From b52a9ec88ae8b448f5322207699ea04e44c84581 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Fri, 31 Jul 2026 10:17:51 +0200
Subject: [PATCH] =?UTF-8?q?CB-WP-0004=20T02:=20make=20task-done=20?=
 =?UTF-8?q?=E2=80=94=20close=20a=20task=20on=20measured=20numbers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the three hand-done steps of a task close (46 turns, $11.52 per
CB-RES-0003): the heredoc flipping status in the workplan file, the
hand-written hub call, and the hand-typed token counts.

The third is the reason this task exists. Every update_task_status this
repo produced carried estimated tokens_in/tokens_out — in a project whose
central finding is that estimated token counts are worthless. task-done
reads the measured figure from the transcripts, or refuses; there is no
path through it that emits an estimate.

cb-cost gains by_task_detail: cost, response count, model histogram and
token components per task. task-done imports cb-cost rather than parsing
its printed table, so the hub figure is not a copy that can drift from
its source.

The positive control found a real defect before the tool ran once.
Attribution keyed on a bare T\d\d from the commit subject, so CB-WP-0002
T01, CB-WP-0003 T01 and CB-WP-0004 T01 shared a bucket: the self-test
reported $12.10 for "T01" where the qualified figure is $2.33. That 5.2x
overstatement would have been pushed to the hub as a *measured* number —
the same fiction in a new form. task_label() now keys qualified subjects
on the full id and leaves unqualified ones bare rather than
retro-assigning them to a workplan. The pinned $93.15 benchmark is
unchanged, so historical attribution was not disturbed.

Fourth instance of trusted arithmetic: a number believed because a
program produced it rather than a hand.

Refusals, all exercised by --self-test: unknown id, typo'd id,
already-done task, missing state_hub_task_id, no measured spend, and a
status flip that produced no change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 Makefile                                  |  11 +-
 tools/__pycache__/cb-cost.cpython-312.pyc | Bin 30154 -> 36204 bytes
 tools/cb-cost.py                          |  67 ++++-
 tools/task-done.py                        | 322 ++++++++++++++++++++++
 workplans/CB-WP-0004-mechanical-work.md   |  22 ++
 5 files changed, 419 insertions(+), 3 deletions(-)
 create mode 100644 tools/task-done.py

diff --git a/Makefile b/Makefile
index 98cf81e..4bddd14 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,7 @@ TOOLS := $(REPO)/tools
 # Every cargo recipe runs at the repo root; the shell does not persist cd.
 IN_REPO := cd $(REPO) &&
 
-.PHONY: check test sim bench bench-test coverage dep-weight cost cost-test cost-pin cost-budget cost-mix loop-lint self-tests env-test loc all
+.PHONY: check test sim bench bench-test coverage dep-weight cost cost-test cost-pin cost-budget cost-mix loop-lint self-tests env-test task-done loc all
 
 ## fmt + clippy (deny warnings) + HashMap deny-lint
 check:
@@ -61,6 +61,7 @@ self-tests:
 	$(PY) $(TOOLS)/rule-coverage.py --self-test
 	$(PY) $(TOOLS)/dep-weight.py --self-test
 	$(PY) $(TOOLS)/repo.py --self-test
+	$(PY) $(TOOLS)/task-done.py --self-test
 
 # T01 positive control: prove the environment fix, do not assume it. Runs
 # every tool from a foreign working directory with a PATH that has no
@@ -79,6 +80,14 @@ env-test:
 	@$(MAKE) -C $(REPO) coverage >/dev/null \
 	  && echo "  [ok ] make -C <repo> works from any directory"
 
+# T02: close a task — flip the workplan file, read the *measured* cost
+# from the transcripts, push the hub event with real numbers. Refuses on an
+# unknown or already-done task, and refuses to report an estimate.
+#   make task-done T=CB-WP-0004-T02
+task-done:
+	@test -n "$(T)" || { echo "usage: make task-done T=CB-WP-0004-T02" >&2; exit 2; }
+	$(PY) $(TOOLS)/task-done.py $(T) $(ARGS)
+
 # CB-01/CB-02: live spend since the last commit.
 cost-budget: cost-test
 	$(PY) $(TOOLS)/cb-cost.py --budget
diff --git a/tools/__pycache__/cb-cost.cpython-312.pyc b/tools/__pycache__/cb-cost.cpython-312.pyc
index 2154d3e99d9424db26b64d12df06a6c661f712b9..21da165bb72e3e4fff7ca5ba472e308f61a5d417 100644
GIT binary patch
delta 12938
zcma)i3sfA}m0(r%zZ<$~x*KS|1>)D@+eiq60SSS=Adm!-te<hyRX{`2jbAmA=oD@o
zJ7XzUj#0`Jp|w25<LpL>Cpmb?nQ?YJ8&90<I<XUj&_uXaJ122+#*@r$f<F0JCp)wE
zzU~I(WPG*`+<x!g``&%u`|iE({or5O|NWo1vUgKc%?y0MJ`o&wQev2&VJ7+M6N!6G
zm&;Ba5m-SVw2h^mw6lz;A1O|9t^bact*4VI(JmMSqhNYX8^@e<3g(k8ju8zbmCBvX
z4!h+wHbKc;$Hr3DuvtRtGt5c1U_F^F*iPnf%w9%FdxjD0V(x32M9DnSImim>&#))+
z1qW~!2ql6Oay<OH;I|NdGvK#K$OP&p$YnvUSa3tG1f-S@GeY*O?3&E7JwgtU%7HN#
z7(GHB<TeZW04o4j0Jut_RN&#aN+<+uwNM1GM%V<fR`d$RqvZ@kvXm#etRkqt_O--t
zBqgxSBsa-zVnj<ZLp(|!cPQo3|2fB;*PLL^v7WMpzvjNBHF{W8d!(nQPZ>3w-j#iN
zpuBxo)$v1Br-cg7DZc7VdEaT_wBR{C5H+11py|^C{=`^PaXNrFLic_I;0mLBrmjF~
z$u$|LSeYdyGOKtyoJviBS^pv<aEWZI&1`&;c}dgDMD)s3UEX>Ddz>RCXp^1jWdvO>
z<Izu~g4DK1gaigAB7ty-5BdhgAU_x;ypQ*X$HoE?UYZyf5&e-$9+2JPkXUUt^Y9&>
z@C5^d0a4%sg2b0U9`9joZS7XRuh#pxhaV830+C-Q#I{x;rJCR6BO;cf^^`vj$R@tJ
zx*Ezz5#J;~faDLSUr01S;>U?7_#%PO5FZ&1NPrHV6+^VSLO|d{;Rqk{jfu3j$gmh7
z{JAh09S{0Kye}m1V-pfE08?y0<cSy|VV^$|I4cGxd7mT&hC<MVNSLQR!;TRg{0D5+
zFF5!m2)aF5)!x_E+u48kXj|9*J^Oce^dH%+>Lt-f{KKklh=eD`RRiTXvfIO{hQyeu
z?3jcV@ce_anqlQHjU_SF9Pvq`{dAm(8)yyiFP#D~&D^&#rtDire#ywsWiA^%(`_FZ
zj4SDmD`l6<W($?gGr6;eXP<ca+|_e)PrMkN4KCU$7L66Rjkf2l7p*hrmW>5a!kvA=
z`+UR2h8gd3O^e#%IW2&DP(7oj9PMsXer$N#L$V=DvJm7Y!Cpv6*z;!?Rl7gVk*EB#
z@!Ofmr&@wxpU^)}0)9~<n*r0k@TQ67wwWLai(NA$Mxfui3CTAks+`}S=r$FinqeV~
z!}x|G5~+s*y~;fcVY3$oQ{H8%4kH$<h9h-KtF_)q1saJjB1-+f2x$Xazw)eg5=yYP
zUXHC(j@nDongLDr0Z=vlLWHy{pSR}~(xNW^u;?F+H@06I7R5+Ew2E{C@3``g{Y9up
zNI${$qV}YcNeWh@C8AFtsfe@!z~*2Y#d}PIife(is*Qw4CDMwt9hldUKnMzlCnDsK
zlIF}xw4aVue|V4_2d1Z$X6HYE+<$WtmMvGF$k>ugo0=9OzL4Z6f$>QHxGyp+k$&L5
zqP&$M<l-dxarGoWJ0z%5IG|U4y18g!Aajb<aA)!sKFm7LrOBoa=6Un;>3+=+6gyL|
zJjg0!GZk-v!vLbD(&cpJ^$MyqVnP<xah#lfS#v2{%Uo*EGE<Hz^Hh4ol@umBlDcBb
z8QGM?qS}=m9ZXUwg2;3~H;e+|#6ckhYW*U2$*2X~RQg&SF4-`G?Z;2Km;<w~{2}LH
zj#G9CIWlvW5pu5?lgunL!(HN)fm|>9q4Gj*X_lX38NX&Kead_eYK1h^e2($tDR1T;
z%ijVus-{R_Oa$dIHm*X3h)+yFZofcUl-j&AX>_7-juW%1yp;FjTwHS9qzE7^T&}uS
zWg}~gR(U?(%l=ULhy2om$fg=V<wRils>Vn-9PFQv#D}!C0eG+(_s#?8WLVJHGIIu2
z&lDS3)9NxiqQO%$l}Yw9fpIEZ&1rqFC1(0d>=l+}E^XDqG4pi|oG2Pqi`tD~C%U1j
zss13Ut-;BDYztkZuvCYEs<H!XJ%B73QGQrZ8v92`N?QT^3-kMF<}Sl#c~)}s?rRu#
z>74H?;w$3yJ+F?<AO72;uOEG*Vd1eG_50r<x3Ui0LB@|IJo-P|*u<(PNd&3k(0<{8
zr3Ta+>?qjIH6EjCP7HT{0LB~T3IIR_#`!&@7qezMaDHDfD1kbFtvwVb0Z~$o$*MdK
z<*)ccwnX_6Uj#e+4xi<vy6FVg2q!Y58V7umNQVM-h^iF={s=+EscOc2=RFyuT-i~W
z9i;1li%6;lb|h|20XOG4No9#@mP9esKNc3mplTQwNk0(c?bE?Y78FQ;3K9YmoHqW5
zsvQQEpt62dKM)N2Vb`CflA-;QlmSV__gF?@T*p~ad-M}g0!0U1Ctm{c%kVGtYm{FW
zeuwoge7$IhjjigL{G#76Y<k@+d%f*?;HzD?Dw~%oo8LIGT)Fo~<-vFAV20A`=6oxz
zj4MYkAD!K%oS7TB;i|o>VI0m?q|Fr4p9^}JqV&3-yRv38lv5YXw{5OF98PXw*?kTC
z{#K*OG{fQXL1h(`O|{;|yy+gJNwZwgt{Rn^;=YpnqLp0F^}fYi?;X1-)%shF#bjPR
z$a;0=Re@zvY|{sRe?O-D=i<#HAK%LYVISYsLnTrT^y{mxPA~ViJEzN{|DH9gD^35s
z9VuNd<2&}Iu59D?J(e!s{I1v0Wz@ZAU;#d)$WVz<MYa=m2ksStr3#6i<YY!!G`o}?
zHWO&dNiC3cqi{k(nn`XTyFR&r&a)C|1HnM8p<maSc5pH$0jFS;xw8z(6ioOlX$3RQ
zvy&Dfg<_0CYJy@-P;8TFGKZq=_GIlKGhOCJ49e>rIW`9#)q)dhWhY&6&RE6<&P*XI
zQImU;@nm;L`7!@^f4?A}ts0&f=<lBx2Mb2*r)NLtsmO%%zy<^!5oq-QB5HlONYsQ3
zVX$b3s@>(2hEWZTje$u+L}*MjmNGsW84icG@Kt<sb2KGhOB2{KLU=tVz`6Utxn>Z>
znRrnML{!~~6b=Q+AXG+h*F4Df301>kKfit`fdS<UPD%mkfip=H&qsJTs{F$-FvvVy
zRO1);s6jkG9wrg~fn5xp4UlkX4739;iIItMYC(aT&<+uCT;*W@bLaf3MiK?`MGy+d
zsV@*zHL#~t?O-4zJaD0A2*Hq`JzB#DLee;xpHb})*rH%)1R_!0m~T|%W6>1)TRw!A
zf(L9gGxUx`q;rADFx88yP6Eqz9Dc@wfrv*#!YEJ^2#tfhF+svLhz1`X#bi7QehCTb
zEdbNZiovpI^WHFcS8P0_pN%~gTg)uGX((T@Wv|2xmJ4S;`{atvv0|}Oi);I`CGUo1
z(_H#3^X4V<=4Er`bo&PuD{>fIvyLT0?ux}d+q-1p=ep<pOU2t)9G(?R`i%c#>+GrP
z?Mrzz^9^tKUvFJ;)U4P_Rt)B6pM2`c#f<Ws2G5GE2=kLqO+NjZ882Yny$6;Iy(_lT
z1l!EuO+(&_&ADQ*&TM)LT9vnAu~9Rw6@5W6ivSf8`3nRuBKQh|mjEpMu6T&^prWRx
zQ2bc@YW!3oUjXzc&Xu<E63)&l-zeM6o>e|5>&!#F7%xTU|1`UkRffxR*-_<l<<CGN
zvuCp<uDhj)G4hnM!&7AWZ%`5@CUTy9K?!>5vT<6})WkUghMW&H_B((}Wf$J?9MtH@
zb;u~@s>|#i<yzIQ6EVnwrS>^2rWqWIkV}vv&(dr_3ae~CL8VP@BcQ!P>lGG2{EO@H
zl(^T^4=YhTPd)^OVs_z?>hE%CH?SCrBtJm#u440M#@@r^5&%!CY7|34eDN(K_9g;6
zeaVjzd=0@K1Ro$!5&TaCv^oC^Q~v}2PIwIw2gy$$y>Zl43!E+C;90SMJP;xu0ks*F
zr}7o=wWdEZ6pcWo`qfGG>ku==3G9?cW;>WOl?-zlOpPh+l#Z$~XH3?}+6c1KPu3;1
z8faHN%S6xupx>Y-NnsgTJEgf)tp%M-j4~^5R6A-AhFB1#ml+V%24W1dLC_+8N-OJ$
zO$IpH0bMmma8=@Wm;n|Yn%9@y>%x*anS+XQpv}<0DdUuB$}AgYt)Dy3jY2PoUN((F
z_a*j{BLqjmr3~3D8<Z<sK5Ru5`HO#tkLsVeO#-S$8ue%iE)?o}5vZ9_tv!c!cY{NB
zux)>L$L=E@3;B-ngRS|oi^zs6M%9AJ6`@N86j)g0h6AdOdT<h&hsgy5zwtF>@+CZK
zk=z6NA(#c}JCK-WR#O<eV|xFJC3U)EB{Tmn!|Bp5S}t%G_O2N1w~Sd!#;n=mIqu5`
zuAf_W7dPA}-uq_rqI=&><Ng(!{i1eN2mE*R$_w@Kr?>}yFfCMW`xdJ#G&rn+@tHMy
zbIPo!4Q0xf#x2VA2CpX-)&(4Yf{9L#P1bcVGwc~$8%EhE7!W(1E?Y+ml-I``%FB%@
zh8)=h6tl9@$U9-6A&E@1c$%CB=kV>u+})6{oQL^Aw2%@7f6A}%b2z_1NkuFaq)XyI
z<kGn>e>>9&Y&vA$u<BBkn~f#xCgnk6*<m|)8+O4Og&CM~$PPI@o`#f7uwl6<c(XK@
z_E65A%n9k&bW>|mMoQqE&sHvNx14fKWyluUm294z@lYpHHd178V3PH1<hoR*g~7a}
z(=w4VXbSyg(};)4Xl*j4Pi4xP8%QZ@q|_Z*k&3k<S;@`|4!Uh>B8DVQaLSp2>qV`Q
z@h9ssW>aFOoJD`LUNR)B`Ya2}pcI#YJ$uTH(|!ibcAWH)Ds)g-H#&{sO@Pah-EvNH
z96m9b+3OUTDY{$|_E`2qBT)kW<qpskAm@3bpQFyH2jxZ3jHF*ua?G7<W4xxJwYiVf
zCV8W<nZU<1Ugj=UfY+J}^{kCBM*dLFYYFCLZBuyxa4;ii<Irzi$0@9k7eRM|eldBi
z0qaOPJ6TNxV*~V)bJuX|!Xd;c=l-#9q2QVp#PDF*vO=M(0chD!)0(;k{K29Pgtb^5
z5H`t~0E^{3fF*LKoEHUe5YnX^nrTWl3GijIIli8^!l1jJ&-ZHr=%Rlkq5EA^`LavS
zk53x>T5t)&FWsFZ4Y&w;*P^&WIa1?rgSZ5DQs_gJhqf)$OY`x?<?;ySNmut_ihJ`q
zB^qzfhH~z-Po>&FjT)<1rwWzV3<`H?9>Novsr)Gy3|7^Kwx=fh1NiC<__atk;A=ME
z*G38OwX$`?5{I=y^(bgM<u4ww?C@UWV9DBOSi}h2b;1^aTjeZ;?M((XjEV3DZP{9=
z1F)WY<-JEvY=dpeP<J(PocY62#1FW&4>TU*fd6}s0=NQhmB2+<rNEV|{JO@tAsG`i
z*R&A-)pnD=0nWIIt|h<0G#*r{p8CiV6$a6TNyHi2!xIn%A*2Y|(CDD2-2-ED&^I<9
z_*$cGe>fNfTfMp&yk%cdYK26c^c)_6#ZY9LnRQ(E9(mJptFd#bv2(fc;B9yDEqCRT
zyK>oGeMiIEYo`;HA3_OejMFC3s4V#%W)CAcf&e!p4b~Bpa-zB4K+YlJZ<K#3b1Oe;
zZYw*FS=uW&);`5R-PTgT{=IUnrQSvj%tV-HEO1`=X<5ecYACxF)xmj%AiO}2y@bMJ
z6G0o8-DJ?_|5K{)T^tx3OB$WIQM7a3H|L!@_R99ZY@KIcZCxtbnTWwSTr7Avy2u0x
zNwjh`ZA|nJ`$7R2>3)h<Z5uGSHpm(5|L2r%w6qLa2OwaCk!L|fhbwLsffk8d{P6&+
zVSNR}BRO=qdw~f8Y~fKcB!O9sp&XjT@QM*?jfYe8ajf!jOI{3C3|*>b=p2TJAbREx
z1Vy1wHG&Zv5a8y(lS`w><RffBKY~0IqX+L2tY{iNAx|M1qqa1JN=+$hkkjQzP)De`
zL5NF7$nTK}tvXc?j&=<EK^nFt(}@2z#h>*BAttD5d;?P4Hv|tfqM8rxZr|6|y}!M!
zi_ScG8ksF)FnImw2!unP0y>HiE((MoyfYXN1XCYF7mwJ|4a1_B8Sw>0uo9ghREJ%+
zY#4Cmqt>Ef6JSXS0=l>_VDtJA97S*pW$S3%TV+Sd0^-1^g%ysKnP534=GllzI>8DS
z(c-j&M?Ep1vS+0NKtWt8KPO>~LePM2N>T!~jKRP3K&O0W$3N%ZH#3g>Tj`#qbPoiM
zOttqkoWncad0)>s3lw2zi{>7ap?rDgwo@sYv+Qi?Rnt;R(FJzJXu44PoN4Cp%-PE)
zmW=t&nGjR)oOQNv$(Zw;6?5emEi-L1LzfT0jl`UH$yf}(wA@8g!p61FZoBHfY22iI
zuyY~hu8uQ#S3Maz@BLb3wk;a7GC8HUva6P|tCq8CzL|5&yKl+6?>*PDx97rnFrHI0
z?lKx(CA7t!e#Ld!H6t(Ei*MLBU+2J{HdS6|TS;-v_@3*UZCgsod#-CG#W{2Mxz1Vd
z?6IrcZ{$>5*DR$}T<W|7QY%+AP|>Q9$twIU!=^OP6yCO_&&0e}>Mz&N<}N!*Z#XKi
z7cJYWzG=Q;YocK^h`psWPj}EC7%Gc(DYb1ba5J@S+1xhWzRFdl=vR!H*Yf5jm)+h~
z4P<{}Ouy}N&w7;p+s>@nET#K4ziF=HRnzT)BG}$<Y`s~ubGcyW9h1&wUey8rYAlU0
z*=Dq>cFd$RChG-h)q!azV{*RGJL^^+TXkVRgE3{iAkEe*(bY`MXECO<8P}>C)7gy4
zJ-cZ&2h+KX$u%R+`Y(^J=3zdcF{Qt-b=IJ?tQKIN2j10E1{86YXDQ1QTh6NZU70h-
ze5aJLyJpxK?`jDI5LdF?xC&PC@@GGD^|4hmlbti$cs1viyLQQ4J8xfhZ<%jfa&Mb|
zV#&Szc6R>k6LVQtKeL=&aXSmIt<GLO@uCf)p9TD!{%YXmv8!X(_s$<)&Tm-Z3+GB-
zF?}WVmDKCOH`<o@))*WE1v`GS0YCCa;WFP0Ggi<7RTLJj6-W>a8Xy=q*1d1ux18U2
zr_i2ey~Eg3t@kw0pVdO_?E#iCIbP_%nON;)5z_@2`wPXej?#-E{F#rqZouVU>su_^
zvYfYdwTJS7BWH4~D8XF?vBMN`3=pmvVf8r8J&NR+eXA#Ej;Ye=KfY^%)$;MZauELU
z-CE9NmK?A>-z%-|t=7I@w`)u97V~m?dhd3lAN<?351mTP-}@yT=+CBHVb*UE1QtS~
zoO?mt^)oK(^C=fogbFmz$QL%SR4PB+<%(4$O&Rdv*PMnV|Amx6FmRqR{?(?WF$P}1
z7C73p5DUPY68b^3lM`ydqjyc2Hq`HuO>pg8D{BSsi`rz3GIi;MI&es~0B&oH+LUo*
z{fpXl_XE82dT@(C5yd}Y8?ZM}8#7tBk>;S3uwBRlD$P@O4&DzSEphIqqw^<}0bkR`
z`eB3~apPsvlzD@gW*n7@7TGMc(&~3Wv7KwVHVh*`Z+Ag&+o5+IFX<@%Zs6GS5Pv+k
z_Y?g4;{4wILLQVjfF-cOLMKS+N@9eAqo*H|(j6}q>j92KSOz2?hV+p{x);)YiS*G=
zbnzJCN%Mvt9*@`nML!q<N>8o<sQ1yAHpXufbeMIhCU?rRp&FNL5l$q8=E@eOZSSVz
zC!xYqh!ajjht6!Q3c}rwbx$DeU{yz5ReNtAT+qXfJ4AaiB8>O=^aPEj@jRTN8-pdE
zQ~qvmn~Q~|5KYD4N%Hc9hX9OyUnZwzmCgGK_G^&A&hvdeeQjN9<%{Xr7`2*td?zp-
zmI4?sj+==VC_ydTs22I7nr3euF|*1S_if7iYiMay*IHlg9elu+MDa1hz$A^s!=bI*
z*tcaH+P840&5fRwaFr(F!yjY0ECSYvNdDNs<v3;Meka^&9^L<H><_?7{tdtcnn54{
zFTZ#=wCQO0c(m5a@ErpT6TW8{_K~6ZBLwlRNGAEj{n#WAvF@!{dID~=g-TuuLz&>j
zSV-c-z!>z6Km5P}-Zwxrbu1<d4_!~9?Tc#X9>%i%oV~(agcu!8m`sgW3j>}2*B!V0
zXx}-NJr9>^f%EYI<a9hh{^<jd4pJoCbibdDG4s7|WW0XrE&J<_&G$?v%=sc1%LgpZ
zMO|Z*Ypsu(=r~9`Ura?u^{tJS)pdi>O*m!ib{StTh{6N}@NrZG4-#Ri{5wb@3@!|q
z;TAq>D&fO}a4#WA<Q?VX{rlKAlwAjou-{Vt{6IbXUzK+cG_;?EB2im>F6c!hTrKeA
zO~j_Guf0cj^7n|cBXt1pIdEpE)t$mByF0hCElRX=Qw(jgsHS?`Ab9}naKE903xBvF
zHn;a2Jk-;@ySuM9{(b<X+;Kw`gN?)m<)~!~0b>aCjwdX|4NF+nM8XkLfP84)#iQ8h
z2dUgd2#CHRm6IBVRd#|@1CxYK5FL~R*clH(>f=k5JOVtwLcT67OwK}E*KgRE#d=}n
zV$F0r+#OtK_^f=}n7U}~zG>{CiH@7b-M8(TvzpnxS5uZZx8JmPfW2j^0lO+U@5|X&
zdoGvGXIyB%onoKqn03tR@J-5`V|HlHf4%IL;Jo*h@ch7H$#$@inle^0z-G8SI#+l(
zG<R&#1@;!}sQ!(QVN+{Xbx`MhBbYafX<Jt8&P7+*lD+(T`eIt;_5Jhy#iq`sZC&pi
zTdeO}NpsHh&N>$Js+Zg~ORk!E$Ncfvb8mQey=7l=wZGNA=-l^?2|}Z`UiLm1fPL($
zaiPBZ91FYg>pgDvrt&{}c=pV~zw~U=#5f39gJ+M<2K|JZ*I;b$6Ke4e@;poO;lNy{
zd)Mf72|CRD2KtsYIxU|(PFaRZ+PZ<W9yrlQ0a4o$Rl)144GaxyRoNz(^@?O>$`(PZ
zo_-MBY!tR9pU+LDeS*@oMzPZdJOV-2=7coxNwz`Av<0(r8XO6&vK=3cC5ymSsz$H{
z)8HA%rgd?0I)suSB2>0R*eN)ZyvgQGIsO!HY=_V$?D`{KCv8%@>=2-XFw$DMNN_@$
z6*`i<(1zW@9%1h_ZVFx+!d&eWH1I}bKdP%_)E`P3p`<H*%#MQM332!=MCeR%rU_ke
zOdU+J2wjTYH>T@`C}5BBtG@oiLoz&)!C_dB9m;E`Bc8!Z=xBrP$W&&;qkQdXSzfQ~
zhI?f8l2LX;5XS;>M~Ix#=JiF&lwTcnyVt^i>)}GE=O|G5V=nixm$d60To3OG$Cd75
zg(Vfq!4@8s^S}l<0XE1<D1A!Kh3V1C`9vq2R$e&PuF+gdQPg8q@M~4f$9q7@r5rC)
zo;n_6A5(sHd?za^HIE*);39)t4!rDCE<KvB$9pvLzB2!49#_vP??0NK2DVN-=o6Ux
zGnRqi$^U)yFjv7UhfcWJ2g=BavPOcc{1<41f-_%>>|RW3Nfo9sB0?~HOW-<*348>6
z@$7)|{S!60c<Rv`W#IQ=nqDyrnDQ&mlP&K3u;+g9HWuA^0QDNFi-)x=%E-yB>;dKF
zlO?gn_O`0pM*fMlXNL5u9N!uWVfvg8{n~&a@;*NaOVZk#KPj5|@KeMleh^MxxR;Jv
z*9rI%F`BWKufsQsO>laWv*IM>i@|eEc+6Nw8MD_I=@Z5#et2?x7~Z15ffP-&b0W0f
z(!}dOY5h54C2cW%d{~uybQsN{GSLdC^7;K3T*D`h@iwS#4YttX9}W|-2};Lb3cy<c
zQF;61B)dy#Ikk;#R3fMLum_dDJGEbb7{-(wQOu`{^>obr%GT4}tfV}BTB@!^nioKn
zJHt=l%^Ocm5f4kB62RM;%{V#75ja?-_)KB!X-KQOb0h$<6q%-liLr5suBv!=26ZGk
zfh7GzC>RKh#;?@c5KZqnY3ODzW}iaPkDv}3;o;*!l=l(Q3jl8Q!*Kh5&Ijiwhzy5@
zNbD#u61XS8Q_l<kb)*R}s%8Kl<QO3I1h1b)At(d){Q+Mven##<ZvB7=uUAD?=NrUW
zWhdfvgJ4<?lWeTO;v0t$*r0DB2v3A`;@Eg(G9D(&LV<2%(Zc){Nn{5ia1*I|v@77f
z!cN4r0g!k=V~{1EPn@>!JSsTY5AP7*!2vMTqBV3zw{Y#T7A|%th0&Q8%^kPRaL83J
zn`;)gv@e<4Ay{GQWN%xu7Tw-uYu)0uJxkU-cQuIoIU?(qt=krx4lG#@+&5@+UF;p>
zhHC1T&0FRtmdwrYT*%T$E2&<#*355Rv^Ly_Tf*(&pPSRBcim2PE&S~9dX8(?DB1pl
z+&;L5_m{?cGBs~!xO$42?>gI34`ph;x4Gg_G4pO}!=YBqd#S~TEzA!yO@~XgKP=P&
zd_PmyQ)qa<IK8Jy^ZqtXPYd(@b{5l3G~JSU$f;S()Ez1`EEZ=TdPK9>syl2nELk!S
z7ik`HY>hB%s8beFh5xRph4UzGrEk1d2P*kFfT*>q3MO*Q7ilRO=1ZhL^4@}Gc$|%u
zU@5xxa4kXDYf^%jxDl|*N!;N2SFB<g!A%7Jh~UQvz6QW!h|hL>w_sIUu@+WT&Eau)
z8wPJpApH16;FQp5PMA~)i)vs(7&5{G;&CYQUltw&j_TMx<xu!<^%Gc;q@<4T$vy~4
zP?<gyNFW{6S5<+1FTmT-v2l0VD01Qu#2ppXvfygy@wGt+UeHo&kkqrv*T?H(X~3(R
zVTns(KX?cdU0GE4C;LFh1Y?rx14Du+3FCcq`w|FFFw_=IiU7e{mGh0OT3R;_0|^13
zPyVpq_IR(gV?KCrFa?zFFNB}?Cfm{qNe{PYkEf0lqR4ZQkB4OGt_Ke{A(H9_j)?Ke
zpzSGD9+%uPoH*JvRV$u{he+`97JNliOYzx)gBf<=NEm|6`a?(dx9{#HTc8Mi|1=JP
zWRi}oE(B;7&|7?h)2^C!pZAO7)DfghgsQcA<Y_|?4<_UJ7}rK$!qhkb)ig-LQ3!Cu
z>{1K;9i)7S;3EY05YSOZb9%!>;JA={q!uBd2P>Ypa4Q0F@rj_=N-h8k{4vsTfM5W#
zN+42k_%~*T&HstX@_gpS%;$42=FSMSUDqoX8xAa+I;Zt3se7i)u!UU(GrO)FxO`x-
zpn2KZvdGw1%+3o%&u_lCdFJ%8xoFyOS8riUAn=!#uiT3??cU9@w!6o;EH>><6JyN;
zyFH78Cx2GWwE1p|oz>r~cCl%9Yaw;FJd<_ZYkHCe<SuP9+s@wYfX8!e_T8XzdZLo+
l%uqf*QI!8@onTnAX%DDtcU{|F$-G@z(UGnBuA2q;{{Ros%7*{|

delta 7336
zcma)A33yZ2m45d<?XoP(vLwq3mN$$bHrQY&ivhF7c5D-HGJ{zZS@#*smL>JRCv4oO
z$Rtbx32C6WU!jG}km;68nobh8)1=dUnI>tcLo-=Q7xxX*$+Z32rp@=&K-w=&mzi^(
zEaT+MeBV6q(YfcGyPtFJfA8C$5ikFSG=10QatQFX_9jNv1A_1~EEGQLJagl|vrPv~
zvSoA$e<R=x)E4wNfB!$a)%7>+3!Gf~1j+Ls{2lZb+T>@qd8=eEwNNXyJz>h55BjKm
z&@T$Ib+m;?@Ac*!g$4%8sdF$$iv}x1VYfhCCj?q7S3V)l*Q=6!!-Tp|kilwNazYqf
zLPOL8r5gAxh2IeTdf~U0mVveoN<JvnQ$Lg%pcH^oBQ1y0QW^x>1hR?~Bs92;*3wE)
zhG`Xum(yyXE9erSx5&-3hF>PN<QD!msV2+0L)=q*hMe|J2$Rx&VS<F~W`@P*OuWf@
z&|yC~G;ol@zajpJ<2&XXIBx!)JzT>|fHTNyU=%Zu6M}B)Vtzx;Kkj@X5CB$pCQ?xv
zNwauNR#**4Hq6i>BARW$KF&vrEB%I<BbFLZr;>6~RoDtpZQ&P+8S&2)yT40Zb`UW1
zjIhX-@n4j*ml<_zEUL;%B&xD?pzGl)J;yBAeN5yYU)juyo(&>d#{cYXY-z&=HUrV6
z2vym7<gDY-$w>5wtV=)?3y4C-#{zs$S*3Xg2oCae*##Ixk#9fAEewJ=vAT)LQOb&d
zWiB8%GURb2VLLNA#Ff!aYHCbjYf#sYWr@X;P&t)R*)Bt$Nyb$L8_#zSl;vk<tXU*A
z%z8nY;y?F)6Nd7I03)QD2ZO7t4672AMUzU5#nWme9aTpZb_ZDB%SVEg`1#WvLGvW+
z%{hMetu-@_iY$@Hp%-QzsGJlV)Fv=AK5!#Jv+od|m@gNcH(SczT#_Z_{BTWgu#^Th
z;iy0>E?NtEB7obx$iH3FN>1>1YnF=PO1?I9CkgY1LRDln|A)|_5@XeH!RD8W2Wo#<
zg<ILjd_cpZF1D=FiK>WD!l`q6T`PHxZ>(Fo8qH$!5ecjypqJsI-na)yk3fWTf+ie-
zCC?I#P$3Au>2djaw!&UINfeO?M}!^1p$gE8n#kvh{JFx=sWb-L#Z1)nDRPbw;dGTr
zIKAE^95X*DK?GRXe&|8B#!^WYT$242mTYP&m55{%nc+D47_MJfVuw*jm`-8}hIL{8
z*j-SVszon}Fj)cLR%C_mulEi;4+`aWAiomcoffVO=Ah%v63?tZaNd44@gx7zH~dR4
z9lPRh{hoi_Q+uylK|N;?Jf*Yll7};=GH335Fnh`IJ@@i=tb(g}P6G98k?R`%{z1Wf
zbWg_?{&amshgEkl`J)+GQ6q86aM{=(5ZwynP~xd1>%x-5m{cs9NGQ5Z$qYd(B-L;k
zFKehJ6?|<&-6*=XZi%MTa+2!ixGIk;x|EQU`3%sH?N+0SZ78b9$>_Lj#IJ6m@tDeR
znz{s$rb|j@JnYSzN@<7z%Ml2Iw4$35@uaL1%EJ8lhQLlHV-<%Y%gM-iipmMynwD9F
zr6%$NHV?<;1Z5GUOBz?ycrvEyrV)(BF%T+VApE%5D}pa=Z7g%%59J3@@iUP}8eb$U
zXX=(7A(ih~1b^_FvG~5=J7!qE8-m&IIO&)x;+|y#byeZV241gfz2>&LihnOT?2fq}
zveN9ByNd`#?&<D#-}xASVA=9z3Z5g6`?|g2OTo(SX3MvV%e&hw-`Y~tz0P*o>+N1{
zz8oe%XWqNzh#1BtH_}Jm`yUq#?=hyl5CCX$7k^-7qxb`XKfQ7}8RJ)1_Eh8C^0n9l
zz<!ANtiZ=sRgow^x#|Q|a<wjZ;_|a&NHTm|Yn}5vu(}jeCz;Gst!))X3USRlL_`^h
z!csp9Hg5<s|J>RunRV$%T;;Czvt$$hyY_8|6wpC-n=+ai9#`3M;Fx9<<4Q^=5pb`}
z(5MVs|4*pG&HS+BRs`vOJPw|jr1B)gi1?K-vtjMaV#$}V+Gmk`4$0?v@%ljS3&=hJ
zB<#{{;D^dYTpeLgqV&s1{t?MjKy<UBLM~*RP%wk!D@eYI#2C=mkb4#gWFCph!|dz8
zFJ4UD3DKHL9F-&Br0gZo3WWdt`oD#2+PNVZ>V|xD4)RJ?q$De81oF#nI4B@{WldSL
zD)23~YL~f?X0jH@JO6!$&namp&B8pIWz>oQ!6g<fl4jM$zq}!s>oN%%VK&HP667&~
zib#_Lda-Jl#X6w}n`WaXlxIzvmARo!>lmC<%%NhcG(NB}<K#~VRXkyhuOQPzXr~fJ
z3wbJQ&pNVB&90eZ;-okxmP0cZ%`pbaQUNTGgyebJuQ@dvKfLj$w*wXv7-s0V{s+E%
z9x<s=Wh`vbtplC=dLnyw>J~+gve*biC(+GDbhBdQi~INN>;sG5&aS>4JNJf**ad#~
zrX{(%vDI&&1sR7l5QVKXf?rIeba5oEn-kF?IicVg3t4sH%O8*Ss0uqhlu>1N1q{ky
zUzG0wGcC*&2_Els*R0buy<;}8<hmf4OHVmZiYIqpE%H9xcdGCFx+_KXCrR_H&GRE$
z`5U(K^9`58r)w{DesTAsyC3WPT=zGsUJvg2zHRrc+jGh^XNCILY<x|JR+UE=&`aSf
z1qN1AxN*@u^Ge5agg?Edia0*8wUs!5G!=oPxHOU4j7=-n0971%W_}~BD4Q<TT%$Go
z4Xc-rZ!NM`z=qhUolkGAB}IH|XCtZQ!<|jHyR#*ln>wbPP}ie*w30jzTrqWGJ5z8Z
z8Kt84m0X1qExu^ZmZBq|WVD_~@2sFOn8tbE^=8X7hvuCGUqAz`Yzjb4Op1x<OW+2J
zG+L?VEi}8>>U0wvp<gixDzusZH2Y{1cErE5%~qQAX}(1&=Yq<$#jl1Js`v|mLEVOH
zuT-rC9WBv()N{c^OFy(7Th35=HNWv&_Q(QGxrf}W003IRZNOxLU!l8fKwXiSz<d|t
zR}(ZzMR;d?H|2|Dra}waA)gk|;BN|oQEgtRWG@&jk`;Z3Y~jwZ$j(`?(_B2UySCnc
zQ9LW2cAEg=W^FV8Q!T&f-UlUONG61EkiW8f|C-g%yK!93hiWVZv4wDxeH#g6EP>sM
zWC6c28$a3=;ot1`^WSxKHYHH`10)#r|M$7m(o;hcJlow~4*(c@)h&Q`<)ktYb{i)N
z+lP(dfdN7PbWcalHgqh1uCrM*_u$YXAX~uyx-FA5pf5!L0|+b@PsmiaL0XQ}Of(S=
z7}p3RH5*{p03y0Yo&=~y86Nj6g9I|8U|?q>K^TV&8_%II2}Cy!!_7q1t=m%>0C~(v
zTLye*D%u=F8_UsX0uU5j5r&lfbS6L?E;nWcz$BgoY&V=o`^KSY&SUTkSec~pG>Rr<
zBdf9hL|GBPuQ#;yC&02dkr;c@ja(0s+koh1<65JWG4>G3bR<7T1wg1F1rjx&+`jUP
zd>RCZnn>Vrdky4mm;@UozPs-i(pB#g-qqhBT^Bt3RR3CDx#yXpYi7~jI#=T{x4yHK
z|9H>TphIvLzv1e<6#u@f^NOQ$di&3Vh&_X?vn6G-?$WEi^7BD{_-dfyd^?|-_4sEi
zs%QO`=VNEbu6hIKt-RxES^4>L-gmXse@44f+HkeH_Vv2eSE|>%$=}{rv&kX^Drd{8
zuGN<oS>}XNv*i!hD@32exNKcsRoY{(ied6Be30Gp$@J?cL715s_`O)1wW~0v{6|;t
zvje^rw`g|Sj0uRgKrUFhP+Em&7ZYhK9GYzx1iJbWvthpmEZW~^pD(Tbfc?6>ed|YP
zHPl#NNO5!n^s=!ap_|4IzOR>#e68GOu-Jlipy#c?ch2+MfZsmP@3@(g2wYs~PL#7v
zi)OfMQDT|b7cu~}yZaHTP`X(kk~lO|m31s?#-};xt@E8$X%1d9SYOix9d@IP_P~U0
zTinz!A>7NOgQ0Sa)v1zD2>g2Cw1qp_6#w*Kr|-w8bb)-~HWPx7{_S8uyee?pftrf{
zKm$)GG|)fLdD}w$25?~Bd7wP-U!Z1Z(8h$yDQQz{8{`0<K2TqM8pY<#?Jcdt?~%qS
zha(gkIu=5J0b#?RI<UIN2Nq$Xi(^L>bcp;N`90gFM09+JMmO_6AE*d?3f&(w+O+WO
z(7$+|lb^kFT3~+Oa`3a{QQmj>R`Lmc?(km1`L7SRlTY$cWZm*H?AaZ{TTsZj1%+Vl
z>{BQ$x;fL0A$E=*j|9Xw1^$`H8o1lO7OBr+P)<oLYlqnnfeTx8GvuwLsynv#_wMQM
z+u1j;FaIcDz;Gk0ARaQZQ`m{{Go8;0P9ym#aTTs*x}>I5_FJ?YMsgepW^G-}By~|4
z(Md+ZNC`DAtnvJdfrUW=giI#EI^2V6F$&Q&^VnU#BQtl$j*?0Py+F-{57){-FLm54
zhseH}Rq|RXrwLiNidQ=01KiO<R~BBZvLzqTtXj}`L;$d~6|hMg-mNDIGlQ3U=xQu!
zCE&knG|vSA9B)46i9jXlPPntBYVFP5G^rHf$-Q2wov!6i#eMF@%6VO`ovx!FDKzv1
zo>A~+%Zwqc*Syr7!2y_H0A;`vx}jhToo=L?Xvak{>ocr3Qwd;&5xRLKYz*B7HGOm|
z#>*JAo)qzjrJV)K61ok7XnVngZsSKs$E`c!5VIFWe(6X#7sqzi@6x0r0?z&>{LmI6
z*obG5|73VsskQ)mppRPti8S%gjWv-j{>oS|*1f25MIrp*`2tS257R)iJ&WY!g&H8g
z?Ge+>Rk#VcXfMAtQQNox!DydW4QaF=(&!$jb-Pvtn`Y9MFf-lDKc3hwiKl1y_Y=+V
z`&Dil?<Wy%8E@hr8&8k{{;Tn=<NyyRZ(pUr(uGaB310+sF*T-JsH{fg3EdJKkz-?u
z@m2vIJZ+p~>~a2hvRZte@b4s-l%S&;z$1R?J|X}#`F-;Cs&_#M(Y9t7!gX2eNN6IJ
zNzl-c9BN=c<grxKN8Um=cnh5iun2-swiJ02t3$pXNdpq}r}!_yE?@j>{$grn6=D~L
zYXJ86+QT5t=O0Yie(p+l1icVYZ@mP<_*OWtb&<8@0hWWu(rZW=Kc8;oKltb*aq>R4
zmbCD{VY}eU_zLT?R6tEu$t#rxi_!9azEkNVBm9$!(((uF<vk!%;-OH+0!%3M)9Fu!
z!i3?SE9}c-onAEirNG<OT8aonH%~BliD7Ajr<w7z!mQYhfqsmqS$vq$Etw>|u8iej
z4MO=mDC$7Yz({u>_eUV%P#(oRj)E@!g6hvL!3LK=88S~R{IxNN0YD)`QL0<v{W1bb
z4=_-asqttcpQqZ<+A<^$r<kmpqr-@+I#FgGhErpN{RVkwG##Pxa5R%p72Pb4r`2P5
zl=v2C*{{*W1W2bsVGxCaF)!Vcjw*^wnH?n#p3H<R188Vh<iv0UUV&AH;OANRQ+{ch
zc_z~#igT8k;Ys)%6Zz+-ddVvO&eYOe?`G*Gzpu|Jyj<4l>f0=RYx#<Pr|@rU*7Y|^
zm)A7(w+Y|fY~NF4dc|e}`tO^~eKzZ>&eFbG>D6kfuR(Y<M3ApF_=Z5=M(Nef=6;*?
zHD{o|PI|4;+`rQLT3cX`U3wq1vB6-`GiN^iv2RPO5DFSc;o^r5l)V6Cs<^os)^9wj
zb~KKJ8kGU|g_(zQX_7;Pmw$A_4FfcIOo2PMiWxtD%v?r;Cy~7WQG|UHWMON5k@Mb&
z%lKz(g~+-i1y6es1>g7BeIQft#x;Mo<UyuoC_|6fWOz7-dUZ4R9lyg2Z_roo`<i7l
zHnfR<`u<&meqbT+3>V)B{FJ4+c_hjx3u3|9+>Be*j9Z18Q3YNg*I;d27UM;gxv>SJ
zTkuf`9w9~JaAbcG`1+G=xu4@`9pG(>9Eq|cim~6ufIc`cW1SF<-&`!#jy<hKf+53d
zjgFBRTk#i=L9P;`Y29SBjZ4GUfxeKXLZ19en8u^<DzpnUJ7@lQ@++jn0&G~^wJY4h
z%COQ_Y;+tsBi!~PXLM=AqsZj^1{ve2<ZnL^%;9DlL(@(2WL(X^kXmV+8JW`xHxIm1
z=(b2?7%oDQi1FB^n?_UkhPr2O*Y=(J*q@*ce61c&g9-arY|%g(=n=Yo=VVMyBeuvd
zNDZo2AXx`wbkRM@$Oc9Vc@)*pBf*rHzd#x5ir8Y&(&I`n51ROp7>OGL6Ob7^-ewZ=
zX0{hh;J={s^FKY<7MXJhHpl%F$0zR39nYO%=O)fhoXeffU1DFHcy!{6xkqzPO<rl*
zdL__##ky_UG;4Q095@wtxaw5Z8G8P<$5y<)uKS9;XWBCB+BNN%b(Ec~dwBV&<!26F
zanwy)XWi92cY4Fh?S#0m-zIv9<wlE-lw4m0-1TMU#CKy;F9G3Q;wrM8Tu+cAgj8G~
r;D0%Ni@3d%-||r1lKXq+%pxgyPr*q&X4>HqUiPfmDM&AGAwd5ZDuw8x

diff --git a/tools/cb-cost.py b/tools/cb-cost.py
index dd328c4..e0af2bf 100644
--- a/tools/cb-cost.py
+++ b/tools/cb-cost.py
@@ -44,7 +44,26 @@ from repo import ROOT as REPO  # noqa: E402  (single source of fact, T01)
 
 PRICES = os.path.join(REPO, "benchmarks", "baselines", "model-prices.toml")
 COMPONENTS = ("input", "output", "cache_read", "write_5m", "write_1h")
+# CA-08 attribution key. Qualified first: a bare `T\d\d` collides across
+# workplans — CB-WP-0002 T01, CB-WP-0003 T01 and CB-WP-0004 T01 all matched
+# the same bucket, so a per-task figure summed three unrelated tasks. Found
+# by T02's positive control, which reported $12.10 for "T01".
+TASK_QUALIFIED_RE = re.compile(r"\b(CB-WP-\d+)[ -](T\d\d)\b")
 TASK_RE = re.compile(r"\bT\d\d\b")
+
+
+def task_label(subject):
+    """Attribution label for a commit subject, or None.
+
+    Qualified ids (`CB-WP-0004 T01`) become `CB-WP-0004-T01`. Bare ids
+    (`T01: ...`) stay bare — commits predating this convention did not name
+    their workplan and must not be retroactively assigned to one.
+    """
+    m = TASK_QUALIFIED_RE.search(subject)
+    if m:
+        return f"{m.group(1)}-{m.group(2)}"
+    m = TASK_RE.search(subject)
+    return m.group(0) if m else None
 UNATTRIBUTED = "UNATTRIBUTED"
 OPEN_REMAINDER = "OPEN (uncommitted)"
 
@@ -323,8 +342,7 @@ def attribute(responses, commits):
     label_for = []
     prev = ""
     for ts, subject in commits:
-        m = TASK_RE.search(subject)
-        label_for.append((prev, ts, m.group(0) if m else UNATTRIBUTED))
+        label_for.append((prev, ts, task_label(subject) or UNATTRIBUTED))
         prev = ts
     last = commits[-1][0] if commits else ""
 
@@ -369,6 +387,13 @@ def collect(slug, pin_ref=None):
     attribute(responses, commit_index(pin))
 
     by_task = collections.defaultdict(float)
+    # T02: per-task token detail, so a task close can report *measured*
+    # tokens. Every update_task_status in this project before T02 carried
+    # hand-typed estimates — in a repo whose finding is that estimated
+    # token counts are worthless.
+    task_detail = collections.defaultdict(
+        lambda: {"cost": 0.0, "responses": 0, "models": collections.Counter(),
+                 "toks": collections.Counter()})
     by_component = collections.Counter()
     by_component_cost = collections.defaultdict(float)
     by_model = collections.defaultdict(float)
@@ -379,6 +404,11 @@ def collect(slug, pin_ref=None):
             unpriced.append(r)
             continue
         by_task[r["task"]] += r["cost"]
+        d = task_detail[r["task"]]
+        d["cost"] += r["cost"]
+        d["responses"] += 1
+        d["models"][r["model"]] += 1
+        d["toks"].update(r["toks"])
         by_model[r["model"]] += r["cost"]
         rin, rout = rates_at(prices, r["model"], r["timestamp"])
         unit = rin / 1e6
@@ -429,6 +459,27 @@ def collect(slug, pin_ref=None):
         "subagent_total": sub,
         "main_total": total - sub,
         "by_task": dict(by_task),
+        "by_task_detail": {
+            k: {
+                "cost": v["cost"],
+                "responses": v["responses"],
+                # The model that ran the most responses for this task. The
+                # hub schema has one model field per event; a task split
+                # across models cannot be represented faithfully, so the
+                # full count travels in the note.
+                "model": v["models"].most_common(1)[0][0],
+                "models": dict(v["models"]),
+                "toks": dict(v["toks"]),
+                # CA-03/CA-04: the hub has no cache fields. tokens_in is
+                # the honest sum of everything billed on the input side.
+                "tokens_in": (v["toks"].get("input", 0)
+                              + v["toks"].get("cache_read", 0)
+                              + v["toks"].get("write_5m", 0)
+                              + v["toks"].get("write_1h", 0)),
+                "tokens_out": v["toks"].get("output", 0),
+            }
+            for k, v in task_detail.items()
+        },
         "by_model": dict(by_model),
         "tokens": dict(by_component),
         "cost_by_component": dict(by_component_cost),
@@ -566,6 +617,18 @@ def self_test():
     finally:
         os.unlink(partial)
 
+    # CA-08 label collision (found by T02's positive control): three
+    # workplans each had a T01, and a bare-label bucket summed all three
+    # into one figure — $12.10 for a task that cost $2.33. Qualified
+    # subjects must produce distinct buckets.
+    check("CA-08 qualified task ids do not collide across workplans",
+          task_label("CB-WP-0004 T01: fix env") == "CB-WP-0004-T01"
+          and task_label("CB-WP-0002 T01: survey") == "CB-WP-0002-T01"
+          and task_label("CB-WP-0004-T01: hyphenated") == "CB-WP-0004-T01")
+    check("CA-08 unqualified subjects stay bare, not retro-assigned",
+          task_label("T01: cost-accounting survey") == "T01"
+          and task_label("chore: no task here") is None)
+
     # CA-16: a dated promo rate must apply before its expiry and lapse after.
     pr = prices
     before = rates_at(pr, "claude-sonnet-5", "2026-07-31T00:00:00Z")
diff --git a/tools/task-done.py b/tools/task-done.py
new file mode 100644
index 0000000..83508ea
--- /dev/null
+++ b/tools/task-done.py
@@ -0,0 +1,322 @@
+#!/usr/bin/env python3
+"""Close a workplan task: flip the file, read the measured cost, tell the hub.
+
+CB-WP-0004 T02. Replaces three things that were done by hand on every task
+close, at a measured 46 turns and $11.52 per pass (CB-RES-0003 candidates
+3 and 5):
+
+  1. a heredoc doing `s.replace("status: todo", "status: done")` on the
+     workplan file — which silently did nothing on a typo'd task id or an
+     already-closed task;
+  2. a hand-written `update_task_status` hub call;
+  3. **hand-typed `tokens_in` / `tokens_out`**, in a project whose central
+     finding is that estimated token counts are worthless. Every hub token
+     event this repo produced before T02 was an estimate. This tool reads
+     the measured figure from the transcripts via cb-cost, or refuses.
+
+Ordering matters and is enforced, not assumed. Attribution is by commit
+subject (CA-08), so the work commit naming the task must exist *before*
+the close: otherwise the spend still sits in OPEN (uncommitted) and there
+is nothing measured to report. The usual sequence is
+
+    <do the work>
+    git commit -m "CB-WP-0004 T02: ..."     # subject names the task
+    make task-done T=CB-WP-0004-T02          # measures, flips, pushes
+    git commit -m "chore: mark T02 done (measured: ...)"
+
+Usage:
+  python3 tools/task-done.py CB-WP-0004-T02
+  python3 tools/task-done.py CB-WP-0004-T02 --dry-run    # measure, change nothing
+  python3 tools/task-done.py CB-WP-0004-T02 --no-hub     # file only
+  python3 tools/task-done.py --self-test
+"""
+import glob
+import json
+import os
+import re
+import subprocess
+import sys
+import urllib.error
+import urllib.request
+
+from repo import ROOT, enter_root
+
+HUB = os.environ.get("CUSTODIAN_HUB", "http://127.0.0.1:8000")
+AGENT = "custodian"
+TASK_ID_RE = re.compile(r"^(?P<wp>CB-WP-\d+)-(?P<label>T\d\d)$")
+
+
+class Fail(Exception):
+    """A loud refusal. The heredocs this replaces failed silently."""
+
+
+# ------------------------------------------------------------ workplan file
+
+
+def find_task_block(text, task_id):
+    """(start, end, body) of the ```task block declaring task_id.
+
+    Returns None when the id is absent — the caller turns that into a
+    non-zero exit. A string replace over the whole file would instead have
+    flipped whichever `status: todo` came first, which is worse than
+    doing nothing.
+    """
+    for m in re.finditer(r"```task\n(.*?)```", text, re.S):
+        body = m.group(1)
+        if re.search(rf"^id:\s*{re.escape(task_id)}\s*$", body, re.M):
+            return m.start(1), m.end(1), body
+    return None
+
+
+def block_status(body):
+    m = re.search(r"^status:\s*(\S+)\s*$", body, re.M)
+    return m.group(1) if m else None
+
+
+def set_status(body, new):
+    return re.sub(r"^status:\s*\S+\s*$", f"status: {new}", body, count=1, flags=re.M)
+
+
+def hub_id(body):
+    m = re.search(r'^state_hub_task_id:\s*"?([0-9a-f-]{36})"?\s*$', body, re.M)
+    return m.group(1) if m else None
+
+
+def locate(task_id):
+    """(path, text, span, body) for the one workplan declaring this task."""
+    hits = []
+    for path in sorted(glob.glob(os.path.join(ROOT, "workplans", "*.md"))):
+        text = open(path).read()
+        found = find_task_block(text, task_id)
+        if found:
+            hits.append((path, text, (found[0], found[1]), found[2]))
+    if not hits:
+        raise Fail(f"no workplan declares task {task_id}")
+    if len(hits) > 1:
+        raise Fail(f"{task_id} declared in {len(hits)} workplans: "
+                   + ", ".join(os.path.basename(h[0]) for h in hits))
+    return hits[0]
+
+
+# ---------------------------------------------------------------- measuring
+
+
+def measured(task_id):
+    """Measured cost and tokens for this task, from the transcripts.
+
+    Looks up the **qualified** label (`CB-WP-0004-T01`) only. A bare `T01`
+    bucket collides across workplans — three of them existed when this was
+    written, and summing them reported $12.10 for a task that cost a
+    fraction of it. Falling back to the bare label would reintroduce
+    exactly the inflated number this tool exists to prevent, so the commit
+    subject must name the workplan.
+
+    Imports cb-cost rather than shelling out and parsing its printed
+    table: a number re-parsed out of formatted text is a copy that can
+    drift from its source (the DFD class).
+    """
+    import importlib.util
+
+    spec = importlib.util.spec_from_file_location(
+        "cb_cost", os.path.join(ROOT, "tools", "cb-cost.py"))
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    rep = mod.collect("-home-worsch-clay-borg", None)
+    detail = rep["by_task_detail"].get(task_id)
+    if not detail:
+        bare = task_id.rsplit("-", 1)[-1]
+        hint = ""
+        if bare in rep["by_task_detail"]:
+            hint = (f" A bare '{bare}' bucket exists, but it is shared with "
+                    f"other workplans and must not be used for this task.")
+        raise Fail(
+            f"no spend attributed to {task_id}. Attribution is by commit "
+            f"subject (CA-08) — commit the work with '{task_id}' (or "
+            f"'{task_id.rsplit('-', 1)[0]} {bare}') in the subject line "
+            f"first, then close the task.{hint} Refusing to report an "
+            f"estimate: that is the habit this tool exists to end.")
+    return detail
+
+
+# --------------------------------------------------------------------- hub
+
+
+def push(task_uuid, detail, label):
+    body = {
+        "status": "done",
+        "tokens_in": detail["tokens_in"],
+        "tokens_out": detail["tokens_out"],
+        "model": detail["model"],
+        "agent": AGENT,
+        "token_note": (
+            f"measured by tools/cb-cost.py (CA-08 attribution); "
+            f"${detail['cost']:.2f} over {detail['responses']} responses; "
+            f"models {detail['models']}; tokens_in includes cache reads and "
+            f"writes, which the hub schema cannot separate"
+        ),
+    }
+    req = urllib.request.Request(
+        f"{HUB}/tasks/{task_uuid}",
+        data=json.dumps(body).encode(),
+        headers={"Content-Type": "application/json"},
+        method="PATCH",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=10) as r:
+            return r.status
+    except urllib.error.URLError as e:
+        raise Fail(f"hub PATCH failed for {label} ({task_uuid}): {e}")
+
+
+# --------------------------------------------------------------- self-test
+
+
+def self_test():
+    """Each assertion pins a failure this tool must detect.
+
+    The controls that matter: the silent no-op that motivated the tool
+    (unknown id, already-done task, wrong block flipped), and the refusal
+    to invent token counts.
+    """
+    results = []
+
+    def check(name, ok, detail=""):
+        results.append((name, ok, detail))
+
+    sample = (
+        "## Task: one\n\n```task\nid: CB-WP-0009-T01\nstatus: done\n"
+        'state_hub_task_id: "11111111-2222-3333-4444-555555555555"\n```\n\n'
+        "## Task: two\n\n```task\nid: CB-WP-0009-T02\nstatus: todo\n"
+        'state_hub_task_id: "66666666-7777-8888-9999-aaaaaaaaaaaa"\n```\n'
+    )
+
+    # The defect: a whole-file replace flips the first `status: todo` it
+    # sees, not the one asked for.
+    found = find_task_block(sample, "CB-WP-0009-T02")
+    check("finds the block for the id asked for, not the first block",
+          found is not None and "T02" in found[2])
+    check("already-done task is visible as such",
+          block_status(find_task_block(sample, "CB-WP-0009-T01")[2]) == "done")
+    check("unknown id yields nothing (caller must abort)",
+          find_task_block(sample, "CB-WP-0009-T99") is None)
+    check("typo'd id yields nothing rather than the nearest match",
+          find_task_block(sample, "CB-WP-0009-TO2") is None)
+    check("status flip touches only the target block",
+          set_status(found[2], "done").count("done") == 1)
+    check("hub uuid is extracted from the right block",
+          hub_id(found[2]) == "66666666-7777-8888-9999-aaaaaaaaaaaa")
+    check("missing hub uuid is None, not a guess",
+          hub_id("id: X\nstatus: todo\n") is None)
+    check("task id format is validated",
+          bool(TASK_ID_RE.match("CB-WP-0004-T02"))
+          and not TASK_ID_RE.match("T02")
+          and not TASK_ID_RE.match("CB-WP-0004"))
+
+    # The estimate refusal, exercised against a label that cannot have spend.
+    try:
+        measured("CB-WP-9999-T99")
+        check("refuses to report a task with no attributed spend", False,
+              "returned a figure for a task with no commit")
+    except Fail as e:
+        check("refuses to report a task with no attributed spend",
+              "Refusing to report an estimate" in str(e))
+    except Exception as e:  # cb-cost aborted for an unrelated reason
+        check("refuses to report a task with no attributed spend", False, str(e))
+
+    # And that it does return real numbers for a task that has them.
+    try:
+        d = measured("CB-WP-0004-T01")
+        check("returns measured tokens for a committed task",
+              d["tokens_in"] > 0 and d["cost"] > 0,
+              f"${d['cost']:.2f}, {d['tokens_in']:,} in / {d['tokens_out']:,} out")
+    except Fail as e:
+        check("returns measured tokens for a committed task", False, str(e))
+
+    print("task-done self-test (positive control)")
+    ok = True
+    for name, passed, det in results:
+        print(f"  [{'ok ' if passed else 'FAIL'}] {name}"
+              + (f"  — {det}" if det else ""))
+        ok &= passed
+    return 0 if ok else 1
+
+
+# -------------------------------------------------------------------- main
+
+
+def main():
+    enter_root()
+    argv = [a for a in sys.argv[1:] if not a.startswith("--")]
+    flags = {a for a in sys.argv[1:] if a.startswith("--")}
+    if "--self-test" in flags:
+        return self_test()
+    if len(argv) != 1:
+        print(__doc__.strip().split("Usage:")[-1], file=sys.stderr)
+        return 2
+
+    task_id = argv[0]
+    m = TASK_ID_RE.match(task_id)
+    if not m:
+        print(f"ERROR — expected a task id like CB-WP-0004-T02, got {task_id!r}",
+              file=sys.stderr)
+        return 1
+
+    try:
+        path, text, (lo, hi), body = locate(task_id)
+        status = block_status(body)
+        if status == "done":
+            raise Fail(f"{task_id} is already done in "
+                       f"{os.path.relpath(path, ROOT)} — refusing to re-close")
+        uuid = hub_id(body)
+        if not uuid and "--no-hub" not in flags:
+            raise Fail(f"{task_id} has no state_hub_task_id; run fix-consistency "
+                       f"first, or pass --no-hub")
+        detail = measured(task_id)
+    except Fail as e:
+        print(f"ERROR — {e}", file=sys.stderr)
+        return 1
+
+    rel = os.path.relpath(path, ROOT)
+    print(f"closing {task_id}  ({rel}, status {status} -> done)")
+    print(f"  measured   ${detail['cost']:,.2f} over {detail['responses']} responses")
+    print(f"  tokens     {detail['tokens_in']:,} in / {detail['tokens_out']:,} out")
+    print(f"  models     {detail['models']}")
+
+    if "--dry-run" in flags:
+        print("  dry-run    file unchanged, hub not called")
+        return 0
+
+    new = text[:lo] + set_status(body, "done") + text[hi:]
+    if new == text:
+        # Positive control for the exact defect being replaced.
+        print("ERROR — status flip produced no change; refusing to claim a close",
+              file=sys.stderr)
+        return 1
+    with open(path, "w") as fh:
+        fh.write(new)
+    print(f"  file       {rel} updated")
+
+    if "--no-hub" in flags:
+        print("  hub        skipped (--no-hub)")
+    else:
+        try:
+            code = push(uuid, detail, task_id)
+            print(f"  hub        {uuid} -> done (HTTP {code}), measured tokens")
+        except Fail as e:
+            # The file is already flipped and that is recoverable by git;
+            # a wrong exit code is not. Report and fail.
+            print(f"ERROR — {e}", file=sys.stderr)
+            return 1
+
+    subject = (f"chore: mark {m.group('label')} done (measured: {detail['responses']} responses, "
+               f"${detail['cost']:,.2f}, {detail['model']})")
+    print(f"\nnext: git commit -m {subject!r}")
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main())
+    except subprocess.CalledProcessError as e:
+        print(f"ERROR — {e}", file=sys.stderr)
+        sys.exit(1)
diff --git a/workplans/CB-WP-0004-mechanical-work.md b/workplans/CB-WP-0004-mechanical-work.md
index c8f28f2..262647c 100644
--- a/workplans/CB-WP-0004-mechanical-work.md
+++ b/workplans/CB-WP-0004-mechanical-work.md
@@ -110,6 +110,28 @@ CB-WP-0002 disproved.
 **Predicted:** those 46 turns → **~6**, **$9–11** recovered, and the hub
 stops holding estimates. Add `--self-test` per InnerLoop v1.1.
 
+**Delivered.** `tools/task-done.py` + `make task-done T=<id>`. It refuses
+on an unknown id, a typo'd id, an already-done task, a task with no
+`state_hub_task_id`, and — the one that matters — **a task with no
+measured spend**, rather than reporting an estimate. `cb-cost` gained
+`by_task_detail` (cost, response count, model histogram, and token
+components per task), and `task-done` imports cb-cost rather than parsing
+its printed table, so the hub number is not a copy that can drift.
+
+**The positive control found a real defect before the tool was used
+once.** Attribution keyed on a bare `T\d\d` from the commit subject, so
+`CB-WP-0002 T01`, `CB-WP-0003 T01` and `CB-WP-0004 T01` all landed in one
+bucket. The self-test reported **$12.10** for "T01"; the qualified figure
+is **$2.33** — a 5.2× overstatement that would have been pushed to the
+hub as a measured number, reproducing the fiction this task exists to
+end, in a new form. Fixed by `task_label()`: qualified subjects
+(`CB-WP-0004 T01`) key on the full id, unqualified ones stay bare and are
+never retro-assigned to a workplan. The pinned $93.15 benchmark is
+unchanged, confirming historical attribution was not disturbed.
+
+That is the **fourth** instance of trusted arithmetic (TA) — a number
+believed because it was produced by a program rather than by hand.
+
 ## Task: `make status` — one-shot orientation
 
 ```task