@mjasnikovs/pi-task 0.18.16 → 0.18.18

package/README.md

@@ -9,7 +9,7 @@
 [![npm](https://img.shields.io/npm/v/@mjasnikovs/pi-task?color=cb3837&logo=npm)](https://www.npmjs.com/package/@mjasnikovs/pi-task)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-blue.svg)](./LICENSE)
 [![pi extension](https://img.shields.io/badge/pi-extension-7c3aed)](https://www.npmjs.com/package/@earendil-works/pi-coding-agent)
-[![tests](https://img.shields.io/badge/tests-1617%20passing-3fb950)](#development)
+[![tests](https://img.shields.io/badge/tests-1637%20passing-3fb950)](#development)
 [![types](https://img.shields.io/badge/TypeScript-strict-3178c6?logo=typescript&logoColor=white)](./tsconfig.json)
 
 </div>
@@ -175,7 +175,7 @@ Tasks are persisted to `<cwd>/.pi-tasks/TASK_NNNN.md`. Add `.pi-tasks/` to your
 
 ```sh
 bun install
-bun test src/      # 1617 tests across 106 files
+bun test src/      # 1637 tests across 107 files
 bun run lint       # prettier + eslint + tsc --noEmit
 bun run build      # tsc → dist/
 ```

package/dist/task/auto-orchestrator.js

@@ -33,7 +33,8 @@ import { getConfig } from '../config/config.js';
 import { configureResearchRun } from '../workers/research-cache.js';
 import { CONTRACT_EXTRACT_PROMPT, parseContractLines, keepGroundedContracts, appendContracts } from './contracts.js';
 import { reconcileTitleSources } from './decompose-fidelity.js';
-import { REQUIREMENT_EXTRACT_PROMPT, COVERAGE_MAP_PROMPT, parseRequirementLines, keepGroundedRequirements, capRequirements, enumerateObligationPassages, uncoveredPassages, extractionRetryHint, parseCoverageMap, accountCoverage, appendCarriedRequirements, buildRequirementsLedger } from './requirements.js';
+import { REQUIREMENT_EXTRACT_PROMPT, COVERAGE_MAP_PROMPT, parseRequirementLines, keepGroundedRequirements, capRequirements, enumerateObligationPassages, uncoveredPassages, extractionRetryHint, parseCoverageMap, accountCoverage, isCrossCuttingRequirement, appendCarriedRequirements, buildRequirementsLedger } from './requirements.js';
+import { decideAdoption, groundedCoverage } from './coverage-loop.js';
 import { LAUNCH_EXTRACT_PROMPT, enumerateScriptCandidates, parseScriptLines, keepGroundedScripts, appendDeclaredScripts } from './launch-contract.js';
 // Hard ceiling on clarify questions per feature. The loop is open-ended (it stops
 // when the model emits NONE), but a model that never says NONE would otherwise
@@ -511,86 +512,124 @@ export async function planAuto(ctx, cwd, feature, deps) {
     // with the missing areas as a hint. Best-effort so a triage fault never blocks
     // planning (mirrors triageClarifyQuestion).
     //
-    // A retry is adopted whenever it is NON-DEGENERATE — not only when it is
-    // strictly longer. The retry was generated WITH the judge's missing areas in
-    // its prompt, so it is the better-informed list, and the NEXT round's judge
-    // (not raw length) decides whether the gaps actually closed. Length survives
-    // only as a collapse floor against the one-task flake this gate exists for.
-    // mx5 run 5 (live): the hinted retry ADDED the flagged test-suite task but came
-    // back 29 titles vs the original 30 — strictly-longer discarded it, round 2
-    // re-judged the same unchanged list, and the known-incomplete plan shipped
-    // with no warning.
-    let unresolvedMissing = null;
-    // The last per-requirement accounting (goal A): completeness is computed
-    // HOST-SIDE from it — a holistic "COMPLETE" alone can no longer pass a plan
-    // while grounded requirements sit unowned (run 11: milestone-parity satisfied
-    // the judge while §10 Testing had zero tasks). Null when no requirements were
-    // extracted or every mapping call faulted (⇒ old judge-only behavior).
-    let accounting = null;
-    for (let round = 0; round < MAX_COVERAGE_ROUNDS && planTitles.length > 0; round++) {
-        // Signal 1 — the holistic judge (kept as the belt; catches feature areas
-        // the requirement extraction itself missed). A fault yields no signal.
+    // Two hard-won invariants (mx5 run 12: a complete full-stack plan — 31
+    // requirements mapped, frontend pages present — was overwritten by a
+    // backend-only regeneration and shipped with only a toast, driven by 3 NEGATIVE
+    // requirements no task could own that kept the verdict INCOMPLETE forever):
+    //   • MONOTONIC replacement (coverage-loop.ts): a retry that DROPS a requirement
+    //     the current plan already owns is REJECTED, never adopted. Coverage can
+    //     only hold or grow across rounds — a worse regeneration can no longer
+    //     overwrite a better plan on the old `length*2` size floor alone.
+    //   • SHIP THE BEST, not the last: because adoption is monotone, the working
+    //     plan at exhaustion is the best-covered one seen, so it is what ships.
+    // Fix A rides in accountCoverage: an un-ownable prohibition/global-policy
+    // requirement is carried CROSS-CUTTING rather than fed back as a missing area,
+    // so it no longer forces the loop to regenerate at all. The monotonic rule is
+    // the hard backstop that holds even for un-ownable lines the classifier misses.
+    //
+    // Score one plan: the holistic judge (belt — catches areas the requirement
+    // extraction itself missed) plus, when requirements were extracted, the
+    // host-side per-requirement map (lever — every grounded requirement gets a
+    // falsifiable TASK/CROSS/NONE verdict). Best-effort: a fault degrades a signal,
+    // never blocks planning.
+    const scorePlan = async (titles) => {
         let verdict;
         try {
-            verdict = parseCoverageVerdict(await deps.runChild('decompose-coverage', '', DECOMPOSE_COVERAGE_PROMPT(featureForModel, clarifications, planTitles)));
+            verdict = parseCoverageVerdict(await deps.runChild('decompose-coverage', '', DECOMPOSE_COVERAGE_PROMPT(featureForModel, clarifications, titles)));
         }
         catch {
             verdict = null;
         }
         const verdictMissing = verdict?.kind === 'incomplete' ? verdict.missing : [];
-        // Signal 2 — the per-requirement map (the lever): every grounded
-        // requirement gets a falsifiable verdict (TASK n / CROSS-CUTTING / NONE);
-        // the host, not the model, decides what is uncovered. A fault keeps the
-        // previous round's accounting.
+        let acc = null;
+        // The monotonic guard's owned-set is grounded DETERMINISTICALLY in
+        // requirement↔title token overlap — NOT the coverage-map model's TASK
+        // numbers. Live (Qwen3.6-27B) the model over-credits ownership, mapping a
+        // "--json output" requirement to a generic "scaffold + argument parser"
+        // task, so a plan with no --json task still "owned" it and the drop guard
+        // went blind (treatment 1/5). Grounding the drop-signal in the titles the
+        // model can't fake takes it back to 5/5. The model map still drives Fix A's
+        // cross-cutting/unmapped accounting below (that only affects reprompt
+        // aggressiveness, which the monotonic guard now backstops).
+        const covered = groundedCoverage(reqEntries.map(e => e.quote), titles, isCrossCuttingRequirement);
         if (reqEntries.length > 0) {
             try {
-                const mapRaw = await deps.runChild('coverage-map', '', COVERAGE_MAP_PROMPT(reqEntries, planTitles));
-                accounting = accountCoverage(reqEntries, parseCoverageMap(mapRaw, reqEntries.length, planTitles.length));
-                logPlanDebug(cwd, `coverage-map round ${round + 1}: ${accounting.mapped.length} task-mapped, `
-                    + `${accounting.crossCutting.length} cross-cutting, `
-                    + `${accounting.unmapped.length} unmapped`);
+                const mappings = parseCoverageMap(await deps.runChild('coverage-map', '', COVERAGE_MAP_PROMPT(reqEntries, titles)), reqEntries.length, titles.length);
+                acc = accountCoverage(reqEntries, mappings);
+                logPlanDebug(cwd, `coverage-map (${titles.length} titles): ${acc.mapped.length} task-mapped, `
+                    + `${acc.crossCutting.length} cross-cutting, ${acc.unmapped.length} unmapped; `
+                    + `${covered.size} requirement(s) title-grounded`);
             }
             catch {
-                // mapping fault — keep whatever accounting an earlier round produced
+                // mapping fault — Fix A accounting degrades; the grounded owned-set
+                // above still guards against drops.
             }
         }
-        const unmappedQuotes = (accounting?.unmapped ?? []).map(e => `"${e.quote}"`);
-        const missing = [...verdictMissing, ...unmappedQuotes];
-        if (missing.length === 0) {
-            unresolvedMissing = null;
-            logPlanDebug(cwd, `decompose-coverage round ${round + 1}: `
-                + (verdict === null ? 'no judge verdict' : 'judge COMPLETE')
-                + (reqEntries.length > 0 ?
-                    ' and every grounded requirement is task-mapped or cross-cutting'
+        const missing = [...verdictMissing, ...(acc?.unmapped ?? []).map(e => `"${e.quote}"`)];
+        return {
+            plan: { titles, covered, missing },
+            accounting: acc,
+            suspect: isSuspectPlan(titles, featureForModel)
+        };
+    };
+    const hasRequirements = reqEntries.length > 0;
+    // `best` is both the plan the next round reprompts FROM and the plan that
+    // ships — kept identical because adoption is monotone (see coverage-loop.ts).
+    let best = await scorePlan(planTitles);
+    // The carried accounting (cross-cutting + unowned) for the plan that ships.
+    let accounting = best.accounting;
+    let round = 0;
+    for (;;) {
+        if (best.plan.titles.length === 0)
+            break;
+        if (best.plan.missing.length === 0) {
+            logPlanDebug(cwd, 'decompose-coverage: COMPLETE'
+                + (hasRequirements ?
+                    ' — every grounded requirement is task-mapped or cross-cutting'
                     : ' — accepting list'));
-            // A COMPLETE on a still-suspect plan is the judge's known live
-            // false-pass mode (bare verdict, indistinguishable from a real one).
-            // The plan still ships — the floor never rejects on count — but
-            // never silently: the user decides whether to trust it.
-            if (isSuspectPlan(planTitles, featureForModel)) {
-                ctx.ui.notify(`/task-auto: only ${planTitles.length} task(s) planned for a large spec`
+            // A COMPLETE on a still-suspect plan is the judge's known live false-pass
+            // mode (bare verdict, indistinguishable from a real one). The plan still
+            // ships — the floor never rejects on count — but never silently.
+            if (best.suspect) {
+                ctx.ui.notify(`/task-auto: only ${best.plan.titles.length} task(s) planned for a large spec`
                     + ' and the regeneration did not grow the list — review the plan before running.', 'warning');
             }
             break;
         }
-        unresolvedMissing = missing;
-        logPlanDebug(cwd, `decompose-coverage round ${round + 1}: INCOMPLETE — missing: `
-            + missing.join('; ').slice(0, 300));
-        const retryRaw = await deps.runChild('auto-decompose', 'read', prependHint(coverageRepromptHint(missing), decomposePrompt));
-        const retryTitles = parsePlan(retryRaw);
+        if (round >= MAX_COVERAGE_ROUNDS)
+            break;
+        round++;
+        logPlanDebug(cwd, `decompose-coverage round ${round}: INCOMPLETE — missing: `
+            + best.plan.missing.join('; ').slice(0, 300));
+        const retryTitles = parsePlan(await deps.runChild('auto-decompose', 'read', prependHint(coverageRepromptHint(best.plan.missing), decomposePrompt)));
         logPlanDebug(cwd, `decompose retry produced ${retryTitles.length} title(s)`);
-        if (retryTitles.length > 0 && retryTitles.length * 2 >= planTitles.length) {
-            planTitles = retryTitles;
+        const cand = await scorePlan(retryTitles);
+        const decision = decideAdoption(best.plan, cand.plan, hasRequirements);
+        if (decision.adopt) {
+            best = cand;
+            accounting = cand.accounting ?? accounting;
+            logPlanDebug(cwd, `decompose retry ADOPTED — ${decision.reason}`);
         }
         else {
-            logPlanDebug(cwd, `decompose retry discarded as degenerate (${retryTitles.length} vs ${planTitles.length} titles)`);
+            // Rejected: keep the better current plan. The loop re-checks it at the
+            // top (still incomplete ⇒ another bounded reprompt) but its coverage is
+            // never sacrificed to a worse regeneration.
+            logPlanDebug(cwd, `decompose retry REJECTED — ${decision.reason}`
+                + (decision.dropped.length > 0 ?
+                    ` [would drop: ${decision.dropped
+                        .map(i => `"${reqEntries[i].quote}"`)
+                        .join('; ')
+                        .slice(0, 200)}]`
+                    : ''));
         }
     }
-    // Rounds exhausted with the last judgment still INCOMPLETE: the plan ships (the
-    // gate is best-effort), but silently shipping a KNOWN-gapped plan is how mx5
-    // run 5 lost its whole test suite — tell the user what the judge last flagged.
+    planTitles = best.plan.titles;
+    // Exhausted still INCOMPLETE: the best plan ships (the gate is best-effort), but
+    // silently shipping a KNOWN-gapped plan is how mx5 run 5 lost its whole test
+    // suite — tell the user what is still uncovered.
+    const unresolvedMissing = best.plan.missing.length > 0 ? best.plan.missing : null;
     if (unresolvedMissing !== null) {
-        logPlanDebug(cwd, `decompose-coverage exhausted ${MAX_COVERAGE_ROUNDS} round(s) still INCOMPLETE — missing: `
+        logPlanDebug(cwd, `decompose-coverage exhausted ${round} round(s) still INCOMPLETE — missing: `
             + unresolvedMissing.join('; ').slice(0, 300));
         ctx.ui.notify(`/task-auto: plan may be missing coverage — ${unresolvedMissing.join('; ').slice(0, 200)} — review the plan before running.`, 'warning');
     }

package/dist/task/coverage-loop.d.ts

@@ -0,0 +1,92 @@
+/**
+ * coverage-loop — the MONOTONIC replacement rule for /task-auto's decompose
+ * coverage gate (mx5 run 12).
+ *
+ * The failure this closes: the coverage-retry loop regenerated the whole plan on
+ * every INCOMPLETE verdict, and adopted the regeneration on nothing but a size
+ * floor (`retry.length * 2 >= current.length`). A regeneration is a fresh
+ * stochastic roll of the ENTIRE plan, so one that DROPPED a previously-covered
+ * feature-area but kept the title count replaced the better plan anyway — and,
+ * because the loop shipped whatever the LAST round produced, the dropped area was
+ * gone with only a toast. Live: a complete full-stack plan (31 requirements
+ * mapped, frontend pages present) was overwritten by a backend-only one and
+ * shipped, driven by 3 NEGATIVE requirements no task could ever "own" that kept
+ * the verdict INCOMPLETE forever.
+ *
+ * The rule here makes replacement monotone: coverage can only hold or grow across
+ * rounds. A retry is adopted ONLY when it drops no requirement the current plan
+ * already owns (its owned-set is a superset). Because adoption is monotone, the
+ * working plan at exhaustion is the best-covered one seen — so "ship the working
+ * plan" is automatically "ship the best", never "ship the last".
+ *
+ * Spec-shape-agnostic: the only inputs are title counts and the set of
+ * requirement INDICES a task owns (from the host-side coverage map). No feature
+ * noun, no web-app assumption. A CLI, a data pipeline, a library, a refactor, a
+ * docs task all flow through the same integers.
+ */
+/** A scored plan candidate — the minimum the adoption rule needs. */
+export interface CoveragePlan {
+    titles: string[];
+    /**
+     * Requirement indices a task OWNS (a per-requirement `TASK n` verdict from the
+     * coverage map). Empty when the run extracted no requirements — then the rule
+     * degrades to the count-floor path below. Cross-cutting requirements are NOT
+     * here: they are carried into every task regardless of plan shape, so they
+     * cannot be "dropped" by a plan change and must not gate adoption.
+     */
+    covered: Set<number>;
+    /**
+     * Feature areas still uncovered (holistic-judge areas + unowned requirement
+     * quotes). Non-empty ⇒ the plan is incomplete and a retry is reprompted. Used
+     * as the regression signal on the no-requirements path.
+     */
+    missing: string[];
+}
+/**
+ * DETERMINISTIC owned-set for the monotonic guard — grounded in requirement↔title
+ * token overlap, NOT the coverage-map model's `TASK n` verdict.
+ *
+ * Why this exists (live A/B, Qwen3.6-27B, mx5-shaped CLI spec): the model
+ * over-credits ownership — it mapped a "--json output" requirement to a generic
+ * "scaffold + argument parser" task, so a plan with NO --json task still reported
+ * owning it. A guard that trusts those numbers is blind to the very drop it must
+ * catch (treatment held only 1/5 trials). Grounding coverage in whether a task
+ * TITLE actually shares a distinctive token with the requirement makes the
+ * drop-signal independent of the model's rubber-stamp (treatment → 5/5).
+ *
+ * A requirement is "covered" when some title shares a DISTINCTIVE token with it —
+ * distinctive meaning the token is not shared across more than half the ownable
+ * requirements. Without that corpus filter a common object-noun repeated in every
+ * requirement (e.g. "range" in a date-range library, present in parse/serialize/
+ * timezone alike) would connect a serialize-requirement to a timezone task and
+ * hide the drop. Cross-cutting requirements are excluded (carried into every task
+ * regardless of plan shape, so they can neither be owned nor dropped).
+ *
+ * Errs toward UNDER-counting coverage (a reworded title with no shared distinctive
+ * noun reads as uncovered), which only makes the guard MORE conservative — it
+ * never manufactures coverage that would hide a drop. Index-aligned with `quotes`.
+ */
+export declare function groundedCoverage(quotes: string[], titles: string[], isCrossCutting: (quote: string) => boolean): Set<number>;
+/** Requirement indices the current plan owns that the retry does NOT — the drops
+ *  that make a retry non-monotone. Empty ⇒ the retry is a superset (safe). */
+export declare function droppedCoverage(current: Set<number>, retry: Set<number>): number[];
+export interface AdoptionDecision {
+    adopt: boolean;
+    reason: string;
+    /** Owned-requirement indices the retry would drop (for the debug trail). */
+    dropped: number[];
+}
+/**
+ * Whether a coverage-retry should REPLACE the current plan.
+ *
+ *   1. Collapse floor (unchanged): an empty retry, or one under half the current
+ *      title count, is the one-task degenerate flake this gate exists for — reject.
+ *   2. WITH requirement signal: reject any retry that drops a requirement the
+ *      current plan already owns (non-superset owned-set). This is the monotone
+ *      guarantee; it holds regardless of how the un-ownable requirements were
+ *      classified, so it backstops the cross-cutting classifier completely.
+ *   3. WITHOUT requirement signal: fall back to the count floor, and additionally
+ *      refuse a retry that leaves MORE areas uncovered than the current plan — so
+ *      the no-requirements path also ships the best, not the last.
+ */
+export declare function decideAdoption(current: CoveragePlan, retry: CoveragePlan, hasRequirements: boolean): AdoptionDecision;

package/dist/task/coverage-loop.js

@@ -0,0 +1,162 @@
+/**
+ * coverage-loop — the MONOTONIC replacement rule for /task-auto's decompose
+ * coverage gate (mx5 run 12).
+ *
+ * The failure this closes: the coverage-retry loop regenerated the whole plan on
+ * every INCOMPLETE verdict, and adopted the regeneration on nothing but a size
+ * floor (`retry.length * 2 >= current.length`). A regeneration is a fresh
+ * stochastic roll of the ENTIRE plan, so one that DROPPED a previously-covered
+ * feature-area but kept the title count replaced the better plan anyway — and,
+ * because the loop shipped whatever the LAST round produced, the dropped area was
+ * gone with only a toast. Live: a complete full-stack plan (31 requirements
+ * mapped, frontend pages present) was overwritten by a backend-only one and
+ * shipped, driven by 3 NEGATIVE requirements no task could ever "own" that kept
+ * the verdict INCOMPLETE forever.
+ *
+ * The rule here makes replacement monotone: coverage can only hold or grow across
+ * rounds. A retry is adopted ONLY when it drops no requirement the current plan
+ * already owns (its owned-set is a superset). Because adoption is monotone, the
+ * working plan at exhaustion is the best-covered one seen — so "ship the working
+ * plan" is automatically "ship the best", never "ship the last".
+ *
+ * Spec-shape-agnostic: the only inputs are title counts and the set of
+ * requirement INDICES a task owns (from the host-side coverage map). No feature
+ * noun, no web-app assumption. A CLI, a data pipeline, a library, a refactor, a
+ * docs task all flow through the same integers.
+ */
+// Ubiquitous words that carry no coverage signal: they appear across most task
+// titles and requirement quotes, so overlap on them would falsely connect a
+// requirement to any plan. Stopped so grounding keys on the DISTINCTIVE nouns
+// (json, dead-letter, serialize, symlink…) that actually name a deliverable.
+// English function words + generic task verbs + generic project nouns — all
+// domain-agnostic (no mx5/web vocabulary).
+const COVERAGE_STOPWORDS = new Set([
+    // function words
+    'the', 'a', 'an', 'and', 'or', 'of', 'to', 'in', 'on', 'for', 'with', 'by', 'at', 'as', 'is',
+    'are', 'be', 'it', 'its', 'that', 'this', 'from', 'into', 'out', 'up', 'per', 'via', 'not', 'no',
+    'but', 'if', 'then', 'than', 'so', 'such', 'each', 'any', 'all', 'every', 'when', 'where', 'must',
+    'should', 'shall', 'may', 'can', 'will', 'end', 'new',
+    // generic task verbs
+    'add', 'implement', 'create', 'build', 'scaffold', 'setup', 'set', 'support', 'handle', 'apply',
+    'use', 'used', 'using', 'make', 'makes', 'made', 'enable', 'provide', 'ensure', 'allow', 'run',
+    'runs', 'get', 'gets', 'define', 'configure', 'init', 'update', 'manage',
+    // generic project nouns
+    'cli', 'tool', 'app', 'application', 'project', 'feature', 'task', 'tasks', 'user', 'users',
+    'mode', 'flag', 'flags', 'option', 'options', 'system', 'code', 'thing', 'things', 'work'
+]);
+/** Distinctive content tokens of a phrase: lowercased alphanumeric words ≥3 chars,
+ *  minus the ubiquitous stopwords. `--json` → `json`, `dead-letter` → `dead`,`letter`.
+ *  A single trailing `s` is stripped (len ≥4) so `scan`/`scans`, `file`/`files`,
+ *  `serialize`/`serializes` match — plain plural/3rd-person, no full stemmer. */
+function contentTokens(s) {
+    const out = new Set();
+    for (const raw of s.toLowerCase().split(/[^a-z0-9]+/)) {
+        if (raw.length < 3 || COVERAGE_STOPWORDS.has(raw))
+            continue;
+        const w = raw.length >= 4 && raw.endsWith('s') && !raw.endsWith('ss') ? raw.slice(0, -1) : raw;
+        out.add(w);
+    }
+    return out;
+}
+/**
+ * DETERMINISTIC owned-set for the monotonic guard — grounded in requirement↔title
+ * token overlap, NOT the coverage-map model's `TASK n` verdict.
+ *
+ * Why this exists (live A/B, Qwen3.6-27B, mx5-shaped CLI spec): the model
+ * over-credits ownership — it mapped a "--json output" requirement to a generic
+ * "scaffold + argument parser" task, so a plan with NO --json task still reported
+ * owning it. A guard that trusts those numbers is blind to the very drop it must
+ * catch (treatment held only 1/5 trials). Grounding coverage in whether a task
+ * TITLE actually shares a distinctive token with the requirement makes the
+ * drop-signal independent of the model's rubber-stamp (treatment → 5/5).
+ *
+ * A requirement is "covered" when some title shares a DISTINCTIVE token with it —
+ * distinctive meaning the token is not shared across more than half the ownable
+ * requirements. Without that corpus filter a common object-noun repeated in every
+ * requirement (e.g. "range" in a date-range library, present in parse/serialize/
+ * timezone alike) would connect a serialize-requirement to a timezone task and
+ * hide the drop. Cross-cutting requirements are excluded (carried into every task
+ * regardless of plan shape, so they can neither be owned nor dropped).
+ *
+ * Errs toward UNDER-counting coverage (a reworded title with no shared distinctive
+ * noun reads as uncovered), which only makes the guard MORE conservative — it
+ * never manufactures coverage that would hide a drop. Index-aligned with `quotes`.
+ */
+export function groundedCoverage(quotes, titles, isCrossCutting) {
+    const ownable = quotes
+        .map((q, i) => ({ q, i, tokens: contentTokens(q) }))
+        .filter(x => !isCrossCutting(x.q));
+    // Document frequency across the OWNABLE requirements: a token shared by more
+    // than half of them carries no discriminating signal for this run.
+    const df = new Map();
+    for (const r of ownable)
+        for (const w of r.tokens)
+            df.set(w, (df.get(w) ?? 0) + 1);
+    const maxDF = Math.max(1, Math.floor(ownable.length / 2));
+    const titleTokens = new Set();
+    for (const t of titles)
+        for (const w of contentTokens(t))
+            titleTokens.add(w);
+    const covered = new Set();
+    for (const r of ownable) {
+        for (const w of r.tokens) {
+            if ((df.get(w) ?? 0) <= maxDF && titleTokens.has(w)) {
+                covered.add(r.i);
+                break;
+            }
+        }
+    }
+    return covered;
+}
+/** Requirement indices the current plan owns that the retry does NOT — the drops
+ *  that make a retry non-monotone. Empty ⇒ the retry is a superset (safe). */
+export function droppedCoverage(current, retry) {
+    const out = [];
+    for (const i of current)
+        if (!retry.has(i))
+            out.push(i);
+    return out;
+}
+/**
+ * Whether a coverage-retry should REPLACE the current plan.
+ *
+ *   1. Collapse floor (unchanged): an empty retry, or one under half the current
+ *      title count, is the one-task degenerate flake this gate exists for — reject.
+ *   2. WITH requirement signal: reject any retry that drops a requirement the
+ *      current plan already owns (non-superset owned-set). This is the monotone
+ *      guarantee; it holds regardless of how the un-ownable requirements were
+ *      classified, so it backstops the cross-cutting classifier completely.
+ *   3. WITHOUT requirement signal: fall back to the count floor, and additionally
+ *      refuse a retry that leaves MORE areas uncovered than the current plan — so
+ *      the no-requirements path also ships the best, not the last.
+ */
+export function decideAdoption(current, retry, hasRequirements) {
+    if (retry.titles.length === 0)
+        return { adopt: false, reason: 'empty retry', dropped: [] };
+    if (retry.titles.length * 2 < current.titles.length) {
+        return {
+            adopt: false,
+            reason: `collapse floor (${retry.titles.length} vs ${current.titles.length} titles)`,
+            dropped: []
+        };
+    }
+    if (hasRequirements) {
+        const dropped = droppedCoverage(current.covered, retry.covered);
+        if (dropped.length > 0) {
+            return {
+                adopt: false,
+                reason: `would drop ${dropped.length} owned requirement(s)`,
+                dropped
+            };
+        }
+        return { adopt: true, reason: 'preserves owned coverage', dropped: [] };
+    }
+    if (retry.missing.length > current.missing.length) {
+        return {
+            adopt: false,
+            reason: `more uncovered areas (${retry.missing.length} vs ${current.missing.length})`,
+            dropped: []
+        };
+    }
+    return { adopt: true, reason: 'count floor met, no coverage regression', dropped: [] };
+}

package/dist/task/launch-contract.js

@@ -94,7 +94,10 @@ export function keepGroundedScripts(names, sourceDoc) {
 export function enumerateScriptCandidates(sourceDoc) {
     const out = [];
     const seen = new Set();
-    for (const para of sourceDoc.split(/\n[ \t]*\n/)) {
+    // Normalise CRLF/CR → LF first: a Windows-authored design would otherwise
+    // collapse into one paragraph (the split marker never matches `\r\n\r\n`),
+    // caps out on early package-name backticks, and drops the real scripts.
+    for (const para of sourceDoc.replace(/\r\n?/g, '\n').split(/\n[ \t]*\n/)) {
         if (!/\bscripts?\b/i.test(para))
             continue;
         for (const m of para.matchAll(/`([^`\n]+)`/g)) {

package/dist/task/render-check.d.ts

@@ -8,6 +8,16 @@ export type RenderOutcome = {
     outcome: 'skip';
     note: string;
 };
+/**
+ * The newest Playwright-cache Chromium, if any — the HEADLESS SHELL preferred over
+ * the full build. Found, never installed: the cache exists on any box that ever ran
+ * Playwright browsers (the mx5-class projects install it as their own test
+ * dependency). The headless shell is purpose-built for `--dump-dom` and returns
+ * promptly on a network URL where the full system chromium can stall under a
+ * virtual-time budget (validated live on this box: shell exits 0 in ~1s, full
+ * chromium times out at 30s on the same http:// URL).
+ */
+export declare function playwrightCachedChromium(): string | null;
 /**
  * A launchable Chrome-family binary, or null when this box has none: the explicit
  * CHROME_BIN override first, then the Playwright cache (headless shell — reliable

package/dist/task/render-check.js

@@ -52,7 +52,7 @@ function onPath(bin) {
  * virtual-time budget (validated live on this box: shell exits 0 in ~1s, full
  * chromium times out at 30s on the same http:// URL).
  */
-function playwrightCachedChromium() {
+export function playwrightCachedChromium() {
     const cache = process.env.PLAYWRIGHT_BROWSERS_PATH
         ?? (process.platform === 'darwin' ?
             path.join(os.homedir(), 'Library', 'Caches', 'ms-playwright')

package/dist/task/requirements.d.ts

@@ -48,6 +48,10 @@ export type ReqMapping = {
 } | {
     kind: 'none';
 };
+export declare function isCrossCuttingRequirement(quote: string): boolean;
+/** Requirement INDICES a task owns (a `TASK n` verdict), the monotonic-replacement
+ *  signal (coverage-loop.ts). Index-aligned with the requirements list. */
+export declare function ownedRequirementIndices(mappings: ReqMapping[]): Set<number>;
 /** Per-requirement coverage verdicts against a task list. Runs with --no-tools. */
 export declare const COVERAGE_MAP_PROMPT: (requirements: RequirementEntry[], titles: string[]) => string;
 /**

package/dist/task/requirements.js

@@ -109,7 +109,10 @@ export function capRequirements(entries, passages) {
  */
 export function enumerateObligationPassages(doc) {
     const out = [];
-    for (const para of doc.split(/\n[ \t]*\n/)) {
+    // Normalise CRLF/CR → LF: a Windows-authored spec would otherwise collapse
+    // into one giant paragraph (the split marker never matches `\r\n\r\n`) and
+    // the per-obligation recall floor would enumerate nothing.
+    for (const para of doc.replace(/\r\n?/g, '\n').split(/\n[ \t]*\n/)) {
         const p = para.trim();
         if (p.length < MIN_QUOTE_LENGTH)
             continue;
@@ -183,6 +186,47 @@ export const REQUIREMENT_EXTRACT_PROMPT = (feature, passages = []) => [
     'Output the REQUIREMENT: lines and nothing else. If the text states no requirements,',
     'output nothing.'
 ].join('\n');
+/**
+ * A requirement no single task can ever OWN: a PROHIBITION (it states what must
+ * NOT exist or happen — there is no task that "delivers" an absence) or a GLOBAL
+ * POLICY (a product-wide rule every slice obeys, not one slice's deliverable). The
+ * per-task coverage map maps both to NONE forever, so left in the `unmapped` set
+ * they kept the decompose loop's verdict INCOMPLETE and forced it to regenerate
+ * the whole plan endlessly (mx5 run 12: 3 un-ownable NEGATIVE requirements drove a
+ * complete full-stack plan to be overwritten by a backend-only one). These belong
+ * in the CROSS-CUTTING carry — injected verbatim into every task — never fed back
+ * as a missing area.
+ *
+ * Deterministic and precision-biased: it only reclassifies clear prohibitions and
+ * clearly product-global policies. It does NOT need to catch every un-ownable line
+ * — the monotonic replacement rule (coverage-loop.ts) is the hard backstop, so a
+ * miss here can at most cost one wasted regeneration, never a dropped area. Spec-
+ * shape/domain agnostic: pure phrasing, no feature nouns.
+ */
+const PROHIBITION_RE = /\b(?:must not|must never|shall not|should not|may not|cannot|can'?t|won'?t|do(?:es)? not|don'?t|doesn'?t|no|not|never|none|without|avoids?|prohibit(?:ed|s|ing)?|forbid(?:den|s)?|disallow(?:ed|s|ing)?|excludes?|excluded|neither|nor)\b/i;
+// Kept narrow on purpose — bare "all"/"every"/"any" appear in plenty of ownable
+// feature statements ("lists all photos"), so the global branch keys only on
+// scope words that name the WHOLE product and is additionally gated by a modal.
+const GLOBAL_SCOPE_RE = /\b(?:everywhere|throughout|always|global(?:ly)?|across (?:the|all|every)|site-?wide|app(?:lication)?-?wide|universal(?:ly)?|consistent(?:ly)?|entire (?:app|application|site|codebase|product|system|ui|project))\b/i;
+const MODAL_RE = /\b(?:must|shall|should|require[sd]?|required|needs? to|has to|have to)\b/i;
+export function isCrossCuttingRequirement(quote) {
+    const q = quote.trim();
+    if (PROHIBITION_RE.test(q))
+        return true;
+    if (GLOBAL_SCOPE_RE.test(q) && MODAL_RE.test(q))
+        return true;
+    return false;
+}
+/** Requirement INDICES a task owns (a `TASK n` verdict), the monotonic-replacement
+ *  signal (coverage-loop.ts). Index-aligned with the requirements list. */
+export function ownedRequirementIndices(mappings) {
+    const out = new Set();
+    mappings.forEach((m, i) => {
+        if (m.kind === 'task')
+            out.add(i);
+    });
+    return out;
+}
 /** Per-requirement coverage verdicts against a task list. Runs with --no-tools. */
 export const COVERAGE_MAP_PROMPT = (requirements, titles) => [
     'Below are the REQUIRED CONTENTS of a feature (verbatim quotes mechanically grounded',
@@ -238,6 +282,12 @@ export function accountCoverage(requirements, mappings) {
             acc.mapped.push({ req: requirements[i], task: m.task });
         else if (m.kind === 'cross')
             acc.crossCutting.push(requirements[i]);
+        // NONE — but a prohibition/global-policy requirement can never be OWNED by
+        // a task (it states an absence or a product-wide rule); the model maps it
+        // NONE every round, which used to force endless whole-plan regeneration.
+        // Carry it cross-cutting instead, so it stops driving the coverage loop.
+        else if (isCrossCuttingRequirement(requirements[i].quote))
+            acc.crossCutting.push(requirements[i]);
         else
             acc.unmapped.push(requirements[i]);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.18.16",
+    "version": "0.18.18",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",