pi-crew 0.11.11 → 0.11.13

package/src/runtime/merge-loop.ts

@@ -13,10 +13,11 @@
  * keeping it here avoids a merge-loop ↔ finalize-run import cycle.
  */
 import { flushPendingAtomicWrites } from "../state/atomic-write.ts";
-import { withRunLock } from "../state/coordination/locks.ts";
+import { appendEventAsync } from "../state/event-log/event-log.ts";
 import { loadRunManifestById, saveRunManifestAsync, saveRunTasksAsync, updateRunStatus } from "../state/stores/state-store.ts";
 import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import { classifyFatalFsError } from "../utils/fs-errno.ts";
+import { MERGE_LOCK_BUSY_RETRY_DELAYS_MS, withRunLockBusyRetryAsync } from "./broker/protocol/lock-busy.ts";
 import { cancelNonTerminalTasks } from "./dispatch-batch.ts";
 import { mergeTaskUpdatesPreservingTerminal } from "./merge-gate.ts";
 import type { SchedulerContext, SchedulerDecision } from "./scheduler-context.ts";
@@ -86,40 +87,67 @@ export async function mergeUnitResult(ctx: SchedulerContext): Promise<SchedulerD
 	// not the arbitrary order in which mapConcurrent returned results.
 	// Read committed manifest from disk inside the lock so artifact merge is based
 	// on committed state, not in-memory state that may differ from disk.
-	const mergeResult = await withRunLock(ctx.manifest, async () => {
-		// NEW-D1: flush any pending coalesced atomic writes before reading from
-		// disk. Without this, a worker's async manifest save (coalesced by
-		// atomic-write) may not be committed yet, causing a lost-update on the
-		// merge read. flushPendingAtomicWrites forces all queued writes to disk.
-		flushPendingAtomicWrites();
-		const disk = loadRunManifestById(ctx.manifest.cwd, ctx.manifest.runId);
-		const diskManifest = disk?.manifest ?? ctx.manifest;
-		const diskArtifacts = diskManifest.artifacts;
-		const reconciledArtifacts = mergeArtifacts([...diskArtifacts, ...validResults.map((item) => item.manifest.artifacts)].flat());
-		// R15-2: only force "running" when the disk manifest is NON-terminal
-		// (queued/planning/running/blocked). If the disk status is already terminal
-		// (cancelled/failed/completed — an external cancel or reconciler write
-		// landing during the batch), PRESERVE that terminal status: forcing
-		// "running" would legally erase it (contracts.ts allows cancelled/failed/
-		// completed → running) and the loop would never observe the disk-terminal
-		// (CANCEL-1/CANCEL-2 only catch worker-reported cancel or signal abort).
-		const mergedBase = { ...diskManifest, artifacts: reconciledArtifacts };
-		const resultManifest = isRunTerminalPreserved(diskManifest.status)
-			? mergedBase
-			: updateRunStatus(mergedBase, "running", "Merged task updates from parallel batch.");
-		// CANCEL-1: use the freshly-loaded disk tasks as the merge base instead
-		// of the in-memory `tasks` closure variable. The in-memory tasks reflect
-		// only team-runner's view; an external cancel (handleCancel, background
-		// race with SIGTERM arriving after cancel wrote but before merge ran)
-		// writes 'cancelled' to disk.tasks — using disk.tasks as base preserves
-		// that cancellation through the merge instead of overwriting it with the
-		// stale in-memory view. disk was loaded inside this lock, so it reflects
-		// the freshest committed state.
-		const resultTasks = mergeTaskUpdatesPreservingTerminal(disk?.tasks ?? ctx.tasks, validResults);
-		await saveRunManifestAsync(resultManifest);
-		await saveRunTasksAsync(resultManifest, resultTasks);
-		return { resultManifest, resultTasks };
-	});
+	// RELIABILITY FIX 2026-10-10 (run team_20261010100956 incident): the merge
+	// used a bare withRunLock. Under run.lock contention (a second writer —
+	// stale reconciler, resumed runner, or a slow ENOSPC-degraded writer —
+	// holding run.lock past the acquire retry budget) withRunLock throws the
+	// plain "Run 'run.lock' is locked by another operation." error, which
+	// escaped executeTeamRun's catch → rejectRunPromise → an UNHANDLED promise
+	// rejection (no waitForRun waiter in background-runner mode) → the runner's
+	// unhandledRejection guard killed the whole runner mid-run. The merge now
+	// retries transient contention with back-off (logging a run.lock_retry
+	// event per attempt); only after the bounded schedule is exhausted does
+	// the busy error propagate for the run-level handler to classify. Non-busy
+	// errors (real faults) keep their existing fatal path — this is NOT a
+	// swallow-all.
+	const mergeResult = await withRunLockBusyRetryAsync(
+		ctx.manifest,
+		MERGE_LOCK_BUSY_RETRY_DELAYS_MS,
+		async () => {
+			// NEW-D1: flush any pending coalesced atomic writes before reading from
+			// disk. Without this, a worker's async manifest save (coalesced by
+			// atomic-write) may not be committed yet, causing a lost-update on the
+			// merge read. flushPendingAtomicWrites forces all queued writes to disk.
+			flushPendingAtomicWrites();
+			const disk = loadRunManifestById(ctx.manifest.cwd, ctx.manifest.runId);
+			const diskManifest = disk?.manifest ?? ctx.manifest;
+			const diskArtifacts = diskManifest.artifacts;
+			const reconciledArtifacts = mergeArtifacts([...diskArtifacts, ...validResults.map((item) => item.manifest.artifacts)].flat());
+			// R15-2: only force "running" when the disk manifest is NON-terminal
+			// (queued/planning/running/blocked). If the disk status is already terminal
+			// (cancelled/failed/completed — an external cancel or reconciler write
+			// landing during the batch), PRESERVE that terminal status: forcing
+			// "running" would legally erase it (contracts.ts allows cancelled/failed/
+			// completed → running) and the loop would never observe the disk-terminal
+			// (CANCEL-1/CANCEL-2 only catch worker-reported cancel or signal abort).
+			const mergedBase = { ...diskManifest, artifacts: reconciledArtifacts };
+			const resultManifest = isRunTerminalPreserved(diskManifest.status)
+				? mergedBase
+				: updateRunStatus(mergedBase, "running", "Merged task updates from parallel batch.");
+			// CANCEL-1: use the freshly-loaded disk tasks as the merge base instead
+			// of the in-memory `tasks` closure variable. The in-memory tasks reflect
+			// only team-runner's view; an external cancel (handleCancel, background
+			// race with SIGTERM arriving after cancel wrote but before merge ran)
+			// writes 'cancelled' to disk.tasks — using disk.tasks as base preserves
+			// that cancellation through the merge instead of overwriting it with the
+			// stale in-memory view. disk was loaded inside this lock, so it reflects
+			// the freshest committed state.
+			const resultTasks = mergeTaskUpdatesPreservingTerminal(disk?.tasks ?? ctx.tasks, validResults);
+			await saveRunManifestAsync(resultManifest);
+			await saveRunTasksAsync(resultManifest, resultTasks);
+			return { resultManifest, resultTasks };
+		},
+		(attempt, delayMs, error) => {
+			// Best-effort observability only — a failed event append (e.g. the same
+			// degraded disk that caused the contention) must not break the retry.
+			appendEventAsync(ctx.manifest.eventsPath, {
+				type: "run.lock_retry",
+				runId: ctx.manifest.runId,
+				message: `run.lock contention during unit merge (attempt ${attempt}); retrying in ${delayMs}ms: ${error.message}`,
+				data: { attempt, delayMs, site: "mergeUnitResult" },
+			}).catch(() => undefined);
+		},
+	);
 	ctx.manifest = mergeResult.resultManifest;
 	ctx.tasks = mergeResult.resultTasks;
 	ctx.settledMerge = { taskIds: completedUnit.taskIds, result: resultToMerge };

package/src/runtime/recovery/crash-recovery.ts

@@ -15,7 +15,7 @@ import {
 	saveRunTasks,
 	updateRunStatus,
 } from "../../state/stores/state-store.ts";
-import type { TeamTaskState } from "../../state/types.ts";
+import type { TeamRunManifest, TeamTaskState } from "../../state/types.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { projectCrewRoot, userCrewRoot } from "../../utils/paths.ts";
 import { resolveRealContainedPath } from "../../utils/safe-paths.ts";
@@ -26,7 +26,13 @@ import { terminateLiveAgentsForRun } from "../live-session/live-agent-manager.ts
 import type { ManifestCache } from "../manifest-cache.ts";
 import { checkProcessLiveness } from "../process-status.ts";
 import { mapConcurrent } from "../scheduling/parallel-utils.ts";
-import { isIntentionalWait, isPlanApprovalPendingEffective, type ReconcileResult, reconcileStaleRun } from "../stale-reconciler.ts";
+import {
+	hasLiveRunClaim,
+	isIntentionalWait,
+	isPlanApprovalPendingEffective,
+	type ReconcileResult,
+	reconcileStaleRun,
+} from "../stale-reconciler.ts";
 
 export interface RecoveryPlan {
 	runId: string;
@@ -134,7 +140,17 @@ export function detectInterruptedRuns(
 		// NOTE: no withRunLock — best-effort only; concurrent writes may cause inconsistency
 		const loaded = loadRunManifestById(cwd, manifest.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 		if (!loaded) continue;
-		const resumableTasks = loaded.tasks.filter((task) => shouldRecoverTask(task, deadMs)).map((task) => task.id);
+		// U9 (upgrade-spec 2026-10-09 — reconcile-at-open fast-path DETECTION): a
+		// dead detached runner PID + no live active-run-registry claim is
+		// AUTHORITATIVE crash evidence. The deadMs heartbeat-staleness wait in
+		// shouldRecoverTask exists to protect runs whose liveness we cannot probe
+		// (foreground/no-PID runs); for a dead async runner it only delays an
+		// interrupted run from becoming actionable by the full deadMs (300s).
+		// Skip the wait here so a crashed run is resumable the moment it is opened.
+		const fastPathEligible = loaded.manifest.async?.pid !== undefined && !hasLiveRunClaim(loaded.manifest.runId, loaded.manifest);
+		const resumableTasks = loaded.tasks
+			.filter((task) => (fastPathEligible ? task.status === "running" : shouldRecoverTask(task, deadMs)))
+			.map((task) => task.id);
 		if (!resumableTasks.length) continue;
 		plans.push({
 			runId: manifest.runId,
@@ -725,6 +741,113 @@ export function purgeStaleActiveRunIndex(
 	return { purged, kept };
 }
 
+/**
+ * U9 (upgrade-spec 2026-10-09): reconcile-at-open FAST-PATH result — the
+ * durable-scheduler-inspired "1 pass" that replaces the verdict tree for
+ * crashed runs WITHOUT a live claim. `event` is appended by the CALLER via the
+ * async primitive after the sync writes land (U2 discipline — mirrors
+ * applyRecoveryPlan's `lifecycle` pattern; the run lock is held by the caller).
+ */
+export interface ReconcileAtOpenFastPathOutcome {
+	result: ReconcileResult;
+	eventsPath: string;
+	event: AppendTeamEvent;
+}
+
+/**
+ * U9 (upgrade-spec 2026-10-09): reconcile-at-open fast-path.
+ *
+ * When a run is opened after a crash and there is NO live claim (dead async
+ * runner PID + no live active-run-registry entry), ONE pass requeues every
+ * `running` task → `queued`, PRESERVING attempt/deps/partial state (attempts,
+ * checkpoint, claim, artifacts, usage — only per-attempt transient fields are
+ * reset, mirroring applyRecoveryPlan), then marks the run `failed` so later
+ * reconcile passes leave the requeued tasks alone (the failed status is
+ * load-bearing idempotency: reconcileAllStaleRuns only visits running/blocked
+ * runs, so the fast-path fires exactly once; a later `team resume` requeues
+ * failed/cancelled/skipped/running → queued and re-executes what remains).
+ *
+ * G12 preserved: a run WITH a live claim NEVER takes this path — callers fall
+ * through to the full stale-reconciler verdict tree
+ * (healthy/waiting_answer/pid_dead/...), unchanged. Intentional waits (plan
+ * approval / pending ask) are likewise left to the verdict tree. Runs without
+ * an async runner PID (foreground/live-session) also defer — their liveness
+ * evidence is the registry entry plus heartbeat staleness, which the verdict
+ * tree already weighs.
+ *
+ * MUST be called under the run lock on a freshly-loaded state (the
+ * reconcileAllStaleRuns call site does exactly that). Returns undefined when
+ * the fast-path does not apply (live claim / intentional wait / no async PID /
+ * nothing left in `running`/`waiting` — the idempotent re-entry case).
+ */
+export function applyReconcileAtOpenFastPath(
+	loaded: { manifest: TeamRunManifest; tasks: TeamTaskState[] },
+	now = Date.now(),
+): ReconcileAtOpenFastPathOutcome | undefined {
+	const { manifest } = loaded;
+	const pid = manifest.async?.pid;
+	// Only a dead, well-formed detached-runner PID is authoritative crash
+	// evidence. No PID (foreground/live-session runs) → verdict tree.
+	if (pid === undefined || !Number.isInteger(pid) || pid <= 0) return undefined;
+	if (checkProcessLiveness(pid).alive) return undefined; // live claim → verdict tree
+	if (hasLiveRunClaim(manifest.runId, manifest)) return undefined; // G12: never touch a claimed run
+	// Intentional waits (plan approval / pending ask within TTL) are not crashes.
+	if (isIntentionalWait(manifest, now)) return undefined;
+	// `waiting` tasks requeue alongside `running` ones (review round-2 MINOR-1):
+	// an ask parked past WAITING_TTL — or whose waitState was lost in the crash —
+	// is NOT an intentional wait (isIntentionalWait above already declined), and
+	// `team resume` only requeues failed/cancelled/skipped/running, so leaving a
+	// `waiting` task inside the failed run would strand it for manual repair.
+	const requeueEligible = loaded.tasks.filter((task) => task.status === "running" || task.status === "waiting");
+	if (requeueEligible.length === 0) return undefined; // idempotent: nothing to requeue
+
+	const requeued = new Set(requeueEligible.map((task) => task.id));
+	const tasks = loaded.tasks.map((task) =>
+		requeued.has(task.id)
+			? {
+					...task,
+					status: "queued" as const,
+					startedAt: undefined,
+					finishedAt: undefined,
+					error: undefined,
+					heartbeat: undefined,
+					// WP-2/R2 discipline (same as applyRecoveryPlan): a requeued task must
+					// not resume parked ask state.
+					waiting: undefined,
+					// attempt/deps/partial state PRESERVED (attempts, checkpoint, claim,
+					// artifacts, usage, modelAttempts) — only per-attempt transient
+					// fields above are reset, exactly like applyRecoveryPlan.
+				}
+			: task,
+	);
+	saveRunTasks(manifest, tasks);
+	updateRunStatus(
+		manifest,
+		"failed",
+		`Interrupted: async runner dead (no live claim); ${requeueEligible.length} task(s) requeued for resume`,
+	);
+	return {
+		result: {
+			runId: manifest.runId,
+			verdict: "requeued_no_claim",
+			repaired: true,
+			detail: `No live claim (async pid ${pid} dead, no live registry entry); requeued ${requeueEligible.length} interrupted task(s) (running or abandoned waiting) → queued for resume (attempt state preserved); run marked failed so later reconcile passes leave it resumable`,
+			repairedTasks: tasks,
+		},
+		eventsPath: manifest.eventsPath,
+		event: {
+			type: "crew.run.resumed",
+			runId: manifest.runId,
+			message: `Reconcile-at-open fast-path: requeued ${requeueEligible.length} interrupted task(s) for resume (no live claim).`,
+			data: {
+				fastPath: true,
+				requeuedTasks: [...requeued],
+				recoveredFromSeq: scanSequence(manifest.eventsPath),
+			},
+		},
+	};
+}
+
 export async function reconcileAllStaleRuns(
 	cwd: string,
 	manifestCache: ManifestCache,
@@ -775,6 +898,21 @@ export async function reconcileAllStaleRuns(
 					});
 					return;
 				}
+				// U9 (upgrade-spec 2026-10-09): reconcile-at-open FAST-PATH. A crashed run
+				// with NO live claim (dead async runner PID + no live registry entry) is
+				// requeued in one pass instead of going through the verdict tree, whose
+				// pid_dead branch would CANCEL the running tasks and destroy resume
+				// eligibility. Runs WITH a live claim (or intentional waits / no async
+				// PID) skip this and keep the full verdict-tree semantics, unchanged.
+				const fastPath = applyReconcileAtOpenFastPath(fresh, now);
+				if (fastPath) {
+					// Async lifecycle append AFTER the sync saveRunTasks/updateRunStatus
+					// writes (U2 discipline — same ordering as the verdict branch below:
+					// run.failed lands first, then the fast-path recovery record).
+					await appendEventAsync(fastPath.eventsPath, fastPath.event);
+					out.push(fastPath.result);
+					return;
+				}
 				const result = reconcileStaleRun(fresh.manifest, fresh.tasks, now);
 				if (result.repaired || result.verdict === "result_exists") {
 					if (result.repairedTasks) {

package/src/runtime/recovery/retry-executor.ts

@@ -1,3 +1,4 @@
+import { logInternalError } from "../../utils/internal-error.ts";
 import { sleep } from "../../utils/sleep.ts";
 import { throwIfCancelled } from "../process/cancellation.ts";
 
@@ -28,6 +29,17 @@ export interface RetryHooks {
 	onRetryGivenUp?: (attempts: number, error: Error, info: RetryAttemptInfo) => void;
 	attemptId?: (attempt: number) => string;
 	signal?: AbortSignal;
+	/**
+	 * U6A (upgrade spec 2026-10-09 §U6 Phase A): async pre-gate consulted
+	 * after a failed attempt and BEFORE the next one is queued. Returning
+	 * false gives up exactly like non-retryable exhaustion (onRetryGivenUp +
+	 * throw of the ORIGINAL error — the gate itself can never introduce a new
+	 * failure). SOFT contract: a throwing/rejecting hook is swallowed and
+	 * treated as "retry" — a broken gate must never change retry behavior.
+	 * Consumer: dispatch-batch's ambient-noise classifier gate
+	 * (classifyAmbientNoiseGate), dormant unless runtime.classifierEnabled.
+	 */
+	shouldRetry?: (attempt: number, error: Error, info: RetryAttemptInfo) => boolean | Promise<boolean>;
 }
 
 export const DEFAULT_RETRY_POLICY: RetryPolicy = {
@@ -95,6 +107,23 @@ export async function executeWithRetry<T>(
 				hooks.onRetryGivenUp?.(attempt, lastError, info);
 				throw lastError;
 			}
+			// U6A: ambient-noise pre-gate — consulted once per failed attempt,
+			// after retryability, BEFORE the backoff sleep + next spawn. SOFT:
+			// hook errors are logged and treated as "retry" (fallback true), so
+			// the gate can only skip a queued retry, never break the loop.
+			if (hooks.shouldRetry) {
+				let gateDecision = true;
+				try {
+					gateDecision = await hooks.shouldRetry(attempt, lastError, info);
+				} catch (gateError) {
+					logInternalError("retry-executor.shouldRetry", gateError, "soft-fail: proceeding with the queued retry", "warn");
+					gateDecision = true;
+				}
+				if (gateDecision === false) {
+					hooks.onRetryGivenUp?.(attempt, lastError, info);
+					throw lastError;
+				}
+			}
 			const delay = calculateRetryDelay(attempt, normalized);
 			hooks.onAttemptFailed?.(attempt, lastError, delay, info);
 			try {

package/src/runtime/run-tracker.ts

@@ -67,6 +67,20 @@ export function registerRunPromise(runId: string): ActiveRunPromise {
 		reject = rej;
 	});
 	const entry: ActiveRunPromise = { promise, resolve, reject };
+	// RELIABILITY FIX 2026-10-10 (run team_20261010100956 incident): a run
+	// registered in a process with NO waitForRun waiter (background-runner
+	// mode — the runner awaits executeTeamRun directly, nothing races
+	// entry.promise) and later REJECTED (executeTeamRun's catch calls
+	// rejectRunPromise with the original error) left the rejection unobserved
+	// → Node unhandledRejection → the background-runner's guard aborted the
+	// whole runner AFTER its cleanup had already run (heartbeat stopped →
+	// stale-reconciler mass-cancelled every task). Attaching a no-op rejection
+	// handler marks the promise handled; consumers still observe the rejection
+	// through their own .then/.race attachments — this changes nothing for
+	// foreground waiters, it only stops a waiter-less rejection from killing
+	// the process. Run failures themselves remain fully reported through the
+	// normal executeTeamRun catch path (manifest failed + async.failed event).
+	promise.catch(() => undefined);
 	activeRunPromises.set(runId, entry);
 	return entry;
 }
@@ -128,6 +142,20 @@ export function rejectRunPromise(runId: string, reason: unknown): void {
 	}
 }
 
+/** Identity matcher for waitForRun's timeout error — thrown by BOTH wait
+ *  paths (the promise-race fast path and the polling slow path) as
+ *  `waitForRun timed out after <N>ms`. Callers use it to distinguish "the
+ *  WATCH window expired — the run itself may still be executing" from real
+ *  wait failures (run not found, corrupt state). RELIABILITY FIX 2026-10-10
+ *  (bug #2): a watch expiry must be reported as a partial-watch, never
+ *  conflated with a run failure. Message identity — run-tracker exports no
+ *  error class (plain Error), mirroring lock-busy.ts's matcher precedent. */
+const WAIT_FOR_RUN_TIMEOUT_MESSAGE = /^waitForRun timed out after \d+ms$/;
+
+export function isWaitForRunTimeoutError(error: unknown): boolean {
+	return error instanceof Error && WAIT_FOR_RUN_TIMEOUT_MESSAGE.test(error.message);
+}
+
 function raceRunPromise(entry: ActiveRunPromise, timeoutMs: number, deadline: number): Promise<RunWaitResult> {
 	let timer: ReturnType<typeof setTimeout> | undefined;
 	const remaining = Math.max(0, deadline - Date.now());

package/src/runtime/stale-reconciler.ts

@@ -38,7 +38,19 @@ const ORPHAN_TEMP_SCAN_BATCH_SIZE = 50;
 export interface ReconcileResult {
 	runId: string;
 	/** What was found and what action was taken */
-	verdict: "healthy" | "blocked_awaiting_approval" | "waiting_answer" | "result_exists" | "pid_dead" | "pid_alive_stale" | "no_status";
+	verdict:
+		| "healthy"
+		| "blocked_awaiting_approval"
+		| "waiting_answer"
+		| "result_exists"
+		| "pid_dead"
+		| "pid_alive_stale"
+		| "no_status"
+		/** U9 (upgrade-spec 2026-10-09): reconcile-at-open fast-path fired — no
+		 *  live claim (dead async runner PID + no live registry entry), running
+		 *  tasks requeued → queued (attempt/deps/partial state preserved) and the
+		 *  run marked failed-for-resume instead of cancelled by the verdict tree. */
+		| "requeued_no_claim";
 	/** Whether repair was applied */
 	repaired: boolean;
 	/** Human-readable detail */
@@ -380,6 +392,29 @@ function findLiveRegistryEntry(runId: string): ActiveRunRegistryEntry | undefine
 	}
 }
 
+/**
+ * U9 (upgrade-spec 2026-10-09 — reconcile-at-open fast-path): does ANY live
+ * claim exist for this run RIGHT NOW? Two independent signals, either ⇒ live:
+ *   1. a LIVE active-run-registry entry (registerActiveRun fires at dispatch;
+ *      activeRunEntries() applies terminal-status, dead-async-PID and
+ *      30-min-freshness filtering itself — an entry found here means a live
+ *      session/runner owns the run), or
+ *   2. the detached async runner PID is alive (authoritative process probe —
+ *      ESRCH/ENOENT dead, EPERM alive).
+ * A run with NEITHER signal cannot have a worker executing tasks right now,
+ * so requeueing its `running` tasks can never double-dispatch a live worker.
+ * This is the G12-preserving precondition for the crash-recovery fast-path:
+ * a run WITH a live claim always defers to the full verdict tree instead.
+ * Registry read failures fail-open (undefined ⇒ "no registry claim"), mirroring
+ * findLiveRegistryEntry/G24: a broken registry must not shield runs forever.
+ */
+export function hasLiveRunClaim(runId: string, manifest: TeamRunManifest): boolean {
+	if (findLiveRegistryEntry(runId)) return true;
+	const pid = manifest.async?.pid;
+	if (pid !== undefined && Number.isInteger(pid) && pid > 0 && checkProcessLiveness(pid).alive) return true;
+	return false;
+}
+
 function repairStaleRun(manifest: TeamRunManifest, tasks: TeamTaskState[], reason: string): TeamTaskState[] {
 	const now = new Date().toISOString();
 	const repairedTasks = tasks.map((task) => {

package/src/runtime/task-runner.ts

@@ -1,9 +1,11 @@
 import type { AgentConfig } from "../agents/agent-config.ts";
 import type { CrewLimitsConfig, CrewRuntimeConfig } from "../config/config.ts";
 import type { MetricRegistry } from "../observability/metric-registry.ts";
+import { appendEventFireAndForget } from "../state/event-log/event-log.ts";
 import { writeArtifact } from "../state/stores/artifact-store.ts";
 import type { ArtifactDescriptor, OperationTerminalEvidence, TeamRunManifest, TeamTaskState } from "../state/types.ts";
 import type { WorkflowStep } from "../workflows/workflow-config.ts";
+import { resolveClassifierEnabled, resolveClassifierModel } from "./classifier/classifier-service.ts";
 import type { CrewRuntimeKind } from "./crew-agent-runtime.ts";
 import { registerStreamBridge } from "./event-stream-bridge.ts";
 import type { ModelAttemptSummary } from "./model/model-fallback.ts";
@@ -15,6 +17,7 @@ import { finalizeTaskResult, type TaskExecutionResult } from "./task-runner/post
 import { prepareTaskExecutionContext } from "./task-runner/pre-execution.ts";
 import { cleanResultText } from "./task-runner/result-utils.ts";
 import { runScaffoldTask } from "./task-runner/scaffold-executor.ts";
+import { renderVerifyGateSummary, resolveVerifyGateEnabled, runVerifierGatePreGate } from "./verification/verify-gate.ts";
 import { registerYieldTool } from "./yield-handler.ts";
 
 // Register the submit_result tool handler so subprocess events can extract yield data.
@@ -106,6 +109,106 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 		const prepared = await prepareTaskExecutionContext(input, manifest, streamBridge);
 		if (prepared.kind === "cancelled") return prepared.result;
 		const ctx = prepared.ctx;
+		// ── U13 (upgrade spec 2026-10-09): deterministic verifier pre-gate ──
+		// For verifier-role tasks, run the deterministic gate (typecheck /
+		// test:critical via package.json scripts, subprocess executor) BEFORE
+		// spawning the LLM verifier worker:
+		//   - gate PASS → SKIP the spawn: terminalize the task as completed
+		//     with the gate evidence as its result (spec acceptance: "một run
+		//     verification với gate xanh không spawn LLM verifier");
+		//   - gate FAILED/INCONCLUSIVE (+ U6B classifier layer on the latter)
+		//     → spawn the LLM verifier as today, with the gate results appended
+		//     to its prompt (it diagnoses; it does not re-derive exit codes).
+		// Disabled by PI_CREW_VERIFY_GATE=0; scaffold runtime never gates.
+		if (ctx.task.role === "verifier" && ctx.runtimeKind !== "scaffold" && resolveVerifyGateEnabled()) {
+			const preGate = await runVerifierGatePreGate({
+				cwd: ctx.task.cwd,
+				signal: input.signal,
+				classifier: {
+					enabled: resolveClassifierEnabled(input.runtimeConfig?.classifierEnabled),
+					modelRegistry: input.modelRegistry,
+					classifierModel: resolveClassifierModel(input.runtimeConfig?.classifierModel),
+					eventsPath: manifest.eventsPath,
+					runId: manifest.runId,
+					taskId: ctx.task.id,
+				},
+				metricRegistry: input.metricRegistry,
+			});
+			// Diagnostic event (task.verifier_pre_gate — U6B's event type; the
+			// TEAM_EVENT_TYPES registry entry stays report-only pending a
+			// src/state/** lane, same as classifier-pre-gate's own appends).
+			appendEventFireAndForget(manifest.eventsPath, {
+				type: "task.verifier_pre_gate",
+				runId: manifest.runId,
+				taskId: ctx.task.id,
+				message: preGate.decision.skipVerifier
+					? `Deterministic verify_gate ${preGate.outcome.verdict} — LLM verifier spawn SKIPPED (${preGate.decision.reason})`
+					: `Deterministic verify_gate ${preGate.outcome.verdict} — LLM verifier spawns with gate context (${preGate.decision.reason})`,
+				data: {
+					verdict: preGate.outcome.verdict,
+					decision: preGate.decision,
+					evidenceLines: preGate.outcome.evidenceLines,
+					...(preGate.preGate ? { classifierAction: preGate.preGate.action } : {}),
+				},
+			});
+			if (preGate.decision.skipVerifier) {
+				// Terminalize WITHOUT spawning: synthesize the branch result (gate
+				// summary as the task result artifact + stdout) and reuse the full
+				// finalizer — events, hooks, persistence, verification evidence.
+				const summary = renderVerifyGateSummary(preGate.outcome, preGate.decision.reason);
+				const resultArtifact = writeArtifact(manifest.artifactsRoot, {
+					kind: "result",
+					relativePath: `results/${ctx.task.id}.txt`,
+					content: `${summary}\n`,
+					producer: ctx.task.id,
+				});
+				ctx.task = {
+					...ctx.task,
+					// Provenance: this verdict came from the deterministic gate, not a
+					// model attempt (U6B mount note: evaluator/model provenance marker).
+					diagnostics: {
+						...(ctx.task.diagnostics ?? {}),
+						verifyGate: {
+							verdict: preGate.outcome.verdict,
+							reason: preGate.decision.reason,
+							evidenceLines: preGate.outcome.evidenceLines,
+						},
+					},
+				};
+				return await finalizeTaskResult(ctx, {
+					resultArtifact,
+					logArtifact: undefined,
+					transcriptArtifact: undefined,
+					exitCode: 0,
+					error: undefined,
+					modelAttempts: [],
+					parsedOutput: undefined,
+					finalStdout: summary,
+					transcriptPath: undefined,
+					terminalEvidence: [],
+					startupEvidence: ctx.startupEvidence,
+				});
+			}
+			if (preGate.promptContext) {
+				// Spawn proceeds — attach the gate results to the verifier prompt
+				// (both channels: full prompt + the user-message half). The prompt
+				// artifact was written in pre-execution with the PRE-gate prompt;
+				// rewrite it so the persisted artifact matches what the worker saw.
+				ctx.prompt = `${ctx.prompt}\n\n${preGate.promptContext}`;
+				if (ctx.userPrompt !== undefined) ctx.userPrompt = `${ctx.userPrompt}\n\n${preGate.promptContext}`;
+				if (ctx.promptArtifact) {
+					ctx.promptArtifact = writeArtifact(manifest.artifactsRoot, {
+						kind: "prompt",
+						// Same relative-path convention pre-execution used
+						// (prompts/<taskId>.md) — ArtifactDescriptor carries only the
+						// absolute path, so the rewrite re-derives the relative path.
+						relativePath: `prompts/${ctx.task.id}.md`,
+						content: `${ctx.prompt}\n`,
+						producer: ctx.task.id,
+					});
+				}
+			}
+		}
 		// Destructure mutable fields for branch closures + sync-back
 		let task = ctx.task;
 		let tasks = ctx.tasks;