pi-crew 0.11.53 → 0.11.55

package/src/state/atomic-write.ts

@@ -987,6 +987,12 @@ interface CoalescedAtomicWrite {
 	generation: number;
 	/** F4: durability knob carried into the underlying atomicWriteFile flush. */
 	durability: WriteDurability;
+	/** ASK-PARK CLOBBER FIX (2026-10-31): on-disk file identity at QUEUE time
+	 *  for the flush-time staleness CAS. null = file did not exist yet. */
+	queuedMtimeMs: number | null;
+	/** ASK-PARK CLOBBER FIX: file size at queue time — backstop for
+	 *  coarse-mtime filesystems (FAT 1-2s granularity). */
+	queuedSize: number | null;
 }
 const MAX_FLUSH_RETRIES = 5;
 const pendingAtomicWrites = new Map<string, CoalescedAtomicWrite>();
@@ -1095,6 +1101,24 @@ export function atomicWriteJsonCoalesced<T>(
 	// future caller mutates after queueing, that mutation persists.
 	const previous = pendingAtomicWrites.get(filePath);
 	if (previous) clearTimeout(previous.timer);
+	// ASK-PARK CLOBBER FIX (2026-10-31): snapshot the on-disk file identity at
+	// QUEUE time so the flush can compare-and-swap against it.
+	// cancelPendingCoalescedWrite only sees SAME-process supersessions — a sync
+	// write from ANOTHER process (e.g. the detached broker's waiting-park via
+	// saveRunTasks) cannot cancel this buffer, and a blind flush would then
+	// clobber that fresher data (live incident team_20261031084714: tasks.json
+	// waiting→running, every leader respond rejected, 3/3 ask timeouts).
+	// stat throw = file absent → null, so a flush-time APPEARANCE of the file
+	// is detected as an external write.
+	let queuedMtimeMs: number | null = null;
+	let queuedSize: number | null = null;
+	try {
+		const queuedStat = fs.statSync(filePath);
+		queuedMtimeMs = queuedStat.mtimeMs;
+		queuedSize = queuedStat.size;
+	} catch {
+		/* file does not exist yet — null is the queue-time identity */
+	}
 	const timer = setTimeout(() => flushOnePendingAtomicWrite(filePath), coalesceMs);
 	timer.unref();
 	// Issue 2 fix: increment generation for each new entry
@@ -1107,6 +1131,8 @@ export function atomicWriteJsonCoalesced<T>(
 		retryCount: 0,
 		generation,
 		durability: normalized.durability,
+		queuedMtimeMs,
+		queuedSize,
 	});
 }
 
@@ -1118,6 +1144,39 @@ function flushOnePendingAtomicWrite(filePath: string): void {
 	// and we will NOT delete the newer entry after the flush completes.
 	const savedGeneration = entry.generation;
 	clearTimeout(entry.timer);
+	// ASK-PARK CLOBBER FIX (2026-10-31): flush-time staleness CAS. Contract: a
+	// coalesced write is a CHECKPOINT-class snapshot — last-writer-wins applies
+	// only WITHIN this process (same-process supersession cancels the buffer
+	// via cancelPendingCoalescedWrite inside atomicWriteFile). If an EXTERNAL
+	// write landed between queue and flush — detected as an mtime/size identity
+	// change, or as the file APPEARING after a queue-time absence — the
+	// buffered snapshot is stale and is DISCARDED, never clobbered over the
+	// fresher data. A stat throw here (file vanished since queue, e.g. an
+	// external delete) keeps the pre-fix flush behavior: write proceeds.
+	// Order matters: this MUST run BEFORE atomicWriteFile — its first
+	// statement cancels the pending entry, so on discard WE delete the entry
+	// explicitly. The retry/backoff path re-adds the SAME entry object, so the
+	// queue-time identity survives retries. Residual window: coarse-mtime
+	// filesystems (FAT 1-2s) are narrowed by the size check; what remains is
+	// acceptable — the next checkpoint re-queues fresh data, and respond.ts
+	// carries a defense-in-depth self-heal for the ask park (2026-10-31).
+	try {
+		const currentStat = fs.statSync(filePath);
+		if (entry.queuedMtimeMs === null || entry.queuedMtimeMs !== currentStat.mtimeMs || entry.queuedSize !== currentStat.size) {
+			pendingAtomicWrites.delete(filePath);
+			logInternalError(
+				"atomic-write.coalesced-stale-drop",
+				new Error(
+					`discarded stale coalesced write: external write landed between queue and flush (queued mtimeMs=${entry.queuedMtimeMs} size=${entry.queuedSize}, current mtimeMs=${currentStat.mtimeMs} size=${currentStat.size})`,
+				),
+				filePath,
+				"warn",
+			);
+			return;
+		}
+	} catch {
+		/* file vanished since queue — keep existing flush behavior (write proceeds) */
+	}
 	try {
 		// PERF (2026-08-24): stringify happens HERE (flush time), not at queue
 		// time — see the note in atomicWriteJsonCoalesced. No defensive deep-copy

package/src/state/contracts.ts

@@ -94,6 +94,13 @@ export const TEAM_EVENT_TYPES = [
 	"async.stale",
 	"task.waiting",
 	"task.resumed",
+	// ASK-PARK CLOBBER FIX (2026-10-31): respond-side self-heal trace — fired
+	// when the no-waiting-tasks fallback finds manifest.waitState still live
+	// while tasks.json lost the park to the cross-process coalesce race (host
+	// coalesced flush vs broker sync park) and restores `waiting` from the
+	// waitState pointer before running the answer path. Participates in
+	// event-log reconstruction (→ "waiting", mirrors task.waiting).
+	"task.waiting_repaired",
 	// G5 (deep-review 2026-10-01): respond-delivery observability. The leader
 	// previously had NO confirmation that a mailbox respond reached the worker:
 	// `respond_delivered` fires at the broker's wait.resolve ack when the parked

package/src/state/coordination/mailbox.ts

@@ -37,8 +37,9 @@ export type MailboxReason = "need_decision" | "progress_update" | "interview_req
 // Fix: the parent/broker process SIGNS every row it writes with an Ed25519
 // per-process keypair. The PRIVATE key is heap-only in the writer process
 // (never persisted, never serialized, never placed in any child env). Children
-// receive ONLY the public verify key (PI_CREW_MAILBOX_VERIFY_KEY, base64 SPKI
-// DER — a public key, safe in env) set by child-pi-spawn at spawn time.
+// receive ONLY public verify keys (PI_CREW_MAILBOX_VERIFY_KEY and/or the
+// FINDING-B plural set PI_CREW_MAILBOX_VERIFY_KEYS — base64 SPKI DER,
+// public keys, safe in env) set by child-pi-spawn at spawn time.
 // Delivery-side readers (parseMailboxFile — the shared path under readMailbox /
 // readAllMailboxMessages / pollWorkerInbox / replay) verify the signature over
 // the identity-bearing fields and treat unverifiable rows as NOISE (dropped,
@@ -69,6 +70,25 @@ export type MailboxReason = "need_decision" | "progress_update" | "interview_req
  *  key (set by child-pi-spawn). A PUBLIC key — non-secret, env-safe. */
 export const COORDINATION_VERIFY_KEY_ENV = "PI_CREW_MAILBOX_VERIFY_KEY";
 
+/** Child env var carrying a COMMA-SEPARATED list of base64 SPKI DER Ed25519
+ *  public verify keys (set by child-pi-spawn). A PUBLIC key — non-secret,
+ *  env-safe.
+ *
+ *  FINDING B (2026-10-31): the singular var above carries exactly ONE key —
+ *  the key of the process that SPAWNED the child. But legitimate coordination
+ *  rows are written by MORE processes than the spawner: async runs have the
+ *  leader session (the dispatcher) write `respond` rows and steering
+ *  fs-fallback lines while the detached runner spawns the workers — those
+ *  leader-signed rows failed the single-key verify and were dropped as noise
+ *  (ask poll 480s timeout). This plural var lets the spawner hand the child
+ *  the FULL verify set: spawner-relayed keys (nested same-run grandchild case)
+ *  plus the run's dispatcher key threaded via the manifest
+ *  (TeamRunManifest.dispatcherVerifyKey → ChildPiRunInput.dispatcherVerifyKey
+ *  → child-pi-spawn env build). The singular var keeps its exact semantics
+ *  (backward-compatible); the resolver merges + dedupes both plus the
+ *  in-process keypair. */
+export const COORDINATION_VERIFY_KEYS_ENV = "PI_CREW_MAILBOX_VERIFY_KEYS";
+
 interface MailboxSigningKeypair {
 	privateKey: KeyObject;
 	publicKey: KeyObject;
@@ -97,16 +117,42 @@ export function getMailboxVerifyKeyPublic(): string {
 	return getMailboxSigningKeypair().publicBase64;
 }
 
+/** Dispatch-path alias of {@link getMailboxVerifyKeyPublic}: get-or-create
+ *  this process's coordination public verify key (base64 SPKI DER). The
+ *  dispatcher (leader session building a run — team-tool run/parallel) stamps
+ *  the returned key onto TeamRunManifest.dispatcherVerifyKey so the spawner
+ *  can hand it to workers via PI_CREW_MAILBOX_VERIFY_KEYS; rows this process
+ *  signs (respond, steering fs-fallback) then verify in those children.
+ *  PUBLIC material only — the private key never leaves this heap. */
+export function ensureCoordinationPublicVerifyKey(): string {
+	return getMailboxVerifyKeyPublic();
+}
+
 /** Whether any verify key is resolvable in THIS process (child env key or an
  *  already-created in-process keypair). Keyless processes are inert readers. */
 export function hasCoordinationVerifyKeys(): boolean {
 	return resolveCoordinationVerifyKeys().length > 0;
 }
-
+/** Resolve the verify-key set for THIS process: MERGE + dedupe of
+ *  [PI_CREW_MAILBOX_VERIFY_KEYS (plural env), PI_CREW_MAILBOX_VERIFY_KEY
+ *  (singular env, backward-compatible), the in-process keypair when it
+ *  exists]. No source shadows another (FINDING B shadow bug: the old
+ *  `if (envKey) return [envKey]` early-return made the env key HIDE the
+ *  in-process keypair, so a writer process that also carried a child env key
+ *  dropped its own freshly-signed rows on re-read). Empty entries and
+ *  duplicates are skipped; malformed key material is tolerated here and
+ *  skipped per-key at verify time. */
 function resolveCoordinationVerifyKeys(): string[] {
-	const envKey = getCrewEnv(COORDINATION_VERIFY_KEY_ENV);
-	if (envKey && envKey.length > 0) return [envKey];
-	return signingKeypair ? [signingKeypair.publicBase64] : [];
+	const keys: string[] = [];
+	const pushKey = (key: string): void => {
+		if (key.length > 0 && !keys.includes(key)) keys.push(key);
+	};
+	const pluralEnv = getCrewEnv(COORDINATION_VERIFY_KEYS_ENV);
+	if (pluralEnv !== undefined) for (const key of pluralEnv.split(",")) pushKey(key.trim());
+	const singularEnv = getCrewEnv(COORDINATION_VERIFY_KEY_ENV);
+	if (singularEnv !== undefined) pushKey(singularEnv.trim());
+	if (signingKeypair) pushKey(signingKeypair.publicBase64);
+	return keys;
 }
 
 /** Canonical payload string over the identity-bearing mailbox-row fields —

package/src/state/event-log/event-log.ts

@@ -1209,11 +1209,35 @@ interface BufferedAppend {
 	reject: (error: unknown) => void;
 }
 const bufferedQueues = new Map<string, BufferedAppend[]>();
-const bufferedTimers = new Map<string, ReturnType<typeof setTimeout>>();
+/**
+ * Armed flush timer per path. The stored `bufferMs` is the delay the queue was
+ * armed with — reused when a flush re-arms for leftovers appended mid-flight
+ * (F3, 2026-10-31).
+ */
+interface ArmedFlushTimer {
+	handle: ReturnType<typeof setTimeout>;
+	bufferMs: number;
+}
+const bufferedTimers = new Map<string, ArmedFlushTimer>();
 /** Per-path in-flight flush (started, not yet settled) — see flushOneEventLogBuffer. */
 const inflightBufferFlushes = new Map<string, Promise<void>>();
 const DEFAULT_BUFFER_MS = 20;
 
+/** Arm the per-path flush timer (single armer for appendEventBuffered and the F3 finally re-arm). */
+function armBufferedFlushTimer(eventsPath: string, bufferMs: number): void {
+	// Wrap flush in async IIFE so the returned Promise is awaited (avoids
+	// "floating promise" warnings under --test-force-exit and prevents
+	// the timer from being treated as done before the flush actually
+	// completes its async work).
+	const handle = setTimeout(() => {
+		flushOneEventLogBuffer(eventsPath).catch((error) => {
+			logInternalError("event-log.buffered-flush", error, `eventsPath=${eventsPath}`);
+		});
+	}, bufferMs);
+	handle.unref();
+	bufferedTimers.set(eventsPath, { handle, bufferMs });
+}
+
 export function appendEventBuffered(eventsPath: string, event: AppendTeamEvent, bufferMs = DEFAULT_BUFFER_MS): Promise<TeamEvent> {
 	// FIX: Terminal events must bypass buffer to ensure they're written immediately.
 	// Previously, terminal events like task.failed could be lost on process crash.
@@ -1235,26 +1259,28 @@ export function appendEventBuffered(eventsPath: string, event: AppendTeamEvent,
 		const queue = bufferedQueues.get(eventsPath) ?? [];
 		queue.push({ event, resolve, reject });
 		bufferedQueues.set(eventsPath, queue);
-		if (!bufferedTimers.has(eventsPath)) {
-			// Wrap flush in async IIFE so the returned Promise is awaited (avoids
-			// "floating promise" warnings under --test-force-exit and prevents
-			// the timer from being treated as done before the flush actually
-			// completes its async work).
-			const timer = setTimeout(() => {
-				flushOneEventLogBuffer(eventsPath).catch((error) => {
-					logInternalError("event-log.buffered-flush", error, `eventsPath=${eventsPath}`);
-				});
-			}, bufferMs);
-			bufferedTimers.set(eventsPath, timer);
-			timer.unref();
-		}
+		// Arm-once gate: while a timer entry exists (armed OR mid-flight),
+		// appends piggyback on it. A flush started for this path clears the
+		// handle at grab (F5) and re-arms for leftovers in its finally (F3), so
+		// events appended during an in-flight flush are never lost from the gate.
+		if (!bufferedTimers.has(eventsPath)) armBufferedFlushTimer(eventsPath, bufferMs);
 	});
 }
 
 async function flushOneEventLogBuffer(eventsPath: string): Promise<void> {
 	const queue = bufferedQueues.get(eventsPath);
 	bufferedQueues.delete(eventsPath);
-	const timer = bufferedTimers.get(eventsPath);
+	// F5 (2026-10-31): clear the armed handle NOW, at grab time. When the flush
+	// is triggered by anything other than the timer itself (terminal-event
+	// flush, flushEventLogBuffer, drainEventLogWriters) a timer may still be
+	// pending — without this clearTimeout the stale timer fires later and runs
+	// a redundant flush. When the timer itself triggered this flush, the
+	// clearTimeout is a harmless no-op on the already-fired handle. The entry
+	// itself stays until the finally below: appends landing mid-flight must see
+	// it (arm-once gate) so they cannot double-arm; the finally then re-arms for
+	// them (F3) or deletes the entry.
+	const armedTimer = bufferedTimers.get(eventsPath);
+	if (armedTimer) clearTimeout(armedTimer.handle);
 	// PERF-CORRECTNESS (2026-10-31, macos CI run 41147573288): track the
 	// in-flight flush so flushEventLogBuffer()/drainEventLogWriters() can AWAIT
 	// it. Previously those helpers were no-ops for a path whose flush had just
@@ -1265,7 +1291,9 @@ async function flushOneEventLogBuffer(eventsPath: string): Promise<void> {
 	// Same window on the exit path: flushBufferedQueuesSync sees an empty map
 	// and cannot recover an in-flight batch.
 	const doFlush = (async (): Promise<void> => {
-		// Timer is cleared in the finally block to ensure cleanup happens even on error
+		// The armed timer HANDLE was cleared at grab time (F5 above); the ENTRY
+		// lifecycle is owned by the finally below (re-arm for leftovers, delete
+		// when drained).
 		try {
 			if (!queue || queue.length === 0) return;
 
@@ -1313,7 +1341,26 @@ async function flushOneEventLogBuffer(eventsPath: string): Promise<void> {
 			// Lock acquire failed — fail every queued item so callers can fall back.
 			if (queue) for (const item of queue) item.reject(error);
 		} finally {
-			bufferedTimers.delete(eventsPath);
+			// F3 (2026-10-31): events appended while this flush was in flight saw
+			// the stale timer entry and could NOT arm one of their own (arm-once
+			// gate) — previously the finally just deleted the entry, leaving them
+			// un-timered until the next append or the exit-path flush. Re-arm with
+			// the queue's last-used delay when leftovers exist; else just delete.
+			// The identity check re-arms only while the entry is still OURS (the
+			// mid-flight stale one): when a prior flush already deleted its entry,
+			// an append during this window armed a FRESH timer — overwriting it
+			// would orphan that handle (double flush later).
+			if (bufferedQueues.has(eventsPath)) {
+				if (bufferedTimers.get(eventsPath) === armedTimer) {
+					armBufferedFlushTimer(eventsPath, armedTimer?.bufferMs ?? DEFAULT_BUFFER_MS);
+				}
+			} else {
+				// Drain case: also clear any handle another flush's re-arm may have
+				// left behind (ours was already cleared at grab — no-op then).
+				const leftoverEntry = bufferedTimers.get(eventsPath);
+				if (leftoverEntry) clearTimeout(leftoverEntry.handle);
+				bufferedTimers.delete(eventsPath);
+			}
 		}
 	})();
 	// Chain per-path: a second flush must wait for the in-flight one (keeps the
@@ -1323,18 +1370,30 @@ async function flushOneEventLogBuffer(eventsPath: string): Promise<void> {
 		() => doFlush,
 		() => doFlush,
 	);
-	inflightBufferFlushes.set(
-		eventsPath,
-		tracked.finally(() => {
-			if (inflightBufferFlushes.get(eventsPath) === tracked) inflightBufferFlushes.delete(eventsPath);
-		}),
-	);
+	// F4 (2026-10-31): the map stores the `.finally()` WRAPPER, so the
+	// compare-and-delete on settle must compare against the WRAPPER reference.
+	// The old code compared against the pre-`.finally()` `tracked` promise — an
+	// identity that never matches what the map holds — so entries were never
+	// deleted (leak, and the "may already have self-deleted" no-op path of the
+	// drain helpers was dead code).
+	const wrapper = tracked.finally(() => {
+		if (inflightBufferFlushes.get(eventsPath) === wrapper) inflightBufferFlushes.delete(eventsPath);
+	});
+	inflightBufferFlushes.set(eventsPath, wrapper);
 	await tracked;
 }
 
 /** Asynchronously flush every queued buffered event across all paths. */
 export async function flushEventLogBuffer(): Promise<void> {
-	for (const eventsPath of [...bufferedQueues.keys()]) {
+	// PERF-CORRECTNESS follow-up (2026-10-31): iterate the UNION of queued and
+	// in-flight paths. Iterating only bufferedQueues keys skipped a path whose
+	// queue an in-flight flush had ALREADY grabbed (removed from the map at
+	// flush start) — exactly the case the await-inflight below exists for — so a
+	// caller awaiting this during an in-flight flush could still observe a log
+	// without the in-flight events (the deterministic-read pin in
+	// event-log-buffered.test.ts flaked ~1 run in 10 on slow fs via that hole).
+	const paths = new Set<string>([...bufferedQueues.keys(), ...inflightBufferFlushes.keys()]);
+	for (const eventsPath of paths) {
 		// PERF-CORRECTNESS (2026-10-31): await any IN-FLIGHT flush for this path
 		// first — the timer-led flush may hold events that are no longer in
 		// bufferedQueues (removed at flush start). Without this, a caller that
@@ -1380,7 +1439,14 @@ export function flushBufferedQueuesSync(): void {
 			logInternalError("event-log.sync-flush", error, eventsPath);
 		}
 	}
-	for (const eventsPath of [...bufferedTimers.keys()]) bufferedTimers.delete(eventsPath);
+	// Adjacent (2026-10-31): clear each pending timer HANDLE before dropping the
+	// entry — an unref'd handle that survives the sync flush would fire later
+	// (tests keep the process alive) and run a redundant no-op flush.
+	for (const eventsPath of [...bufferedTimers.keys()]) {
+		const armedTimer = bufferedTimers.get(eventsPath);
+		if (armedTimer) clearTimeout(armedTimer.handle);
+		bufferedTimers.delete(eventsPath);
+	}
 }
 
 // Exported only for the buffered-batch unit tests. NOT part of the public API —
@@ -1402,6 +1468,18 @@ export function __test__appendBatchForUnitTest(
 	return appendEventBatchInsideLock(eventsPath, queue, locks);
 }
 
+/**
+ * Exposed only for the buffered-flush unit tests (F4 pin, 2026-10-31): how many
+ * per-path in-flight flush trackers are currently registered. NOT part of the
+ * public API — same `__test__` convention as `__test__appendBatchForUnitTest`
+ * above. Pins that the tracker entry SELF-DELETES on settle (the pre-F4 code
+ * stored a `.finally()` wrapper but compare-deleted against the pre-wrapper
+ * promise, so entries leaked for the process lifetime).
+ */
+export function __test__inflightBufferFlushCount(): number {
+	return inflightBufferFlushes.size;
+}
+
 /**
  * Schedule an async event append without waiting for the result.
  * Uses the non-blocking async queue to avoid blocking the event loop.
@@ -1423,8 +1501,11 @@ export function appendEventFireAndForget(eventsPath: string, event: AppendTeamEv
  *   write chain (tail-chaining guarantees the tail completes last), then
  *   flushes that path's buffered tier via the internal `flushOneEventLogBuffer`
  *   (per-path flush is a simple direct call — no complexity caveat).
- *   The Map entry may already have self-deleted (compare-and-delete on
- *   settle) — `?? Promise.resolve()` makes that a clean no-op.
+ *   The asyncQueues tail entry may already have self-deleted (compare-and-delete
+ *   on settle) — `?? Promise.resolve()` makes that a clean no-op. The
+ *   inflight-buffer tracker below it self-deletes on settle the same way
+ *   (F4 2026-10-31: it previously stored a `.finally()` wrapper but compared
+ *   against the pre-wrapper promise, so the entry never matched and leaked).
  * - Without `eventsPath`: awaits every queue tail + `flushEventLogBuffer()`.
  *
  * Never throws: a rejected tail is absorbed by `allSettled` (a teardown

package/src/state/event-log/event-reconstructor.ts

@@ -34,6 +34,9 @@ const TASK_LIFECYCLE_EVENT_TYPES = new Set([
 	"task.needs_attention",
 	"task.waiting",
 	"task.resumed",
+	// ASK-PARK CLOBBER FIX (2026-10-31): respond's clobbered-park self-heal —
+	// reconstructs to "waiting" exactly like the task.waiting park it repairs.
+	"task.waiting_repaired",
 	"task.retried",
 	"task.blocked",
 	"task.progress",
@@ -55,6 +58,8 @@ const EVENT_STATUS_MAP: Readonly<Record<string, string>> = {
 	"task.needs_attention": "needs_attention",
 	"task.waiting": "waiting",
 	"task.resumed": "running",
+	// ASK-PARK CLOBBER FIX (2026-10-31): see TASK_LIFECYCLE_EVENT_TYPES above.
+	"task.waiting_repaired": "waiting",
 	"task.retried": "queued",
 };
 

package/src/state/stores/state-store.ts

@@ -485,6 +485,13 @@ export function createRunManifest(params: {
 	 * catalogue must be persisted on the manifest at creation time.
 	 * Omitted when undefined so old manifests stay byte-identical. */
 	modelContext?: RunModelContext;
+	/** FINDING B (2026-10-31): PUBLIC base64 SPKI verify key of the DISPATCHING
+	 * session process, threaded to every worker's
+	 * PI_CREW_MAILBOX_VERIFY_KEYS env so the dispatcher's signed rows
+	 * (respond / steering fs-fallback) verify cross-process. See
+	 * TeamRunManifest.dispatcherVerifyKey. Omitted when undefined so old
+	 * manifests stay byte-identical. */
+	dispatcherVerifyKey?: string;
 }): { manifest: TeamRunManifest; tasks: TeamTaskState[]; paths: RunPaths } {
 	const paths = createRunPaths(params.cwd, params.runId);
 	const now = (params.now ? params.now() : new Date()).toISOString();
@@ -532,6 +539,7 @@ export function createRunManifest(params: {
 		runKind: params.runKind ?? "team-run",
 		...(params.args !== undefined ? { args: params.args } : {}),
 		...(params.modelContext ? { modelContext: params.modelContext } : {}),
+		...(params.dispatcherVerifyKey ? { dispatcherVerifyKey: params.dispatcherVerifyKey } : {}),
 	};
 	fs.mkdirSync(paths.stateRoot, { recursive: true });
 	fs.mkdirSync(paths.artifactsRoot, { recursive: true });

package/src/state/types.ts

@@ -455,6 +455,22 @@ export interface TeamRunManifest {
 	 * models.json happens to list first.
 	 */
 	modelContext?: RunModelContext;
+	/** FINDING B (2026-10-31) — w1a coordination verify-key distribution: the
+	 *  base64 SPKI DER PUBLIC verify key of the DISPATCHING session process
+	 *  (the leader that created this run; stamped via
+	 *  ensureCoordinationPublicVerifyKey() at team-tool run/parallel dispatch).
+	 *  Async runs execute in a detached runner whose workers verify
+	 *  coordination rows against the SPAWNER's key — without this field the
+	 *  leader's respond rows and steering fs-fallback lines (signed with the
+	 *  LEADER's keypair) fail verify and drop as noise (ask poll timeout).
+	 *  The runner threads it into every worker's
+	 *  PI_CREW_MAILBOX_VERIFY_KEYS env (plural set). PUBLIC material — safe to
+	 *  persist (same-uid readable); possession cannot forge rows. Optional:
+	 *  absent on every pre-FINDING-B manifest → workers keep verifying against
+	 *  the singular spawner key only (pre-fix behavior). goal-loop turns
+	 *  inherit the OUTER manifest's key so the session that dispatched the
+	 *  loop stays the verifiable responder across every turn. */
+	dispatcherVerifyKey?: string;
 	/** MuxSurface A1 (spec §8.3): pane/pid/lockout state of this run. Absent on
 	 *  runs that never booted a surface worker and on older manifests. */
 	surface?: ManifestSurfaceState;

package/src/worktree/worktree-manager.ts

@@ -1133,6 +1133,18 @@ export function prepareTaskWorkspace(
 	}
 	try {
 		const syntheticPaths = runSetupHook(manifest, task, repoRoot, worktreePath, branch);
+		// TRUST ASSUMPTION (S-1 shared-cwd-untracked-harness review, 2026-10-31):
+		// linking the leader's node_modules into a task worktree means those
+		// files are NOT covered by the verify-gate's dispatch-pinned bindings
+		// (treeOid/cleanTree/memo key bind TRACKED content only — a gitignored
+		// shim inside the leader node_modules would execute in the worktree's
+		// gate too, outside every binding). Accepted residual: worktree-mode
+		// executors are trusted not to write outside their own worktree (their
+		// uncommitted work there is separately guarded by the W2 probes), and
+		// the leader node_modules is host-managed. The shared-cwd variant of
+		// this residual IS closed: the gate refuses the deterministic skip when
+		// a write-role task executed in the gate cwd (reason
+		// "shared-cwd-untracked-harness", verify-gate.ts). See docs/trust-model.md.
 		const nodeModulesLinked =
 			loadedConfig.config.worktree?.linkNodeModules === true ? linkNodeModulesIfPresent(repoRoot, worktreePath) : false;
 		// Overlay seed paths from config + step-level seedPaths