@mjasnikovs/pi-task 0.38.15 → 0.38.17

package/dist/task/run-end.js

@@ -0,0 +1,37 @@
+/**
+ * run-end — how a single /task run ENDED, named once.
+ *
+ * `TaskRunner.run` returned `void` and never threw, so `runSingleTask` learned
+ * what it had just done by RE-READING the task file's front matter, narrowing
+ * that to `ok: boolean`, and smuggling the rest out of the `withSession` closure
+ * through three mutable captures. Both commands then re-derived a cause the
+ * runner already had: `classifyFailure` names the ending exactly, and
+ * `handleFailure` threw the name away.
+ *
+ * The live consequence was a wrong report. `/task-cancel` during a gated run
+ * writes `cancelled` to the file; `ok` is `state === 'completed'`, so it is
+ * false; `!res.ok` calls `markResumable`, which overwrites `cancelled` with
+ * `failed`, and announces a red *"stopped — fix and run /task-resume"*.
+ * `/task-auto` hits the same arm for the same input, because its cancel branch
+ * only consults a module global that `/task-cancel` never sets.
+ *
+ * The file is still written — it is what a RESUME reads. What changed is that it
+ * is no longer the channel this process uses to talk to itself.
+ */
+/**
+ * The one table. A run that the USER stopped is not resumable-as-failed: its
+ * file already says `cancelled`, and rewriting that to `failed` both lies in the
+ * ledger and turns a deliberate stop into a red error the user has to read as a
+ * fault.
+ */
+export const RUN_END_POLICY = {
+    completed: { resumable: false, failsRun: false, level: 'info' },
+    cancelled: { resumable: false, failsRun: false, level: 'warning' },
+    interrupted: { resumable: true, failsRun: false, level: 'warning' },
+    failed: { resumable: true, failsRun: true, level: 'error' },
+    'no-session': { resumable: false, failsRun: false, level: 'warning' }
+};
+/** Did the run deliver a spec? The single question the old `ok` boolean answered. */
+export function runSucceeded(end) {
+    return end.kind === 'completed';
+}

package/dist/task/run-final-gate.js

@@ -1,3 +1,4 @@
+import { AutofixLedger } from './autofix-ledger.js';
 import { describeDebt, recordDebt } from './accept-debt.js';
 import { cancelCheckpoint } from './cancel-points.js';
 import { SessionUI } from '../remote/bridge.js';
@@ -5,7 +6,9 @@ import { isYoloMode, yoloFinalGateChoice, YOLO_STAMP } from './yolo.js';
 import { ignoredWriteTrailLine, ignoredWriteDebtReason } from './write-guard.js';
 import { readOwnedRequirements } from './requirements.js';
 import { unclaimedPendingRequirements } from './owned-freeze-reassign.js';
-import { applyDemotions, isNonProgress, normalizeFailureDetail, rankedFirstFailure, unobservedDebtReason } from './final-gate-progress.js';
+// `final-gate-progress.ts`'s five pure functions are `AutofixLedger`'s internals
+// now — each was called from exactly ONE site inside this loop, extracted for
+// testability while the ordering and carry-forward decisions stayed out here.
 import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE, STRANDED_FIX_COMMIT, strandedFixNote } from './final-gate-fix.js';
 /**
  * Show the run-end picker and return the raw answer. Card ORDER is fixed —
@@ -227,45 +230,34 @@ export async function runFinalGateStage(active, deps, p) {
     // pass + gate re-run — run 7's gap: the picker had NO automated fix path) /
     // Accept. The user always decides; after MAX_FINAL_GATE_AUTOFIX attempts that
     // still FAIL the autofix card is withdrawn so the loop cannot run unbounded.
-    let fixAttempts = 0;
-    // Gitignored paths the fix passes have written so far in this resolution loop (mx5
-    // run 19). Accumulated across attempts: a `.env` written by a failed attempt is
-    // still on disk for the next one, and that attempt's own before/after diff cannot
-    // see it.
-    let ignoredWritten = [];
-    // Sub-fixes a non-converging autofix attempt left uncommitted. Refreshed after
-    // every attempt; drives the picker note and the terminal commit (mx5 run 13 PROMPT
-    // 4 item 3, run 14 item 2b).
-    let stranded = [];
+    // What this loop RECORDS, and the decisions that record makes: the attempt
+    // count and its bound, the accumulated gitignored writes, the stranded
+    // sub-fixes, the previous failure signature, the demoted set and the
+    // rejected-edits flag. Six closure-threaded locals before, and the
+    // non-progress rule applied downstream from the evidence it judges — the shape
+    // `final-gate-progress.ts`'s own comment names as the run-21 defect.
+    // `GateTally`'s twin, one altitude up (autofix-ledger.ts).
+    const ledger = new AutofixLedger(MAX_FINAL_GATE_AUTOFIX);
     const refreshStranded = async () => {
         if (!deps.pendingChanges)
             return;
         try {
-            stranded = await deps.pendingChanges(cwd);
+            ledger.setStranded(await deps.pendingChanges(cwd));
         }
         catch {
             // Inconclusive: say nothing rather than claim a clean tree.
-            stranded = [];
+            ledger.setStranded([]);
         }
     };
-    // NON-PROGRESS / UNFALSIFIABLE-CHECK state (mx5 run 14 item 2a). `prevFailSig` is
-    // the previous attempt's normalized ranked-first failure; `demoted` holds the
-    // signatures already carried as debt, so a re-run that still reports them does not
-    // re-fail the gate.
-    let prevFailSig = null;
-    const demoted = new Set();
-    // Set when a write-guard rejected an attempt whose edits could NOT be discarded:
-    // REJECTED edits are then sitting in the tree and must never be committed by the
-    // terminal paths below.
-    let rejectedEditsInTree = false;
     // Commit whatever guard-clean repairs the fix passes left, on ANY terminal
     // non-converged outcome. Run 14 ended on LEAVE with 13 real repairs dirty in the
     // tree after an unattended run — the next checkout would have destroyed them
     // silently.
     const commitStranded = async (outcome) => {
+        const stranded = ledger.stranded();
         if (stranded.length === 0)
             return;
-        if (rejectedEditsInTree) {
+        if (!ledger.mayCommitTree()) {
             await recGate(`final-gate: NOT committing ${stranded.length} working-tree change(s) — a `
                 + `write-guard rejected an attempt and its edits could not be discarded, `
                 + `so the tree holds REJECTED edits: ${stranded.slice(0, 8).join(', ')}`);
@@ -300,20 +292,20 @@ export async function runFinalGateStage(active, deps, p) {
         }
     };
     while (!fin.ok) {
-        const canAutofix = deps.finalGateFix !== undefined && fixAttempts < MAX_FINAL_GATE_AUTOFIX;
+        const canAutofix = deps.finalGateFix !== undefined && ledger.canAutofix();
         // The picker question shows the debts (the HUMAN weighs them); the autofix seed
         // below deliberately does not — mx5 run 11's fix child executed a debt claim as
         // an `rm` instruction.
         const question = `Final integration gate FAILED for ${id}.\n\n${fin.reason}${fin.debtNote ?? ''}\n\n`
             + 'All tasks are checked off — this is the whole-repo check '
             + '(the project’s own test/build/static commands, run unaided).'
-            + (fixAttempts > 0 ?
-                `\n\nAutofix attempts so far: ${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX}.`
+            + (ledger.attempts() > 0 ?
+                `\n\nAutofix attempts so far: ${ledger.attempts()}/${MAX_FINAL_GATE_AUTOFIX}.`
                 : '')
             // Never let a partial repair be invisible at the moment the human decides
             // (run 13: a bunfig fix that made `bun run test` pass 116/116 was stranded
             // by an ACCEPT).
-            + strandedFixNote(stranded);
+            + strandedFixNote([...ledger.stranded()]);
         // YOLO: keep autofixing WHILE the card is still offered — the loop withdraws it
         // after MAX_FINAL_GATE_AUTOFIX, so the cap that bounds a non-converging fix pass
         // still bounds this — then LEAVE the run failed. Never 'accept': an unattended
@@ -339,17 +331,17 @@ export async function runFinalGateStage(active, deps, p) {
             // instruction to throw away work (mx5 run 13 item 3).
             await commitStranded('accepted');
             active.ui.notify(`${id}: final integration gate FAIL accepted by user — completing.`
-                + (stranded.length > 0 ?
-                    ` ${stranded.length} uncommitted fix-pass change(s) committed separately.`
+                + (ledger.stranded().length > 0 ?
+                    ` ${ledger.stranded().length} uncommitted fix-pass change(s) committed separately.`
                     : ''), 'warning');
             break;
         }
         if (choice.action === 'autofix' && canAutofix) {
-            fixAttempts += 1;
-            await recGate(`final-gate: user chose AUTOFIX (attempt ${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX})`);
-            active.ui.notify(`${id}: final-gate autofix (${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX}) — bounded fix pass, then the gate re-runs…`, 'info');
+            const attempt = ledger.attempt();
+            await recGate(`final-gate: user chose AUTOFIX (attempt ${attempt}/${MAX_FINAL_GATE_AUTOFIX})`);
+            active.ui.notify(`${id}: final-gate autofix (${attempt}/${MAX_FINAL_GATE_AUTOFIX}) — bounded fix pass, then the gate re-runs…`, 'info');
             const seed = choice.guidance ? `${fin.reason}\n\nUser guidance: ${choice.guidance}` : fin.reason;
-            const fix = await deps.finalGateFix(active, cwd, seed, ignoredWritten);
+            const fix = await deps.finalGateFix(active, cwd, seed, [...ledger.ignoredWrites()]);
             // IGNORED-PATH WRITES (mx5 run 19). The pass wrote file(s) git ignores, so
             // they are not in the commit and a fresh clone does not have them. Trailed
             // on EVERY outcome — a rejected attempt's tracked edits are discarded while
@@ -358,7 +350,7 @@ export async function runFinalGateStage(active, deps, p) {
             // own attempt. PATH NAMES ONLY: an ignored file's contents (`.env` is the
             // canonical case) never enter a log, a debt or a child prompt.
             if (fix.ignoredWrites && fix.ignoredWrites.length > 0) {
-                ignoredWritten = [...new Set([...ignoredWritten, ...fix.ignoredWrites])].sort();
+                ledger.wroteIgnored(fix.ignoredWrites);
                 await recGate(ignoredWriteTrailLine(fix.ignoredWrites));
                 // Debt only where a verdict can rest on the file: the probe proved the
                 // gate needs it, or the question stayed open. A write the gate
@@ -379,26 +371,30 @@ export async function runFinalGateStage(active, deps, p) {
                 }
                 await recGate(`final-gate: autofix ${fix.unobserved ? 'ended UNOBSERVED' : 'converged'} — ${fix.reason.slice(0, 200)}`);
                 active.ui.notify(`${id}: final integration gate ${fix.unobserved ? 'is UNOBSERVED' : 'PASSES'} after autofix — ${fix.reason.slice(0, 140)}`, fix.unobserved ? 'warning' : 'info');
-                fin = { ok: true, reason: fix.reason };
+                // The gate's own outcome, whole, with this door's reason on it. It
+                // used to be a two-key literal, so `openDebts` and `observedFailures`
+                // were dropped and `reconcileDebts` was the only thing putting one of
+                // them back — the recorded mx5 run-18 defect.
+                fin = { ...(fix.gate ?? fin), ok: true, reason: fix.reason };
                 // The gate itself just passed, statics included, so `staticOk` here is
                 // proof rather than assumption.
                 await reconcileDebts(true);
                 break;
             }
-            await recGate(`final-gate: autofix attempt ${fixAttempts} failed — ${fix.reason.slice(0, 200)}`);
+            await recGate(`final-gate: autofix attempt ${attempt} failed — ${fix.reason.slice(0, 200)}`);
             // A guard that rejected an attempt WITHOUT discarding leaves rejected edits
             // behind: the terminal paths must not commit the tree after that (the cheat
             // guard stays intact).
             if (fix.guardTripped === true && fix.editsDiscarded !== true) {
-                rejectedEditsInTree = true;
+                ledger.rejectedEditsRemain();
             }
             // The attempt's edits survive a non-convergence (only a guard trip
             // discards). Find out what they are NOW, so the next picker shows them and
             // a terminal outcome commits them.
             await refreshStranded();
-            if (stranded.length > 0) {
-                await recGate(`final-gate: autofix attempt ${fixAttempts} left ${stranded.length} `
-                    + `uncommitted change(s) — ${stranded.slice(0, 8).join(', ')}`);
+            if (ledger.stranded().length > 0) {
+                await recGate(`final-gate: autofix attempt ${attempt} left ${ledger.stranded().length} `
+                    + `uncommitted change(s) — ${ledger.stranded().slice(0, 8).join(', ')}`);
             }
             active.ui.notify(`${id}: final-gate autofix did not converge — ${fix.reason.slice(0, 140)}`, 'warning');
             // NON-PROGRESS CLASSIFIER (mx5 run 14 item 2a). An attempt that changed the
@@ -407,46 +403,32 @@ export async function runFinalGateStage(active, deps, p) {
             // burned all three attempts on a boot probe that could not observe a
             // listener in that sandbox at all. Demote that one check to
             // UNOBSERVED-with-debt and let the REMAINING checks decide.
-            const detail = rankedFirstFailure({
-                reason: fix.gateReason,
-                failures: fix.gateFailures
-            });
-            const edited = fix.gateReason !== undefined && stranded.length > 0;
-            // …and whether a PROBE OBSERVED this failure (nexttask 19A). Exact text
-            // identity against the gate's own observed subset — not a second string
-            // pattern, which is the mistake `isNonProgress` already made once.
-            const observed = fix.gateObservedFailures?.includes(detail ?? '') === true;
-            if (detail !== null
-                && isNonProgress({
-                    previousSignature: prevFailSig,
-                    currentDetail: detail,
-                    edited,
-                    observed
-                })) {
-                demoted.add(normalizeFailureDetail(detail));
-                prevFailSig = null;
-                await carryDebt(unobservedDebtReason(detail));
-                await recGate(`final-gate: check DEMOTED to UNOBSERVED after ${fixAttempts} tree-changing `
+            //
+            // The judgement, the observed check and the signature carry-forward are
+            // the ledger's — made where the evidence is, not downstream from it.
+            const verdict = ledger.judge(fix.gate, fix.gate !== undefined && ledger.stranded().length > 0);
+            if (verdict.demoted) {
+                await carryDebt(verdict.debtReason);
+                await recGate(`final-gate: check DEMOTED to UNOBSERVED after ${attempt} tree-changing `
                     + `attempts returned an identical failure — carried as debt (origin final-gate) `
-                    + `and re-checked by the next run's gate: ${detail.slice(0, 240)}`);
+                    + `and re-checked by the next run's gate: ${verdict.detail.slice(0, 240)}`);
                 active.ui.notify(`${id}: final-gate check is unfalsifiable in this environment — carried as debt; `
                     + 'the remaining checks decide convergence.', 'warning');
             }
-            else {
-                prevFailSig = detail !== null ? normalizeFailureDetail(detail) : null;
-            }
             // Convergence on the REMAINING checks: a demoted signature no longer counts
             // against the gate. Nothing left ⇒ the run converges carrying the demotion
             // as debt, and the fix passes' repairs are committed rather than stranded.
-            if (demoted.size > 0 && fix.gateReason !== undefined) {
-                const remaining = applyDemotions(fix.gateFailures ?? [fix.gateReason], demoted);
-                if (remaining.length === 0) {
+            if (ledger.hasDemotions() && fix.gate !== undefined) {
+                const remaining = ledger.remaining(fix.gate);
+                if (remaining !== undefined && remaining.length === 0) {
                     await deps.commit(cwd, `FINAL GATE AUTOFIX (${id})`);
-                    const converged = `converged on all remaining checks; ${demoted.size} check(s) `
+                    const converged = `converged on all remaining checks; ${ledger.demotedCount()} check(s) `
                         + 'carried as UNOBSERVED debt (unfalsifiable in this environment)';
                     await recGate(`final-gate: ${converged}`);
                     active.ui.notify(`${id}: final integration gate converged — ${converged}.`, 'warning');
-                    fin = { ok: true, reason: converged };
+                    // The gate's own outcome, with this door's reason on it — the
+                    // whole value, so `openDebts` survives the assignment.
+                    fin = { ...fix.gate, ok: true, reason: converged };
                     // Converged on the REMAINING checks only: one or more were DEMOTED
                     // as unfalsifiable here, and the statics may be among them. No
                     // proof ⇒ pass false, so nothing static-class can auto-close on
@@ -464,17 +446,27 @@ export async function runFinalGateStage(active, deps, p) {
             // next picker and the next fix seed target only what is still falsifiable —
             // never re-aiming the child at the check the classifier just proved it
             // cannot move.
-            const freshFailures = fix.gateReason !== undefined ? fix.gateFailures : fin.failures;
-            const carried = freshFailures !== undefined ? applyDemotions(freshFailures, demoted) : undefined;
+            // Outcome to outcome. The base is the FRESH gate outcome when the fix
+            // pass got as far as re-running it, otherwise the one we already hold —
+            // and either way it arrives whole, so nothing (`openDebts`,
+            // `observedFailures`) is dropped by the assignment. This used to be a
+            // literal with four keys, and the field it omitted is the recorded mx5
+            // run-18 defect.
+            const base = fix.gate ?? fin;
+            const carried = base.failures === undefined ? undefined : ledger.remaining(base);
             fin = {
+                ...base,
                 ok: false,
-                reason: demoted.size > 0 && carried !== undefined && carried.length > 0 ?
+                reason: ledger.hasDemotions() && carried !== undefined && carried.length > 0 ?
                     carried[0]
-                    : (fix.gateReason ?? fin.reason),
-                failures: carried,
-                debtNote: fin.debtNote
+                    : base.reason,
+                ...(carried === undefined ? {} : { failures: carried }),
+                // The debt NOTE is the caller's running one: the next picker must
+                // still show the open claims, and the fresh gate's own note is
+                // reconciled separately against the final tree.
+                ...(fin.debtNote === undefined ? {} : { debtNote: fin.debtNote })
             };
-            if (fix.gateReason !== undefined && (fix.gateFailures?.length ?? 0) > 1) {
+            if (fix.gate !== undefined && (fix.gate.failures?.length ?? 0) > 1) {
                 await trailGateFail(fin);
             }
             continue;
@@ -492,8 +484,8 @@ export async function runFinalGateStage(active, deps, p) {
         return {
             kind: 'failed',
             message: `${id} finished all tasks but FAILED the final integration gate — ${fin.reason.slice(0, 200)} — fix and /task-auto-resume (the gate re-runs).`
-                + (stranded.length > 0 ?
-                    ` NOTE: ${stranded.length} fix-pass change(s) were committed separately (${stranded.slice(0, 4).join(', ')}).`
+                + (ledger.stranded().length > 0 ?
+                    ` NOTE: ${ledger.stranded().length} fix-pass change(s) were committed separately (${ledger.stranded().slice(0, 4).join(', ')}).`
                     : '')
         };
     }

package/dist/task/serve-entry.js

@@ -38,8 +38,9 @@
  *
  * Ground truth is the file tree only. No model, no network.
  */
-import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import * as path from 'node:path';
+import { shippedSources, stripCommentLines, SOURCE_JS_RE } from './shipped-source.js';
 /** A server-app construction: framework, and the regex that recognises it. */
 const CONSTRUCT_PATTERNS = [
     { re: /\bnew\s+Hono\s*[<(]/, construct: 'new Hono()' },
@@ -180,62 +181,10 @@ export function opaqueLauncher(cwd) {
     }
     return null;
 }
-// Directories never scanned: VCS/dep trees, build output (bundled copies of the
-// same sources), and test/fixture/example/doc trees — a test that stands up a
-// throwaway listener is not the app's launch, and a doc snippet is not code.
-const SKIP_DIR_RE = /^(?:\.git|node_modules|\.pi-tasks|dist|build|out|coverage|target|vendor|__pycache__|\.venv|venv|tmp|test|tests|__tests__|__mocks__|__fixtures__|fixtures|e2e|examples|example|docs|doc|bench|benchmarks)$/;
-const SKIP_FILE_RE = /\.(?:test|spec|stories|bench)\.[a-z]+$|\.d\.[mc]?ts$/i;
-const SCAN_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts)$/i;
-const MAX_SCAN_FILES = 3000;
-const MAX_FILE_BYTES = 400_000;
-/** Authored sources, bounded and in deterministic order. */
-function scanCandidates(cwd) {
-    const out = [];
-    const walk = (rel) => {
-        if (out.length >= MAX_SCAN_FILES)
-            return;
-        let entries;
-        try {
-            entries = readdirSync(path.join(cwd, rel)).sort();
-        }
-        catch {
-            return;
-        }
-        for (const name of entries) {
-            if (out.length >= MAX_SCAN_FILES)
-                return;
-            const relPath = rel === '' ? name : `${rel}/${name}`;
-            let st;
-            try {
-                st = statSync(path.join(cwd, relPath));
-            }
-            catch {
-                continue;
-            }
-            if (st.isDirectory()) {
-                if (name.startsWith('.') || SKIP_DIR_RE.test(name))
-                    continue;
-                walk(relPath);
-            }
-            else if (st.isFile() && st.size <= MAX_FILE_BYTES) {
-                if (SKIP_FILE_RE.test(name))
-                    continue;
-                if (SCAN_RE.test(name))
-                    out.push(relPath);
-            }
-        }
-    };
-    walk('');
-    return out;
-}
-/** Strip comment-only lines — a `Bun.serve` quoted in a comment is not a bind, and
- *  a commented-out catch-all is not a route. Inline comments are left alone. */
-function stripCommentLines(src) {
-    return src
-        .split('\n')
-        .filter(l => !/^\s*(?:\/\/|\*|\/\*)/.test(l))
-        .join('\n');
-}
+// The tree walk, the caps, the skip sets and the comment strip live in
+// task/shipped-source.ts — this scan and artifact-closure's were the same walker
+// written twice, and their skip sets had drifted apart on `bench`/`benchmarks`.
+const scanCandidates = (cwd) => shippedSources(cwd, { ext: SOURCE_JS_RE });
 /** A `/…/flags` literal whose body carries a regex METACHARACTER — `[`, `\`, `+`,
  *  `?`, `|`, a group. A path string like `'/api/admin'` has none, so it survives. */
 const REGEX_LITERAL_RE = /\/(?![*/])((?:\\.|\[(?:\\.|[^\]\\])*\]|[^/\\\n])+)\/[gimsuyd]*/g;

package/dist/task/shipped-source.d.ts

@@ -0,0 +1,67 @@
+/**
+ * What counts as SHIPPED SOURCE — the input every run-level closure scan reads.
+ *
+ * `CLOSURE_SCANS` (final-gate.ts) deepened the DRIVER of these scans: the fault
+ * isolation, the rank, the stage. It did not unify their INPUT, and the copies
+ * had drifted.
+ *
+ *  - `scanCandidates` existed twice, near-byte-identical — `serve-entry.ts` and
+ *    `artifact-closure.ts` — same `readdirSync().sort()` → `statSync` → recurse,
+ *    same 3000-file cap, same 400 KB per-file cap, same dot-dir rule.
+ *  - The skip sets had diverged: serve-entry carried `bench|benchmarks` and
+ *    `*.bench.*`; artifact-closure did not, so a dangling artifact reference in a
+ *    benchmark file was a run-level finding while the same file was invisible to
+ *    the sibling scan. Nothing in either file acknowledged the other.
+ *  - The same extension regex was declared twice under two names (`SCAN_RE`,
+ *    `SCAN_JS_RE`), and `stripCommentLines` was byte-identical in both.
+ *  - `.pi-tasks` was hardcoded into both skip sets rather than derived from
+ *    `TASKS_DIR_NAME`.
+ *
+ * The locality proof is in the suites: `artifact-closure.test.ts` has 28
+ * references to the pure extractors and 5 calls to the driver, and NO test in the
+ * cluster asserted a skip set at all. That is the shape recorded under
+ * `resolveTypeSource` — pure functions extracted for testability while the real
+ * logic stayed in how they are CALLED.
+ *
+ * NOT unified here: `env-template-closure.ts`. It asks a different question —
+ * which TRACKED files could read an env var, including `.py`/`.go`, including
+ * tests — and answering it over this walk would silently change which env
+ * findings a run produces. Its comment rule is not this one either: it is a
+ * per-line predicate that also treats `#` as a comment opener, which it must,
+ * and which would be wrong for JS/TS. Recorded as a real divergence rather than
+ * harmonised; changing it is an env-policy change with its own A/B.
+ */
+/** Authored JS/TS. The one declaration — it was two constants under two names. */
+export declare const SOURCE_JS_RE: RegExp;
+/** Markup a produced artifact can be referenced from. */
+export declare const SOURCE_HTML_RE: RegExp;
+/** Bounds. A scan is a gate step, not a search: it must terminate on any tree. */
+export declare const MAX_SCAN_FILES = 3000;
+export declare const MAX_FILE_BYTES = 400000;
+/** Is this directory NAME (not path) one no closure scan descends into? */
+export declare function isSkippedDir(name: string): boolean;
+/** Is this file NAME one no closure scan reads? */
+export declare function isSkippedFile(name: string): boolean;
+export interface ShippedSourceOptions {
+    /** Which extensions this scan reads. */
+    ext: RegExp;
+    /**
+     * Extra ROOT-LEVEL directory names to exclude. artifact-closure's own: a
+     * produced output tree re-referencing its own chunks is noise, and which dirs
+     * are produced is discovered per run, so it cannot live in the static set.
+     */
+    excludeRoots?: ReadonlySet<string>;
+}
+/**
+ * Walk `cwd` for shipped sources — bounded, deterministic order, never throws.
+ *
+ * Unreadable directories and unstattable entries are skipped rather than fatal:
+ * a closure scan runs against whatever tree the implementation left behind.
+ */
+export declare function shippedSources(cwd: string, opts: ShippedSourceOptions): string[];
+/**
+ * Strip comment-only lines. A `Bun.serve` quoted in a comment is not a bind, a
+ * commented-out catch-all is not a route, and a path in a comment is not a
+ * runtime read. Inline comments are left alone — strings may contain `//`.
+ */
+export declare function stripCommentLines(src: string): string;

package/dist/task/shipped-source.js

@@ -0,0 +1,144 @@
+/**
+ * What counts as SHIPPED SOURCE — the input every run-level closure scan reads.
+ *
+ * `CLOSURE_SCANS` (final-gate.ts) deepened the DRIVER of these scans: the fault
+ * isolation, the rank, the stage. It did not unify their INPUT, and the copies
+ * had drifted.
+ *
+ *  - `scanCandidates` existed twice, near-byte-identical — `serve-entry.ts` and
+ *    `artifact-closure.ts` — same `readdirSync().sort()` → `statSync` → recurse,
+ *    same 3000-file cap, same 400 KB per-file cap, same dot-dir rule.
+ *  - The skip sets had diverged: serve-entry carried `bench|benchmarks` and
+ *    `*.bench.*`; artifact-closure did not, so a dangling artifact reference in a
+ *    benchmark file was a run-level finding while the same file was invisible to
+ *    the sibling scan. Nothing in either file acknowledged the other.
+ *  - The same extension regex was declared twice under two names (`SCAN_RE`,
+ *    `SCAN_JS_RE`), and `stripCommentLines` was byte-identical in both.
+ *  - `.pi-tasks` was hardcoded into both skip sets rather than derived from
+ *    `TASKS_DIR_NAME`.
+ *
+ * The locality proof is in the suites: `artifact-closure.test.ts` has 28
+ * references to the pure extractors and 5 calls to the driver, and NO test in the
+ * cluster asserted a skip set at all. That is the shape recorded under
+ * `resolveTypeSource` — pure functions extracted for testability while the real
+ * logic stayed in how they are CALLED.
+ *
+ * NOT unified here: `env-template-closure.ts`. It asks a different question —
+ * which TRACKED files could read an env var, including `.py`/`.go`, including
+ * tests — and answering it over this walk would silently change which env
+ * findings a run produces. Its comment rule is not this one either: it is a
+ * per-line predicate that also treats `#` as a comment opener, which it must,
+ * and which would be wrong for JS/TS. Recorded as a real divergence rather than
+ * harmonised; changing it is an env-policy change with its own A/B.
+ */
+import { readdirSync, statSync } from 'node:fs';
+import * as path from 'node:path';
+import { TASKS_DIR_NAME } from './task-types.js';
+/**
+ * Directories never scanned: VCS/dep trees, build output (bundled copies of the
+ * same sources), and test/fixture/example/doc/bench trees — a test that stands up
+ * a throwaway listener is not the app's launch, a doc snippet is not code, and a
+ * benchmark references fixture paths freely.
+ */
+const SKIP_DIRS = new Set([
+    '.git',
+    'node_modules',
+    TASKS_DIR_NAME,
+    'dist',
+    'build',
+    'out',
+    'coverage',
+    'target',
+    'vendor',
+    '__pycache__',
+    '.venv',
+    'venv',
+    'tmp',
+    'test',
+    'tests',
+    '__tests__',
+    '__mocks__',
+    '__fixtures__',
+    'fixtures',
+    'e2e',
+    'examples',
+    'example',
+    'docs',
+    'doc',
+    'bench',
+    'benchmarks'
+]);
+const SKIP_FILE_RE = /\.(?:test|spec|stories|bench)\.[a-z]+$|\.d\.[mc]?ts$/i;
+/** Authored JS/TS. The one declaration — it was two constants under two names. */
+export const SOURCE_JS_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs|mts|cts)$/i;
+/** Markup a produced artifact can be referenced from. */
+export const SOURCE_HTML_RE = /\.html?$/i;
+/** Bounds. A scan is a gate step, not a search: it must terminate on any tree. */
+export const MAX_SCAN_FILES = 3000;
+export const MAX_FILE_BYTES = 400_000;
+/** Is this directory NAME (not path) one no closure scan descends into? */
+export function isSkippedDir(name) {
+    return name.startsWith('.') || SKIP_DIRS.has(name);
+}
+/** Is this file NAME one no closure scan reads? */
+export function isSkippedFile(name) {
+    return SKIP_FILE_RE.test(name);
+}
+/**
+ * Walk `cwd` for shipped sources — bounded, deterministic order, never throws.
+ *
+ * Unreadable directories and unstattable entries are skipped rather than fatal:
+ * a closure scan runs against whatever tree the implementation left behind.
+ */
+export function shippedSources(cwd, opts) {
+    const out = [];
+    const walk = (rel) => {
+        if (out.length >= MAX_SCAN_FILES)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(path.join(cwd, rel)).sort();
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (out.length >= MAX_SCAN_FILES)
+                return;
+            const relPath = rel === '' ? name : `${rel}/${name}`;
+            let st;
+            try {
+                st = statSync(path.join(cwd, relPath));
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory()) {
+                if (isSkippedDir(name))
+                    continue;
+                if (rel === '' && opts.excludeRoots?.has(name))
+                    continue;
+                walk(relPath);
+            }
+            else if (st.isFile() && st.size <= MAX_FILE_BYTES) {
+                if (isSkippedFile(name))
+                    continue;
+                if (opts.ext.test(name))
+                    out.push(relPath);
+            }
+        }
+    };
+    walk('');
+    return out;
+}
+/**
+ * Strip comment-only lines. A `Bun.serve` quoted in a comment is not a bind, a
+ * commented-out catch-all is not a route, and a path in a comment is not a
+ * runtime read. Inline comments are left alone — strings may contain `//`.
+ */
+export function stripCommentLines(src) {
+    return src
+        .split('\n')
+        .filter(l => !/^\s*(?:\/\/|\*|\/\*)/.test(l))
+        .join('\n');
+}

package/dist/task/task-gates.d.ts

@@ -31,7 +31,7 @@
 import type { ExtensionCommandContext } from '@earendil-works/pi-coding-agent';
 import type { RunSingleTaskResult } from './orchestrator.js';
 import type { CommitResult } from './auto-commit.js';
-import type { VerifyOutcome } from './verify-work.js';
+import { type VerifyOutcome } from './verify-work.js';
 import type { EnforceOutcome } from './enforce-guidelines.js';
 import { type ResolutionOutcome, type ResolutionChoice } from './verify-resolution.js';
 import { type RepairCandidate } from './root-cause-repair.js';
@@ -248,6 +248,14 @@ export type GateResult = {
     kind: 'interrupted';
     ctx: ExtensionCommandContext;
 }
+/**
+ * The USER cancelled an AUTOFIX re-run. Distinct from `interrupted`: the task
+ * file already says `cancelled` and must not be demoted to `failed` over it.
+ */
+ | {
+    kind: 'cancelled';
+    ctx: ExtensionCommandContext;
+}
 /** An AUTOFIX re-run's implementation itself failed. */
  | {
     kind: 'failed';