pi-crew 0.11.37 → 0.11.39

package/src/runtime/verification/verify-gate-memo.ts

@@ -0,0 +1,127 @@
+/**
+ * verify-gate-memo.ts — W10-2 (v0.11.38): memoized green verify-gate by
+ * workspace tree-hash (pi-subagents lesson #3, tool-reference.md:432-496).
+ *
+ * WHY: sibling lanes / re-verifies on an UNCHANGED workspace re-run the full
+ * check set (typecheck + test:critical — minutes each) for a deterministic
+ * same-tree result. pisub memoizes gate acceptance by workspace tree-hash:
+ * tree unchanged ⇒ same verdict, no re-run.
+ *
+ * SAFETY MODEL (stronger than the M1-7 manifest bookends):
+ *  - The key embeds the FULL workspace tree OID (`git write-tree` over the
+ *    index — every tracked file, not just manifests) + the exact check list
+ *    (name+command) + the running node version. A memo HIT therefore proves
+ *    the tree is bit-identical to the tree that produced the recorded PASS —
+ *    no manifest re-hash needed (tree equality subsumes it).
+ *  - ONLY verdict PASS outcomes are recorded (ran>0). FAILED / INCONCLUSIVE
+ *    (incl. every integrity-drift and determinism downgrade) never memoize.
+ *  - The lookup ITSELF re-computes the tree OID — a hit can never serve a
+ *    stale tree; a miss is an ordinary full gate run (fail-open).
+ *  - Not a git repo / git unavailable / write-tree failure ⇒ key undefined ⇒
+ *    memo silently disabled for that cwd (ordinary gate runs).
+ *  - Typed-JSON gates (structured output, W10-9 candidate) must NEVER
+ *    memoize — a JSON schema consumer reads fresh structuredOutput per run.
+ *    The memo records only exit-code checks; a future structured gate kind
+ *    must bypass this module entirely.
+ *  - KNOWN TRADEOFF (accepted by design, mirrors pisub): tests that are
+ *    time-dependent or environment-sensitive can pass once and be skipped on
+ *    an unchanged tree. The kill-switch PI_CREW_VERIFY_GATE_MEMO=0 restores
+ *    pre-W10-2 behavior bit-for-bit (default ON).
+ *
+ * Scope: host-process in-memory Map. Parallel sibling lanes within one host
+ * process share it; cross-process persistence is deliberately out of scope.
+ */
+import { execFileSync } from "node:child_process";
+
+import { getCrewEnvBool } from "../../config/env-vars.ts";
+import type { VerifyGateCheck, VerifyGateOutcome } from "./verify-gate.ts";
+
+/** W10-2 kill-switch: PI_CREW_VERIFY_GATE_MEMO beats default ON. */
+export function resolveVerifyGateMemoEnabled(explicit?: boolean): boolean {
+	const env = getCrewEnvBool("PI_CREW_VERIFY_GATE_MEMO");
+	if (env !== undefined) return env;
+	return explicit ?? true;
+}
+
+/** Tree OID of `cwd`'s git index, or undefined when git/repo unavailable. */
+export function computeWorkspaceTreeOid(cwd: string): string | undefined {
+	try {
+		const oid = execFileSync("git", ["write-tree"], {
+			cwd,
+			stdio: ["ignore", "pipe", "ignore"],
+			encoding: "utf-8",
+			timeout: 10_000,
+		}).trim();
+		return /^[0-9a-f]{40}$/.test(oid) ? oid : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/** Deterministic memo key: tree OID + check list + node major.minor.
+ *  Undefined tree OID ⇒ undefined key ⇒ memo disabled for this cwd. */
+export function computeVerifyGateMemoKey(cwd: string, checks: VerifyGateCheck[]): string | undefined {
+	const oid = computeWorkspaceTreeOid(cwd);
+	if (!oid) return undefined;
+	const checkPart = checks.map((c) => `${c.name}::${c.command}::crit=${c.critical !== false}`).join("|");
+	return `${oid}::${process.version}::${checkPart}`;
+}
+
+/** In-host memo store (module-level: one per host process). */
+const memoStore = new Map<string, VerifyGateOutcome>();
+
+/** Test hook: wipe the store between unit tests. */
+export function resetVerifyGateMemoStoreForTests(): void {
+	memoStore.clear();
+}
+
+/** Build the memo-HIT outcome: verdict PASS with every check marked
+ *  skipped-memo — evidence lines make the hit auditable in prompts/metrics. */
+function memoHitOutcome(key: string, checks: VerifyGateCheck[]): VerifyGateOutcome {
+	const oid = key.split("::")[0];
+	return {
+		verdict: "PASS",
+		checks: checks.map((c) => ({
+			name: c.name,
+			command: c.command,
+			exitCode: 0,
+			passed: true,
+			durationMs: 0,
+			outputTail: "",
+			skipped: true,
+			error: `memoized (tree ${oid.slice(0, 12)} unchanged since recorded PASS)`,
+		})),
+		evidenceLines: [
+			`verify-gate-memo: HIT — workspace tree ${oid.slice(0, 12)} + ${checks.length} check(s) unchanged since recorded PASS (W10-2)`,
+		],
+		allPassed: true,
+		totalDurationMs: 0,
+	};
+}
+
+/** Lookup a recorded PASS for this exact (tree, checks, node) triple.
+ *  Returns undefined on miss / disabled / unkeyable cwd. Typed-JSON gates
+ *  (W10-9, check.output==="json") NEVER hit the memo — structured-output
+ *  consumers read fresh structuredOutput every run. */
+export function lookupVerifyGateMemo(cwd: string, checks: VerifyGateCheck[]): VerifyGateOutcome | undefined {
+	if (checks.length === 0) return undefined;
+	if (checks.some((c) => c.output === "json")) return undefined;
+	const key = computeVerifyGateMemoKey(cwd, checks);
+	if (!key) return undefined;
+	const hit = memoStore.get(key);
+	return hit ? memoHitOutcome(key, checks) : undefined;
+}
+
+/** Record an outcome — ONLY a ran PASS with real (non-memo) evidence.
+ *  Memo-hit outcomes must not re-record (they carry skipped checks). */
+export function recordVerifyGateMemo(cwd: string, checks: VerifyGateCheck[], outcome: VerifyGateOutcome): boolean {
+	if (checks.length === 0) return false;
+	if (checks.some((c) => c.output === "json")) return false;
+	if (outcome.verdict !== "PASS" || !outcome.allPassed) return false;
+	const ranReal = outcome.checks.some((c) => !c.skipped);
+	if (!ranReal) return false;
+	const key = computeVerifyGateMemoKey(cwd, checks);
+	if (!key) return false;
+	memoStore.set(key, outcome);
+	return true;
+}

package/src/runtime/verification/verify-gate.ts

@@ -75,6 +75,7 @@ import { executeCommand } from "./verification-gates.ts";
 // index.bundle value-import graph (goal.ts/goal-wrap.ts/goal-loop-runner.ts
 // import it), so this adds no bundle-graph file (check-lazy-imports budget).
 import { compareSnapshot, snapshotManifests } from "./verification-integrity.ts";
+import { lookupVerifyGateMemo, recordVerifyGateMemo, resolveVerifyGateMemoEnabled } from "./verify-gate-memo.ts";
 
 /** One deterministic check to run. Mirrors the phase-gate shape
  *  (verification-gates.ts) but kept local so the tool schema can reuse it. */
@@ -85,6 +86,15 @@ export interface VerifyGateCheck {
 	command: string;
 	/** Stop the gate on the first failure of this check (default true). */
 	critical?: boolean;
+	/** W10-9 (v0.11.38, pi-subagents lesson #2): TYPED gate — stdout must be
+	 *  valid JSON matching `schema` (minimal subset below). Invalid JSON or a
+	 *  schema mismatch FAILS the check even at exit 0. Typed gates NEVER
+	 *  memoize (verify-gate-memo.ts guard): a structured-output consumer reads
+	 *  fresh structuredOutput every run. */
+	output?: "json";
+	/** Minimal JSON-schema subset: {type, required?, properties?, items?,
+	 *  enum?} — nested one level deep is the intended use (gate summaries). */
+	schema?: Record<string, unknown>;
 }
 
 /** Result of one executed check. */
@@ -98,6 +108,10 @@ export interface VerifyGateCheckResult {
 	outputTail: string;
 	skipped?: boolean;
 	error?: string;
+	/** W10-9: parsed JSON stdout of a typed gate (present only when the JSON
+	 *  was valid — invalid stdout fails and carries the reason in `error`). */
+	structuredOutput?: unknown;
+	output?: "json";
 }
 
 /** Overall gate verdict. */
@@ -264,6 +278,52 @@ export function evaluateVerifyGateResults(checks: VerifyGateCheckResult[]): Veri
 	};
 }
 
+/**
+ * W10-9: minimal JSON-schema subset validator — {type, required, properties,
+ * items, enum}, nested arbitrarily. Returns undefined on success or the first
+ * mismatch reason. Deliberately tiny (no new dependency); unsupported schema
+ * constructs are IGNORED (permissive), never crash.
+ */
+export function validateJsonLite(value: unknown, schema: unknown, at = "$"): string | undefined {
+	if (!schema || typeof schema !== "object" || Array.isArray(schema)) return undefined;
+	const s = schema as Record<string, unknown>;
+	if (typeof s.type === "string") {
+		const t = s.type;
+		const ok =
+			(t === "object" && !!value && typeof value === "object" && !Array.isArray(value)) ||
+			(t === "array" && Array.isArray(value)) ||
+			(t === "string" && typeof value === "string") ||
+			(t === "number" && typeof value === "number" && Number.isFinite(value)) ||
+			(t === "boolean" && typeof value === "boolean") ||
+			(t === "null" && value === null);
+		if (!ok) return `${at}: expected type ${t}`;
+	}
+	if (Array.isArray(s.enum) && !s.enum.some((e) => JSON.stringify(e) === JSON.stringify(value))) {
+		return `${at}: not in enum`;
+	}
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const rec = value as Record<string, unknown>;
+		for (const key of Array.isArray(s.required) ? (s.required as string[]) : []) {
+			if (!(key in rec)) return `${at}: missing required "${key}"`;
+		}
+		if (s.properties && typeof s.properties === "object") {
+			for (const [k, sub] of Object.entries(s.properties as Record<string, unknown>)) {
+				if (k in rec) {
+					const err = validateJsonLite(rec[k], sub, `${at}.${k}`);
+					if (err) return err;
+				}
+			}
+		}
+	}
+	if (Array.isArray(value) && s.items !== undefined) {
+		for (let i = 0; i < value.length; i++) {
+			const err = validateJsonLite(value[i], s.items, `${at}[${i}]`);
+			if (err) return err;
+		}
+	}
+	return undefined;
+}
+
 /** Run the gate checks sequentially through the injected executor.
  *  Mirrors runPhaseGates semantics: stop on first critical failure; abort
  *  signal between checks marks the rest skipped. NEVER rejects. */
@@ -297,14 +357,33 @@ export async function runVerifyGate(
 			// blowup must degrade the CHECK, not the host.
 			execResult = { exitCode: null, output: "", error: error instanceof Error ? error.message : String(error) };
 		}
+		// W10-9: typed gate — validate stdout JSON against the schema; an
+		// exit-0 command with invalid/mismatching JSON is a FAIL (the consumer
+		// reads structuredOutput; silence must never count as data).
+		let typedError: string | undefined;
+		let structured: unknown;
+		if (check.output === "json") {
+			try {
+				structured = JSON.parse(execResult.output ?? "");
+			} catch {
+				typedError = "typed gate: stdout is not valid JSON";
+			}
+			if (structured !== undefined && check.schema) {
+				const mismatch = validateJsonLite(structured, check.schema);
+				if (mismatch) typedError = `typed gate: schema mismatch — ${mismatch}`;
+			}
+		}
 		results.push({
 			name: check.name,
 			command: check.command,
 			exitCode: execResult.exitCode,
-			passed: execResult.exitCode === 0,
+			passed: execResult.exitCode === 0 && !typedError,
 			durationMs: Date.now() - start,
 			outputTail: tailOutput(execResult.output ?? ""),
 			...(execResult.error ? { error: execResult.error } : {}),
+			...(typedError ? { error: typedError } : {}),
+			...(check.output === "json" ? { output: "json" } : {}),
+			...(structured !== undefined && !typedError ? { structuredOutput: structured } : {}),
 		});
 		// Stop on critical failure (default critical) — mirrors runPhaseGates.
 		if (execResult.exitCode !== 0 && check.critical !== false) break;
@@ -582,6 +661,43 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 	// nothing here reads the worker-mutable task cwd. Zero resolvable checks
 	// ⇒ INCONCLUSIVE ⇒ escalate (fail-closed on absence, pre-R47-1 doctrine).
 	const checks = input.checks ?? input.hostSpec?.checks ?? [];
+	// ── W10-2 (v0.11.38): memoized green gate by workspace tree-hash ──────
+	// Lookup BEFORE any command runs. A hit proves the FULL tree + check list
+	// + node version are bit-identical to the tree that produced a recorded
+	// PASS (tree equality subsumes the manifest bookends) — re-running
+	// deterministic checks on an unchanged tree buys nothing. Miss / disabled
+	// / non-git cwd ⇒ ordinary full gate below (fail-open).
+	if (resolveVerifyGateMemoEnabled()) {
+		const memoHit = lookupVerifyGateMemo(input.cwd, checks);
+		if (memoHit) {
+			const decision = resolveVerifierSpawnDecision(memoHit);
+			incMetric(input.metricRegistry, "crew.verification.verify_gate_runs_total", "Deterministic verify_gate executions by verdict", {
+				verdict: memoHit.verdict,
+			});
+			incMetric(
+				input.metricRegistry,
+				"crew.verification.verify_gate_memo_hits_total",
+				"W10-2 memoized PASS verdicts served without re-running checks",
+				{},
+			);
+			if (decision.skipVerifier) {
+				incMetric(
+					input.metricRegistry,
+					"crew.verification.verifier_spawns_skipped_total",
+					"LLM verifier spawns saved by the U13 deterministic pre-gate",
+					{ reason: decision.reason },
+				);
+			} else {
+				incMetric(
+					input.metricRegistry,
+					"crew.verification.verifier_spawns_total",
+					"LLM verifier spawns that still ran, labeled by the deciding layer",
+					{ reason: decision.reason },
+				);
+			}
+			return { outcome: memoHit, decision, promptContext: "" };
+		}
+	}
 	const exec = createSubprocessVerifyGateExecutor();
 	let outcome = await runVerifyGate(checks, exec, {
 		cwd: input.cwd,
@@ -644,6 +760,16 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 	// `input.classifier` stays on the interface (deprecated) because the dispatch
 	// call site in task-runner.ts passes it; removing the field is a follow-up
 	// that must land with that call site.
+	// ── W10-2: record the green verdict for same-tree memoization (AFTER the
+	// post-bookend — a drift-downgraded INCONCLUSIVE must never memoize).
+	if (outcome.verdict === "PASS" && recordVerifyGateMemo(input.cwd, checks, outcome)) {
+		incMetric(
+			input.metricRegistry,
+			"crew.verification.verify_gate_memo_records_total",
+			"W10-2 PASS verdicts recorded for same-tree memoization",
+			{},
+		);
+	}
 	const preGate: VerifierPreGateResult | undefined = undefined;
 	const decision = resolveVerifierSpawnDecision(outcome, preGate);
 	incMetric(input.metricRegistry, "crew.verification.verify_gate_runs_total", "Deterministic verify_gate executions by verdict", {

package/src/state/coordination/mailbox.ts

@@ -13,6 +13,14 @@ export type MailboxMessageStatus = "queued" | "delivered" | "acknowledged";
 export type MailboxMessageKind = "message" | "notify" | "steer" | "follow-up" | "response" | "group_join";
 export type MailboxMessagePriority = "urgent" | "normal" | "low";
 export type MailboxDeliveryMode = "interrupt" | "next_turn";
+/**
+ * W10-3 (2026-10-22, lesson #22 — intercom typed reason): why the sender is
+ * contacting the supervisor/peer channel. Optional + backward-compatible —
+ * pre-W10-3 rows simply carry no `reason`; an out-of-enum value parses as
+ * `undefined` (dropped field, NOT a repair-worthy error — same graceful
+ * semantics as `kind`/`priority`).
+ */
+export type MailboxReason = "need_decision" | "progress_update" | "interview_request";
 
 // ============================================================================
 // Phase 1.3: post-append observer (single notification point)
@@ -81,6 +89,10 @@ export interface MailboxMessage {
 	requestId?: string;
 	acknowledgedAt?: string;
 	data?: Record<string, unknown>;
+	/** W10-3 (2026-10-22, lesson #22): typed supervisor-contact reason
+	 *  ({@link MailboxReason}). Optional — old messages without it parse
+	 *  unchanged. */
+	reason?: MailboxReason;
 	/** ID of the original message this is a reply to. */
 	replyTo?: string;
 	/** Task ID sending the reply. */
@@ -292,6 +304,10 @@ function isDeliveryMode(value: unknown): value is MailboxDeliveryMode {
 	return value === "interrupt" || value === "next_turn";
 }
 
+function isReason(value: unknown): value is MailboxReason {
+	return value === "need_decision" || value === "progress_update" || value === "interview_request";
+}
+
 function parseMailboxMessage(raw: unknown, expectedDirection: MailboxDirection): MailboxMessage | undefined {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
 	const obj = raw as Record<string, unknown>;
@@ -322,6 +338,7 @@ function parseMailboxMessage(raw: unknown, expectedDirection: MailboxDirection):
 		priority: isPriority(obj.priority) ? obj.priority : undefined,
 		deliveryMode: isDeliveryMode(obj.deliveryMode) ? obj.deliveryMode : undefined,
 		taskId: typeof obj.taskId === "string" ? obj.taskId : undefined,
+		reason: isReason(obj.reason) ? obj.reason : undefined,
 		questionId: typeof obj.questionId === "string" ? obj.questionId : undefined,
 		requestId: typeof obj.requestId === "string" ? obj.requestId : undefined,
 		acknowledgedAt: typeof obj.acknowledgedAt === "string" ? obj.acknowledgedAt : undefined,
@@ -805,6 +822,7 @@ function buildMailboxMessage(manifest: TeamRunManifest, message: MailboxAppendIn
 		priority: message.priority,
 		deliveryMode: message.deliveryMode,
 		taskId: message.taskId,
+		reason: message.reason,
 		questionId: message.questionId,
 		// U5: every send carries a requestId — explicit (idempotent senders)
 		// or auto-stamped uuid (one per row; still unique per send).
@@ -1186,6 +1204,56 @@ export function readMailboxMessage(manifest: TeamRunManifest, messageId: string)
 	return readMailbox(manifest).find((message) => message.id === messageId);
 }
 
+/** Verdict of the W10-3 strict replyTo origin check (lesson #22, A→B→C). */
+export type ReplyToRequesterOrigin =
+	| { verdict: "no-reply-to" }
+	| { verdict: "match"; replyTo: string; requester: string }
+	| { verdict: "origin-not-found"; replyTo: string }
+	| { verdict: "mismatch"; replyTo: string; originalFrom: string; responseTo: string };
+
+/**
+ * W10-3 (2026-10-22, lesson #22): strict replyTo routing predicate.
+ *
+ * Gap (verified 2-way): `replyTo` was parse/serialize-only — NOTHING validated
+ * that a response tagged with a `replyTo` was resolving a request opened by
+ * the SAME requester the response is addressed to. With parallel lanes asking
+ * concurrently, a reply meant for B (replyTo → a request B opened) could
+ * resolve C's waiting park (A→B→C confusion) when its questionId happened to
+ * tag C.
+ *
+ * Rule: when a response carries `replyTo`, the ORIGINAL message that id points
+ * at (searched across global + every task mailbox, live + archives — the same
+ * scan space `updateMailboxMessageReply` uses) must have been opened by
+ * (`from` ===) the requester the response is addressed to (`to`). Verdicts:
+ *  - "no-reply-to"        — untagged legacy responses: nothing to verify.
+ *  - "match"              — right pair (original.from === response.to).
+ *  - "origin-not-found"   — the replyTo id cannot be resolved (rotated out,
+ *                          garbage, cross-run): unverifiable — callers keep
+ *                          the exact-questionId correlation as the primary
+ *                          defense and only log (fail-open, no availability
+ *                          regression on stale ids).
+ *  - "mismatch"           — A→B→C: original found but opened by a DIFFERENT
+ *                          requester ⇒ callers MUST NOT resolve the waiting
+ *                          task with this response (log + skip).
+ *
+ * Pure read-only; throws never (a mailbox read failure surfaces as
+ * "origin-not-found" so the caller's own error handling decides).
+ */
+export function checkReplyToRequesterOrigin(manifest: TeamRunManifest, response: MailboxMessage): ReplyToRequesterOrigin {
+	const replyTo = response.replyTo;
+	if (replyTo === undefined) return { verdict: "no-reply-to" };
+	let original: MailboxMessage | undefined;
+	try {
+		original = readAllMailboxMessages(manifest).find((message) => message.id === replyTo);
+	} catch {
+		// Unreadable mailbox during the lookup — unverifiable, same as not found.
+		return { verdict: "origin-not-found", replyTo };
+	}
+	if (!original) return { verdict: "origin-not-found", replyTo };
+	if (original.from === response.to) return { verdict: "match", replyTo, requester: original.from };
+	return { verdict: "mismatch", replyTo, originalFrom: original.from, responseTo: response.to };
+}
+
 export function acknowledgeMailboxMessage(manifest: TeamRunManifest, messageId: string): MailboxDeliveryState {
 	// BUGFIX (Round 12 I6): unlocked read-modify-write on delivery.json could
 	// clobber concurrent appends. FIX: wrap in a file lock.

package/src/state/stores/state-store.ts

@@ -475,6 +475,14 @@ export function createRunManifest(params: {
 		tasksPath: paths.tasksPath,
 		eventsPath: paths.eventsPath,
 		artifacts: [],
+		// Wave 11c (battery F2): record the SPAWNING process pid at creation — for
+		// a SYNC/foreground run (no async runner ever spawned) this is the only
+		// recorded parent its leaked descendants can name in PI_CREW_PARENT_PID,
+		// and without it the descendant sweep could never prove their descent.
+		// Sync-vs-async is NOT known at creation time (the async dispatch happens
+		// after this), so every run records it; async runs keep using
+		// `manifest.async.pid` as their primary recorded runner.
+		sessionPid: process.pid,
 		...(params.ownerSessionId ? { ownerSessionId: params.ownerSessionId } : {}),
 		runKind: params.runKind ?? "team-run",
 		...(params.args !== undefined ? { args: params.args } : {}),

package/src/state/types.ts

@@ -368,6 +368,18 @@ export interface TeamRunManifest {
 	eventsPath: string;
 	artifacts: ArtifactDescriptor[];
 	async?: AsyncRunState;
+	/** Wave 11c (battery 2026-10-24 F2): pid of the process that CREATED the
+	 *  run — `process.pid` at createRunManifest time (the session pi for a
+	 *  foreground team-tool dispatch; the detached runner itself when it
+	 *  creates sub-runs). A SYNC (foreground) run records no `async.pid`, so a
+	 *  leaked descendant carrying `PI_CREW_PARENT_PID=<session pi pid>` could
+	 *  never satisfy the run-descendant sweep's descent proof and was skipped
+	 *  forever; `sweepTerminalRunDescendants` now accepts this pid as a
+	 *  recorded proof parent (DEAD-only, like every other proof parent — a
+	 *  live session is never proof, the operator may still be using it).
+	 *  Purely additive/optional: absent on every manifest written before 11c,
+	 *  and async runs keep `async.pid` as their primary recorded runner. */
+	sessionPid?: number;
 	/** @deprecated-plan-pointer T2/R4 (ADR-4 §2): dual-write era — PlanRecord at
 	 *  `<stateRoot>/plans/plans.json` is authoritative; this field is kept (never
 	 *  dropped) as the pre-v2 fallback and legacy UI surface. Deprecate-only. */
@@ -437,6 +449,26 @@ export interface TeamRunManifest {
 	/** MuxSurface A1 (spec §8.3): pane/pid/lockout state of this run. Absent on
 	 *  runs that never booted a surface worker and on older manifests. */
 	surface?: ManifestSurfaceState;
+	/** Wave 11b.2 (F7 reachability): ISO timestamp of the LAST completed
+	 *  run-descendant sweep for this run (`sweepTerminalRunDescendants`).
+	 *  Purely additive/optional — absent on every manifest written before
+	 *  11b.2, and absent means "never swept" (⇒ still eligible for the
+	 *  startup sweep). Startup reconciliation enumerates terminal runs that
+	 *  lack it, because a leak OUTLIVES its run: the incident run was
+	 *  `completed` the day before its 6 grandchildren were finally reaped.
+	 *  Stamped only after a REAL sweep (never on dry-run, kill switch off, or
+	 *  a throwing sweep) so a failed attempt is retried on the next pass. */
+	descendantSweepAt?: string;
+	/** Wave 11b.4 (HIGH-2): the last sweep attempt PROVED descendants it could
+	 *  not signal (a live unmatched group leader, a candidate with no usable
+	 *  pgid, a refused group reap, an interactive tty). Without this the run
+	 *  would be stamped as done and the leak never looked at again — the exact
+	 *  failure mode 11b.2 introduced. Purely additive/optional: absent (or
+	 *  `false`) means "nothing left to retry". Startup reconciliation re-selects
+	 *  a pending run once `TERMINAL_SWEEP_RETRY_MS` has elapsed since
+	 *  `descendantSweepAt`, so a permanently un-signallable leak does not burn a
+	 *  /proc scan on every pass. */
+	descendantSweepPending?: boolean;
 }
 
 export interface RunModelContext {
@@ -591,6 +623,8 @@ export interface ModelAttemptState {
 	success: boolean;
 	exitCode?: number | null;
 	error?: string;
+	/** W10-7: per-attempt usage mirrored from ModelAttemptSummary. */
+	usage?: UsageState;
 }
 
 export interface ModelRoutingState {
@@ -619,6 +653,16 @@ export interface TaskCheckpointState {
 	phase: "started" | "child-spawned" | "child-stdout-final" | "artifact-written";
 	updatedAt: string;
 	childPid?: number;
+	/**
+	 * Wave 11a (F3): spawn-time process identity of `childPid`, written from
+	 * `readProcIdentity(pid)` right after the spawn. `starttime` is the
+	 * PID-reuse-proof field and `pgid` is only meaningful when the child leads
+	 * its own group (detached spawn). All three are OPTIONAL: records written
+	 * before this wave keep loading unchanged.
+	 */
+	childPgid?: number;
+	childStartTime?: string;
+	childUid?: number;
 }
 
 export interface TaskAttemptState {
@@ -663,6 +707,23 @@ export interface TeamTaskState {
 	modelAttempts?: ModelAttemptState[];
 	modelRouting?: ModelRoutingState;
 	usage?: UsageState;
+	/** W10-7 (v0.11.38): usage reconciliation — sum of ALL attempts' cost
+	 *  (incl. failed fallbacks) vs the final run's cost. Present only when the
+	 *  gap exceeds 5% AND more than one attempt carried usage — observability
+	 *  only, never a task failure. */
+	usageReconcile?: {
+		attemptTotalCostUsd: number;
+		finalRunCostUsd: number;
+		deltaPct: number;
+		attemptsWithUsage: number;
+	};
+	/** W10-8 (v0.11.38): a READ-ONLY lane dirtied its worktree (modified or
+	 *  untracked files). Note-only — evidence lives in the task's diff
+	 *  artifact; the leader decides whether it invalidates the result. */
+	unexpectedMutation?: {
+		filesChanged: number;
+		sample: string[];
+	};
 	jsonEvents?: number;
 	agentProgress?: CrewAgentProgress;
 	error?: string;