@cspeach/cli 1.1.27 → 1.1.28

package/dist/commands/plan-chain.js

@@ -2,20 +2,23 @@
 //
 // Task 6 (agentic-flow, 2026-07-03) — the shared post-phase sequence, called
 // by BOTH repl.tsx plan-resume call sites (Ink + classic) so neither
-// duplicates the block. Exact order (the crash-safety design):
+// duplicates the block.
 //
-//   finishPlanResume persisted the phase WITH audit:'pending'   (caller)
-//     → runPhaseAudit          (fresh-context, tool-less judge turn)
-//     → applyAuditResult       (verdict persisted as revision N+1)
-//     → verdict handling       (failed ⇒ re-run/waive/block; infra ⇒ stop,
-//                               2nd consecutive infra ⇒ retry/waive/block)
-//     → decideNextPhaseGate    (step/guarded transition decision)
-//     → offerNextPhaseAutoRun  (prompt, or auto-queue in guarded mode)
+// 2026-10-04 (continuous run, spec §3.1–§3.4) — one approval, then one run:
 //
-// A crash anywhere before applyAuditResult leaves 'pending' on disk;
-// preparePlanResume's re-audit-on-resume then runs this chain FIRST on the
-// next --resume (executedPhaseId = the pending phase, forceAudit) instead of
-// executing a new phase — the audit is never skipped.
+//   finishPlanResume persisted the step WITH audit:'pending'     (caller)
+//     → decideNextPhaseGate   guarded: chain on (write steps included);
+//                             step: ask before each step
+//     → deploy card           always, before a deploy step
+//     → queue the next step   (the harness-built resume command)
+//
+//   …and when the run ends without queueing a next step (last step, the user
+//   said No, a stop), the independent audit runs ONCE over every step still
+//   'pending' (runBatchAudit), then the completion lines.
+//
+// A crash before the end-of-run audit leaves 'pending' on disk; the next
+// resume in a new session checks those steps first (preparePlanResume →
+// runReauditPass), so the audit is never skipped.
 //
 // Everything I/O-heavy or interactive is injectable via PlanChainDeps so the
 // chain is unit-testable without a provider, Ink, or inquirer.
@@ -23,69 +26,264 @@ import { basename } from 'node:path';
 import chalk from 'chalk';
 import { readProjectFile } from '../projects/status.js';
 import { parsePlanContent } from '../projects/plan-schema.js';
-import { statusesFromItems, computeNextPhase, isPhaseSatisfied, isAuditResolved, planCompletionLines, renderPlanTracker, } from '../projects/plan-run.js';
+import { statusesFromItems, computeNextPhaseForRun, isPhaseSatisfiedForRun, planCompletionLines, phaseDisplayTitle, } from '../projects/plan-run.js';
+import { savedLocation } from '../projects/saved-lines.js';
+import { clearPlanGrant, getPlanGrant, getGrantTransport, installPlanGrant, noteDeltaOffered, offeredDeltaObjects, planGrantAllowed, } from '../approvals/plan-grant.js';
+import { collectPlannedObjects, plannedObjectFacts } from '../projects/plan-objects.js';
 import { isDeployPhase } from '../projects/plan-lane.js';
 import { askDeployCard } from './deploy-card.js';
 import { decideNextPhaseGate, getAndResetPlanPhaseSubagentDispatches, getAndResetPlanDeviation, } from './plan-gate.js';
-import { runPhaseAudit } from './plan-audit.js';
 import { applyAuditResult, applyPhaseResolution, buildResumeCommand, offerNextPhaseAutoRun, } from './plan-resume.js';
-import { appendCostLine, buildEntry } from '../cost/cost-log.js';
-import { getGlyphs } from '../renderer/glyphs.js';
-import { formatFailure, formatAttention, formatInfo } from '../renderer/notice-shape.js';
-import { paint } from '../renderer/theme.js';
+import { formatFailure, formatInfo } from '../renderer/notice-shape.js';
 import { clean } from '../renderer/tool-labels.js';
-import { startThinkingHeartbeat, AUDIT_HEARTBEAT_THRESHOLDS } from '../renderer/thinking-heartbeat.js';
-import { computeCost, formatCost } from '../cost/pricing.js';
-import { creditsActive } from '../cost/credits.js';
-/** Two consecutive failed verdicts on the same phase force status 'blocked'. */
-export const MAX_CONSECUTIVE_AUDIT_FAILURES = 2;
-/** Infra error strings are model/HTTP noise — clamp when rendering (Task 5 review). */
-const INFRA_RENDER_CHARS = 200;
+import { runBatchAudit, pendingAuditPhaseIds, selectPlanCardAction, } from './plan-batch-audit.js';
+// The audit menus and the failure cap live in plan-batch-audit.ts; re-exported
+// for existing callers.
+export { MAX_CONSECUTIVE_AUDIT_FAILURES, defaultSelectFailureAction, defaultSelectWaiveCategory, } from './plan-batch-audit.js';
+/** After this many "Fix it now" on one step in one run, the card offers only Skip / Stop. */
+export const MAX_FAILED_CHECK_FIXES = 2;
+/**
+ * runBatchAudit can throw (a revision failed validation, the save failed).
+ * The chain shows one plain line and stops; whatever was not recorded stays
+ * 'pending', so the next resume checks it again.
+ */
+async function batchAuditOrNull(args) {
+    try {
+        return await runBatchAudit(args);
+    }
+    catch {
+        args.log(formatFailure({
+            what: 'The independent check could not finish',
+            detail: ['the steps it did not record stay unchecked — CSPeach checks them on the next resume'],
+        }).trimEnd());
+        return null;
+    }
+}
+/**
+ * The checked steps whose check FAILED and got no answer: the audit says
+ * failed while the step still claims done. A step the user marked blocked
+ * (status blocked) or chose to re-run (status todo) is not one of them.
+ */
+function unansweredFailures(content, statuses, ids) {
+    const want = new Set(ids);
+    return content.phases.filter((p) => want.has(p.id) && p.audit?.state === 'failed'
+        && (statuses[p.id] === 'validated' || statuses[p.id] === 'validated-with-waiver'));
+}
+/**
+ * "Fix it now" count per step for this run (in memory). Keyed by the plan's
+ * stable id + the step id; cleared when the run ends without queueing a step.
+ */
+const failedCheckFixes = new Map();
+/** Test seam — forget every fix count. */
+export function resetFailedCheckFixAttempts() {
+    failedCheckFixes.clear();
+}
+/** One short display line from model text. */
+function shortLine(s, max = 200) {
+    const c = clean(s);
+    return c.length > max ? `${c.slice(0, max - 1)}…` : c;
+}
+/**
+ * The card's facts for a step that ended blocked by its own check: what failed
+ * (the reason the step saved — an explicit blocked reason, else its notes,
+ * else its own check), the snapshot when one was recorded, and that nothing
+ * after it has run. Never field names.
+ */
+export function failedCheckFacts(p) {
+    const work = (p.work ?? {});
+    const reason = typeof work.blockedReason === 'string' && work.blockedReason.trim()
+        ? work.blockedReason
+        : work.notes?.trim()
+            ? work.notes
+            : null;
+    const facts = [reason
+            ? `What failed: ${shortLine(reason)}`
+            : `What failed: its own check did not hold — ${shortLine(p.exitGate)}`];
+    if (work.snapshot?.trim())
+        facts.push(`Snapshot: ${shortLine(work.snapshot, 120)}`);
+    facts.push('Nothing after this step has run.');
+    return facts;
+}
+/** Production failed-check card (same surface as the audit menus). */
+export async function defaultSelectFailedCheckAction(a) {
+    const choices = [
+        ...(a.canFix ? [{ value: 'fix', label: 'Fix it now (CSPeach runs this step again)' }] : []),
+        { value: 'skip', label: 'Skip this step (record a one-line reason)' },
+        { value: 'stop', label: 'Stop' },
+    ];
+    const picked = await selectPlanCardAction({
+        id: 'plan-failed-check',
+        question: `${a.title} could not finish`,
+        facts: a.facts,
+        choices,
+        footnote: 'Plan run',
+    });
+    return picked === 'none' ? 'stop' : picked;
+}
+/**
+ * 2026-10-04 — a design step may name objects the approved list did not have.
+ * Ask ONCE to add them (instead of a card per write). Only objects not yet
+ * offered for this plan in this session are asked about: a No (or no answer)
+ * is remembered, so the same card never comes back at the next step; those
+ * writes ask one by one, as any off-list write does. Only extends a live
+ * grant of THIS plan and session, and never where a grant may not be minted
+ * (production, advisory-only, per-write approvals).
+ */
+export async function offerObjectListDelta(a) {
+    const g = getPlanGrant();
+    if (!g || g.planId !== a.planId || g.sessionId !== a.sessionId)
+        return 'none';
+    const listed = new Set(g.objects.map((o) => `${o.type}:${o.name}`));
+    const offered = offeredDeltaObjects(a.planId);
+    const added = collectPlannedObjects(a.content)
+        .filter((o) => !listed.has(`${o.type}:${o.name}`) && !offered.has(`${o.type}:${o.name}`));
+    if (added.length === 0)
+        return 'none';
+    if (!(await planGrantAllowed(a.sapAlias)))
+        return 'none';
+    noteDeltaOffered(a.planId, added);
+    const confirm = a.confirm ?? (async (req) => (await import('../ui/confirm-request.js')).askConfirm(req));
+    const one = added.length === 1;
+    const res = await confirm({
+        id: 'plan-object-delta',
+        tag: 'QUESTION',
+        title: `The design added ${added.length} object${one ? '' : 's'} to the plan. Add ${one ? 'it' : 'them'} to the approved list?`,
+        facts: plannedObjectFacts(added),
+        choices: [{ value: 'yes', label: 'Yes' }, { value: 'no', label: 'No — ask before each of these writes' }],
+        initial: 0,
+        aliases: { y: 'yes', n: 'no' },
+    });
+    if (res.value !== 'yes' || res.cancelled)
+        return 'declined';
+    const transport = getGrantTransport();
+    const ok = await installPlanGrant({
+        planId: g.planId, sessionId: g.sessionId, objects: [...g.objects, ...added],
+        ...(transport ? { transport } : {}), ...(a.sapAlias ? { sapAlias: a.sapAlias } : {}),
+    }).catch(() => false);
+    if (!ok) {
+        a.log(`The added object${one ? '' : 's'} could not be approved. Each SAP write to ${one ? 'it' : 'them'} asks first.`);
+        return 'declined';
+    }
+    a.log(formatInfo(`${added.length} object${one ? '' : 's'} added to the approved list`).trimEnd());
+    return 'added';
+}
 /**
  * Run the post-phase chain. Returns the LATEST saved envelope path (the
  * caller's savedPath when nothing was written), or null when the chain could
  * not even load the envelope.
  */
 export async function runPostPhaseChain(args) {
+    // 2026-10-04 (continuous run, spec §3.2) — the plan object-list grant lives
+    // for one run: when the chain ends without queueing a next step (plan
+    // complete, a stop, the user said No, or the chain failed), it is cleared,
+    // so a later resume asks again.
+    let queuedNext = false;
+    const tracked = {
+        ...args,
+        queueDispatch: (cmd) => { queuedNext = true; args.queueDispatch(cmd); },
+    };
+    try {
+        return await postPhaseChain(tracked);
+    }
+    finally {
+        if (!queuedNext && !args.suppressOffer)
+            clearPlanGrant();
+    }
+}
+async function postPhaseChain(args) {
     let path = args.savedPath;
     let loaded = loadPlan(path, args.log);
     if (!loaded)
         return null;
-    let phase = loaded.content.phases.find((p) => p.id === args.executedPhaseId);
+    const phase = loaded.content.phases.find((p) => p.id === args.executedPhaseId);
     if (!phase) {
-        args.log(formatFailure({ what: 'Plan phase not found', object: args.executedPhaseId, detail: [`${basename(path)} · follow-up steps skipped`] }).trimEnd());
+        args.log(formatFailure({ what: 'Plan step not found', detail: [`${basename(path)} · follow-up steps skipped`] }).trimEnd());
         return path;
     }
     // Per-run flags survive the chain: an explicitly flagged run keeps its mode
-    // AND its audit setting across every harness-built resume command (I2 — the
-    // audit flag mirrors modeFlag; --audit maps to itself, 'off' to --no-audit).
+    // AND its audit setting across every harness-built resume command.
     const flagSuffix = (args.modeFlag ? ` --${args.modeFlag}` : '')
         + (args.auditFlag === 'off' ? ' --no-audit' : args.auditFlag === 'on' ? ' --audit' : '');
     const resumeCmd = (p) => buildResumeCommand(p) + flagSuffix;
-    let chainWrote = false;
-    // Task 7 — phase-end subagent report. agent_run counted every dispatch
-    // made while the plan-phase flag was on (all forced read-only). The REPL
-    // reads+resets the counter in its runTurn finally and threads the value
-    // here (fix-wave, item 1) — this chain can be skipped on error paths, so
-    // consuming the counter here alone would let counts leak into the next
-    // phase's report line. The read+reset below is only the fallback for
-    // callers that ran no phase turn (re-audit passes, direct test calls) —
-    // zero there in practice, so nothing is printed.
+    let queued = false;
+    let stopShown = false;
+    const queue = (cmd) => { queued = true; args.queueDispatch(cmd); };
+    const titleOf = (p) => phaseDisplayTitle(p, loaded?.content.phases ?? []);
+    const batchArgs = (p, phaseIds, force) => ({
+        savedPath: p, phaseIds, sessionId: args.sessionId, cwd: args.cwd,
+        ...(force ? { force: true } : {}),
+        prompt: args.prompt, log: args.log, ...(args.deps ? { deps: args.deps } : {}),
+    });
+    // The run ended without queueing a next step: audit every step still
+    // 'pending' once (spec §3.4), then the completion lines + where the file is.
+    const endOfRun = async (p) => {
+        if (queued)
+            return p;
+        let cur = p;
+        const l = loadPlan(cur, args.log);
+        if (!l)
+            return cur;
+        // Under skipEndAudit only the steps runReauditPass just checked are
+        // skipped — any other step still pending is checked here, so "Plan
+        // complete" never prints over an unchecked step.
+        const justChecked = new Set(args.skipEndAudit ? args.checkedPhaseIds ?? [] : []);
+        const ids = pendingAuditPhaseIds(l.content).filter((id) => !justChecked.has(id));
+        let autoBlocked = args.reauditFailed === true;
+        if (ids.length > 0) {
+            const r = await batchAuditOrNull(batchArgs(cur, ids));
+            if (!r)
+                return cur;
+            cur = r.path;
+            if (r.rerun) {
+                queue(resumeCmd(cur));
+                return cur;
+            }
+            autoBlocked = autoBlocked || r.blocked.length > 0;
+        }
+        const after = loadPlan(cur, args.log);
+        if (after) {
+            const st = statusesFromItems(after.envelope.interaction.items, after.content.phases);
+            const auditFailed = autoBlocked
+                || unansweredFailures(after.content, st, [...ids, ...(args.checkedPhaseIds ?? [])]).length > 0;
+            // F25b — a step whose audit is still deferred ('pending': the check
+            // could not run) counts as built; the batch audit already said so.
+            const built = after.content.phases.every((q) => isPhaseSatisfiedForRun(st[q.id], q.audit));
+            const nextAfter = computeNextPhaseForRun(after.content.phases, st);
+            if (built && !nextAfter) {
+                args.log('', ...planCompletionLines(after.content.phases));
+                args.log(`Plan file: ${savedLocation(cur, args.cwd)}`);
+            }
+            else if (!built && auditFailed && !stopShown) {
+                // A failed check left unresolved (blocked, or no answer): say how to go on.
+                args.log(stoppedBanner('a step failed its independent check', resumeCmd(cur)));
+            }
+            else if (!built && !nextAfter && !stopShown) {
+                // Nothing left to run, but a step is blocked (marked blocked, or
+                // auto-blocked earlier) and the other steps finished: never end in
+                // silence. Name the blocked step(s) and how to go on.
+                const phases = after.content.phases;
+                const blocked = phases.filter((q) => st[q.id] === 'blocked');
+                const open = blocked.length > 0 ? blocked : phases.filter((q) => !isPhaseSatisfiedForRun(st[q.id], q.audit));
+                const names = open.map((q) => phaseDisplayTitle(q, phases)).join(', ');
+                args.log(stoppedBanner(`${names} ${open.length === 1 ? 'is' : 'are'} blocked; every other step it could run is done`, resumeCmd(cur)));
+            }
+        }
+        // The run is over: the next run starts with fresh fix counts.
+        if (!queued)
+            failedCheckFixes.clear();
+        return cur;
+    };
+    // Task 7 — phase-end helper report (all forced read-only inside plan steps).
     const subagentDispatches = args.subagentDispatches ?? getAndResetPlanPhaseSubagentDispatches();
     if (subagentDispatches > 0) {
-        args.log(chalk.dim(`[phase] ${args.executedPhaseId}: ${subagentDispatches} subagent dispatch(es) — read-only enforced`));
+        args.log(chalk.dim(`${titleOf(phase)}: ${subagentDispatches} read-only helper${subagentDispatches === 1 ? '' : 's'} used`));
     }
-    /* ── 0. deviation backstop (Task 10) ──────────────────────────────────────
-     * approval.ts raised the flag mid-turn: this phase declared writes:false
-     * but requested a write approval anyway — the write was DENIED without
-     * prompting; here the chain records why and stops. Design choice (per the
-     * task's simpler-path option): SKIP the audit — the phase didn't complete
-     * honestly and was deliberately stopped, so auditing it wastes a turn. The
-     * finishPlanResume-injected 'pending' audit is dropped in the same write
-     * (clearAudit) or the next resume would re-audit the blocked phase. Same
-     * read+reset pattern as the subagent counter — the flag never leaks into
-     * the next chain leg. Guarded-only by construction: approval.ts only ever
-     * raises it while isGuardedRunActive(). */
+    /* ── 0. deviation backstop (Task 10, unchanged semantics) ────────────────
+     * approval.ts raised the flag mid-turn: this step declared writes:false but
+     * requested a write approval anyway — the write was DENIED without
+     * prompting; here the chain records why and stops. The injected 'pending'
+     * audit is dropped in the same write (clearAudit): the step did not finish
+     * honestly, so there is nothing to check. */
     const deviationDetail = getAndResetPlanDeviation();
     if (deviationDetail) {
         path = await applyPhaseResolution(path, phase.id, {
@@ -95,295 +293,119 @@ export async function runPostPhaseChain(args) {
             clearAudit: true,
             log: args.log,
         });
-        args.log(formatFailure({ what: 'Plan deviation', object: `phase ${phase.id}`, detail: [deviationDetail] }).trimEnd(), stoppedBanner(`plan deviation — phase ${phase.id} blocked (undeclared write denied)`, resumeCmd(path)));
+        args.log(formatFailure({ what: 'Step went off plan', object: titleOf(phase), detail: ['it asked to write to SAP, but the plan says this step only reads — the write was refused'] }).trimEnd(), stoppedBanner(`${titleOf(phase)} stopped — it asked for a write the plan did not declare`, resumeCmd(path)));
         ringBell();
-        return path;
+        stopShown = true;
+        return endOfRun(path);
     }
-    /* ── 1. audit (only when unresolved-pending/infra, or forced) ─────────── */
-    // Off-switch: audits off skips the NORMAL post-phase audit (no injected
-    // pending exists to catch anyway). A forced re-audit still runs — a persisted
-    // pending/infra record from an earlier ON run must resolve regardless.
-    const auditState = phase.audit?.state;
-    const auditsOff = args.auditMode === 'off';
-    // audit-infra-continue (2026-07-09): 'infra_failed' is now RESOLVED and no
-    // longer auto-re-audited — an audit that could not run already let the chain
-    // continue, so it must not spontaneously re-run on a later pass. Only a
-    // persisted 'pending' (crash between phase-save and verdict-save) or an
-    // explicit forceAudit (hand-edit re-verification) triggers an audit here.
-    const needsAudit = args.forceAudit
-        || (!auditsOff && auditState === 'pending');
-    if (needsAudit) {
-        args.log('', chalk.dim(`[audit] independent audit of phase ${phase.id} — fresh context, judged against the tool-call evidence…`));
-        // Evidence lives with the session that EXECUTED the phase; on a re-audit
-        // in a fresh CLI session that id was recorded on the pending audit.
-        const evidenceSessionId = phase.audit?.sessionId ?? args.sessionId;
-        const auditFn = args.deps?.runPhaseAuditFn ?? runPhaseAudit;
-        let cost;
-        // D-B — window the evidence to THIS attempt only. Live post-phase audit:
-        // the repl threads the turn-start it captured (attemptStartedAt).
-        // RE-audit (review item 1): the OLD session's JSONL can hold MULTIPLE
-        // attempts (fail → rerun in the same process → die before verdict →
-        // resume re-audits), so an unwindowed re-audit re-creates the exact
-        // cross-attempt false-ordering on the standard recovery path — use the
-        // window finishPlanResume persisted on the audit record
-        // (audit.attemptStartedAt, carried through verdict writes). A legacy
-        // record without the field runs unwindowed (fail-open, no window claim
-        // is made to the auditor either — see buildAuditPrompt).
-        const sinceIso = args.attemptStartedAt ?? phase.audit?.attemptStartedAt;
-        // D-F item 4 — liveness. The audit is a single fresh-context model turn
-        // (10-40s) with no streaming into this chain, so the [audit] header sat
-        // silent. Reuse the house-style heartbeat (same primitive loop.ts uses),
-        // routed through args.log so it works under both Ink and classic.
-        // audit-timeout (2026-07-06): use the audit-specific schedule — the audit
-        // is a PROXY call (api.cspeach.dev), so the generic "check the VPN" 5m copy
-        // is the wrong diagnosis. runPhaseAudit now hard-caps each attempt at 120s,
-        // so this can never sit stuck forever. Attempt transitions are surfaced via
-        // onRetry below. Always stopped in finally.
-        // audit-lean FIX #2 — a LIVE token count threaded from the auditor's stream
-        // into the heartbeat suffix, so a stall (`· 0 tokens`) reads differently
-        // from slow-but-working progress. The suffix closure reads the latest value
-        // at each heartbeat tick; onProgress updates it as chunks arrive.
-        let auditTokens = 0;
-        const heartbeat = startThinkingHeartbeat({
-            thresholds: AUDIT_HEARTBEAT_THRESHOLDS,
-            emit: (line) => args.log(line),
-            suffix: () => ` · ${auditTokens.toLocaleString()} token${auditTokens === 1 ? '' : 's'}`,
-        });
-        let verdict;
-        try {
-            verdict = await auditFn({
-                envelope: loaded.envelope,
-                phaseId: phase.id,
-                sessionId: evidenceSessionId,
-                cwd: args.cwd,
-                ...(sinceIso ? { sinceIso } : {}),
-                onCost: (c) => { cost = c; },
-                // Best-effort: the heartbeat reads auditTokens at each tick.
-                onProgress: (n) => { auditTokens = n; },
-                // audit-timeout — an honest attempt-transition line when a prior
-                // attempt hit its deadline (or otherwise failed) and we retry in a
-                // fresh session. Keeps the timeline truthful against the 120s×3 ceiling.
-                onRetry: (r) => {
-                    const why = r.reason === 'timeout' ? 'previous attempt timed out'
-                        : r.reason === 'unparseable' ? 'previous attempt returned no verdict'
-                            : 'previous attempt errored';
-                    args.log(chalk.dim(`  [audit] attempt ${r.attempt} of ${r.totalAttempts} (${why})`));
-                },
-            });
-        }
-        finally {
-            heartbeat.stop();
+    /* ── 1. forced re-check (hand-edit re-verification) ──────────────────── */
+    if (args.forceAudit) {
+        const r = await batchAuditOrNull(batchArgs(path, [phase.id], true));
+        if (!r)
+            return path;
+        path = r.path;
+        if (r.rerun) {
+            queue(resumeCmd(path));
+            return path;
         }
-        if (cost)
-            renderAuditCost(args, cost);
-        // Fix-wave (item 10a) — a persisted 'failed' reaching a re-audit means
-        // the session died AT the failure menu (verdict written, resolution
-        // never was). A failed verdict then RE-CONFIRMS the same failure: hold
-        // the counter instead of incrementing, and re-render the menu — the
-        // developer must still get the re-run/waive/block choice they lost.
-        // Delta-review edge: an interleaved infra outage launders the same case
-        // — failed(1) → menu death → re-audit hits infra (the counter is carried
-        // onto infra_failed) → the NEXT re-audit's failed verdict would count as
-        // consecutive and silently force-block. A persisted infra_failed that
-        // CARRIES a failure counter is therefore also a reconfirmation: the
-        // menu was owed and never shown.
-        const reconfirmingFailed = auditState === 'failed'
-            || (auditState === 'infra_failed' && (phase.audit?.consecutiveFailures ?? 0) >= 1);
-        // Consecutive-failure decision happens BEFORE the write so the forced
-        // block lands in the SAME revision as the verdict.
-        const priorFailures = phase.audit?.consecutiveFailures ?? 0;
-        const countedFailures = reconfirmingFailed
-            ? Math.max(priorFailures, 1)
-            : priorFailures + 1;
-        const forceBlock = verdict.state === 'failed'
-            && countedFailures >= MAX_CONSECUTIVE_AUDIT_FAILURES;
-        const nowIso = new Date().toISOString();
-        // Only a real 'failed' verdict records a stop. 'infra_failed' no longer
-        // stops (audit-infra-continue) — like warn/pass it leaves no lastStop, so
-        // applyAuditResult clears any stale one (see its resolved-verdict branch).
-        const lastStop = verdict.state === 'failed'
-            ? { phaseId: phase.id, reason: 'audit-failed', detail: clampInfra(verdict.findings[0] ?? ''), at: nowIso }
-            : undefined;
-        // Confidence-tiered redesign (2026-07-08) — the GATE. A `warn` verdict is
-        // NON-BLOCKING: it persists LITERALLY (state:'warn', findings carried),
-        // clears the failure counter (a warn is not a failure), and the chain
-        // continues exactly like a pass — no menu, no lastStop, forceBlock can
-        // never fire on it (forceBlock keys off verdict.state === 'failed' above).
-        // fail / infra_failed / pass persistence is byte-unchanged.
-        path = await applyAuditResult(path, phase.id, {
-            state: verdict.state,
-            findings: verdict.findings,
-        }, {
-            lastStop,
-            ...(forceBlock ? { statusOverride: 'blocked' } : {}),
-            ...(reconfirmingFailed ? { reconfirmedFailure: true } : {}),
-            log: args.log,
-        });
-        chainWrote = true;
         loaded = loadPlan(path, args.log);
         if (!loaded)
             return path;
-        phase = loaded.content.phases.find((p) => p.id === args.executedPhaseId);
-        // D-E — the progress board renders HERE, AFTER the verdict lands, so the
-        // tally is audit-aware and never contradicts a later verdict. (finishPlanResume
-        // now prints only a neutral "audit pending…" line; the board it used to
-        // print counted the just-run phase as done because it erased the pending
-        // audit for display — a validated phase with a pending audit is NOT
-        // satisfied, so the pre-audit board read "2/3" for what was really "1/3".)
-        // Suppressed on mid-pass re-audit legs (runReauditPass renders once at the
-        // end via its final, unsuppressed leg).
-        if (!args.suppressOffer) {
-            const boardStatuses = statusesFromItems(loaded.envelope.interaction.items, loaded.content.phases);
-            args.log('', renderPlanTracker({
-                title: loaded.envelope.title,
-                version: loaded.envelope.version,
-                content: loaded.content,
-                statuses: boardStatuses,
-                currentId: null,
-                auditsOff,
-            }), '');
-        }
-        if (verdict.state === 'infra_failed') {
-            // audit-infra-continue (2026-07-09): the audit COULD NOT RUN — after the
-            // in-turn 3 attempts (runPhaseAudit's 120s×3 ceiling) the model call
-            // returned no output. That is an audit-INFRASTRUCTURE failure, not a
-            // finding against the phase, whose own exit gate (activation + ATC)
-            // already passed. So we do NOT hard-stop verified work: exactly like a
-            // warn/pass, render a LOUD, DISTINCT "could not run / NOT verified" note,
-            // keep the infra_failed state recorded (tracker keeps "! audit not run";
-            // the final summary lists it as unverified) and CONTINUE to the gate +
-            // offer below. isAuditResolved treats infra_failed as resolved, so
-            // dependants unlock and the failure menu is never shown.
-            renderAuditNotRun(args.log, phase.id, clampInfra(verdict.findings[0] ?? 'auditor infrastructure failure'), resumeCmd(path));
-        }
-        else if (verdict.state === 'failed') {
-            renderFindings(args.log, phase.id, verdict.findings);
-            if (forceBlock) {
-                args.log(formatFailure({ what: `Phase ${phase.id} failed its audit ${countedFailures} times in a row`, detail: ['marked blocked'] }).trimEnd(), stoppedBanner('two consecutive failed audits — phase blocked', resumeCmd(path)));
-                ringBell();
-                return path;
-            }
-            const select = args.deps?.selectFailureAction ?? defaultSelectFailureAction;
-            const action = await select({ phaseId: phase.id, findings: verdict.findings });
-            if (action === 'none') {
-                // D-C — fail CLOSED. 'none' is headless OR an interactive decline/cancel
-                // (Esc, no listener, or an unrecognised menu answer). The phase must NOT
-                // auto-re-run — a re-run is an explicit menu choice, never a default.
-                // Stop with the banner; resuming re-audits and re-offers the menu (the
-                // persisted 'failed' on a still-satisfied phase is re-caught by
-                // preparePlanResume's died-at-menu scan).
-                args.log(stoppedBanner(`audit failed for phase ${phase.id} — resolve interactively (re-run / waive / block)`, resumeCmd(path)));
-                ringBell();
-                return path;
-            }
-            if (action === 'blocked') {
-                path = await applyPhaseResolution(path, phase.id, {
-                    status: 'blocked',
-                    lastStop: { phaseId: phase.id, reason: 'audit-failed', detail: 'user marked the phase blocked after a failed audit', at: new Date().toISOString() },
-                    summary: `audit ${phase.id}: failed — user marked phase blocked`,
-                    log: args.log,
-                });
-                args.log(stoppedBanner(`phase ${phase.id} marked blocked after failed audit`, resumeCmd(path)));
-                ringBell();
-                return path;
-            }
-            if (action === 'rerun') {
-                // Status back to 'todo' — computeNextPhase re-picks it, and the flow
-                // ALWAYS audits an executed phase, so a re-run is re-audited by
-                // construction. The failed audit + counter stay on the phase until
-                // the re-run's finishPlanResume replaces them with 'pending'.
-                path = await applyPhaseResolution(path, phase.id, {
-                    status: 'todo',
-                    summary: `audit ${phase.id}: failed — user chose re-run (status → todo)`,
-                    log: args.log,
-                });
-                args.log(formatInfo(`Re-running phase ${phase.id} · it will be re-audited after execution.`).trimEnd());
-                args.queueDispatch(resumeCmd(path));
-                return path;
-            }
-            // action === 'waive'
-            const reasonRaw = (await args.prompt(`Waive reason for ${phase.id} (one line): `)).trim();
-            const reason = reasonRaw.length > 0 ? reasonRaw : 'waived by user (no reason given)';
-            // §10 Q2 — a light 2-choice category alongside the reason: was the audit
-            // WRONG (false-positive) or is the finding real-but-accepted
-            // (accepted-risk)? Persisted so the audit's FP rate is measurable.
-            // Headless / cancel → accepted-risk (never a false-positive unasserted).
-            const category = await (args.deps?.selectWaiveCategory ?? defaultSelectWaiveCategory)({ phaseId: phase.id });
-            path = await applyAuditResult(path, phase.id, { state: 'waived', waivedReason: reason, waiveCategory: category }, { log: args.log });
-            loaded = loadPlan(path, args.log);
-            if (!loaded)
-                return path;
-            phase = loaded.content.phases.find((p) => p.id === args.executedPhaseId);
-            args.log(paint('dim', `${getGlyphs().info} audit waived (${category}) for ${phase.id} — reason recorded in the envelope.`));
-        }
-        else if (verdict.state === 'warn') {
-            // Non-blocking tier: ALWAYS shown, concise (Open-Q decision — warns are
-            // never swallowed). The chain continues to the gate + offer below just
-            // like a pass; the notes are already recorded on phase.audit.findings.
-            renderWarnings(args.log, phase.id, verdict.findings);
-        }
-        else {
-            args.log(paint('ok', `${getGlyphs().done} audit passed · ${phase.id} verified against the evidence.`));
-        }
     }
-    /* ── 2. gate + offer ──────────────────────────────────────────────────── */
-    // Review I-2 — mid-pass re-audits stop after the verdict: the pass owner
-    // (runReauditPass) issues one offer at the end.
     if (args.suppressOffer)
         return path;
-    const statuses = statusesFromItems(loaded.envelope.interaction.items, loaded.content.phases);
-    const next = computeNextPhase(loaded.content.phases, statuses);
-    if (!next) {
-        // Terminal messages only when this chain changed something — otherwise
-        // finishPlanResume already printed the same conclusion (no duplicates).
-        if (chainWrote) {
-            if (loaded.content.phases.every((p) => isPhaseSatisfied(statuses[p.id], p.audit))) {
-                args.log(...planCompletionLines(loaded.content.phases));
+    /* ── 1b. failed-check stop card (spec §3.3 #3, §5) ──────────────────────
+     * The step that just ran ended blocked: its own check failed after its own
+     * fix-and-recheck. Only on the normal post-phase call — a step blocked by
+     * the independent check (re-audit pass / forced re-check) has its own menu. */
+    if (!args.checkedPhaseIds && !args.forceAudit) {
+        const st0 = statusesFromItems(loaded.envelope.interaction.items, loaded.content.phases);
+        const ran = loaded.content.phases.find((p) => p.id === args.executedPhaseId);
+        if (ran && st0[ran.id] === 'blocked') {
+            const title = titleOf(ran);
+            const key = `${loaded.envelope.id}:${ran.id}`;
+            const fixes = failedCheckFixes.get(key) ?? 0;
+            const select = args.deps?.selectFailedCheckAction ?? defaultSelectFailedCheckAction;
+            const action = await select({ phaseId: ran.id, title, facts: failedCheckFacts(ran), canFix: fixes < MAX_FAILED_CHECK_FIXES });
+            if (action === 'fix' && fixes < MAX_FAILED_CHECK_FIXES) {
+                failedCheckFixes.set(key, fixes + 1);
+                path = await applyPhaseResolution(path, ran.id, {
+                    status: 'todo', summary: `${ran.id}: blocked — user chose fix it now (status → todo)`, log: args.log,
+                });
+                args.log(formatInfo(`Running ${title} again`).trimEnd());
+                queue(resumeCmd(path));
+                return path;
+            }
+            let skipped = false;
+            if (action === 'skip') {
+                const reason = (await args.prompt(`Why skip ${title}? (one line): `)).trim();
+                if (reason.length > 0) {
+                    // Recorded as a waiver, like the audit waiver: never shown as done.
+                    path = await applyAuditResult(path, ran.id, { state: 'waived', waivedReason: reason, waiveCategory: 'accepted-risk' }, {
+                        statusOverride: 'validated-with-waiver', log: args.log,
+                    });
+                    args.log(chalk.dim(`${title} skipped — reason recorded in the plan file.`));
+                    skipped = true;
+                    const re = loadPlan(path, args.log);
+                    if (!re)
+                        return path;
+                    loaded = re;
+                }
             }
-            else {
-                const blocked = loaded.content.phases.filter((p) => statuses[p.id] === 'blocked').map((p) => p.id);
-                const unresolved = loaded.content.phases
-                    .filter((p) => isPhaseSatisfied(statuses[p.id]) && !isAuditResolved(p.audit))
-                    .map((p) => `${p.id} (audit ${p.audit?.state ?? 'unknown'})`);
-                const unresolvedNote = unresolved.length > 0 ? ` Unresolved audits: ${unresolved.join(', ')}.` : '';
-                args.log(`No eligible next phase. Blocked: ${blocked.join(', ') || '(none)'}.${unresolvedNote}`);
+            if (!skipped) {
+                // Stop: check the steps done, then say how to go on.
+                stopShown = true;
+                const out = await endOfRun(path);
+                if (!queued) {
+                    args.log(stoppedBanner(`${title} could not finish`, resumeCmd(out)));
+                    ringBell();
+                }
+                return out;
             }
         }
-        return path;
     }
+    /* ── 1c. the design added objects to the approved list (ask once) ───── */
+    await offerObjectListDelta({
+        content: loaded.content, planId: loaded.envelope.id, sessionId: args.sessionId, log: args.log,
+        ...(args.sapAlias ? { sapAlias: args.sapAlias } : {}),
+        ...(args.deps?.confirmCard ? { confirm: args.deps.confirmCard } : {}),
+    });
+    /* ── 2. gate ─────────────────────────────────────────────────────────── */
+    const statuses = statusesFromItems(loaded.envelope.interaction.items, loaded.content.phases);
+    const next = computeNextPhaseForRun(loaded.content.phases, statuses);
+    if (!next)
+        return endOfRun(path);
+    // After a batch check (re-audit pass / forced re-check) the gate looks at
+    // EVERY step that was checked: the first one left failed with no answer
+    // stops the run, whatever its place in the list. A user-chosen 'blocked'
+    // does not stop it. Otherwise the gate judges the step that just ran.
+    const checked = args.checkedPhaseIds ?? (args.forceAudit ? [phase.id] : null);
+    const stopStep = checked
+        ? unansweredFailures(loaded.content, statuses, checked)[0]
+        : loaded.content.phases.find((p) => p.id === args.executedPhaseId);
     const decision = decideNextPhaseGate({
         mode: args.mode,
-        nextPhase: { id: next.id, writes: next.writes },
-        prevPhaseAudit: phase?.audit,
+        nextPhase: { id: next.id, writes: next.writes, title: titleOf(next) },
+        prevPhaseAudit: stopStep?.audit,
     });
     if (decision.action === 'stop') {
-        path = await applyPhaseResolution(path, args.executedPhaseId, {
-            lastStop: {
-                phaseId: args.executedPhaseId,
-                reason: decision.stopReason === 'audit-infra' ? 'audit-infra' : 'audit-failed',
-                at: new Date().toISOString(),
-            },
-            summary: `guarded chain stopped: ${decision.stopReason}`,
-            log: args.log,
-        });
-        args.log(substitutePlanToken(decision.banner ?? stoppedBanner('guarded chain stopped', resumeCmd(path)), path));
-        ringBell();
-        return path;
-    }
-    if (decision.action === 'prompt' && decision.stopReason === 'write-phase') {
-        // The prompt IS the stop (guarded semantics) — record it crash-safe
-        // BEFORE blocking on the user, then render the banner + bell.
-        path = await applyPhaseResolution(path, args.executedPhaseId, {
-            lastStop: { phaseId: next.id, reason: 'write-phase', at: new Date().toISOString() },
-            summary: `guarded chain stopped: write-phase consent for ${next.id}`,
-            log: args.log,
-        });
-        args.log(substitutePlanToken(decision.banner ?? '', path));
+        const stopId = stopStep?.id ?? args.executedPhaseId;
+        // The batch check already recorded this stop with the finding text — keep
+        // it (no extra revision, no lost detail).
+        const recorded = loaded.content.lastStop;
+        if (!(recorded?.phaseId === stopId && recorded.reason === 'audit-failed')) {
+            path = await applyPhaseResolution(path, stopId, {
+                lastStop: { phaseId: stopId, reason: 'audit-failed', at: new Date().toISOString() },
+                summary: 'chain stopped: an earlier step failed its independent check',
+                log: args.log,
+            });
+        }
+        args.log(substitutePlanToken(decision.banner ?? stoppedBanner('stopped', resumeCmd(path)), path));
         ringBell();
+        stopShown = true;
+        return endOfRun(path);
     }
-    // 2026-10-02 — deploy is a chained step of a UI plan. Before ui.deploy the
-    // chain stops on the CLI-owned deploy card (deploy-card.ts), in step AND
-    // guarded mode, instead of the plain "run the next phase?" question.
+    /* ── 3. deploy card (always — spec §3.2) ─────────────────────────────── */
     if (isDeployPhase(next)) {
         const card = await askDeployCard({
             phases: loaded.content.phases,
@@ -400,91 +422,88 @@ export async function runPostPhaseChain(args) {
             },
         });
         if (card.outcome === 'blocked') {
-            args.log(`${next.id} cannot run here: ${card.reason}. Resume later with: ${resumeCmd(path)}`);
-            return path;
+            args.log(`${titleOf(next)} cannot run here: ${card.reason}. To continue later: open CSPeach in this folder and choose Continue.`);
+            return endOfRun(path);
         }
         if (card.outcome === 'no') {
-            args.log(`Not deployed — resume later with: ${resumeCmd(path)}`);
-            return path;
+            args.log('Not deployed. To continue later: open CSPeach in this folder and choose Continue.');
+            return endOfRun(path);
         }
-        args.queueDispatch(resumeCmd(path));
+        queue(resumeCmd(path));
         return path;
     }
-    await offerNextPhaseAutoRun({
-        outcome: {
-            savedPath: path,
-            resumeCommand: resumeCmd(path),
-            nextPhaseId: next.id,
-            nextDelegateTo: next.delegateTo,
-        },
+    /* ── 4. continue ─────────────────────────────────────────────────────── */
+    if (decision.action === 'auto') {
+        args.log(formatInfo(`Next: ${titleOf(next)}`).trimEnd());
+        queue(resumeCmd(path));
+        return path;
+    }
+    // step mode — one consent per step
+    const consented = await offerNextPhaseAutoRun({
+        outcome: { savedPath: path, resumeCommand: resumeCmd(path), nextPhaseId: next.id, nextDelegateTo: next.delegateTo, nextTitle: titleOf(next) },
         prompt: args.prompt,
         confirm: args.confirm,
-        queueDispatch: args.queueDispatch,
+        queueDispatch: queue,
         log: args.log,
         gate: decision,
     });
-    return path;
+    // The offer already said how to continue later: one continue line only.
+    if (!consented)
+        stopShown = true;
+    return consented ? path : endOfRun(path);
 }
 /**
- * Review I-2 — a re-audit PASS over multiple phases in ONE dispatch. Used by
- * the repl's re-audit-on-resume branch: usually a single pending/infra phase,
- * but a guarded hand-edit re-verification lists EVERY hand-edited satisfied
- * phase (design: "an audit pass over hand-edited statuses"). Each phase runs
- * the full chain with the offer suppressed except on the last; the saved path
- * feeds forward so every verdict lands on the latest revision.
- *
- * Abort semantics: when a chain iteration queues a dispatch (the user picked
- * re-run, or the final offer auto/consented), the pass stops — continuing to
- * audit while a dispatch is pending would race the re-entry. Any phases left
- * un-audited are named in a warning: hand-edit detection is history-author
- * based and the pass's own writes wash it away, so they will NOT be
- * re-detected automatically on the next resume. Stops (blocked/infra) do NOT
- * abort the pass — infra persists as `infra_failed` (re-caught by the
- * pending/infra scan next resume) and auditing the remaining phases is still
- * useful information.
+ * The resume path's audit pass: steps left 'pending' by a run that died, a
+ * 'failed' check whose menu was never answered, or (force) every step a hand
+ * edit invalidated. All listed steps are checked in one batch (quiet, titles
+ * only), then the run continues from where the plan stands — without a
+ * second end-of-run audit over the same steps.
  */
 export async function runReauditPass(args) {
-    // Task 10 review follow-up — a re-audit dispatch runs NO model turn, so a
-    // raised deviation flag here is never legitimate: it can only be stale
-    // residue from a chain leg that crashed before consuming it (possibly for
-    // a DIFFERENT plan in the same process). Discard it — mirroring the repl's
-    // phase-turn-start discard — or the deviation step inside runPostPhaseChain
-    // would wrongly block the re-audited phase and clearAudit would destroy
-    // the very 'pending' audit crash-safety depends on.
+    // 2026-10-04 — a re-audit leg that queues nothing ends the run (nothing to
+    // check, the check could not run, or the chain stopped): the plan
+    // object-list grant ends with it.
+    let queuedNext = false;
+    const tracked = { ...args, queueDispatch: (cmd) => { queuedNext = true; args.queueDispatch(cmd); } };
+    try {
+        return await reauditPass(tracked);
+    }
+    finally {
+        if (!queuedNext)
+            clearPlanGrant();
+    }
+}
+async function reauditPass(args) {
+    // A re-audit dispatch runs NO model turn, so a raised deviation flag here
+    // can only be stale residue from a chain leg that crashed before consuming
+    // it. Discard it, or the chain below would wrongly block a checked step.
     getAndResetPlanDeviation();
-    const { phaseIds, ...chainArgs } = args;
+    const { phaseIds, force, ...chainArgs } = args;
     if (phaseIds.length === 0)
         return args.savedPath;
-    if (phaseIds.length > 1) {
-        args.log(chalk.dim(`[audit] re-audit pass over ${phaseIds.length} phases: ${phaseIds.join(', ')}`));
-    }
-    let path = args.savedPath;
-    let queued = false;
-    const queueDispatch = (cmd) => { queued = true; args.queueDispatch(cmd); };
-    for (let i = 0; i < phaseIds.length; i++) {
-        const result = await runPostPhaseChain({
-            ...chainArgs,
-            savedPath: path,
-            executedPhaseId: phaseIds[i],
-            forceAudit: true,
-            suppressOffer: i < phaseIds.length - 1,
-            queueDispatch,
-        });
-        if (result)
-            path = result;
-        if (queued) {
-            const remaining = phaseIds.slice(i + 1);
-            if (remaining.length > 0) {
-                args.log(formatAttention({
-                    text: `${remaining.length} hand-edited phase(s) not re-audited yet`,
-                    fact: remaining.join(', '),
-                    next: 'they are not auto-detected after this write; verify them (or re-run their phases) once the queued dispatch completes',
-                }).trimEnd());
-            }
-            break;
-        }
+    const r = await batchAuditOrNull({
+        savedPath: args.savedPath, phaseIds, sessionId: args.sessionId, cwd: args.cwd,
+        ...(force ? { force: true } : {}), prompt: args.prompt, log: args.log,
+        ...(args.deps ? { deps: args.deps } : {}),
+    });
+    if (!r)
+        return args.savedPath;
+    if (r.rerun) {
+        const suffix = (args.modeFlag ? ` --${args.modeFlag}` : '')
+            + (args.auditFlag === 'off' ? ' --no-audit' : args.auditFlag === 'on' ? ' --audit' : '');
+        args.queueDispatch(buildResumeCommand(r.path) + suffix);
+        return r.path;
     }
-    return path;
+    const out = await runPostPhaseChain({
+        ...chainArgs,
+        savedPath: r.path,
+        executedPhaseId: phaseIds[phaseIds.length - 1],
+        subagentDispatches: 0,
+        skipEndAudit: true,
+        checkedPhaseIds: phaseIds,
+        ...(r.blocked.length > 0 ? { reauditFailed: true } : {}),
+    });
+    return out ?? r.path;
 }
 /* ── helpers ───────────────────────────────────────────────────────────── */
 function loadPlan(path, log) {
@@ -516,188 +535,12 @@ function ringBell() {
 }
 /** STOPPED banner in the plan-gate style, with the REAL resume command. */
 function stoppedBanner(reason, resumeCommand) {
-    return `\n■ STOPPED — ${reason}\n  Resume with: ${resumeCommand}\n`;
+    return `\n■ STOPPED — ${reason}\n  To continue: open CSPeach in this folder and choose Continue, or type ${resumeCommand}\n`;
 }
 /**
- * Task 3 left the gate banner's `@<plan>` placeholder literal (the pure
- * module doesn't know the saved path) — substitute the real basename here.
+ * The gate banner leaves its `@<plan>` placeholder literal (the pure module
+ * doesn't know the saved path) — substitute the real basename here.
  */
 export function substitutePlanToken(banner, savedPath) {
     return banner.replace(/@<plan>/g, `@${basename(savedPath)}`);
 }
-function clampInfra(msg) {
-    const flat = msg.replace(/\s+/g, ' ').trim();
-    return flat.length > INFRA_RENDER_CHARS ? flat.slice(0, INFRA_RENDER_CHARS - 1).trimEnd() + '…' : flat;
-}
-function renderFindings(log, phaseId, findings) {
-    log('', paint('bad', `${getGlyphs().failed} audit FAILED for phase ${phaseId}:`));
-    const shown = findings.length > 0 ? findings : ['(auditor returned no findings text)'];
-    shown.forEach((f, i) => log(`  ${i + 1}. ${f}`));
-}
-/**
- * Confidence-tiered redesign (2026-07-08) — the concise, always-shown render
- * for a NON-BLOCKING warn verdict. Mirrors renderFindings' shape but frames the
- * phase as passed-with-notes (the chain continues). Each finding is already
- * formatted "[W1] detail" by the auditor (plan-audit.renderFinding).
- */
-function renderWarnings(log, phaseId, findings) {
-    const n = findings.length;
-    log('', paint('warn', `${getGlyphs().attention} audit passed with ${n} note${n === 1 ? '' : 's'} for phase ${phaseId}:`));
-    const shown = n > 0 ? findings : ['(auditor returned a warn verdict with no note detail)'];
-    shown.forEach((f, i) => log(`  ${i + 1}. ${f}`));
-}
-/**
- * audit-infra-continue (2026-07-09) — the LOUD, always-shown note for an
- * audit that COULD NOT RUN. Distinct from warn's "passed with N notes": this
- * frames the phase as unverified-but-proceeding, is explicit that the audit
- * INFRASTRUCTURE failed (not the work), reassures that the phase's own exit
- * gate passed, and points at the off-switch for a persistent outage — a
- * pointer, not a forced prompt. Never swallowed (the chain continues, so
- * nothing else surfaces this).
- */
-function renderAuditNotRun(log, phaseId, reason, resumeCommand) {
-    log('', paint('warn', `${getGlyphs().attention} audit could not run for phase ${phaseId} (audit infrastructure failed after 3 attempts — the model call returned no output).`), paint('warn', '  This phase is NOT audit-verified; its own exit gate (activation + ATC) passed. Proceeding.'), paint('dim', `  reason: ${reason}`), paint('dim', `  If the auditor keeps failing, run with --no-audit (or set audit off in config) to stop retrying; resume as usual: ${resumeCommand}`));
-}
-/**
- * Shared menu surface for the audit-resolution selects. Mirrors
- * safety-confirm.ts: headless → no decision (fail-closed, nothing written);
- * Ink → confirm card via askConfirm (piece 2 §5); classic → inquirer select.
- */
-async function selectAuditAction(args) {
-    const { isHeadless, shouldUseInk } = await import('../renderer/tty.js');
-    if (isHeadless())
-        return 'none';
-    if (shouldUseInk()) {
-        // D-C — this card opens in the POST-PHASE chain. A leaked keystroke used
-        // to auto-select choice 1 ("Re-run phase") and silently re-run the
-        // phase. The card slot claims input focus (spinner stopped, status row
-        // paused, restored after), digits only move the cursor, and typed-ahead
-        // keys are dropped — so no stray key can pick a choice.
-        const { askConfirm } = await import('../ui/confirm-request.js');
-        const res = await askConfirm({
-            id: args.id,
-            tag: 'SAFETY CHECK',
-            title: args.question,
-            facts: args.facts,
-            choices: args.choices,
-            initial: 0,
-            footnote: 'Plan audit',
-        });
-        if (res.cancelled || res.value == null)
-            return 'none';
-        return coerceAction(res.value, args.choices);
-    }
-    const { select } = await import('@inquirer/prompts');
-    const { withInquirer } = await import('../repl/inquirer-guard.js');
-    const { inquirerTheme } = await import('../repl/inquirer-theme.js');
-    const picked = await withInquirer(() => select({
-        message: args.question,
-        theme: inquirerTheme,
-        choices: args.choices.map((c) => ({ value: c.value, name: c.label })),
-    }));
-    return coerceAction(picked, args.choices);
-}
-/**
- * D-C — fail CLOSED on any answer that is not one of this menu's own choice
- * values. `'' ?? 'none'` did NOT catch an empty-string answer (nullish
- * coalescing only guards null/undefined), so a stray/blank answer used to fall
- * through the runPostPhaseChain switch to a silent default. Anything the menu
- * did not explicitly offer maps to 'none' (stop, no auto-action).
- */
-function coerceAction(answer, choices) {
-    return choices.some((c) => c.value === answer) ? answer : 'none';
-}
-/** Production failed-verdict menu (see selectAuditAction for the surface).
- *  The findings are already printed above by renderFindings; the card
- *  repeats only the count and the first three. */
-export async function defaultSelectFailureAction(a) {
-    const n = a.findings.length;
-    const facts = [
-        `${n} ${n === 1 ? 'finding' : 'findings'}, listed above`,
-        // Findings are model text: display-clean them at the source (ANSI and
-        // control characters out, one line each), like the safety-card rows.
-        ...a.findings.slice(0, 3).map((f, i) => `${i + 1}. ${clean(f)}`),
-    ];
-    if (n > 3)
-        facts.push(`${getGlyphs().more} ${n - 3} more`);
-    return selectAuditAction({
-        id: 'plan-audit-failed',
-        question: `Audit failed for phase ${a.phaseId} — what now?`,
-        facts,
-        choices: [
-            { value: 'rerun', label: 'Re-run phase (re-audited after execution)' },
-            { value: 'waive', label: 'Waive audit (record a one-line reason)' },
-            { value: 'blocked', label: 'Mark phase blocked' },
-        ],
-    });
-}
-/**
- * §10 Q2 (audit-confidence redesign) — production waive-category menu. A LIGHT
- * 2-choice shown right after the waive-reason prompt so the audit's real
- * false-positive rate is measurable. Same surface as selectAuditAction, but
- * headless / cancel / stray answer → 'accepted-risk' (the CONSERVATIVE default:
- * a waive no human explicitly labelled a false-positive is recorded as
- * accepted-risk, so the measured FP rate never over-counts). Never hangs.
- */
-/** Exported for the piece-2 behaviour pins (plan-chain-focus-pin.test.ts). */
-export async function defaultSelectWaiveCategory(a) {
-    const { isHeadless, shouldUseInk } = await import('../renderer/tty.js');
-    if (isHeadless())
-        return 'accepted-risk';
-    const question = `Waiving ${a.phaseId} — why? (measures the audit's false-positive rate)`;
-    const choices = [
-        { value: 'accepted-risk', label: 'Accepted risk — the finding is real, I accept it and proceed' },
-        { value: 'false-positive', label: 'False positive — the audit was wrong, the work is actually fine' },
-    ];
-    const coerce = (answer) => choices.some((c) => c.value === answer) ? answer : 'accepted-risk';
-    if (shouldUseInk()) {
-        // Same input-focus discipline as selectAuditAction (askConfirm).
-        const { askConfirm } = await import('../ui/confirm-request.js');
-        const res = await askConfirm({
-            id: 'plan-waive-category',
-            tag: 'QUESTION',
-            title: question,
-            choices,
-            initial: 0,
-            footnote: 'Plan audit',
-        });
-        if (res.cancelled || res.value == null)
-            return 'accepted-risk';
-        return coerce(res.value);
-    }
-    const { select } = await import('@inquirer/prompts');
-    const { withInquirer } = await import('../repl/inquirer-guard.js');
-    const { inquirerTheme } = await import('../repl/inquirer-theme.js');
-    const picked = await withInquirer(() => select({
-        message: question,
-        theme: inquirerTheme,
-        choices: choices.map((c) => ({ value: c.value, name: c.label })),
-    }));
-    return coerce(picked);
-}
-/**
- * Audit spend surfaces twice: a dim line next to the turn footer (the
- * `audit` entry) and a labelled turn-0 line in the session cost JSONL —
- * the audit runs in its own isolated session, so without this its tokens
- * would be invisible to the user's cost trail. Best-effort, never throws.
- */
-function renderAuditCost(args, cost) {
-    try {
-        const tok = cost.tokens.input + cost.tokens.output;
-        const usd = computeCost(cost.model, cost.tokens);
-        // Credits mode: the audit turn's USD is our COGS. There is no per-audit
-        // credit figure to substitute (the ledger charges the turn, not this
-        // sub-step), so the dim line drops the cost fragment and keeps tokens —
-        // never a dollar on a managed customer's screen.
-        args.log(chalk.dim(creditsActive()
-            ? `[audit] ${tok.toLocaleString()} tok (${cost.model})`
-            : `[audit] ${tok.toLocaleString()} tok · ${formatCost(usd)} (${cost.model})`));
-        void appendCostLine(args.sessionId, {
-            ...buildEntry({ turn: 0, model: cost.model, tokens: cost.tokens, duration_ms: cost.durationMs }),
-            label: 'audit',
-        });
-    }
-    catch {
-        // observability only
-    }
-}