@mjasnikovs/pi-task 0.38.15 → 0.38.16

package/dist/task/repo-health-check.js

@@ -29,10 +29,10 @@
  * environment gap, not a code fault, so that command is SKIPPED — only a command that
  * actually ran and returned non-zero fails the check.
  */
-import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import * as path from 'node:path';
-import { resolveRunner, runnerEnv, isCommandNotFound } from './runner-resolve.js';
+import { resolveRunner, runnerEnv } from './runner-resolve.js';
+import { classifyCommandRun, spawnCommand } from './command-run.js';
 /** How much of a failing command's output to keep — bounded so a wedged tool that
  *  spews megabytes cannot bloat the trail. stderr leads (a crash trace lives there). */
 const HEALTH_OUTPUT_MAX_LINES = 40;
@@ -106,141 +106,72 @@ export function discoverHealthCommands(cwd) {
     }
     return { ecosystem: null, cmds: [] };
 }
-/**
- * Verdict for ONE finished command: 'skip' (environment gap — cannot conclude),
- * 'pass', or the FAIL outcome. Shared by the sync and async runners so their
- * semantics cannot drift apart — the async runner exists only to stop blocking the
- * event loop, and a behaviour difference between the two would be a silent gate
- * change rather than a UI fix.
- */
-function classifyHealthRun(bin, args, ecosystem, r) {
-    // Tool missing (ENOENT) or killed by timeout → cannot conclude; skip it.
-    if (r.failedToStart || r.status === null)
-        return 'skip';
-    // "Command not found" INSIDE the script chain (e.g. `bun run lint` before
-    // node_modules exists — seen live failing TASK_0001's first verify). Same
-    // environment gap as ENOENT, just surfaced through the runner's shell —
-    // as exit 127 where a posix shell ran it, else by the runner's own wording
-    // (Windows bun reports the miss itself and exits 1).
-    if (isCommandNotFound(r.status, `${r.stdout ?? ''}\n${r.stderr ?? ''}`))
-        return 'skip';
-    if (r.status !== 0) {
-        return {
-            ok: false,
-            reason: `\`${bin} ${args.join(' ')}\` exited ${r.status}`,
-            ecosystem,
-            output: captureHealthOutput(r.stdout, r.stderr)
-        };
-    }
-    return 'pass';
-}
 /** The nothing-to-run outcome, shared by both runners. */
 function noCommandOutcome(ecosystem) {
     return { ok: true, reason: 'no repo-wide static-analysis command found', ecosystem, output: '' };
 }
 /**
  * Run the discovered static checks whole-repo and let the real exit codes decide.
- * Deterministic and synchronous under the hood (a wrapper keeps the caller async).
  *
  *  - No manifest / no static command  → ok (nothing can regress).
- *  - A command that CANNOT run (ENOENT / null exit — tool not installed) → skipped,
+ *  - A command that CANNOT run (ENOENT / null exit / 127 inside the chain) → skipped,
  *    treated as an environment gap, not a fault.
  *  - A command that ran and exited non-zero → the first such failure is returned.
  *
- * A generous per-command timeout guards against a wedged tool; a timeout is treated
- * as an inconclusive skip, not a fault (it is an environment problem, not the code's).
+ * This module owns DISCOVERY and its own output policy; running a command and
+ * deciding what its ending MEANS is `command-run.ts`'s. It used to own those too —
+ * `HealthRun`, `classifyHealthRun` and `spawnHealthCommand` were a second statement
+ * of the gap ladder, with no injectable runner, so every classification case in the
+ * suite spawned a real shell. `command-run.ts`'s own header notes that this module
+ * "had solved exactly this shape years earlier" and the gate never adopted it; this
+ * is the adoption, in the other direction.
  *
- * SYNCHRONOUS — it blocks the event loop for as long as the project's own lint takes
- * (MEASURED: 15s on mx5, 69s on aiz-client), so nothing can render or animate while
- * it runs. Gate callers must use {@link runRepoHealthCheckAsync} instead; this stays
- * for callers that genuinely have no async seam.
+ * `captureHealthOutput` stays this module's own: 40 lines of a linter's report is a
+ * real difference from `outputTail`'s 400 characters, and that is a parameter, not a
+ * thing to unify.
+ *
+ * `onCommand` lets the caller name the running command in a live status line — the
+ * gate runs this immediately after the implementation turn ends, when the impl
+ * widget has just been cleared.
  */
-export function runRepoHealthCheck(cwd, timeoutMs = 600_000) {
+export async function runRepoHealthCheck(cwd, opts = {}) {
     const { ecosystem, cmds } = discoverHealthCommands(cwd);
     if (!ecosystem || cmds.length === 0)
         return noCommandOutcome(ecosystem);
+    const run = opts.run ?? spawnCommand;
     for (const [bin, args] of cmds) {
+        opts.onCommand?.(`${bin} ${args.join(' ')}`);
         // Runner resolution (mx5 run 16): a PATH-stripped environment must not
         // silently skip the statics when the runner sits at a known install
         // location; the resolved dir also rides on PATH for the script chain.
         const runner = resolveRunner(bin);
-        const r = spawnSync(runner.bin, args, {
+        const r = await run({
             cwd,
-            encoding: 'utf8',
-            timeout: timeoutMs,
-            env: runnerEnv(runner)
+            bin: runner.bin,
+            args,
+            timeoutMs: opts.timeoutMs ?? 600_000,
+            env: runnerEnv(runner),
+            ...(opts.signal === undefined ? {} : { signal: opts.signal })
         });
-        const verdict = classifyHealthRun(bin, args, ecosystem, {
-            failedToStart: r.error !== undefined,
-            status: r.status,
-            stdout: r.stdout ?? '',
-            stderr: r.stderr ?? ''
-        });
-        if (verdict === 'skip' || verdict === 'pass')
+        // The DECISION comes from the shared ladder; the OUTPUT is this module's own
+        // policy. `captureHealthOutput` keeps 40 lines of a linter's report where the
+        // ladder's `tail` keeps 400 characters, and that difference is real — a
+        // truncated lint report is unactionable. So the run is classified, not
+        // consumed: the verdict decides, the raw streams are what we show.
+        // `runtimeGap: false` — this ladder is NARROWER than the gate's. The
+        // browser/runtime row was written for the gate's TEST commands; here the
+        // commands are lint and typecheck, and its pattern matches ordinary
+        // English, so a genuine report quoting "browsers are not installed" would
+        // skip the static check and certify the repo healthy.
+        const verdict = classifyCommandRun(r, [], { runtimeGap: false });
+        if (verdict.outcome !== 'fail')
             continue;
-        return verdict;
-    }
-    return { ok: true, reason: `${ecosystem}: static checks passed`, ecosystem, output: '' };
-}
-/** Spawn one health command without blocking the event loop. Mirrors spawnSync's
- *  result shape (status null when killed, failedToStart on ENOENT). */
-function spawnHealthCommand(bin, args, cwd, timeoutMs, signal) {
-    return new Promise(resolve => {
-        const runner = resolveRunner(bin);
-        let stdout = '';
-        let stderr = '';
-        let settled = false;
-        const child = spawn(runner.bin, args, { cwd, env: runnerEnv(runner) });
-        const done = (r) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            signal?.removeEventListener('abort', onAbort);
-            resolve(r);
-        };
-        const kill = () => {
-            try {
-                child.kill('SIGKILL');
-            }
-            catch {
-                /* already gone */
-            }
+        return {
+            ok: false,
+            reason: `\`${bin} ${args.join(' ')}\` exited ${verdict.status}`,
+            ecosystem,
+            output: captureHealthOutput(r.stdout, r.stderr)
         };
-        const timer = setTimeout(kill, timeoutMs);
-        timer.unref?.();
-        const onAbort = () => kill();
-        signal?.addEventListener('abort', onAbort, { once: true });
-        child.stdout?.on('data', (d) => {
-            stdout += d.toString();
-        });
-        child.stderr?.on('data', (d) => {
-            stderr += d.toString();
-        });
-        child.on('error', () => done({ failedToStart: true, status: null, stdout, stderr }));
-        child.on('close', (code) => done({ failedToStart: false, status: code, stdout, stderr }));
-    });
-}
-/**
- * Same check, same verdicts, without blocking the event loop.
- *
- * The gate runs this immediately after the implementation turn ends, when the impl
- * widget has just been cleared — the sync version froze the whole TUI there for the
- * duration of the project's lint (MEASURED: 0 of 686 expected 100ms timer ticks
- * fired during a 69s aiz-client run), so no spinner, clock or queued notify could
- * paint. `onCommand` lets the caller name the running command in a live status line.
- */
-export async function runRepoHealthCheckAsync(cwd, opts = {}) {
-    const { ecosystem, cmds } = discoverHealthCommands(cwd);
-    if (!ecosystem || cmds.length === 0)
-        return noCommandOutcome(ecosystem);
-    for (const [bin, args] of cmds) {
-        opts.onCommand?.(`${bin} ${args.join(' ')}`);
-        const r = await spawnHealthCommand(bin, args, cwd, opts.timeoutMs ?? 600_000, opts.signal);
-        const verdict = classifyHealthRun(bin, args, ecosystem, r);
-        if (verdict === 'skip' || verdict === 'pass')
-            continue;
-        return verdict;
     }
     return { ok: true, reason: `${ecosystem}: static checks passed`, ecosystem, output: '' };
 }

package/dist/task/run-end.d.ts

@@ -0,0 +1,77 @@
+/**
+ * run-end — how a single /task run ENDED, named once.
+ *
+ * `TaskRunner.run` returned `void` and never threw, so `runSingleTask` learned
+ * what it had just done by RE-READING the task file's front matter, narrowing
+ * that to `ok: boolean`, and smuggling the rest out of the `withSession` closure
+ * through three mutable captures. Both commands then re-derived a cause the
+ * runner already had: `classifyFailure` names the ending exactly, and
+ * `handleFailure` threw the name away.
+ *
+ * The live consequence was a wrong report. `/task-cancel` during a gated run
+ * writes `cancelled` to the file; `ok` is `state === 'completed'`, so it is
+ * false; `!res.ok` calls `markResumable`, which overwrites `cancelled` with
+ * `failed`, and announces a red *"stopped — fix and run /task-resume"*.
+ * `/task-auto` hits the same arm for the same input, because its cancel branch
+ * only consults a module global that `/task-cancel` never sets.
+ *
+ * The file is still written — it is what a RESUME reads. What changed is that it
+ * is no longer the channel this process uses to talk to itself.
+ */
+/** Why a run stopped. Exactly one of these is true of any finished run. */
+export type RunEnd = 
+/** Every phase ran and the spec was delivered. */
+{
+    kind: 'completed';
+}
+/** The user cancelled — via /task-cancel, ESC, or an aborted signal. */
+ | {
+    kind: 'cancelled';
+}
+/** A phase threw. `reason` is `FailureClass.reason`, already trimmed. */
+ | {
+    kind: 'failed';
+    reason?: string;
+}
+/** The implementation turn was interrupted and left resumable. */
+ | {
+    kind: 'interrupted';
+}
+/** No fresh session could be started, so nothing ran at all. */
+ | {
+    kind: 'no-session';
+};
+export type RunEndKind = RunEnd['kind'];
+/**
+ * What a command does about each ending.
+ *
+ * `resumable` and `announce` are the two facts the two hand-written ladders
+ * disagreed about, and the disagreement is where the cancel bug lived: a
+ * `cancelled` run was falling into the `failed` arm and being marked resumable.
+ * The WORDING stays per-command — `/task` says "resume with /task-resume" where
+ * `/task-auto` says "/task-auto-resume" — so only the policy is shared.
+ */
+export interface RunEndPolicy {
+    /** Mark the task resumable (overwrites its state with `failed`). */
+    resumable: boolean;
+    /**
+     * Does this ending FAIL the plan that contains the task?
+     *
+     * Strictly narrower than `resumable`, and the distinction is load-bearing: a
+     * declined-steer interrupt leaves the inner task resumable but the PLAN in
+     * progress, so `/task-auto-resume` re-delivers that task's spec. A fault fails
+     * the plan too. Only `/task-auto` reads this — a bare `/task` has no plan.
+     */
+    failsRun: boolean;
+    /** The notify level for this ending. */
+    level: 'info' | 'warning' | 'error';
+}
+/**
+ * The one table. A run that the USER stopped is not resumable-as-failed: its
+ * file already says `cancelled`, and rewriting that to `failed` both lies in the
+ * ledger and turns a deliberate stop into a red error the user has to read as a
+ * fault.
+ */
+export declare const RUN_END_POLICY: Record<RunEndKind, RunEndPolicy>;
+/** Did the run deliver a spec? The single question the old `ok` boolean answered. */
+export declare function runSucceeded(end: RunEnd): boolean;

package/dist/task/run-end.js

@@ -0,0 +1,37 @@
+/**
+ * run-end — how a single /task run ENDED, named once.
+ *
+ * `TaskRunner.run` returned `void` and never threw, so `runSingleTask` learned
+ * what it had just done by RE-READING the task file's front matter, narrowing
+ * that to `ok: boolean`, and smuggling the rest out of the `withSession` closure
+ * through three mutable captures. Both commands then re-derived a cause the
+ * runner already had: `classifyFailure` names the ending exactly, and
+ * `handleFailure` threw the name away.
+ *
+ * The live consequence was a wrong report. `/task-cancel` during a gated run
+ * writes `cancelled` to the file; `ok` is `state === 'completed'`, so it is
+ * false; `!res.ok` calls `markResumable`, which overwrites `cancelled` with
+ * `failed`, and announces a red *"stopped — fix and run /task-resume"*.
+ * `/task-auto` hits the same arm for the same input, because its cancel branch
+ * only consults a module global that `/task-cancel` never sets.
+ *
+ * The file is still written — it is what a RESUME reads. What changed is that it
+ * is no longer the channel this process uses to talk to itself.
+ */
+/**
+ * The one table. A run that the USER stopped is not resumable-as-failed: its
+ * file already says `cancelled`, and rewriting that to `failed` both lies in the
+ * ledger and turns a deliberate stop into a red error the user has to read as a
+ * fault.
+ */
+export const RUN_END_POLICY = {
+    completed: { resumable: false, failsRun: false, level: 'info' },
+    cancelled: { resumable: false, failsRun: false, level: 'warning' },
+    interrupted: { resumable: true, failsRun: false, level: 'warning' },
+    failed: { resumable: true, failsRun: true, level: 'error' },
+    'no-session': { resumable: false, failsRun: false, level: 'warning' }
+};
+/** Did the run deliver a spec? The single question the old `ok` boolean answered. */
+export function runSucceeded(end) {
+    return end.kind === 'completed';
+}

package/dist/task/run-final-gate.js

@@ -1,3 +1,4 @@
+import { AutofixLedger } from './autofix-ledger.js';
 import { describeDebt, recordDebt } from './accept-debt.js';
 import { cancelCheckpoint } from './cancel-points.js';
 import { SessionUI } from '../remote/bridge.js';
@@ -5,7 +6,9 @@ import { isYoloMode, yoloFinalGateChoice, YOLO_STAMP } from './yolo.js';
 import { ignoredWriteTrailLine, ignoredWriteDebtReason } from './write-guard.js';
 import { readOwnedRequirements } from './requirements.js';
 import { unclaimedPendingRequirements } from './owned-freeze-reassign.js';
-import { applyDemotions, isNonProgress, normalizeFailureDetail, rankedFirstFailure, unobservedDebtReason } from './final-gate-progress.js';
+// `final-gate-progress.ts`'s five pure functions are `AutofixLedger`'s internals
+// now — each was called from exactly ONE site inside this loop, extracted for
+// testability while the ordering and carry-forward decisions stayed out here.
 import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE, STRANDED_FIX_COMMIT, strandedFixNote } from './final-gate-fix.js';
 /**
  * Show the run-end picker and return the raw answer. Card ORDER is fixed —
@@ -227,45 +230,34 @@ export async function runFinalGateStage(active, deps, p) {
     // pass + gate re-run — run 7's gap: the picker had NO automated fix path) /
     // Accept. The user always decides; after MAX_FINAL_GATE_AUTOFIX attempts that
     // still FAIL the autofix card is withdrawn so the loop cannot run unbounded.
-    let fixAttempts = 0;
-    // Gitignored paths the fix passes have written so far in this resolution loop (mx5
-    // run 19). Accumulated across attempts: a `.env` written by a failed attempt is
-    // still on disk for the next one, and that attempt's own before/after diff cannot
-    // see it.
-    let ignoredWritten = [];
-    // Sub-fixes a non-converging autofix attempt left uncommitted. Refreshed after
-    // every attempt; drives the picker note and the terminal commit (mx5 run 13 PROMPT
-    // 4 item 3, run 14 item 2b).
-    let stranded = [];
+    // What this loop RECORDS, and the decisions that record makes: the attempt
+    // count and its bound, the accumulated gitignored writes, the stranded
+    // sub-fixes, the previous failure signature, the demoted set and the
+    // rejected-edits flag. Six closure-threaded locals before, and the
+    // non-progress rule applied downstream from the evidence it judges — the shape
+    // `final-gate-progress.ts`'s own comment names as the run-21 defect.
+    // `GateTally`'s twin, one altitude up (autofix-ledger.ts).
+    const ledger = new AutofixLedger(MAX_FINAL_GATE_AUTOFIX);
     const refreshStranded = async () => {
         if (!deps.pendingChanges)
             return;
         try {
-            stranded = await deps.pendingChanges(cwd);
+            ledger.setStranded(await deps.pendingChanges(cwd));
         }
         catch {
             // Inconclusive: say nothing rather than claim a clean tree.
-            stranded = [];
+            ledger.setStranded([]);
         }
     };
-    // NON-PROGRESS / UNFALSIFIABLE-CHECK state (mx5 run 14 item 2a). `prevFailSig` is
-    // the previous attempt's normalized ranked-first failure; `demoted` holds the
-    // signatures already carried as debt, so a re-run that still reports them does not
-    // re-fail the gate.
-    let prevFailSig = null;
-    const demoted = new Set();
-    // Set when a write-guard rejected an attempt whose edits could NOT be discarded:
-    // REJECTED edits are then sitting in the tree and must never be committed by the
-    // terminal paths below.
-    let rejectedEditsInTree = false;
     // Commit whatever guard-clean repairs the fix passes left, on ANY terminal
     // non-converged outcome. Run 14 ended on LEAVE with 13 real repairs dirty in the
     // tree after an unattended run — the next checkout would have destroyed them
     // silently.
     const commitStranded = async (outcome) => {
+        const stranded = ledger.stranded();
         if (stranded.length === 0)
             return;
-        if (rejectedEditsInTree) {
+        if (!ledger.mayCommitTree()) {
             await recGate(`final-gate: NOT committing ${stranded.length} working-tree change(s) — a `
                 + `write-guard rejected an attempt and its edits could not be discarded, `
                 + `so the tree holds REJECTED edits: ${stranded.slice(0, 8).join(', ')}`);
@@ -300,20 +292,20 @@ export async function runFinalGateStage(active, deps, p) {
         }
     };
     while (!fin.ok) {
-        const canAutofix = deps.finalGateFix !== undefined && fixAttempts < MAX_FINAL_GATE_AUTOFIX;
+        const canAutofix = deps.finalGateFix !== undefined && ledger.canAutofix();
         // The picker question shows the debts (the HUMAN weighs them); the autofix seed
         // below deliberately does not — mx5 run 11's fix child executed a debt claim as
         // an `rm` instruction.
         const question = `Final integration gate FAILED for ${id}.\n\n${fin.reason}${fin.debtNote ?? ''}\n\n`
             + 'All tasks are checked off — this is the whole-repo check '
             + '(the project’s own test/build/static commands, run unaided).'
-            + (fixAttempts > 0 ?
-                `\n\nAutofix attempts so far: ${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX}.`
+            + (ledger.attempts() > 0 ?
+                `\n\nAutofix attempts so far: ${ledger.attempts()}/${MAX_FINAL_GATE_AUTOFIX}.`
                 : '')
             // Never let a partial repair be invisible at the moment the human decides
             // (run 13: a bunfig fix that made `bun run test` pass 116/116 was stranded
             // by an ACCEPT).
-            + strandedFixNote(stranded);
+            + strandedFixNote([...ledger.stranded()]);
         // YOLO: keep autofixing WHILE the card is still offered — the loop withdraws it
         // after MAX_FINAL_GATE_AUTOFIX, so the cap that bounds a non-converging fix pass
         // still bounds this — then LEAVE the run failed. Never 'accept': an unattended
@@ -339,17 +331,17 @@ export async function runFinalGateStage(active, deps, p) {
             // instruction to throw away work (mx5 run 13 item 3).
             await commitStranded('accepted');
             active.ui.notify(`${id}: final integration gate FAIL accepted by user — completing.`
-                + (stranded.length > 0 ?
-                    ` ${stranded.length} uncommitted fix-pass change(s) committed separately.`
+                + (ledger.stranded().length > 0 ?
+                    ` ${ledger.stranded().length} uncommitted fix-pass change(s) committed separately.`
                     : ''), 'warning');
             break;
         }
         if (choice.action === 'autofix' && canAutofix) {
-            fixAttempts += 1;
-            await recGate(`final-gate: user chose AUTOFIX (attempt ${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX})`);
-            active.ui.notify(`${id}: final-gate autofix (${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX}) — bounded fix pass, then the gate re-runs…`, 'info');
+            const attempt = ledger.attempt();
+            await recGate(`final-gate: user chose AUTOFIX (attempt ${attempt}/${MAX_FINAL_GATE_AUTOFIX})`);
+            active.ui.notify(`${id}: final-gate autofix (${attempt}/${MAX_FINAL_GATE_AUTOFIX}) — bounded fix pass, then the gate re-runs…`, 'info');
             const seed = choice.guidance ? `${fin.reason}\n\nUser guidance: ${choice.guidance}` : fin.reason;
-            const fix = await deps.finalGateFix(active, cwd, seed, ignoredWritten);
+            const fix = await deps.finalGateFix(active, cwd, seed, [...ledger.ignoredWrites()]);
             // IGNORED-PATH WRITES (mx5 run 19). The pass wrote file(s) git ignores, so
             // they are not in the commit and a fresh clone does not have them. Trailed
             // on EVERY outcome — a rejected attempt's tracked edits are discarded while
@@ -358,7 +350,7 @@ export async function runFinalGateStage(active, deps, p) {
             // own attempt. PATH NAMES ONLY: an ignored file's contents (`.env` is the
             // canonical case) never enter a log, a debt or a child prompt.
             if (fix.ignoredWrites && fix.ignoredWrites.length > 0) {
-                ignoredWritten = [...new Set([...ignoredWritten, ...fix.ignoredWrites])].sort();
+                ledger.wroteIgnored(fix.ignoredWrites);
                 await recGate(ignoredWriteTrailLine(fix.ignoredWrites));
                 // Debt only where a verdict can rest on the file: the probe proved the
                 // gate needs it, or the question stayed open. A write the gate
@@ -379,26 +371,30 @@ export async function runFinalGateStage(active, deps, p) {
                 }
                 await recGate(`final-gate: autofix ${fix.unobserved ? 'ended UNOBSERVED' : 'converged'} — ${fix.reason.slice(0, 200)}`);
                 active.ui.notify(`${id}: final integration gate ${fix.unobserved ? 'is UNOBSERVED' : 'PASSES'} after autofix — ${fix.reason.slice(0, 140)}`, fix.unobserved ? 'warning' : 'info');
-                fin = { ok: true, reason: fix.reason };
+                // The gate's own outcome, whole, with this door's reason on it. It
+                // used to be a two-key literal, so `openDebts` and `observedFailures`
+                // were dropped and `reconcileDebts` was the only thing putting one of
+                // them back — the recorded mx5 run-18 defect.
+                fin = { ...(fix.gate ?? fin), ok: true, reason: fix.reason };
                 // The gate itself just passed, statics included, so `staticOk` here is
                 // proof rather than assumption.
                 await reconcileDebts(true);
                 break;
             }
-            await recGate(`final-gate: autofix attempt ${fixAttempts} failed — ${fix.reason.slice(0, 200)}`);
+            await recGate(`final-gate: autofix attempt ${attempt} failed — ${fix.reason.slice(0, 200)}`);
             // A guard that rejected an attempt WITHOUT discarding leaves rejected edits
             // behind: the terminal paths must not commit the tree after that (the cheat
             // guard stays intact).
             if (fix.guardTripped === true && fix.editsDiscarded !== true) {
-                rejectedEditsInTree = true;
+                ledger.rejectedEditsRemain();
             }
             // The attempt's edits survive a non-convergence (only a guard trip
             // discards). Find out what they are NOW, so the next picker shows them and
             // a terminal outcome commits them.
             await refreshStranded();
-            if (stranded.length > 0) {
-                await recGate(`final-gate: autofix attempt ${fixAttempts} left ${stranded.length} `
-                    + `uncommitted change(s) — ${stranded.slice(0, 8).join(', ')}`);
+            if (ledger.stranded().length > 0) {
+                await recGate(`final-gate: autofix attempt ${attempt} left ${ledger.stranded().length} `
+                    + `uncommitted change(s) — ${ledger.stranded().slice(0, 8).join(', ')}`);
             }
             active.ui.notify(`${id}: final-gate autofix did not converge — ${fix.reason.slice(0, 140)}`, 'warning');
             // NON-PROGRESS CLASSIFIER (mx5 run 14 item 2a). An attempt that changed the
@@ -407,46 +403,32 @@ export async function runFinalGateStage(active, deps, p) {
             // burned all three attempts on a boot probe that could not observe a
             // listener in that sandbox at all. Demote that one check to
             // UNOBSERVED-with-debt and let the REMAINING checks decide.
-            const detail = rankedFirstFailure({
-                reason: fix.gateReason,
-                failures: fix.gateFailures
-            });
-            const edited = fix.gateReason !== undefined && stranded.length > 0;
-            // …and whether a PROBE OBSERVED this failure (nexttask 19A). Exact text
-            // identity against the gate's own observed subset — not a second string
-            // pattern, which is the mistake `isNonProgress` already made once.
-            const observed = fix.gateObservedFailures?.includes(detail ?? '') === true;
-            if (detail !== null
-                && isNonProgress({
-                    previousSignature: prevFailSig,
-                    currentDetail: detail,
-                    edited,
-                    observed
-                })) {
-                demoted.add(normalizeFailureDetail(detail));
-                prevFailSig = null;
-                await carryDebt(unobservedDebtReason(detail));
-                await recGate(`final-gate: check DEMOTED to UNOBSERVED after ${fixAttempts} tree-changing `
+            //
+            // The judgement, the observed check and the signature carry-forward are
+            // the ledger's — made where the evidence is, not downstream from it.
+            const verdict = ledger.judge(fix.gate, fix.gate !== undefined && ledger.stranded().length > 0);
+            if (verdict.demoted) {
+                await carryDebt(verdict.debtReason);
+                await recGate(`final-gate: check DEMOTED to UNOBSERVED after ${attempt} tree-changing `
                     + `attempts returned an identical failure — carried as debt (origin final-gate) `
-                    + `and re-checked by the next run's gate: ${detail.slice(0, 240)}`);
+                    + `and re-checked by the next run's gate: ${verdict.detail.slice(0, 240)}`);
                 active.ui.notify(`${id}: final-gate check is unfalsifiable in this environment — carried as debt; `
                     + 'the remaining checks decide convergence.', 'warning');
             }
-            else {
-                prevFailSig = detail !== null ? normalizeFailureDetail(detail) : null;
-            }
             // Convergence on the REMAINING checks: a demoted signature no longer counts
             // against the gate. Nothing left ⇒ the run converges carrying the demotion
             // as debt, and the fix passes' repairs are committed rather than stranded.
-            if (demoted.size > 0 && fix.gateReason !== undefined) {
-                const remaining = applyDemotions(fix.gateFailures ?? [fix.gateReason], demoted);
-                if (remaining.length === 0) {
+            if (ledger.hasDemotions() && fix.gate !== undefined) {
+                const remaining = ledger.remaining(fix.gate);
+                if (remaining !== undefined && remaining.length === 0) {
                     await deps.commit(cwd, `FINAL GATE AUTOFIX (${id})`);
-                    const converged = `converged on all remaining checks; ${demoted.size} check(s) `
+                    const converged = `converged on all remaining checks; ${ledger.demotedCount()} check(s) `
                         + 'carried as UNOBSERVED debt (unfalsifiable in this environment)';
                     await recGate(`final-gate: ${converged}`);
                     active.ui.notify(`${id}: final integration gate converged — ${converged}.`, 'warning');
-                    fin = { ok: true, reason: converged };
+                    // The gate's own outcome, with this door's reason on it — the
+                    // whole value, so `openDebts` survives the assignment.
+                    fin = { ...fix.gate, ok: true, reason: converged };
                     // Converged on the REMAINING checks only: one or more were DEMOTED
                     // as unfalsifiable here, and the statics may be among them. No
                     // proof ⇒ pass false, so nothing static-class can auto-close on
@@ -464,17 +446,27 @@ export async function runFinalGateStage(active, deps, p) {
             // next picker and the next fix seed target only what is still falsifiable —
             // never re-aiming the child at the check the classifier just proved it
             // cannot move.
-            const freshFailures = fix.gateReason !== undefined ? fix.gateFailures : fin.failures;
-            const carried = freshFailures !== undefined ? applyDemotions(freshFailures, demoted) : undefined;
+            // Outcome to outcome. The base is the FRESH gate outcome when the fix
+            // pass got as far as re-running it, otherwise the one we already hold —
+            // and either way it arrives whole, so nothing (`openDebts`,
+            // `observedFailures`) is dropped by the assignment. This used to be a
+            // literal with four keys, and the field it omitted is the recorded mx5
+            // run-18 defect.
+            const base = fix.gate ?? fin;
+            const carried = base.failures === undefined ? undefined : ledger.remaining(base);
             fin = {
+                ...base,
                 ok: false,
-                reason: demoted.size > 0 && carried !== undefined && carried.length > 0 ?
+                reason: ledger.hasDemotions() && carried !== undefined && carried.length > 0 ?
                     carried[0]
-                    : (fix.gateReason ?? fin.reason),
-                failures: carried,
-                debtNote: fin.debtNote
+                    : base.reason,
+                ...(carried === undefined ? {} : { failures: carried }),
+                // The debt NOTE is the caller's running one: the next picker must
+                // still show the open claims, and the fresh gate's own note is
+                // reconciled separately against the final tree.
+                ...(fin.debtNote === undefined ? {} : { debtNote: fin.debtNote })
             };
-            if (fix.gateReason !== undefined && (fix.gateFailures?.length ?? 0) > 1) {
+            if (fix.gate !== undefined && (fix.gate.failures?.length ?? 0) > 1) {
                 await trailGateFail(fin);
             }
             continue;
@@ -492,8 +484,8 @@ export async function runFinalGateStage(active, deps, p) {
         return {
             kind: 'failed',
             message: `${id} finished all tasks but FAILED the final integration gate — ${fin.reason.slice(0, 200)} — fix and /task-auto-resume (the gate re-runs).`
-                + (stranded.length > 0 ?
-                    ` NOTE: ${stranded.length} fix-pass change(s) were committed separately (${stranded.slice(0, 4).join(', ')}).`
+                + (ledger.stranded().length > 0 ?
+                    ` NOTE: ${ledger.stranded().length} fix-pass change(s) were committed separately (${ledger.stranded().slice(0, 4).join(', ')}).`
                     : '')
         };
     }

package/dist/task/task-gates.d.ts

@@ -248,6 +248,14 @@ export type GateResult = {
     kind: 'interrupted';
     ctx: ExtensionCommandContext;
 }
+/**
+ * The USER cancelled an AUTOFIX re-run. Distinct from `interrupted`: the task
+ * file already says `cancelled` and must not be demoted to `failed` over it.
+ */
+ | {
+    kind: 'cancelled';
+    ctx: ExtensionCommandContext;
+}
 /** An AUTOFIX re-run's implementation itself failed. */
  | {
     kind: 'failed';