@mjasnikovs/pi-task 0.28.1 → 0.28.3

package/dist/task/auto-orchestrator.d.ts

@@ -55,6 +55,25 @@ export interface AutoDeps extends GateDeps {
      * handling is skipped entirely (prior behavior).
      */
     pendingChanges?: (cwd: string) => Promise<string[]>;
+    /**
+     * Re-derive the still-open ACCEPT-debt ledger against the tree AS IT IS NOW
+     * (final-gate.ts `deriveOpenDebts`). Needed because the run's "N recorded
+     * verify-FAIL defect(s) are STILL unresolved" report used to be built from the
+     * FIRST gate result and the converged-autofix path then rebuilt the gate
+     * outcome as a bare `{ok, reason}` — so `openDebts` was not merely un-actioned,
+     * it was GONE from the value, and no code path could ever clear, re-check or
+     * act on it (mx5 run 18: four defects reported STILL OPEN at 14:58, one of them
+     * fixed by the autofix that converged at 15:03, and the report never moved).
+     *
+     * `staticOk` is the caller's PROOF about the current statics, never a guess:
+     * pass true only where the gate itself just passed them. Absent (tests) → the
+     * post-autofix re-check is skipped and the pre-autofix report stands, exactly
+     * the prior behavior.
+     */
+    recheckOpenDebts?: (cwd: string, staticOk: boolean) => Promise<{
+        openDebts: AcceptDebt[];
+        debtNote?: string;
+    }>;
 }
 /**
  * Expand any @file references in the feature text by appending each referenced

package/dist/task/auto-orchestrator.js

@@ -33,7 +33,7 @@ import { getParentContextWindow, resolveContextUsage } from './context-usage.js'
 import { buildGateDeps, collectTreeChanges } from './gate-deps.js';
 import { runGatesForTask } from './task-gates.js';
 import { gitUnmergedPaths, gitStashRef } from './auto-commit.js';
-import { runFinalIntegrationGate } from './final-gate.js';
+import { runFinalIntegrationGate, deriveOpenDebts } from './final-gate.js';
 import { describeDebt, recordFinalGateUnobservedDebt } from './accept-debt.js';
 import { applyDemotions, isNonProgress, normalizeFailureDetail, rankedFirstFailure, unobservedDebtReason } from './final-gate-progress.js';
 import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE, STRANDED_FIX_COMMIT, strandedFixNote } from './final-gate-fix.js';
@@ -1103,7 +1103,11 @@ function defaultDeps(ctx, cwd, signal, title) {
         pendingChanges: async (cwd2) => {
             const changes = await collectTreeChanges(cwd2, signal);
             return [...changes.modified, ...changes.added, ...changes.deleted].sort();
-        }
+        },
+        // Re-derive the debt ledger against the FINAL tree after a converged
+        // autofix (nexttask 6). Only ever reached from inside the gate's own
+        // resolution loop, so it needs no `verify work` switch of its own.
+        recheckOpenDebts: (cwd2, staticOk) => deriveOpenDebts(cwd2, staticOk)
     };
 }
 // ─── Loop ────────────────────────────────────────────────────────────────────
@@ -1222,12 +1226,79 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                     // gate moment — on PASS or FAIL — so a run never completes silently
                     // carrying an accepted defect. Informational: the per-task ACCEPT was
                     // already a human decision, so this reports, it does not re-fail.
-                    if (fin.openDebts && fin.openDebts.length > 0) {
-                        for (const d of fin.openDebts) {
+                    const debtKey = (d) => `${d.taskId}\t${d.reason}`;
+                    const surfaceOpenDebts = async (debts) => {
+                        if (debts.length === 0)
+                            return;
+                        for (const d of debts) {
                             await recGate(`defect STILL OPEN — ${d.taskId || '(unknown task)'}: ${describeDebt(d)}: ${d.reason.slice(0, 240)}${d.conflict ? ` [CONFLICTING CLAIM — ${d.conflict}]` : ''}`);
                         }
-                        active.ui.notify(`${id}: ${fin.openDebts.length} recorded verify-FAIL defect(s) are STILL unresolved at run end — see the gate trail.`, 'warning');
-                    }
+                        active.ui.notify(`${id}: ${debts.length} recorded verify-FAIL defect(s) are STILL unresolved at run end — see the gate trail.`, 'warning');
+                    };
+                    // What was REPORTED, so a post-autofix re-derivation can be
+                    // compared against it rather than blindly re-printed.
+                    let reportedDebts = fin.openDebts ?? [];
+                    await surfaceOpenDebts(reportedDebts);
+                    /**
+                     * nexttask 6 (mx5 run 18). The lines above are emitted from the
+                     * FIRST gate result; the converged-autofix paths below used to
+                     * rebuild `fin` as `{ok, reason}`, so `openDebts` did not survive
+                     * the fix pass — the run's last word on its own defects was a
+                     * snapshot of a tree that no longer existed, and no code path
+                     * could clear, re-check or act on it. Re-derive here, against the
+                     * tree the run actually ends with, and correct the record.
+                     *
+                     * FP-safe by inheritance: `deriveOpenDebts` auto-closes only what
+                     * a deterministic check can stand behind (a static-class debt when
+                     * the statics provably pass, a cross-task-deletion whose file is
+                     * back). Anything model-judged or behavioral STAYS OPEN —
+                     * `inv-no-false-clear`. `staticOk` is therefore only ever passed
+                     * true where the gate itself just passed the statics.
+                     */
+                    const reconcileDebts = async (staticOk) => {
+                        if (!deps.recheckOpenDebts)
+                            return;
+                        let fresh;
+                        try {
+                            fresh = await deps.recheckOpenDebts(cwd, staticOk);
+                        }
+                        catch {
+                            // A ledger read fault is inconclusive: say nothing rather
+                            // than imply the defects cleared.
+                            return;
+                        }
+                        fin = {
+                            ...fin,
+                            openDebts: fresh.openDebts,
+                            ...(fresh.debtNote ? { debtNote: fresh.debtNote } : {})
+                        };
+                        // Identity is (task, origin, reason), but a RESOLUTION claim
+                        // needs more than a key miss: a ledger entry whose TEXT changed
+                        // is the same defect re-recorded, never a fix. So a debt counts
+                        // as closed only when nothing for that (task, origin) survives.
+                        const slot = (d) => `${d.taskId}\t${d.origin ?? ''}`;
+                        const before = new Set(reportedDebts.map(debtKey));
+                        const after = new Set(fresh.openDebts.map(debtKey));
+                        const beforeSlots = new Set(reportedDebts.map(slot));
+                        const afterSlots = new Set(fresh.openDebts.map(slot));
+                        const closed = reportedDebts.filter(d => !after.has(debtKey(d)) && !afterSlots.has(slot(d)));
+                        const added = fresh.openDebts.filter(d => !before.has(debtKey(d)) && !beforeSlots.has(slot(d)));
+                        if (closed.length === 0 && added.length === 0) {
+                            if (reportedDebts.length > 0) {
+                                await recGate(`defect re-check after autofix: all ${reportedDebts.length} defect(s) `
+                                    + 'above re-derived against the FINAL tree and still open');
+                            }
+                            return;
+                        }
+                        for (const d of closed) {
+                            await recGate(`defect RESOLVED by the final-gate autofix — ${d.taskId || '(unknown task)'}: `
+                                + `${d.reason.slice(0, 240)}`);
+                        }
+                        await surfaceOpenDebts(added);
+                        reportedDebts = fresh.openDebts;
+                        await recGate(`defect re-check after autofix: ${closed.length} resolved, `
+                            + `${fresh.openDebts.length} still open (re-derived against the FINAL tree)`);
+                    };
                     // Resolution loop: Leave-failed (recommended) / Autofix (bounded,
                     // model-driven fix pass + gate re-run — run 7's gap: the picker
                     // had NO automated fix path) / Accept. The user always decides;
@@ -1371,6 +1442,9 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                                 await recGate(`final-gate: autofix ${fix.unobserved ? 'ended UNOBSERVED' : 'converged'} — ${fix.reason.slice(0, 200)}`);
                                 active.ui.notify(`${id}: final integration gate ${fix.unobserved ? 'is UNOBSERVED' : 'PASSES'} after autofix — ${fix.reason.slice(0, 140)}`, fix.unobserved ? 'warning' : 'info');
                                 fin = { ok: true, reason: fix.reason };
+                                // The gate itself just passed, statics included, so
+                                // `staticOk` here is proof rather than assumption.
+                                await reconcileDebts(true);
                                 break;
                             }
                             await recGate(`final-gate: autofix attempt ${fixAttempts} failed — ${fix.reason.slice(0, 200)}`);
@@ -1434,6 +1508,12 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                                     await recGate(`final-gate: ${converged}`);
                                     active.ui.notify(`${id}: final integration gate converged — ${converged}.`, 'warning');
                                     fin = { ok: true, reason: converged };
+                                    // Converged on the REMAINING checks only: one or
+                                    // more were DEMOTED as unfalsifiable here, and the
+                                    // statics may be among them. No proof ⇒ pass false,
+                                    // so nothing static-class can auto-close on this
+                                    // door (inv-no-false-clear).
+                                    await reconcileDebts(false);
                                     break;
                                 }
                             }

package/dist/task/final-gate.d.ts

@@ -446,6 +446,30 @@ export declare function bootSkipVerdict(args: {
     expectServer: boolean;
 }): string | null;
 export { taskThatIntroduced };
+/**
+ * ACCEPT-debt re-check (mx5 run 4 B3 / run 8 TASK_0012): read the ledger of tasks
+ * the user accepted despite a verify-FAIL and re-check each against the CURRENT
+ * tree. A static-class debt whose statics now pass is provably RESOLVED (a later
+ * task fixed it) and pruned from the ledger; every other debt cannot be proven
+ * resolved deterministically, so it stays OPEN and is surfaced — a run may not
+ * complete silently carrying an accepted defect. FP-safe by construction (see
+ * accept-debt.ts). Best-effort: a ledger read/write failure must never break the
+ * caller.
+ *
+ * FACTORED OUT of runFinalIntegrationGate (nexttask 6): the derivation has to be
+ * runnable at a SECOND moment — after a converged final-gate autofix, where the
+ * orchestrator used to rebuild its gate outcome as a bare `{ok, reason}` and drop
+ * `openDebts` entirely. The report a run ends on has to be derived from the tree
+ * the run ends with, not from the tree as it was before the fix pass.
+ *
+ * `staticOk` is the caller's claim about the CURRENT statics, and it is the only
+ * thing that can auto-close a static-class debt — so a caller that does not know
+ * must pass `false` (unprovable ⇒ stays open), never a guess.
+ */
+export declare function deriveOpenDebts(cwd: string, staticOk: boolean): Promise<{
+    openDebts: AcceptDebt[];
+    debtNote?: string;
+}>;
 /**
  * Run the final gate: static analysis first, then the lockfile consistency
  * checks, then the discovered integration commands, then one boot exercise of

package/dist/task/final-gate.js

@@ -1132,6 +1132,44 @@ async function recoverOrphanPort(cwd, boot, first, bootGraceMs, deps, expectServ
 // PROMPT 2 extracted it for the cross-task deletion guards); re-exported so
 // existing importers keep working.
 export { taskThatIntroduced };
+/**
+ * ACCEPT-debt re-check (mx5 run 4 B3 / run 8 TASK_0012): read the ledger of tasks
+ * the user accepted despite a verify-FAIL and re-check each against the CURRENT
+ * tree. A static-class debt whose statics now pass is provably RESOLVED (a later
+ * task fixed it) and pruned from the ledger; every other debt cannot be proven
+ * resolved deterministically, so it stays OPEN and is surfaced — a run may not
+ * complete silently carrying an accepted defect. FP-safe by construction (see
+ * accept-debt.ts). Best-effort: a ledger read/write failure must never break the
+ * caller.
+ *
+ * FACTORED OUT of runFinalIntegrationGate (nexttask 6): the derivation has to be
+ * runnable at a SECOND moment — after a converged final-gate autofix, where the
+ * orchestrator used to rebuild its gate outcome as a bare `{ok, reason}` and drop
+ * `openDebts` entirely. The report a run ends on has to be derived from the tree
+ * the run ends with, not from the tree as it was before the fix pass.
+ *
+ * `staticOk` is the caller's claim about the CURRENT statics, and it is the only
+ * thing that can auto-close a static-class debt — so a caller that does not know
+ * must pass `false` (unprovable ⇒ stays open), never a guess.
+ */
+export async function deriveOpenDebts(cwd, staticOk) {
+    const { open: openRaw, resolved } = recheckAcceptDebts(await readAcceptDebts(cwd), {
+        staticOk,
+        // Cross-task-deletion debts auto-close iff the deleted file is back in the
+        // tree — a deterministic existence check, corroborating the per-file
+        // provenance the record already carries.
+        fileExists: rel => existsSync(path.join(cwd, rel))
+    });
+    if (resolved.length > 0)
+        await writeAcceptDebts(cwd, openRaw);
+    // Conflicting-claim annotation (mx5 run 11): an existence-as-failure debt whose
+    // named file is another task's committed deliverable is a plan defect — surface
+    // the contradiction with the debt so nobody (human or child) treats the claim as
+    // a deletion instruction. Pure git-history lookup; degrades to no annotation.
+    const openDebts = annotateDebtConflicts(openRaw, p => taskThatIntroduced(cwd, p));
+    const debtNote = buildAcceptDebtNote(openDebts);
+    return { openDebts, ...(debtNote ? { debtNote } : {}) };
+}
 /**
  * Run the final gate: static analysis first, then the lockfile consistency
  * checks, then the discovered integration commands, then one boot exercise of
@@ -1150,29 +1188,7 @@ export { taskThatIntroduced };
  */
 export async function runFinalIntegrationGate(cwd, timeoutMs = 900_000, bootGraceMs = 10_000, bootDeps = {}, planText) {
     const stat = runRepoHealthCheck(cwd);
-    // ACCEPT-debt re-check (mx5 run 4 B3 / run 8 TASK_0012): read the ledger of tasks
-    // the user accepted despite a verify-FAIL and re-check each against the current
-    // tree. A static-class debt whose statics now pass is provably RESOLVED (a later
-    // task fixed it) and pruned; every other debt cannot be proven resolved
-    // deterministically, so it stays OPEN and is surfaced in this gate's report — a
-    // run may not complete silently carrying an accepted defect. FP-safe by
-    // construction (see accept-debt.ts). Best-effort: a ledger read/write failure
-    // must never break the gate.
-    const { open: openRaw, resolved } = recheckAcceptDebts(await readAcceptDebts(cwd), {
-        staticOk: stat.ok,
-        // Cross-task-deletion debts auto-close iff the deleted file is back in the
-        // tree — a deterministic existence check, corroborating the per-file
-        // provenance the record already carries.
-        fileExists: rel => existsSync(path.join(cwd, rel))
-    });
-    if (resolved.length > 0)
-        await writeAcceptDebts(cwd, openRaw);
-    // Conflicting-claim annotation (mx5 run 11): an existence-as-failure debt whose
-    // named file is another task's committed deliverable is a plan defect — surface
-    // the contradiction with the debt so nobody (human or child) treats the claim as
-    // a deletion instruction. Pure git-history lookup; degrades to no annotation.
-    const openDebts = annotateDebtConflicts(openRaw, p => taskThatIntroduced(cwd, p));
-    const debtNote = buildAcceptDebtNote(openDebts);
+    const { openDebts, debtNote } = await deriveOpenDebts(cwd, stat.ok);
     // The debt note rides in its OWN field: `reason` stays the mechanical failure
     // because it seeds the autofix child's prompt (see FinalGateOutcome.reason —
     // run 11's fix child executed a recorded claim as an instruction).

package/dist/task/owned-freeze-conflict.d.ts

@@ -0,0 +1,95 @@
+import type { OwnedRequirement } from './requirements.js';
+/** A freeze whose scope is a CATEGORY of files, with the paths it carves out. */
+export interface CategoryFreeze {
+    /** The freeze line, verbatim. */
+    constraint: string;
+    /** The paths the category exempts — everything else is frozen. */
+    exempt: string[];
+}
+/**
+ * One unsatisfiable pair, keyed by the REQUIREMENT rather than by the path.
+ *
+ * Grouping matters for the resolution's size. mx5 run 18's TASK_0023 carries
+ * two owned build-contract clauses that between them name three frozen paths;
+ * per-path findings would demand three separate ownership grants (and the same
+ * pair twice over, because that spec states its freeze in CONSTRAINTS and again
+ * in ACCEPTANCE). Per requirement, the rewrite is told which files that one
+ * obligation names and grants only what it needs — which is what keeps
+ * `inv-no-spec-inflation` satisfiable at all.
+ */
+export interface OwnedFreezeConflict {
+    /** The owned requirement line, verbatim. */
+    requirement: string;
+    /** The files it names that this freeze covers. */
+    paths: string[];
+    /** The category freeze line, verbatim. */
+    constraint: string;
+    /** The paths that freeze exempts (the resolution has to widen this, or
+     *  move the requirement to a task whose scope already includes the file). */
+    exempt: string[];
+}
+/**
+ * Backtick-quoted path-shaped tokens in a text, INCLUDING the ones embedded in
+ * a backticked command (`bun run --watch src/server/index.ts` is one backtick
+ * span; the path inside it is what the requirement is about). Route literals
+ * (`/api`) and bare directories survive this filter — the caller decides what
+ * to do with them; `findOwnedFreezeConflicts` keeps only files.
+ */
+export declare function pathTokensIn(text: string): string[];
+/**
+ * Every CATEGORY freeze in the spec: a modification ban (or its passive/only-
+ * form equivalent) scoped to a class of files rather than to named paths. A
+ * freeze that only names paths is `frozen-conflict.ts`'s job, not this one.
+ */
+export declare function findCategoryFreezes(spec: string | null | undefined): CategoryFreeze[];
+/**
+ * The spec lines carrying an AUTHORITATIVE owned requirement: the machine-
+ * stamped ones, plus — when the run's ledger is supplied — any line carrying an
+ * owned quote verbatim (compose folding the quote in itself leaves no stamp).
+ */
+export declare function ownedRequirementLines(spec: string | null | undefined, owned?: OwnedRequirement[]): string[];
+export interface OwnedFreezeOptions {
+    /** The run's owned-requirement ledger, so belt-folded (unstamped) quotes
+     *  count too. Omitted → stamped lines only. */
+    owned?: OwnedRequirement[];
+    /**
+     * Is this repo-relative token an existing SOURCE file of the tree the spec
+     * will run against? Supplied by the caller (compose knows its cwd; the
+     * measured implementation is "tracked by git" — see `trackedSourceOracle`).
+     *
+     * Two false-positive classes die here, both observed at STEP 0 on the real
+     * TASK_0023 spec: route literals and build outputs (`/api`, `dist/`,
+     * `dist/app.css` — named by the very clause that is the true positive, but
+     * not files anyone can edit), and files a task is about to CREATE, which a
+     * freeze on the existing tree does not block. Omitted → every path-shaped
+     * token counts (the broad reading, reported alongside at STEP 0).
+     */
+    isSource?: (p: string) => boolean;
+}
+/**
+ * Every unsatisfiable pair in the composed spec: an AUTHORITATIVE owned
+ * requirement naming a file that a CATEGORY freeze in the same spec forbids
+ * touching. Deterministic, pure text (plus the caller's existence oracle).
+ * Empty when the spec froze no category or carries no owned requirement — the
+ * ordinary single-`/task` case degrades to a no-op.
+ */
+export declare function findOwnedFreezeConflicts(spec: string | null | undefined, opts?: OwnedFreezeOptions): OwnedFreezeConflict[];
+/**
+ * The measured `isSource` oracle: a token counts only when git tracks it in
+ * `cwd`. Tracked ⇒ it exists, it is not a build output, and it is not ignored —
+ * exactly the "source file" the category freezes talk about. `git` missing or
+ * the tree not a repo ⇒ every token counts (the broad reading), so the detector
+ * degrades toward firing rather than toward silent blindness.
+ */
+export declare function trackedSourceOracle(lsFiles: (p: string) => {
+    stdout: string;
+    exitCode: number;
+}): (p: string) => boolean;
+/**
+ * The forced critique-rewrite defect text, in the shape the existing four
+ * families use: MANDATORY, self-contained, naming the exact resolutions. Prose
+ * surrender and silently dropping the requirement are called out as
+ * non-resolutions because narrowing the clause is precisely what run 16 did and
+ * freezing its file is precisely what run 18 did.
+ */
+export declare function ownedFreezeConflictProbeText(conflicts: OwnedFreezeConflict[]): string;

package/dist/task/owned-freeze-conflict.js

@@ -0,0 +1,359 @@
+/**
+ * owned-freeze-conflict — the FIFTH unsatisfiable-pair family (nexttask 7):
+ * an AUTHORITATIVE owned requirement whose file falls inside a CATEGORY freeze
+ * written by the same spec.
+ *
+ * WHY frozen-conflict.ts does not see it (mx5 run 18, TASK_0023). The owned
+ * channel worked: `.pi-tasks/requirements-owned.md` carried the design clause
+ * "**Server:** `bun run --watch src/server/index.ts` — serves `/api` + static
+ * `dist/`." and the composed spec carried it verbatim under CONSTRAINTS, marked
+ * AUTHORITATIVE. The same CONSTRAINTS block then said "Do not modify
+ * `docker-compose.dev.yml`, …, or any source files outside of `package.json`",
+ * and the spec's ACCEPTANCE/VERIFY converted the behavioural half of the clause
+ * ("serves `/api` + static `dist/`") into a string-match on `package.json`. The
+ * only file that could implement it — `src/server/index.ts` — was frozen. The
+ * requirement was structurally unsatisfiable inside its owning task, VERIFY
+ * PASSed honestly, and the app shipped with no static route.
+ *
+ * The existing detector misses this shape twice over (both visible in its own
+ * header): its freeze side needs a NAMED path (`pathNamedIn`), and run 18's
+ * freeze names a CATEGORY ("any source files outside of `package.json`"); its
+ * statement side must match one of four measured phrasing families, and a plain
+ * behavioural claim matches none of them.
+ *
+ * HIGH-PRECISION BY CONSTRUCTION — the statement side needs no NLP:
+ *   - owned requirement lines are MACHINE-MARKED. `appendOwnedConstraints`
+ *     stamps every one it appends with "owned requirement from the source
+ *     design (AUTHORITATIVE; …)"; when compose folded the quote in by itself
+ *     the marker is absent, so the caller may also pass the run's ledger
+ *     entries and the quote is matched verbatim against the spec text.
+ *   - the requirement names its path literally, so the intersection is lexical.
+ *   - category freezes are a small closed lexical set ("any source files
+ *     outside of X", "any files other than X", "only X may be modified",
+ *     "no files outside X").
+ *
+ * ── STATUS: NOT WIRED. The critique seam FAILED its A/B, 2026-08-04. ─────────
+ *
+ * The detector is precise — 1 finding over 58 real composed specs, and it is the
+ * true positive (scripts/owned-freeze-conflict-fp-suite.ts, PASS; STEP 0 in
+ * scripts/owned-vs-freeze-baserate.ts). What failed is the LEVER built on it,
+ * for two independent reasons, both measured:
+ *
+ *  1. THE SEAM IS BLIND IN PRODUCTION. `appendOwnedConstraints` — the BRACES that
+ *     stamp the machine-marked owned bullet this detector keys on — runs AFTER
+ *     `critiqueWithFallback`, inside the `critique` step (phases.ts). When
+ *     critique runs, the stamped line does not exist yet; compose's own folding
+ *     is a PARAPHRASE ("The server watch command must match the contract exactly:
+ *     `…` — serves `/api` + static `dist/`"), so neither the stamp nor the
+ *     verbatim quote is there to match. Live: 0/40 compose drafts carried a
+ *     detectable pair while 11/40 carried the clause semantically. A critique-
+ *     time probe cannot see the shape it was designed for.
+ *  2. THE REWRITE RESOLVES IT BY DELETING THE REQUIREMENT. Forced through the
+ *     controlled critique seam on run 18's real TASK_0023 draft (n=20/arm):
+ *     pair-present 8/20 → 0/20, but the resolution was scoped ownership in only
+ *     9/20 — the other 11/20 removed the AUTHORITATIVE clause outright and
+ *     rationalised it ("this references an existing file; no edits are required
+ *     or permitted"), with 0 of the 11 reassigning it to the task that owns the
+ *     file. VERIFY behaviour-observation was 6/20 in BOTH arms: the delivered
+ *     spec still verifies the requirement by grepping `package.json`.
+ *
+ * Removal of the pair is not satisfaction of the requirement — the same lesson
+ * as the run-16 lever's delivery metric, one level down. Anything built here
+ * next has to act AFTER the braces, where the pair actually exists, and cannot
+ * be a model rewrite: the braces are the last spec-producing step.
+ *
+ * It is a pure text function so the base rate, the FP suite and the live A/B all
+ * measure the same object.
+ */
+import { PROHIBITION_RE } from './prohibition-probe.js';
+import { pathNamedIn } from './frozen-path-guard.js';
+/**
+ * The machine stamp `appendOwnedConstraints` writes on every owned requirement
+ * it appends to CONSTRAINTS. Matching the stamp — not the prose — is what keeps
+ * the statement side free of NLP.
+ */
+const OWNED_MARKER_RE = /owned\s+requirement\s+from\s+the\s+source\s+design/i;
+/**
+ * Modification verbs, shared by the active and passive freeze families. Scoped
+ * to modification exactly as `PROHIBITION_RE` is: a "do not CREATE any files
+ * other than X" line is a creation ban and freezes no existing file, so it must
+ * never be read as a category freeze (mx5 run 18 TASK_0009 ships that line).
+ */
+const MOD_VERB = 'modif|touch|edit|chang|alter|rewrit|overwrit';
+/**
+ * A category noun phrase with an exception: "any source files outside of X",
+ * "any existing file other than X", "no files except X". `\w+` slots absorb the
+ * qualifiers seen in the corpora (source/existing/other), bounded so the phrase
+ * cannot span a whole paragraph.
+ */
+const CATEGORY_NOUN = String.raw `(?:any|no)\s+(?:\w+\s+){0,3}?files?\b`;
+const EXCEPT_KEYWORD = String.raw `(?:outside(?:\s+of)?|other\s+than|except(?:\s+for)?|besides|apart\s+from|beyond)`;
+/**
+ * Active family: a modification ban whose object is the category phrase. The
+ * tempered gap forbids crossing a creation/addition verb, so the compound line
+ * "Do not create any files other than `X` and do not modify `Y`" — where the
+ * category belongs to the CREATE half — cannot be mis-read as a category freeze.
+ */
+const ACTIVE_CATEGORY_RE = new RegExp(String.raw `\b(?:do\s+not|do\s+NOT|don'?t|must\s+not|never)\s+(?:${MOD_VERB})\w*\b`
+    + String.raw `(?:(?!\b(?:creat|add|introduc|generat)\w*\b)[\s\S]){0,200}?`
+    + String.raw `\b${CATEGORY_NOUN}[^\n]{0,40}?\b${EXCEPT_KEYWORD}\b`, 'i');
+/**
+ * Passive family: "No files other than `package.json` are modified." — run 18's
+ * ACCEPTANCE line, identical in force to the CONSTRAINTS freeze above it.
+ */
+const PASSIVE_CATEGORY_RE = new RegExp(String.raw `\b${CATEGORY_NOUN}[^\n]{0,40}?\b${EXCEPT_KEYWORD}\b`
+    + String.raw `[^\n]{0,120}?\b(?:are|is|may|must|should|can|will)\s+(?:be\s+|been\s+)?(?:${MOD_VERB})\w*`, 'i');
+/**
+ * A SCOPED-OWNERSHIP grant — "You MAY edit `X` ONLY to …/ONLY as far as …" —
+ * which is the resolution this detector demands. Whatever else the spec says,
+ * the paths named on such a line are editable, so they can never be the frozen
+ * side of a pair. Without this the rewrite that grants ownership on a NEW line
+ * while leaving the category freeze in place would re-fire forever.
+ */
+const SCOPED_GRANT_RE = new RegExp(String.raw `\b(?:may|can|are\s+allowed\s+to|is\s+allowed\s+to)\s+(?:${MOD_VERB})\w*\b[^\n]{0,80}?\bonly\b`, 'i');
+/** "Only `X` may be modified" / "Only `X` is edited". */
+const ONLY_CATEGORY_RE = new RegExp(String.raw `\bonly\b[^\n]{0,60}?\b(?:may|must|should|can|will|is|are)\s+(?:be\s+)?(?:${MOD_VERB})\w*`, 'i');
+/**
+ * Backtick-quoted path-shaped tokens in a text, INCLUDING the ones embedded in
+ * a backticked command (`bun run --watch src/server/index.ts` is one backtick
+ * span; the path inside it is what the requirement is about). Route literals
+ * (`/api`) and bare directories survive this filter — the caller decides what
+ * to do with them; `findOwnedFreezeConflicts` keeps only files.
+ */
+export function pathTokensIn(text) {
+    return tokensWithOrigin(text).map(t => t.path);
+}
+function tokensWithOrigin(text) {
+    const out = [];
+    const seen = new Set();
+    for (const m of text.matchAll(/`([^`]+)`/g)) {
+        const span = m[1];
+        const fromCommand = /\s/.test(span.trim());
+        for (const raw of span.split(/[\s,;()"']+/)) {
+            const token = raw.trim().replace(/[.,;:]+$/, '');
+            if (token.length === 0 || !/^[\w.@~/-]+$/.test(token))
+                continue;
+            if (!(token.includes('/') || /\.[A-Za-z0-9]+$/.test(token) || token.startsWith('.'))) {
+                continue;
+            }
+            // A leading `/` is a route literal or an absolute path — never a
+            // repo-relative source file, and `/api` is named by the very clause
+            // that is the true positive, so this one is not hypothetical.
+            if (token.startsWith('/'))
+                continue;
+            const n = token.replace(/^\.\//, '').replace(/\/+$/, '');
+            if (n.length === 0 || seen.has(n))
+                continue;
+            seen.add(n);
+            out.push({ path: n, fromCommand });
+        }
+    }
+    return out;
+}
+/**
+ * Does the requirement claim anything about the files it names BEYOND quoting a
+ * command that mentions them?
+ *
+ * This is what separates the two build-contract clauses of mx5 run 18's
+ * TASK_0023, which are otherwise the same shape:
+ *
+ *   "**Client CSS:** `bunx @tailwindcss/cli -i src/client/index.css -o dist/app.css`"
+ *   "**Server:** `bun run --watch src/server/index.ts` — serves `/api` + static `dist/`."
+ *
+ * The first is satisfied by putting that command in `package.json`; nothing
+ * about `src/client/index.css` has to change, so the freeze does not make it
+ * impossible. The second attaches a BEHAVIOURAL claim to the quoted file, and
+ * that claim can only be satisfied inside the file. Prose outside the backtick
+ * spans — minus the label, the anchor tag and the machine marker — is the
+ * signal; two words of it are enough.
+ */
+function hasClaimOutsideCommand(requirement) {
+    const prose = requirement
+        .replace(/`[^`]*`/g, ' ')
+        .replace(/—\s*owned\s+requirement\s+from\s+the\s+source\s+design[\s\S]*$/i, ' ')
+        .replace(/\[[^\]]*\]/g, ' ')
+        .replace(/\*\*[^*]*\*\*/g, ' ')
+        .replace(/^[\s\-"']+/, ' ');
+    const words = prose.match(/\b[A-Za-z][A-Za-z-]{1,}\b/g) ?? [];
+    return words.length >= 2;
+}
+/**
+ * The clause the exception keyword governs: from the keyword to the first
+ * clause break (an em dash, a semicolon, or a sentence end). Everything else on
+ * the line — notably the "— all engine modules (`document.ts`, …) must remain
+ * untouched" tail of gofer-pixel's freeze — is NOT an exemption.
+ */
+function exemptClause(line) {
+    const m = new RegExp(String.raw `\b${EXCEPT_KEYWORD}\b`, 'i').exec(line);
+    if (!m)
+        return null;
+    const rest = line.slice(m.index + m[0].length);
+    const brk = /\s+[—–]\s+|;|\.\s+[A-Z]|\.$/.exec(rest);
+    return brk ? rest.slice(0, brk.index) : rest;
+}
+/**
+ * Every CATEGORY freeze in the spec: a modification ban (or its passive/only-
+ * form equivalent) scoped to a class of files rather than to named paths. A
+ * freeze that only names paths is `frozen-conflict.ts`'s job, not this one.
+ */
+export function findCategoryFreezes(spec) {
+    if (!spec)
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const raw of spec.split('\n')) {
+        const line = raw.trim();
+        if (line.length === 0 || seen.has(line))
+            continue;
+        const isCategory = ACTIVE_CATEGORY_RE.test(line)
+            || PASSIVE_CATEGORY_RE.test(line)
+            || (ONLY_CATEGORY_RE.test(line) && PROHIBITION_RE.test(line) === false);
+        if (!isCategory || SCOPED_GRANT_RE.test(line))
+            continue;
+        const clause = ONLY_CATEGORY_RE.test(line) && exemptClause(line) === null ? line : exemptClause(line);
+        seen.add(line);
+        out.push({ constraint: line, exempt: clause === null ? [] : pathTokensIn(clause) });
+    }
+    return out;
+}
+const basename = (p) => p.slice(p.lastIndexOf('/') + 1);
+/**
+ * Is `p` inside the freeze — i.e. NOT one of the exempted paths, a file under
+ * an exempted directory, or the same file spelled shorter?
+ *
+ * The last clause is load-bearing. gofer-pixel TASK_0011 exempts
+ * `src/components/Canvas.tsx` while its owned requirement quotes the design's
+ * table cell, which says just `Canvas.tsx` — the same file, and the spec is
+ * correctly formed. A bare basename is matched against the exempted paths'
+ * basenames; a path WITH a directory must match exactly or by prefix, so
+ * `src/a/config.ts` never counts as exempted by `src/b/config.ts`.
+ */
+function insideFreeze(p, exempt) {
+    return !exempt.some(e => e === p
+        || p.startsWith(`${e}/`)
+        || pathNamedIn(p, e)
+        || (!p.includes('/') && basename(e) === p));
+}
+/**
+ * The spec lines carrying an AUTHORITATIVE owned requirement: the machine-
+ * stamped ones, plus — when the run's ledger is supplied — any line carrying an
+ * owned quote verbatim (compose folding the quote in itself leaves no stamp).
+ */
+export function ownedRequirementLines(spec, owned = []) {
+    if (!spec)
+        return [];
+    const quotes = owned.map(o => o.quote.trim()).filter(q => q.length > 0);
+    const out = [];
+    const seen = new Set();
+    for (const raw of spec.split('\n')) {
+        const line = raw.trim();
+        if (line.length === 0 || seen.has(line))
+            continue;
+        if (!OWNED_MARKER_RE.test(line) && !quotes.some(q => line.includes(q)))
+            continue;
+        seen.add(line);
+        out.push(line);
+    }
+    return out;
+}
+/**
+ * Every unsatisfiable pair in the composed spec: an AUTHORITATIVE owned
+ * requirement naming a file that a CATEGORY freeze in the same spec forbids
+ * touching. Deterministic, pure text (plus the caller's existence oracle).
+ * Empty when the spec froze no category or carries no owned requirement — the
+ * ordinary single-`/task` case degrades to a no-op.
+ */
+export function findOwnedFreezeConflicts(spec, opts = {}) {
+    if (!spec)
+        return [];
+    const freezes = findCategoryFreezes(spec);
+    if (freezes.length === 0)
+        return [];
+    // Scoped ownership granted ANYWHERE in the spec settles the file, even when
+    // the grant is a line the rewrite added next to an untouched category
+    // freeze — otherwise a correctly resolved spec re-fires forever.
+    const granted = spec
+        .split('\n')
+        .filter(l => SCOPED_GRANT_RE.test(l))
+        .flatMap(l => pathTokensIn(l));
+    const out = [];
+    for (const requirement of ownedRequirementLines(spec, opts.owned)) {
+        // An owned requirement that is itself prohibition-shaped restates the
+        // freeze side; it can never be the thing the freeze makes impossible.
+        if (PROHIBITION_RE.test(requirement))
+            continue;
+        const claim = hasClaimOutsideCommand(requirement);
+        const named = tokensWithOrigin(requirement)
+            .filter(t => claim || !t.fromCommand)
+            .map(t => t.path)
+            .filter(p => !opts.isSource || opts.isSource(p));
+        if (named.length === 0)
+            continue;
+        // One finding per requirement: the FIRST freeze that covers any of its
+        // files. A spec that restates the same freeze under ACCEPTANCE (run 18
+        // does) must not double the rewrite's work.
+        for (const f of freezes) {
+            const paths = named.filter(p => insideFreeze(p, [...f.exempt, ...granted]));
+            if (paths.length === 0)
+                continue;
+            out.push({ requirement, paths, constraint: f.constraint, exempt: f.exempt });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * The measured `isSource` oracle: a token counts only when git tracks it in
+ * `cwd`. Tracked ⇒ it exists, it is not a build output, and it is not ignored —
+ * exactly the "source file" the category freezes talk about. `git` missing or
+ * the tree not a repo ⇒ every token counts (the broad reading), so the detector
+ * degrades toward firing rather than toward silent blindness.
+ */
+export function trackedSourceOracle(lsFiles) {
+    const cache = new Map();
+    return p => {
+        const hit = cache.get(p);
+        if (hit !== undefined)
+            return hit;
+        const r = lsFiles(p);
+        const ok = r.exitCode !== 0 ? true : r.stdout.trim().length > 0;
+        cache.set(p, ok);
+        return ok;
+    };
+}
+/**
+ * The forced critique-rewrite defect text, in the shape the existing four
+ * families use: MANDATORY, self-contained, naming the exact resolutions. Prose
+ * surrender and silently dropping the requirement are called out as
+ * non-resolutions because narrowing the clause is precisely what run 16 did and
+ * freezing its file is precisely what run 18 did.
+ */
+export function ownedFreezeConflictProbeText(conflicts) {
+    const items = conflicts.map(c => `- the spec carries the AUTHORITATIVE owned requirement `
+        + `"${c.requirement.slice(0, 200)}", which names ${c.paths.map(p => `\`${p}\``).join(', ')} — `
+        + `and the spec FREEZES ${c.paths.length > 1 ? 'those files' : 'that file'} with a CATEGORY freeze `
+        + `("${c.constraint.slice(0, 160)}"`
+        + (c.exempt.length > 0 ?
+            `, which exempts only ${c.exempt.map(e => `\`${e}\``).join(', ')}`
+            : '')
+        + ')');
+    return [
+        'UNSATISFIABLE-CONSTRAINT FINDING (deterministic; MUST be resolved, it overrides a CLEAN triage):',
+        ...items,
+        'An owned requirement is AUTHORITATIVE: it comes from the source design and this task',
+        'owns it. A category freeze that covers the only file which could satisfy it makes the',
+        'requirement structurally impossible INSIDE THIS TASK, and the task will still pass its',
+        'own VERIFY — because VERIFY can then only assert strings in the files it is allowed to',
+        'touch. Narrowing the requirement to what the unfrozen files can express, or dropping it,',
+        'is NOT a resolution.',
+        'REWRITE the spec to resolve it in exactly ONE of these two ways:',
+        '  (a) SCOPED OWNERSHIP — widen the category freeze for that file only:',
+        '      "You MAY edit `<path>` ONLY as far as the owned requirement requires; any other',
+        '      change to `<path>` is forbidden." Then make ACCEPTANCE state the requirement\'s',
+        '      BEHAVIOUR and make VERIFY exercise that behaviour, not the presence of a string.',
+        '  (b) REASSIGN — state that the owned requirement is not satisfiable in this task and',
+        "      belongs to the task that owns `<path>`, and remove it from this spec's",
+        '      CONSTRAINTS/ACCEPTANCE so it is not falsely claimed as met here.',
+        'Never ship both the category freeze and the owned requirement it makes impossible.'
+    ].join('\n');
+}

package/dist/task/phases.d.ts

@@ -132,7 +132,18 @@ export interface PhaseAutoAnswerDeps {
 export declare function phaseAutoAnswer(deps: PhaseDeps, refined: string, research: string, question: string, autoDeps?: PhaseAutoAnswerDeps): Promise<AutoAnswer>;
 export declare function phaseGrill(deps: PhaseDeps, ctx: ExtensionCommandContext, widgetState: WidgetState, refined: string, research: string): Promise<string>;
 export declare function phaseCompose(deps: PhaseDeps, refined: string, research: string, qa: string): Promise<string>;
-export declare function phaseCritique(deps: PhaseDeps, spec: string, refined: string, qa: string, planContext?: string, research?: string): Promise<string>;
+export declare function phaseCritique(deps: PhaseDeps, spec: string, refined: string, qa: string, planContext?: string, research?: string, 
+/**
+ * An additional deterministic defect block, forced into the rewrite exactly
+ * like the probes below and overriding a CLEAN triage the same way.
+ *
+ * This is the A/B seam for a probe that is not wired yet: the discipline
+ * here is "wire only on PASS" (memory/prompt4-spec-urls-failed.md), so a
+ * candidate probe has to be measurable through the SHIPPED critique path
+ * rather than through a hand-copied replica of it, or the two arms differ by
+ * more than the probe. Undefined in production.
+ */
+extraDefects?: string | null): Promise<string>;
 export declare function critiqueWithFallback(d: PhaseDeps, p: PhaseContext): Promise<string>;
 export declare const PHASES: PhaseConfig[];
 export declare function postCommitPhase(phase: PhaseConfig, deps: PhaseDeps, pc: PhaseContext, out: string): Promise<void>;

package/dist/task/phases.js

@@ -1269,7 +1269,18 @@ export async function phaseCompose(deps, refined, research, qa) {
         return { ok: true, value: stripped };
     }, problem => new Error(`compose_invalid: ${problem}`));
 }
-export async function phaseCritique(deps, spec, refined, qa, planContext, research) {
+export async function phaseCritique(deps, spec, refined, qa, planContext, research, 
+/**
+ * An additional deterministic defect block, forced into the rewrite exactly
+ * like the probes below and overriding a CLEAN triage the same way.
+ *
+ * This is the A/B seam for a probe that is not wired yet: the discipline
+ * here is "wire only on PASS" (memory/prompt4-spec-urls-failed.md), so a
+ * candidate probe has to be measurable through the SHIPPED critique path
+ * rather than through a hand-copied replica of it, or the two arms differ by
+ * more than the probe. Undefined in production.
+ */
+extraDefects) {
     // Fast triage before the expensive full rewrite. The rewrite regenerates
     // the entire spec from scratch and is the costliest tail of the pipeline
     // (observed up to ~240s). Most compose drafts are already good, so we first
@@ -1392,7 +1403,8 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
                     && absenceProbe === null
                     && frozenProbe === null
                     && grepOnlyProbe === null
-                    && scriptProbe === null) {
+                    && scriptProbe === null
+                    && (extraDefects ?? null) === null) {
                     return spec;
                 }
             }
@@ -1411,6 +1423,7 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
         frozenProbe,
         grepOnlyProbe,
         scriptProbe,
+        extraDefects ?? null,
         triageDefects
     ]
         .filter(Boolean)

package/dist/task/verify-quality.d.ts

@@ -11,6 +11,29 @@ export interface GrepOnlyVerifyFinding {
  * source (doc/config-only tasks).
  */
 export declare function findGrepOnlyVerify(spec: string): GrepOnlyVerifyFinding[];
+/** One VERIFY command, classified by what it can observe. */
+export interface VerifyCommandClass {
+    /** The command line, verbatim. */
+    raw: string;
+    /** Every pipeline segment is a STATIC head (grep/test/tsc/…) — it inspects
+     *  files and can never observe the deliverable's behaviour. */
+    staticOnly: boolean;
+    /**
+     * The command observes RUNTIME behaviour: an HTTP request, a port probe, a
+     * process it starts and watches. This is the distinction nexttask 7's M3
+     * turns on — mx5 run 18's TASK_0023 VERIFY is all `node -e "…package.json…"`,
+     * which EXECUTES node yet can only assert that a string is present in a
+     * config file, and the behavioural half of the owned requirement ("serves
+     * `/api` + static `dist/`") is exactly what it cannot see.
+     */
+    observesBehaviour: boolean;
+}
+/**
+ * Classify each command of a spec's VERIFY block. Shares `segmentHead` with the
+ * grep-theater detector, so "static" means one thing across the two measures.
+ * Empty when the spec has no runnable VERIFY block.
+ */
+export declare function classifyVerifyCommands(spec: string): VerifyCommandClass[];
 /**
  * Retry hint when the critique rewrite KEPT the grep-theater block it was told
  * to fix (live A/B: 1/5 rewrites ignored the injected defect). Prepended to the

package/dist/task/verify-quality.js

@@ -148,6 +148,28 @@ export function findGrepOnlyVerify(spec) {
     }
     return [...inspected.entries()].map(([target, lines]) => ({ target, lines }));
 }
+const BEHAVIOUR_RE = /\bcurl\b|\bwget\b|\bhttpie?\b|https?:\/\/|\bnc\s+-z\b|\bss\s+-|\blsof\b|127\.0\.0\.1|localhost|\bplaywright\b|\bfetch\(/i;
+/**
+ * Classify each command of a spec's VERIFY block. Shares `segmentHead` with the
+ * grep-theater detector, so "static" means one thing across the two measures.
+ * Empty when the spec has no runnable VERIFY block.
+ */
+export function classifyVerifyCommands(spec) {
+    const cmds = parseVerifyBlock(spec);
+    if (!cmds)
+        return [];
+    return cmds.map(({ raw }) => {
+        let staticOnly = true;
+        for (const segment of raw.split(/&&|\|\||;|\|/)) {
+            const s = segmentHead(segment);
+            if (s === null)
+                continue;
+            if (!STATIC_HEADS.has(s.head))
+                staticOnly = false;
+        }
+        return { raw, staticOnly, observesBehaviour: BEHAVIOUR_RE.test(raw) };
+    });
+}
 /**
  * Retry hint when the critique rewrite KEPT the grep-theater block it was told
  * to fix (live A/B: 1/5 rewrites ignored the injected defect). Prepended to the

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.28.1",
+    "version": "0.28.3",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",