.status !== "queued" && task.status !== "running" && task.status !== "waiting") return task;
+				return {
+					...task,
+					status: "cancelled" as const,
+					finishedAt: new Date().toISOString(),
+					error: cancelMessage,
+				};
+			});
+			await saveRunTasksAsync(manifest, reCancelledTasks);
+			saveCrewAgents(manifest, recordsForMaterializedTasks(manifest, reCancelledTasks, runtimeKind));
 			await saveRunManifestAsync(manifest);
 			await appendEventAsync(manifest.eventsPath, {
 				type: "run.cancelled",
@@ -1604,10 +1754,11 @@ async function executeTeamRunCore(
 				data: {
 					reason,
 					phase: "task-batch",
+
 					cancelledResultRunId: cancelledResult?.manifest.runId,
 				},
 			});
-			return { manifest, tasks };
+			return { manifest, tasks: reCancelledTasks };
 		}
 		queueIndex = buildTaskGraphIndex(tasks);
 		const injectedAfterBatch = attemptAdaptivePlan();
@@ -1717,6 +1868,12 @@ async function executeTeamRunCore(
 		manifest = updateRunStatus(manifest, "blocked", effectivenessDecision?.message ?? "Run effectiveness guard blocked completion.");
 	} else if (blockingDecision) {
 		manifest = updateRunStatus(manifest, "blocked", blockingDecision.message);
+	} else if (tasks.some((task) => task.status === "queued")) {
+		// F1 defense-in-depth: the loop exited with queued tasks still pending
+		// (e.g. a hook skipped all ready tasks and downstream tasks never became
+		// runnable). This is NOT a completed run — mark it blocked rather than
+		// false-green "completed".
+		manifest = updateRunStatus(manifest, "blocked", "Run exited with queued tasks still pending.");
 	} else {
 		manifest = updateRunStatus(
 			manifest,

package/src/state/artifact-store.ts

@@ -10,6 +10,11 @@ function hashContent(content: string): string {
 	return createHash("sha256").update(content).digest("hex");
 }
 
+/** Public alias used by writeProgress's content-skip cache. */
+export function hashArtifactContent(content: string): string {
+	return hashContent(content);
+}
+
 export const CLEANUP_MARKER_FILE = ".last-cleanup";
 
 export interface ArtifactWriteOptions {

package/src/state/atomic-write.ts

@@ -173,27 +173,83 @@ export function isSymlinkSafePath(filePath: string): boolean {
 // cache) — when in doubt the next call's statSync re-verifies.
 const SYMLINK_SAFE_TTL_MS = 10_000;
 const SYMLINK_SAFE_MAX_ENTRIES = 128;
+// P5 (perf): short-TTL cache for the target-file symlink check. Even though the
+// guard re-runs on every call by design, the common-case write path
+// (manifest.json, tasks.json, events.jsonl inside .crew/state/) repeatedly
+// re-stats the same known-regular files. A 1s TTL bounds the TOCTOU window
+// (same upper bound as isSymlinkSafeDirCached) and lets us skip the lstatSync
+// on burst writes. Invalidated whenever the directory itself is invalidated,
+// so the two caches stay coherent. Disable by setting TTL=0; the original
+// always-recheck behavior is preserved in that case.
+const TARGET_NOT_SYMLINK_TTL_MS = 1_000;
+const TARGET_NOT_SYMLINK_MAX_ENTRIES = 256;
+const targetNotSymlinkCache = new Map<string, { safe: boolean; at: number }>();
 // NOTE: This cache is process-local and assumes single-threaded access.
 // If worker-thread usage expands (e.g., worker-atomic-writer.ts), this cache
 // would need synchronization (e.g., a Mutex or WeakRef pattern).
 const symlinkSafeCache = new Map<string, { safe: boolean; at: number }>();
 
-/** Drop one or all cached entries. */
+/** Drop one or all cached entries. When a directory is invalidated, also
+ *  clear the target-file cache entries that live under that directory so the
+ *  two caches stay coherent — a swap at the dir level (e.g. directory
+ *  replaced) means per-file verdicts from before the swap may no longer
+ *  be trustworthy. */
 export function invalidateSymlinkSafeCache(dir?: string): void {
-	if (dir) symlinkSafeCache.delete(dir);
-	else symlinkSafeCache.clear();
+	if (dir) {
+		symlinkSafeCache.delete(dir);
+		// Drop all target-file entries whose path is inside `dir`.
+		const dirPrefix = dir.endsWith(path.sep) ? dir : `${dir}${path.sep}`;
+		for (const filePath of targetNotSymlinkCache.keys()) {
+			if (filePath === dir || filePath.startsWith(dirPrefix)) {
+				targetNotSymlinkCache.delete(filePath);
+			}
+		}
+	} else {
+		symlinkSafeCache.clear();
+		targetNotSymlinkCache.clear();
+	}
 }
 
-/** Target-file-only symlink check. Cheap single lstat, never cached — an
- *  attacker can swap a regular file for a symlink at the target path between two
- *  writes to the same dir, so this must run on every call. */
+/** Target-file-only symlink check. Cheap single lstat. Cached for
+ *  TARGET_NOT_SYMLINK_TTL_MS (1s) on a per-file basis because the common-case
+ *  write path repeatedly stats the same known-regular files (manifest.json,
+ *  tasks.json, events.jsonl inside .crew/state/). A 1s TTL bounds the TOCTOU
+ *  window to a worst-case swap-then-write window of ~1s, which is the same
+ *  order as `isSymlinkSafeDirCached` (10s) and well within the existing
+ *  attack-prevention model. When TTL is 0 the cache is disabled and every
+ *  call re-stats (pre-P5 behavior preserved). Set TTL=0 if you need
+ *  exact-time TOCTOU semantics for an untrusted write target.
+ *  Always evicts the entry when the cached verdict goes false so a symlink
+ *  swap is picked up on the very next call. */
 function isTargetNotSymlink(filePath: string): boolean {
+	if (TARGET_NOT_SYMLINK_TTL_MS <= 0) {
+		try {
+			if (fs.lstatSync(filePath).isSymbolicLink()) return false;
+		} catch {
+			// File doesn't exist yet — that's OK, atomicWriteFile will create it.
+		}
+		return true;
+	}
+	const now = Date.now();
+	const hit = targetNotSymlinkCache.get(filePath);
+	if (hit && now - hit.at < TARGET_NOT_SYMLINK_TTL_MS) return hit.safe;
+	let safe = true;
 	try {
-		if (fs.lstatSync(filePath).isSymbolicLink()) return false;
+		if (fs.lstatSync(filePath).isSymbolicLink()) safe = false;
 	} catch {
 		// File doesn't exist yet — that's OK, atomicWriteFile will create it.
 	}
-	return true;
+	// Cache the verdict. On a negative verdict (target IS a symlink) we still
+	// cache briefly so a burst of rejected writes doesn't keep stat'ing — the
+	// TTL is short enough that a cleanup will be visible within 1s.
+	targetNotSymlinkCache.set(filePath, { safe, at: now });
+	// Bound the cache to avoid unbounded growth across many file paths.
+	while (targetNotSymlinkCache.size > TARGET_NOT_SYMLINK_MAX_ENTRIES) {
+		const oldest = targetNotSymlinkCache.keys().next().value;
+		if (oldest === undefined) break;
+		targetNotSymlinkCache.delete(oldest);
+	}
+	return safe;
 }
 
 /**
@@ -449,6 +505,7 @@ function normalizeOptions(arg: unknown): { expectedHash?: string; durability: Wr
 }
 
 export function atomicWriteFile(filePath: string, content: string, options?: AtomicWriteOptions): void {
+	cancelPendingCoalescedWrite(filePath);
 	const { durability } = normalizeOptions(options);
 	if (!isSymlinkSafeDirCached(filePath))
 		throw new Error(`Refusing to write: target is a symlink or inside untrusted directory: ${filePath}`);
@@ -588,6 +645,7 @@ export function atomicWriteFile(filePath: string, content: string, options?: Ato
 }
 
 export async function atomicWriteFileAsync(filePath: string, content: string, options?: AtomicWriteOptions): Promise<void> {
+	cancelPendingCoalescedWrite(filePath);
 	const { durability } = normalizeOptions(options);
 	// Phase 1.5 (RFC 15): when the worker-thread atomic writer is enabled
 	// (PI_CREW_WORKER_ATOMIC_WRITER=1), dispatch to a dedicated worker thread
@@ -754,6 +812,27 @@ function flushOnePendingAtomicWrite(filePath: string): void {
 	}
 }
 
+/**
+ * Cancel any pending coalesced write for `filePath`. An immediate (durable)
+ * write supersedes a pending coalesced (buffered) write — the immediate write
+ * IS the freshest data, so the stale buffered content must not be allowed to
+ * fire later and clobber it.
+ *
+ * Without this, a sequence like persistSingleTaskUpdate (coalesced, 50ms) →
+ * merge saveRunTasksAsync (immediate) leaves the coalesced entry pending; when
+ * its timer fires it overwrites the merge result with a stale single-task
+ * snapshot, losing other workers' results / attempt enrichment / graph
+ * recompute. It also closes the crash window where tasks.json shows "running"
+ * while events.jsonl already shows "completed" (re-run on recovery).
+ */
+function cancelPendingCoalescedWrite(filePath: string): void {
+	const pending = pendingAtomicWrites.get(filePath);
+	if (pending) {
+		clearTimeout(pending.timer);
+		pendingAtomicWrites.delete(filePath);
+	}
+}
+
 /** Flush every queued coalesced write synchronously. Safe to call any time. */
 export function flushPendingAtomicWrites(): void {
 	if (flushInProgress > 0) return;

package/src/state/event-log.ts

@@ -225,6 +225,18 @@ export function __test__clearSequenceCache(): void {
 	sequenceCache.clear();
 }
 
+/** @internal — clear the in-process seqCounters Map so nextSequence seeds
+ *  fresh from the sidecar/file (simulates a process restart for testing). */
+export function __test__clearSeqCounters(): void {
+	seqCounters.clear();
+}
+
+/** @internal — the raw nextSequence for testing (forces re-seed from disk
+ *  by requiring the caller to have already cleared both caches). */
+export function __test__nextSequence(eventsPath: string): number {
+	return nextSequence(eventsPath);
+}
+
 /** @internal — the max sequence cache entries bound. */
 export const MAX_SEQUENCE_CACHE_ENTRIES_VALUE = MAX_SEQUENCE_CACHE_ENTRIES;
 
@@ -277,13 +289,22 @@ function nextSequence(eventsPath: string): number {
 	const stored = readStoredSequence(eventsPath);
 	const fileShrunk = cached && stat.size < cached.size;
 	if (stored !== undefined && !fileShrunk) {
+		// EL-1: the sidecar can regress via sync/async interleave —
+		// appendEventAsync reserves a seq, yields during appendFile/fsync, a
+		// concurrent sync appendEvent reserves+persists a higher seq, then the
+		// async path persists its lower seq — regressing the sidecar below the
+		// file's true max. Trusting the regressed sidecar alone would return a
+		// duplicate seq on the next append. Take max with scanSequence so a
+		// regressed sidecar cannot cause duplicate sequence numbers.
+		const fileMax = scanSequence(eventsPath);
+		const safeSeq = Math.max(stored, fileMax);
 		sequenceCache.set(eventsPath, {
 			size: stat.size,
 			mtimeMs: stat.mtimeMs,
-			seq: stored,
+			seq: safeSeq,
 			lastAccessMs: Date.now(),
 		});
-		return stored + 1;
+		return safeSeq + 1;
 	}
 	const current = scanSequence(eventsPath);
 	sequenceCache.set(eventsPath, {
@@ -1040,6 +1061,40 @@ export async function flushEventLogBuffer(): Promise<void> {
 	for (const eventsPath of [...bufferedQueues.keys()]) await flushOneEventLogBuffer(eventsPath);
 }
 
+/**
+ * EL-2: Synchronously flush every queued buffered event across all paths.
+ * Used by the `exit` / `uncaughtException` / `SIGTERM` / `SIGINT` handlers,
+ * which CANNOT await async work (process is terminating). The async
+ * flushEventLogBuffer() previously called from these handlers created
+ * floating promises that never resolved, and the process exited before
+ * any buffered events were written — losing all events buffered via
+ * appendEventBuffered (task.progress etc.). This sync variant writes the
+ * buffered batches using the sync event-log lock + appendFileSync + fsync
+ * + persistSequence, recovering buffered events before termination.
+ * In-flight asyncQueues (appendEventAsync writes already dispatched to
+ * the thread pool) remain best-effort and cannot be awaited on `exit` —
+ * we clear them to drop stale state. SIGKILL cannot be intercepted.
+ */
+export function flushBufferedQueuesSync(): void {
+	for (const eventsPath of [...bufferedQueues.keys()]) {
+		const queue = bufferedQueues.get(eventsPath);
+		bufferedQueues.delete(eventsPath);
+		if (!queue || queue.length === 0) continue;
+		try {
+			withEventLogLockSync(eventsPath, () => {
+				// appendEventBatchInsideLock is declared async but its body is fully
+				// synchronous (fs.appendFileSync + fs.fsyncSync + persistSequence,
+				// no awaits). Invoking without await runs the body synchronously and
+				// returns a resolved Promise that we discard.
+				void appendEventBatchInsideLock(eventsPath, queue);
+			});
+		} catch (error) {
+			logInternalError("event-log.sync-flush", error, eventsPath);
+		}
+	}
+	for (const eventsPath of [...bufferedTimers.keys()]) bufferedTimers.delete(eventsPath);
+}
+
 /**
  * Schedule an async event append without waiting for the result.
  * Uses the non-blocking async queue to avoid blocking the event loop.
@@ -1059,20 +1114,13 @@ export function appendEventFireAndForget(eventsPath: string, event: AppendTeamEv
 // failing tests with "Promise resolution is still pending but the event loop
 // has already resolved" even when the test body completed cleanly.
 process.on("exit", () => {
-	if (bufferedQueues.size > 0) {
-		flushEventLogBuffer().catch(() => {
-			/* best-effort flush on exit */
-		});
-	}
-	// FIX (Issue 1): Drain asyncQueues on exit to minimize event loss.
-	// In-flight async writes are awaited (via Promise.allSettled) before
-	// the map is cleared. This reduces but does not eliminate event loss
-	// on crash — SIGKILL (kill -9) cannot be intercepted.
-	if (asyncQueues.size > 0) {
-		drainAsyncQueues().catch(() => {
-			/* best-effort drain on exit */
-		});
-	}
+	// EL-2: synchronously flush buffered events before the process terminates.
+	// `exit` is sync-only and cannot await async work; the previous async
+	// flushEventLogBuffer()/drainAsyncQueues() created floating promises that
+	// never resolved, and the process exited before any buffered events were
+	// written. flushBufferedQueuesSync uses the sync lock + appendFileSync +
+	// fsync + persistSequence to recover buffered events.
+	flushBufferedQueuesSync();
 	asyncQueues.clear();
 });
 
@@ -1099,20 +1147,18 @@ process.on("beforeExit", async () => {
 		}
 	}
 });
-process.on("SIGTERM", () => setImmediate(() => flushEventLogBuffer()));
-process.on("SIGINT", () => setImmediate(() => flushEventLogBuffer()));
+process.on("SIGTERM", () => setImmediate(() => flushBufferedQueuesSync()));
+process.on("SIGINT", () => setImmediate(() => flushBufferedQueuesSync()));
 // FIX (Issue 1): Handle uncaught exceptions to flush buffered events before
 // the process terminates. The async queues use promise chains that will be
 // abandoned on crash; clearing the map prevents memory leaks and stale state.
 // Note: SIGKILL (kill -9) cannot be intercepted and is not handled.
 process.on("uncaughtException", (error) => {
-	try {
-		flushEventLogBuffer();
-	} catch {
-		/* best-effort */
-	}
-	// FIX (Issue 1): Drain asyncQueues before clearing to minimize event loss.
-	drainAsyncQueues();
+	// EL-2: synchronously flush buffered events before re-throwing (which
+	// terminates the process). The previous async flushEventLogBuffer() +
+	// drainAsyncQueues() couldn't complete before process exit; use the sync
+	// variant to recover buffered events.
+	flushBufferedQueuesSync();
 	asyncQueues.clear();
 	// Re-throw to preserve default uncaught exception behavior (process exit)
 	throw error;