pi-crew 0.11.21 → 0.11.22

package/src/runtime/task-runner/child-executor.ts

@@ -414,6 +414,21 @@ export function attemptErrorFor(
 		const rateLimitErr = detectRetryableModelFailureFromOutput(parsedOutput);
 		if (rateLimitErr) err = rateLimitErr;
 	}
+	// DR-01 (deep review 2026-10-14, P0 false-green): upstream rate-limit
+	// exhaustion can end a session WITHOUT stopReason:"error" — the transcript
+	// is a chain of EMPTY assistant message_end events (content [], usage 0)
+	// between auto-retry cycles, ending in agent_settled. The detector above
+	// misses that shape (no errorMessage is ever emitted), and finalText lies
+	// (it keeps the LAST NON-EMPTY text — an early opening sentence from
+	// before the outage, which is exactly what made failed audits look
+	// green). settledWithoutAnswer tracks the actual FINAL assistant message;
+	// patches still count as real work (coder roles may legitimately end
+	// patch-only); cancelled attempts are excluded so an abort never burns a
+	// fallback model. Message includes rate-limit/429 keywords so
+	// isRetryableModelFailure lets the model-fallback chain advance.
+	if (!err && !childResult.exitStatus?.cancelled && parsedOutput?.settledWithoutAnswer === true && !(parsedOutput.patches?.length ?? 0)) {
+		err = "Model settled without a final answer (empty final assistant message; upstream rate-limit/429 exhaustion)";
+	}
 	return err;
 }
 
@@ -797,6 +812,13 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 				workerTransport: input.runtimeConfig?.workerTransport,
 				agent: input.agent,
 				model,
+				// R6-8 (DR-03 round-6): thread the full candidate chain (primary +
+				// fallbacks) so buildChildPiSpawnOptions scopes provider env keys to
+				// the UNION of the chain's providers — a bare-id primary would
+				// otherwise spawn with ZERO provider keys and break the chain on a
+				// non-retryable auth failure while qualified fallbacks sat queued.
+				// Parameter threading only — the attempt loop logic is untouched.
+				modelChain: attemptModels,
 				signal: timeoutController.signal,
 				transcriptPath,
 				maxDepth: input.limits?.maxTaskDepth,
@@ -1265,9 +1287,14 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 	if (error && modelAttempts.length > 1) {
 		// E2/E1 (Round 15): structured CrewError (E008). Build via the factory so
 		// the error carries a code + help hint; keep its .message as the task error.
+		// J4 (DR-03 round-6): attemptModels may still hold UNTRIED candidates when
+		// the loop broke early (non-retryable failure, classifier veto, or
+		// spawn-budget stop) — pass the planned chain length so E008 distinguishes
+		// "Model chain failed early (tried X of N)" from genuine exhaustion.
 		error = errors.modelExhausted(
 			modelAttempts.map((a) => a.model),
 			error,
+			attemptModels.length,
 		).message;
 	}
 	// bug-026 sub-issue B: reclassify after the E008 modelExhausted rewrite —

package/src/runtime/task-runner/output-splitter.ts

@@ -28,15 +28,36 @@
  * raw output. When the deadletter strategy is returned, all entries have
  * empty text — the caller decides what marker to surface per task.
  *
- * Note: pure function — no I/O, no LLM calls, deterministic. This is
- * deliberately the simplest possible splitter; we don't try fuzzy
- * matching, NL extraction, or retry-the-LLM. The MVP trusts workers
- * to follow delimiters 99% of the time; a zero-marker miss degrades to
- * broadcast (nothing task-specific exists to leak), and a partial
- * violation now fails closed (G20) instead of leaking cross-task
- * delimited bodies.
+ * Note: deterministic — no I/O, no LLM calls. (R6-11 exception: duplicate
+ * delimiter hits emit a structured `logInternalError` warn to the console
+ * audit trail; parsing itself stays deterministic.) This is deliberately
+ * the simplest possible splitter; we don't try fuzzy matching, NL
+ * extraction, or retry-the-LLM. The MVP trusts workers to follow
+ * delimiters 99% of the time; a zero-marker miss degrades to broadcast
+ * (nothing task-specific exists to leak), and a partial violation now
+ * fails closed (G20) instead of leaking cross-task delimited bodies.
+ *
+ * R6-11 (DR-03 round-6): duplicate-delimiter handling. A worker that QUOTES
+ * an earlier task's delimited block (in prose, code fences, or a transcript)
+ * and then emits its own genuine block produces two `<<<TASK_RESULT:id>>>`
+ * hits for the same id. Previously first-occurrence-wins let the quoted /
+ * forged block steal attribution with full `strategy:"delimiter"` trust.
+ * Now the LAST occurrence wins (the worker's own genuine emission follows
+ * any quote of earlier material), and every duplicate hit raises a
+ * structured warn via `logInternalError` naming the task and hit count so
+ * operators can audit the group.
+ *
+ * R6-11 residual (documented, accepted): emit-then-quote inversion. A worker
+ * that emits its genuine block FIRST and quotes a forged `<<<TASK_RESULT:…>>>`
+ * block LAST still misattributes under last-wins — as would first-wins under
+ * the mirror-image attack. Without content signing (cryptographic proof that
+ * a block was emitted by its owning worker, not merely quoted) neither
+ * ordering heuristic can distinguish genuine from quoted. Signing is out of
+ * scope; the duplicate-hit warn is the audit signal for exactly this case.
  */
 
+import { logInternalError } from "../../utils/internal-error.ts";
+
 export interface SplitResult {
 	taskId: string;
 	text: string;
@@ -60,6 +81,7 @@ export function splitCoalescedOutput(rawOutput: string, taskIds: string[]): Spli
 
 	const byId = new Map<string, string>();
 	const delimiterHits = new Set<string>();
+	const delimiterHitCounts = new Map<string, number>();
 
 	// Strategy 1: delimiter parse.
 	// Pattern: <<<TASK_RESULT:{id}>>> ... <<<END_TASK_RESULT>>>
@@ -69,10 +91,28 @@ export function splitCoalescedOutput(rawOutput: string, taskIds: string[]): Spli
 	while ((match = delimiterRegex.exec(rawOutput)) !== null) {
 		const id = match[1]!;
 		const body = match[2]!.trim();
-		if (taskIds.includes(id) && !byId.has(id)) {
-			byId.set(id, body);
-			delimiterHits.add(id);
-		}
+		if (!taskIds.includes(id)) continue;
+		delimiterHitCounts.set(id, (delimiterHitCounts.get(id) ?? 0) + 1);
+		// R6-11: LAST-wins. First-occurrence-wins previously let a quoted /
+		// forged block steal attribution (a worker quoting an earlier task's
+		// delimited output before emitting its own genuine block). With
+		// last-wins the worker's own emission wins; duplicates raise a
+		// structured warn below. Residual: emit-then-quote inversion — see
+		// the header note; unsolvable without content signing.
+		byId.set(id, body);
+		delimiterHits.add(id);
+	}
+	// R6-11 (b): duplicate-hit detection → structured warn naming the task
+	// and hit count, so misattribution attempts (and accidental self-quotes)
+	// surface in the audit trail instead of silently shifting attribution.
+	for (const [id, hits] of delimiterHitCounts) {
+		if (hits <= 1) continue;
+		logInternalError(
+			"output-splitter.duplicate-delimiter",
+			new Error(`task "${id}" produced ${hits} TASK_RESULT delimiter blocks; LAST occurrence wins attribution`),
+			`taskId=${id} hits=${hits} resolution=last-wins`,
+			"warn",
+		);
 	}
 
 	if (delimiterHits.size === taskIds.length) {
@@ -135,12 +175,32 @@ export function splitCoalescedOutput(rawOutput: string, taskIds: string[]): Spli
 	}));
 }
 
+/**
+ * True iff `headerText` attributes the section to `id` by exact or
+ * word-boundary match. R6-11: plain substring matching let a shorter id
+ * claim a longer id's header ("task-a" matching "### Task task-alpha").
+ * `id` is escaped before regex construction; the surrounding `\b` anchors
+ * require a non-word char (or string edge) on both sides, so "task-a" no
+ * longer matches "task-alpha" while "task-a", "task-a:" and
+ * "task-a (done)" all still match "task-a".
+ */
+function headerMatchesId(headerText: string, id: string): boolean {
+	if (headerText === id) return true;
+	const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return new RegExp(`\\b${escaped}\\b`).test(headerText);
+}
+
 /**
  * Strategy 2 implementation: parse sections by heading patterns.
  *
  * Matches `### Task N of M` (N=1..M) or `### Task N` headers, then
  * captures text up to the next header or end-of-input.
  *
+ * R6-11: numbered sections map to taskIds by their declared `num`
+ * (`### Task 2 of 2` → taskIds[1]), NOT by scan position — a worker that
+ * emits its sections out of order previously had them assigned positionally
+ * to the wrong tasks. Out-of-range `num` values are ignored (no task to map).
+ *
  * Falls back to "first heading wins all text" if no N-of-M numbering is
  * present, which is common in worker output that just labels sections.
  */
@@ -155,12 +215,15 @@ function parseBySectionHeadings(rawOutput: string, taskIds: string[]): Map<strin
 	}
 	if (sections.length >= taskIds.length) {
 		sections.sort((a, b) => a.start - b.start);
-		for (let i = 0; i < sections.length && i < taskIds.length; i += 1) {
+		for (let i = 0; i < sections.length; i += 1) {
 			const section = sections[i]!;
 			const end = sections[i + 1]?.start ?? rawOutput.length;
 			const text = rawOutput.slice(section.start, end).trim();
-			const taskId = taskIds[i];
-			if (taskId) result.set(taskId, text);
+			// R6-11: honor the declared `num` — the section's own identity —
+			// instead of mapping by scan position.
+			const taskId = taskIds[section.num - 1];
+			if (taskId === undefined) continue; // num out of range — no task to map
+			if (!result.has(taskId)) result.set(taskId, text); // first occurrence wins
 		}
 		return result;
 	}
@@ -168,7 +231,7 @@ function parseBySectionHeadings(rawOutput: string, taskIds: string[]): Map<strin
 	const idHeaderRegex = /^(#{2,3})\s+Task\s+([^\s].*?)$/gm;
 	while ((m = idHeaderRegex.exec(rawOutput)) !== null) {
 		const headerText = m[2]!.trim();
-		const matchedId = taskIds.find((id) => headerText.includes(id));
+		const matchedId = taskIds.find((id) => headerMatchesId(headerText, id));
 		if (matchedId && !result.has(matchedId)) {
 			result.set(matchedId, ""); // placeholder; filled below
 		}
@@ -179,7 +242,7 @@ function parseBySectionHeadings(rawOutput: string, taskIds: string[]): Map<strin
 		const idHeaderRegex2 = /^(#{2,3})\s+Task\s+([^\s].*?)$/gm;
 		while ((m = idHeaderRegex2.exec(rawOutput)) !== null) {
 			const headerText = m[2]!.trim();
-			const matchedId = taskIds.find((id) => headerText.includes(id));
+			const matchedId = taskIds.find((id) => headerMatchesId(headerText, id));
 			if (matchedId) headerPositions.push({ taskId: matchedId, start: m.index + m[0].length });
 		}
 		headerPositions.sort((a, b) => a.start - b.start);

package/src/runtime/task-runner/post-execution.ts

@@ -16,6 +16,7 @@
  */
 import { readFileSync } from "node:fs";
 import { appendHookEvent, executeHook } from "../../hooks/registry.ts";
+import type { TeamEventType } from "../../state/contracts.ts";
 import { withRunLock } from "../../state/coordination/locks.ts";
 import { appendEventAsync } from "../../state/event-log/event-log.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
@@ -25,6 +26,7 @@ import type {
 	OperationTerminalEvidence,
 	TeamRunManifest,
 	TeamTaskState,
+	TeamTaskStatus,
 	VerificationEvidence,
 } from "../../state/types.ts";
 import { captureWorktreeDiffAsync, captureWorktreeDiffStatAsync } from "../../worktree/worktree-manager.ts";
@@ -47,6 +49,24 @@ import { buildWorkerPromptPipeline } from "./prompt-pipeline.ts";
 import { computeSpecGate } from "./spec-evidence.ts";
 import { persistSingleTaskUpdate, updateTask } from "./state-helpers.ts";
 
+/**
+ * R6-1 (DR-03, 2026-10-16): terminal status → singleton-path terminal event
+ * type. When persistSingleTaskUpdate PRESERVED a disk terminal status (e.g.
+ * `cancelled` written by crash-recovery while this worker was settling), the
+ * emitted event must match the PRESERVED record — emitting task.completed
+ * over a cancelled tasks.json entry recreates the event-log vs tasks.json
+ * divergence crash-recovery reconstructs from. Every terminal task status
+ * has a matching event type in TEAM_EVENT_TYPES; the lookup is total in
+ * practice, the undefined guard is defensive only.
+ */
+const TERMINAL_TASK_EVENT_TYPES: Readonly<Partial<Record<TeamTaskStatus, TeamEventType>>> = {
+	completed: "task.completed",
+	failed: "task.failed",
+	cancelled: "task.cancelled",
+	skipped: "task.skipped",
+	needs_attention: "task.needs_attention",
+};
+
 /**
  * Branch execution output — the set of variables produced by the
  * child-process / live-session / scaffold branch dispatch. These flow
@@ -424,12 +444,23 @@ export async function finalizeTaskResult(ctx: TaskExecutionContext, execResult:
 				? "Safe scaffold mode; verification commands were not executed."
 				: `${runtimeKind} worker finished without reporting a verification failure.`,
 	);
+	// R4-5 (DR-02 wave 2): decorative contract — required green level but zero
+	// verification commands — means satisfaction is purely self-attested. The
+	// `decorative` flag is stamped by createVerificationEvidence; surface it in
+	// the notes too so the evidence artifact reads honestly WITHOUT changing
+	// the satisfied logic or defaultVerificationContract defaults.
+	const seededEvidence: VerificationEvidence = baseEvidence.decorative
+		? {
+				...baseEvidence,
+				notes: `${baseEvidence.notes ?? ""} — self-attested (no verification commands configured)`,
+			}
+		: baseEvidence;
 
 	// Only execute verification commands when:
 	// 1. Task completed successfully (no error)
 	// 2. Verification contract has commands
 	// 3. Not in scaffold mode (scaffold mode intentionally skips execution)
-	let verificationEvidence: VerificationEvidence = baseEvidence;
+	let verificationEvidence: VerificationEvidence = seededEvidence;
 	if (runtimeKind !== "scaffold" && taskPacket.verification?.commands?.length) {
 		try {
 			const commandResults = await executeVerificationCommands(
@@ -470,11 +501,20 @@ export async function finalizeTaskResult(ctx: TaskExecutionContext, execResult:
 					: `${failedCount}/${commandResults.length} verification commands failed`,
 			};
 		} catch (execError) {
-			// On execution error, return base evidence with error note
-			verificationEvidence = {
-				...baseEvidence,
-				notes: `Verification execution failed: ${execError instanceof Error ? execError.message : String(execError)}`,
-			};
+			// B4 (DR-02 wave 2): verification execution THREW — fail CLOSED instead of
+			// keeping the self-attested baseEvidence (satisfied=true via manual
+			// evidence), which used to green-light a task whose verification never
+			// ran. Only contracts that require a green level flip to unsatisfied;
+			// level "none" has nothing to gate, so baseEvidence stays untouched.
+			if (taskPacket.verification && taskPacket.verification.requiredGreenLevel !== "none") {
+				const message = execError instanceof Error ? execError.message : String(execError);
+				verificationEvidence = {
+					...seededEvidence,
+					satisfied: false,
+					observedGreenLevel: "none",
+					notes: `Verification execution failed (fail-closed): ${message}`,
+				};
+			}
 		}
 	}
 
@@ -659,7 +699,15 @@ export async function finalizeTaskResult(ctx: TaskExecutionContext, execResult:
 		await saveRunManifestAsync(manifest);
 		return persistSingleTaskUpdate(manifest, tasks, task, undefined, true);
 	});
-	upsertCrewAgent(manifest, recordFromTask(manifest, task, runtimeKind));
+	// R6-1 (DR-03): persistSingleTaskUpdate may have PRESERVED a disk terminal
+	// status (e.g. cancelled by crash-recovery / stale-reconciler) instead of
+	// this worker's settle status. Everything downstream of the persist — the
+	// agents.json record, the terminal event, and the after_task_complete hook
+	// status — must match the PRESERVED record, never the in-memory verdict.
+	const persistedTask = tasks.find((t) => t.id === task.id) ?? task;
+	const preservedStatus: TeamTaskStatus | undefined = persistedTask.status !== task.status ? persistedTask.status : undefined;
+	const effectiveStatus: TeamTaskStatus = preservedStatus ?? task.status;
+	upsertCrewAgent(manifest, recordFromTask(manifest, persistedTask, runtimeKind));
 	// Execute task_result hook before emitting terminal event
 	const hookReport = await executeHook("task_result", {
 		runId: manifest.runId,
@@ -667,23 +715,35 @@ export async function finalizeTaskResult(ctx: TaskExecutionContext, execResult:
 		cwd: manifest.cwd,
 	});
 	appendHookEvent(manifest, hookReport);
-	await appendEventAsync(manifest.eventsPath, {
-		type: error ? "task.failed" : noYield ? "task.needs_attention" : "task.completed",
-		runId: manifest.runId,
-		taskId: task.id,
-		message: error,
+	// R6-1: emit the terminal event for the PRESERVED status when one was
+	// preserved (task.cancelled over a cancelled record — never task.completed);
+	// otherwise the inferred settle event exactly as before.
+	const terminalEventType = TERMINAL_TASK_EVENT_TYPES[effectiveStatus];
+	if (terminalEventType !== undefined) {
 		// bug-026 sub-issue B: surface the classified fatal-fs cause (enospc/
 		// edquot/emfile/enfile) on the failure event so operators see "disk
 		// full" instead of a generic timeout diagnostic.
-		...(task.failureCause ? { data: { failureCause: task.failureCause } } : {}),
-	});
+		const eventData: Record<string, unknown> = {
+			...(task.failureCause ? { failureCause: task.failureCause } : {}),
+			...(preservedStatus ? { preservedFrom: task.status } : {}),
+		};
+		await appendEventAsync(manifest.eventsPath, {
+			type: terminalEventType,
+			runId: manifest.runId,
+			taskId: task.id,
+			// For a preserved terminal the disk record's error (the cancel
+			// reason) is the truthful message; otherwise the settle error.
+			message: preservedStatus ? (persistedTask.error ?? error) : error,
+			...(Object.keys(eventData).length > 0 ? { data: eventData } : {}),
+		});
+	}
 
 	// Execute after_task_complete lifecycle hook (non-blocking)
 	const afterTaskReport = await executeHook("after_task_complete", {
 		runId: manifest.runId,
 		taskId: task.id,
 		cwd: manifest.cwd,
-		status: error ? "failed" : noYield ? "needs_attention" : "completed",
+		status: effectiveStatus,
 	});
 	appendHookEvent(manifest, afterTaskReport);
 

package/src/runtime/task-runner/state-helpers.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import { loadConfig } from "../../config/config.ts";
 import { flushPendingAtomicWrites } from "../../state/atomic-write.ts";
+import { isTerminalTaskStatus } from "../../state/contracts.ts";
 import { withRunLockSync } from "../../state/coordination/locks.ts";
 import { loadRunManifestById, saveRunTasksCoalesced } from "../../state/stores/state-store.ts";
 import type { TaskCheckpointState, TeamRunManifest, TeamTaskState } from "../../state/types.ts";
@@ -11,6 +12,87 @@ export function updateTask(tasks: TeamTaskState[], updated: TeamTaskState): Team
 	return tasks.map((task) => (task.id === updated.id ? updated : task));
 }
 
+/**
+ * R6-1 + R6-4 (DR-03, 2026-10-16): field-level merge of the INCOMING task
+ * onto the DISK task at the persistSingleTaskUpdate merge point. BUG-028
+ * made DISK authoritative for SIBLING tasks; this extends disk authority to
+ * two fields of THIS task where the incoming runner snapshot is provably
+ * stale relative to another writer:
+ *
+ * R6-1 terminal-preserve — when the incoming status is TERMINAL and disk
+ * already holds a DIFFERENT terminal status (e.g. `cancelled` written by
+ * crash-recovery / stale-reconciler / external cancel while a detached
+ * worker was still settling), the disk terminal status + error are
+ * preserved (mirror of the coalesced cancelled branch,
+ * run-coalesced-task-group.ts:367, and the R13-S1 terminal-preserve class
+ * in team-tool api). Without this, a late worker settle overwrote the
+ * leader's cancellation with `completed` and post-execution then emitted
+ * task.completed after crew.run.orphan_cancelled — cancelled run holding a
+ * completed task, event-log vs tasks.json divergence. Incoming fields other
+ * than status/error (result artifacts, finishedAt, usage, …) are still taken
+ * from the incoming record — the worker DID run; only the terminal verdict
+ * is not ours to overwrite. Non-terminal disk status → incoming wins as
+ * before (normal settle path); incoming non-terminal → untouched (the
+ * heartbeat resurrect window is guarded upstream by live-executor's
+ * isCurrent disk-status check, R13-S1 style).
+ *
+ * R6-4 allocation merge — delegate budget accounting (crew-broker writes
+ * task.allocation.tokensSpent under the run lock: reserve = disk + reserved
+ * at admission, roll-up = − reserved + actual on the then-current base at
+ * completion) was a lost update vs the runner's ~1s heartbeat whole-record
+ * replace which carries the dispatch-time (pre-reserve) copy. Rule chosen:
+ * `tokensSpent = max(disk, incoming)`. Verification against the broker
+ * arithmetic (read before choosing — crew-broker.ts reserve ~:1575-1602,
+ * roll-up ~:1690-1708, P2-8c refund ~:1745): every broker write is computed
+ * off the then-current DISK base; each roll-up subtracts exactly the amount
+ * its own reserve previously added and adds back actual ∈ [0, reserved], so
+ * disk(t) ≥ any runner snapshot for snapshots that predate their reserves'
+ * roll-ups — and the runner NEVER writes allocation (zero writers in
+ * task-runner/team-runner; its in-memory copy is dispatch-time lineage that
+ * never saw a reserve). Hence max() degenerates to "disk wins" in every
+ * broker-consistent interleaving, AND self-heals two disk-corruption shapes
+ * verbatim-disk would not: (a) a pre-fix heartbeat that already clobbered a
+ * reserve down, (b) the P2-8c refund over-subtracting a reserve that never
+ * landed. The one theoretical max() hazard — a runner snapshot taken BETWEEN
+ * a reserve and its roll-up, then rolled up with actual < reserved — cannot
+ * occur today because no task-runner path reloads the in-memory task from
+ * disk mid-execution. `tokensGranted` is admission-authoritative write-once
+ * (broker passes it through verbatim) → disk wins verbatim. A heartbeat
+ * snapshot that lacks `allocation` entirely (pre-admission copy) keeps the
+ * disk allocation instead of deleting it — same lost-update class.
+ */
+function mergeTaskUpdateWithDisk(diskTasks: TeamTaskState[], incoming: TeamTaskState): TeamTaskState {
+	const diskTask = diskTasks.find((t) => t.id === incoming.id);
+	if (!diskTask) return incoming;
+
+	let effective = incoming;
+	// R6-1: incoming terminal vs disk DIFFERENT terminal → disk wins for the
+	// terminal verdict (status + error).
+	if (isTerminalTaskStatus(incoming.status) && isTerminalTaskStatus(diskTask.status) && diskTask.status !== incoming.status) {
+		effective = { ...incoming, status: diskTask.status, error: diskTask.error };
+	}
+
+	// R6-4: field-wise allocation merge (see docblock above for the max()
+	// derivation). Applies on every persist (heartbeat, checkpoint, terminal
+	// settle) — all runner paths carry the same stale dispatch-time copy.
+	const incomingAllocation = incoming.allocation;
+	const diskAllocation = diskTask.allocation;
+	if (diskAllocation && !incomingAllocation) {
+		// Heartbeat snapshot predates admission — keep the broker's accounting
+		// instead of deleting it via whole-record replace.
+		effective = { ...effective, allocation: diskAllocation };
+	} else if (diskAllocation && incomingAllocation) {
+		effective = {
+			...effective,
+			allocation: {
+				tokensGranted: diskAllocation.tokensGranted,
+				tokensSpent: Math.max(diskAllocation.tokensSpent ?? 0, incomingAllocation.tokensSpent ?? 0),
+			},
+		};
+	}
+	return effective;
+}
+
 /**
  * Persist a single task update using compare-and-swap under the run lock.
  *
@@ -37,6 +119,12 @@ export function updateTask(tasks: TeamTaskState[], updated: TeamTaskState): Team
  * (durability "best-effort") — tasks.json is reconstructible from the
  * fsync'd event log, so a crash loses at most the un-flushed tail.
  *
+ * R6-1/R6-4 (DR-03, 2026-10-16): the per-task merge is NOT an unconditional
+ * replace-by-id anymore — mergeTaskUpdateWithDisk (above) preserves a disk
+ * terminal status (vs a different incoming terminal) and merges
+ * `allocation.tokensSpent` with max(disk, incoming). The mtime CAS retry
+ * loop, the run lock, and the BUG-028 always-load-disk policy are unchanged.
+ *
  * @param checkpointPhase - Optional checkpoint phase to include in the task state alongside the update.
  */
 export function persistSingleTaskUpdate(
@@ -109,11 +197,13 @@ export function persistSingleTaskUpdate(
 				// stat, i.e. staleness acquired AFTER that baseline — not fallback
 				// staleness that predates it. Loading disk here makes sibling
 				// state authoritative (matching mergeUnitResult / bug-027 policy)
-				// while `updated` still wins for THIS task via updateTask.
+				// while `updated` still wins for THIS task via updateTask — EXCEPT
+				// where R6-1/R6-4 (DR-03) preserve disk authority for the terminal
+				// verdict and delegate budget accounting (mergeTaskUpdateWithDisk).
 				// fallbackTasks remains the fallback when the run state is absent
 				// (fresh run, manifest not yet on disk).
 				const latest = loadRunManifestById(manifest.cwd, manifest.runId)?.tasks ?? fallbackTasks;
-				merged = updateTask(latest, taskWithCheckpoint);
+				merged = updateTask(latest, mergeTaskUpdateWithDisk(latest, taskWithCheckpoint));
 
 				// F2: collapsed from 3 redundant statSync calls into 1. The previous
 				// implementation re-checked mtime twice more after load and before

package/src/runtime/usage-tracker.ts

@@ -68,12 +68,23 @@ export function usageStateFromLifetime(lifetime: LifetimeUsage): UsageState {
 	};
 }
 
+// DR-02 C2: crash/abandon paths never run clearTrackedTaskUsage, so per-task
+// ledger entries could accumulate for the whole process lifetime. Bounded
+// FIFO eviction on insert — Map preserves insertion order, so deleting the
+// first key evicts the first-INSERTED task (mirrors the sibling
+// agentEventSeqCache cap in crew-agent-records.ts). Exported for tests.
+export const MAX_TRACKED_TASK_USAGE = 5_000;
 const taskUsageMap = new Map<string, LifetimeUsage>();
 
 export function trackTaskUsage(taskId: string, delta: UsageDelta): void {
 	const existing = taskUsageMap.get(taskId) ?? emptyLifetimeUsage();
 	addUsage(existing, delta);
 	taskUsageMap.set(taskId, existing);
+	while (taskUsageMap.size > MAX_TRACKED_TASK_USAGE) {
+		const oldest = taskUsageMap.keys().next().value;
+		if (oldest === undefined) break;
+		taskUsageMap.delete(oldest);
+	}
 }
 
 export function getTrackedTaskUsage(taskId: string): LifetimeUsage {

package/src/runtime/verification/green-contract.ts

@@ -33,6 +33,18 @@ export function inferGreenLevelFromTask(success: boolean, contract: Verification
 	return contract.allowManualEvidence ? contract.requiredGreenLevel : "targeted";
 }
 
+/** R4-5 (DR-02 wave 2): true when the contract REQUIRES a green level but
+ *  configures zero verification commands — the default contract shape for
+ *  every `verify: true` step (task-packet defaultVerificationContract).
+ *  With no commands to run, satisfaction can only ever come from
+ *  self-attestation (allowManualEvidence → inferGreenLevelFromTask returns
+ *  the required level), which silently reports e.g. "targeted/targeted".
+ *  Surface that as `decorative: true` on the evidence instead of changing
+ *  the satisfied logic or the defaults (detection-first, no behavior flip). */
+export function isDecorativeVerification(contract: VerificationContract): boolean {
+	return contract.requiredGreenLevel !== "none" && contract.commands.length === 0;
+}
+
 export function createVerificationEvidence(contract: VerificationContract, success: boolean, notes: string): VerificationEvidence {
 	const observedGreenLevel = inferGreenLevelFromTask(success, contract);
 	const outcome = evaluateGreenContract(contract, {
@@ -42,6 +54,10 @@ export function createVerificationEvidence(contract: VerificationContract, succe
 		commands: [],
 		notes,
 	});
+	// R4-5: stamp the decorative flag so consumers (post-execution evidence
+	// builder, policy engine, UI) can tell self-attested satisfaction from
+	// command-backed satisfaction. Satisfied logic is untouched.
+	const decorative = isDecorativeVerification(contract);
 	return {
 		requiredGreenLevel: contract.requiredGreenLevel,
 		observedGreenLevel,
@@ -51,5 +67,6 @@ export function createVerificationEvidence(contract: VerificationContract, succe
 			status: "not_run" as const,
 		})),
 		notes,
+		...(decorative ? { decorative: true } : {}),
 	};
 }

package/src/runtime/verification/verification-gates.ts

@@ -144,6 +144,16 @@ export const CARGO_RUST_GATES: Array<{
 /**
  * Execute a single command and capture output.
  */
+/**
+ * P-4 (DR-04 round-7): accumulation cap while STREAMING child output. The
+ * final `slice(-100000)` already bounds the RESULT, but the live `output`
+ * buffer used to concatenate every chunk until close/timeout — a command
+ * emitting gigabytes held them ALL in memory (plus O(n²) string concat).
+ * Past this cap we stop concatenating and pin a "[truncated]" marker in the
+ * buffer; the final tail slice is unchanged.
+ */
+const OUTPUT_ACCUMULATION_CAP_CHARS = 200 * 1024;
+const OUTPUT_TRUNCATION_MARKER = "\n[truncated]";
 /** Characters/patterns that indicate dangerous shell metacharacters. */
 // Round 25 (VULN-3/VULN-4): also block raw newlines (sh -c treats \n as a
 // command separator -> injection) and bare $VARNAME references (can exfiltrate
@@ -253,8 +263,20 @@ export async function executeCommand(
 
 	const start = Date.now();
 	let output = "";
+	let capped = false;
 	let exitCode: number | null = null;
 
+	// P-4: single capped appender for BOTH streams — once the cap trips, later
+	// chunks are dropped (marker stays in the buffer; final slice keeps it).
+	const appendCapped = (chunk: Buffer): void => {
+		if (capped) return;
+		output += chunk.toString();
+		if (output.length > OUTPUT_ACCUMULATION_CAP_CHARS) {
+			capped = true;
+			output += OUTPUT_TRUNCATION_MARKER;
+		}
+	};
+
 	return new Promise((resolve) => {
 		const shell = spawn("sh", ["-c", command], {
 			cwd,
@@ -263,13 +285,9 @@ export async function executeCommand(
 			detached: true, // CORE-10: own process group so group-wide SIGKILL reaches children
 		});
 
-		shell.stdout?.on("data", (data) => {
-			output += data.toString();
-		});
+		shell.stdout?.on("data", appendCapped);
 
-		shell.stderr?.on("data", (data) => {
-			output += data.toString();
-		});
+		shell.stderr?.on("data", appendCapped);
 
 		// M-9 fix (code-review 2026-06-23): store the timeout handle so it can be
 		// cleared when the process exits normally, and unref it so it does not