The container drain revisits finished phases for 30 minutes; the other drains are idempotent because they truncate, and the taint file deliberately is not. The first live mission (01a0cb7e) recorded the same event four times. Record only when no event for the phase already carries at least as many hosts. Live result otherwise as designed: curl https://example.com tainted iana.org (the page's link), not example.com (the agent's own target), and grep -rn curl added nothing. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>