@mjasnikovs/pi-task 0.38.2 → 0.38.4

package/dist/task/critique-probes.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The critique phase's deterministic Probes, as a table.
+ *
+ * Each row is a defect a model does not self-discover reliably, found by a pure
+ * scanner over the composed spec, and forced into the rewrite. Together they are
+ * the deterministic half of critique: the triage child judges taste, these decide
+ * facts.
+ *
+ * Why a table. Every probe used to be written out three times inside
+ * `phaseCritique` — once as a four-line detect/format/log ritual, once as a term
+ * in the seven-way conjunction that lets a CLEAN triage short-circuit, and once
+ * as an element of the array merged into the rewrite. Adding a probe meant three
+ * coordinated edits, and forgetting the SECOND one is silent and severe: a CLEAN
+ * triage would then ship a spec carrying a defect the scanner had already found —
+ * which is precisely the failure each probe exists to prevent. No test would
+ * notice, because the wiring, unlike the scanners, was almost entirely untested
+ * (1 of 6).
+ *
+ * With a table the override and the merge are DERIVED from the rows, so "every
+ * probe blocks a CLEAN short-circuit" is structurally true rather than something
+ * a reviewer must check. This is the same move `PROBE_ADAPTERS` (verify-work.ts)
+ * and `CLOSURE_SCANS` (final-gate.ts) already made; critique is the one place
+ * that never got it.
+ */
+/** Everything the probes read. Assembled once by the critique phase. */
+export interface CritiqueProbeContext {
+    /** The composed draft under critique. */
+    spec: string;
+    /** The refined feature description the draft was composed from. */
+    refined: string;
+    /** The task's RESEARCH section, when it has one. */
+    research?: string;
+    cwd: string;
+    /** The cross-slice contract registry, verbatim. Empty for a single /task. */
+    registryRaw: string;
+    planContext?: string;
+}
+interface CritiqueProbe<F> {
+    id: string;
+    /** Findings, or empty when the probe does not fire. Pure and total. */
+    detect: (ctx: CritiqueProbeContext) => F[];
+    /** The defect block fed to the rewrite as a forced FOCUS item. */
+    text: (findings: F[], ctx: CritiqueProbeContext) => string;
+    /** One debug line naming what was flagged. */
+    log: (findings: F[]) => string;
+    /**
+     * A rewrite that was HANDED this defect and shipped it anyway is a failed
+     * rewrite, not a finished one. Rows that can check their own closure name the
+     * retry problem here; the emphasis retry then gets a targeted hint.
+     */
+    unresolvedProblem?: {
+        name: string;
+        stillPresent: (rewritten: string) => boolean;
+    };
+}
+/**
+ * The probes, in the order their defects reach the rewrite. Order is presentation
+ * only — every row that fires blocks the CLEAN short-circuit equally.
+ */
+export declare const CRITIQUE_PROBES: ReadonlyArray<CritiqueProbe<unknown>>;
+/** What the deterministic half of critique found. */
+export interface CritiqueDefects {
+    /** One defect block per probe that fired, in table order. */
+    blocks: string[];
+    /**
+     * True when any probe fired. A CLEAN triage verdict may NOT short-circuit the
+     * rewrite while this holds — the whole reason the override exists.
+     */
+    forced: boolean;
+    /**
+     * The retry problem for a rewrite that shipped a flagged defect anyway, or
+     * null. Only probes that were actually FIRED are re-checked: a defect the
+     * draft never had is not the rewrite's to resolve.
+     */
+    unresolvedIn: (rewritten: string) => string | null;
+}
+/**
+ * Run every probe over one draft. The loop owns the ritual — skip-when-empty,
+ * log, order — so a row cannot be added that silently skips any of it.
+ */
+export declare function collectCritiqueDefects(ctx: CritiqueProbeContext, logDebug?: (line: string) => void): CritiqueDefects;
+export {};

package/dist/task/critique-probes.js

@@ -0,0 +1,156 @@
+/**
+ * The critique phase's deterministic Probes, as a table.
+ *
+ * Each row is a defect a model does not self-discover reliably, found by a pure
+ * scanner over the composed spec, and forced into the rewrite. Together they are
+ * the deterministic half of critique: the triage child judges taste, these decide
+ * facts.
+ *
+ * Why a table. Every probe used to be written out three times inside
+ * `phaseCritique` — once as a four-line detect/format/log ritual, once as a term
+ * in the seven-way conjunction that lets a CLEAN triage short-circuit, and once
+ * as an element of the array merged into the rewrite. Adding a probe meant three
+ * coordinated edits, and forgetting the SECOND one is silent and severe: a CLEAN
+ * triage would then ship a spec carrying a defect the scanner had already found —
+ * which is precisely the failure each probe exists to prevent. No test would
+ * notice, because the wiring, unlike the scanners, was almost entirely untested
+ * (1 of 6).
+ *
+ * With a table the override and the merge are DERIVED from the rows, so "every
+ * probe blocks a CLEAN short-circuit" is structurally true rather than something
+ * a reviewer must check. This is the same move `PROBE_ADAPTERS` (verify-work.ts)
+ * and `CLOSURE_SCANS` (final-gate.ts) already made; critique is the one place
+ * that never got it.
+ */
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { findSkipEscapes, skipEscapeDefectText } from './skip-escape.js';
+import { findSynthesizedWiring, wiringProbeText, readReferencedDocs } from './wiring-claims.js';
+import { findAbsenceConflicts, absenceProbeText, siblingTitlesFromPlanContext } from './verify-reconcile.js';
+import { findFrozenPathConflicts, frozenConflictProbeText } from './frozen-conflict.js';
+import { findGrepOnlyVerify, grepOnlyVerifyDefectText } from './verify-quality.js';
+import { findScriptEscapesInText, scriptEscapeDefectText } from './script-escape.js';
+/** Narrow helper so each row keeps its own finding type without a cast. */
+function probe(row) {
+    return row;
+}
+/**
+ * The probes, in the order their defects reach the rewrite. Order is presentation
+ * only — every row that fires blocks the CLEAN short-circuit equally.
+ */
+export const CRITIQUE_PROBES = [
+    probe({
+        // run-8 F2: a required VERIFY check wrapped in a skip-announcing `||`
+        // fallback (`… || echo "skipping (tool absent)"`) lets the check pass
+        // while never running. FP-measured 0/20 on the historical specs.
+        id: 'skip-escape',
+        detect: ctx => findSkipEscapes(ctx.spec),
+        text: f => skipEscapeDefectText(f),
+        log: f => `skip-escape flagged in VERIFY: ${f.length} line(s)`
+    }),
+    probe({
+        // run-8 F3, generation side. The registry alone is a WEAK catcher (live
+        // A/B: prompt+registry ~1/8) — the model's attention goes to the obvious
+        // VERIFY weakness and it rarely does the path-composition reasoning. The
+        // scanner NAMES the inferred mount mappings and juxtaposes the verbatim
+        // pinned facts, forcing focused reconciliation. FP-clean (1/18 files on
+        // the run-8 trees). Grounding = the registry ∪ any design doc the
+        // spec/refined @-reference. No registry ⇒ nothing to contradict.
+        id: 'synthesized-wiring',
+        detect: ctx => ctx.registryRaw.trim().length > 0 ?
+            findSynthesizedWiring(ctx.spec, ctx.registryRaw + '\n' + readReferencedDocs(ctx.cwd, ctx.refined, ctx.spec), ctx.registryRaw)
+            : [],
+        text: (f, ctx) => wiringProbeText(f, ctx.registryRaw),
+        log: f => `synthesized wiring flagged in spec: ${f.map(w => w.line).join(' | ')}`
+    }),
+    probe({
+        // mx5 run 11, goal D: a VERIFY line asserting the ABSENCE of an artifact
+        // the plan pins elsewhere — a path a prior task already shipped, a sibling
+        // title's deliverable, a contract-pinned boundary. Run 11: the scope fence
+        // leaked into TASK_0009's verify as "the admin page must NOT exist"
+        // (TASK_0008's deliverable); the guaranteed FAIL became an accepted debt
+        // that the final-gate autofix then "fixed" by deleting the sibling's work.
+        // It must die here, at spec time. Delete-tasks keep their check by
+        // declaring the delete.
+        id: 'plan-contradiction',
+        detect: ctx => findAbsenceConflicts(ctx.spec, {
+            fileExists: p => existsSync(resolve(ctx.cwd, p)),
+            siblingTitles: siblingTitlesFromPlanContext(ctx.planContext),
+            contracts: ctx.registryRaw
+        }),
+        text: f => absenceProbeText(f),
+        log: f => 'plan-contradiction flagged in VERIFY: '
+            + f.map(c => `${c.assertion.target} (${c.against})`).join(' | ')
+    }),
+    probe({
+        // mx5 run 12 root cause: a blanket frozen path ("Do NOT modify
+        // `tsconfig.json` … handled in steps 1–2") whose registration edit the
+        // spec's OWN body — or the task's RESEARCH the spec was composed from
+        // (live drafts sometimes drop the nuance while shipping the freeze and the
+        // creation) — says the deliverable requires. Shipped as-is, the created
+        // files turn the repo-wide static check permanently red and no task is
+        // allowed to fix it: every later task burns its AUTOFIX rounds on it. The
+        // rewrite must grant scoped ownership or drop the creation.
+        id: 'frozen-conflict',
+        detect: ctx => findFrozenPathConflicts(ctx.spec, ctx.research),
+        text: f => frozenConflictProbeText(f),
+        log: f => 'unsatisfiable freeze/requires-edit pair flagged in spec: '
+            + f.map(c => c.path).join(' | ')
+    }),
+    probe({
+        // mx5 run 13, Bug B: a VERIFY block that grep-asserts the SOURCE of a
+        // runnable deliverable while every command in the block is static
+        // inspection — the build script "verified" by three greps that was never
+        // run, shipping broken for 14 tasks. VERIFY must EXECUTE the artifact and
+        // assert an observable outcome of that run.
+        id: 'grep-theater',
+        detect: ctx => findGrepOnlyVerify(ctx.spec),
+        text: f => grepOnlyVerifyDefectText(f),
+        log: f => `grep-theater VERIFY flagged in spec: ${f.map(x => x.target).join(' | ')}`,
+        // Detector-backed closure: live A/B, 1/5 rewrites ignored the injected
+        // defect and re-shipped the grep-only block.
+        unresolvedProblem: {
+            name: 'verify_grep_theater',
+            stillPresent: rewritten => findGrepOnlyVerify(rewritten).length > 0
+        }
+    }),
+    probe({
+        // mx5 run 13, PROMPT 4 item 4: a spec that DICTATES a check script which
+        // cannot fail — `"lint": "… || true"`, or a checker laundered through an
+        // inverted grep. Whatever task implements that spec writes the disarmed
+        // script into package.json, and from then on every gate that runs it
+        // reads a constant. Cheapest to kill here, before it is authored.
+        id: 'script-escape',
+        detect: ctx => findScriptEscapesInText(ctx.spec),
+        text: f => scriptEscapeDefectText(f),
+        log: f => `neutered check script dictated by spec: ${f.map(x => x.name).join(' | ')}`
+    })
+];
+/**
+ * Run every probe over one draft. The loop owns the ritual — skip-when-empty,
+ * log, order — so a row cannot be added that silently skips any of it.
+ */
+export function collectCritiqueDefects(ctx, logDebug) {
+    const blocks = [];
+    const fired = [];
+    for (const row of CRITIQUE_PROBES) {
+        const findings = row.detect(ctx);
+        if (findings.length === 0)
+            continue;
+        fired.push(row);
+        blocks.push(row.text(findings, ctx));
+        logDebug?.(row.log(findings));
+    }
+    return {
+        blocks,
+        forced: blocks.length > 0,
+        unresolvedIn: rewritten => {
+            for (const row of fired) {
+                if (row.unresolvedProblem?.stillPresent(rewritten) === true) {
+                    return row.unresolvedProblem.name;
+                }
+            }
+            return null;
+        }
+    };
+}

package/dist/task/deep-render-check.d.ts

@@ -1,3 +1,4 @@
+import WebSocket from 'ws';
 export type DeepRenderOutcome = {
     outcome: 'pass';
     detail: string;
@@ -132,6 +133,31 @@ export declare function deriveLegacyFacts(log: SessionRequest[]): Pick<DeepSessi
 export declare function judgeDeepSession(f: DeepSessionFacts): DeepRenderOutcome;
 /** Whole-session wall-clock cap, including browser launch (I4). */
 export declare const DEEP_RENDER_TIMEOUT_MS = 45000;
+/** Minimal DevTools-protocol client: request/response ids over one socket, plus
+ *  event fan-out. Everything the driver needs and nothing more.
+ *
+ *  @internal Exported for its own tests: the id/response matching and the
+ *  send-failure path are the parts of the driver that need no browser. */
+export declare class Cdp {
+    private readonly ws;
+    private nextId;
+    private readonly pending;
+    private readonly handlers;
+    constructor(ws: WebSocket);
+    on(method: string, cb: (params: Record<string, unknown>) => void): void;
+    send(method: string, params?: Record<string, unknown>, sessionId?: string): Promise<Record<string, unknown>>;
+}
+/** Page-side fill: native value setters + input/change events, so a controlled
+ *  React/Vue/Svelte input actually updates its state (a bare `el.value = …` does
+ *  not, and the form then submits empty).
+ *
+ *  @internal Exported so the credential ESCAPING is testable: a password with a
+ *  quote or a backslash in it must not break out of the injected expression. */
+export declare function fillExpr(identifier: string, password: string): string;
+/** Wait until `ms` of silence pass with no new request, or `cap` elapses.
+ *  @internal Exported for its own tests — the quiet/cap arithmetic decides
+ *  whether a slow page is judged half-loaded. */
+export declare function settle(lastActivity: () => number, cap: number, quiet?: number): Promise<void>;
 /**
  * Drive one authenticated session against `url` and judge it. `cwd` is the project
  * whose dotenv declares the account. Every failure mode of the DRIVER itself
@@ -146,4 +172,8 @@ export declare function runDeepRenderCheck(url: string, cwd: string, opts?: {
     /** Recorder hook: receives the facts the verdict was made on. Used by the
      *  corpus builder; the gate itself never passes it. */
     onFacts?: (f: DeepSessionFacts) => void;
+    /** @internal Settle quiet window, for tests only. The three settle windows
+     *  cost QUIET_MS each against a fake browser that answers instantly, which
+     *  is the whole runtime of a driver test. The gate never passes it. */
+    quietMs?: number;
 }): Promise<DeepRenderOutcome>;

package/dist/task/deep-render-check.js

@@ -348,8 +348,11 @@ const POST_SUBMIT_CAP_MS = 12_000;
  *  small so the three settle windows together stay inside DEEP_RENDER_TIMEOUT_MS. */
 const RE_NAV_CAP_MS = 6_000;
 /** Minimal DevTools-protocol client: request/response ids over one socket, plus
- *  event fan-out. Everything the driver needs and nothing more. */
-class Cdp {
+ *  event fan-out. Everything the driver needs and nothing more.
+ *
+ *  @internal Exported for its own tests: the id/response matching and the
+ *  send-failure path are the parts of the driver that need no browser. */
+export class Cdp {
     ws;
     nextId = 1;
     pending = new Map();
@@ -418,8 +421,11 @@ const INSPECT_EXPR = `(() => {
 })()`;
 /** Page-side fill: native value setters + input/change events, so a controlled
  *  React/Vue/Svelte input actually updates its state (a bare `el.value = …` does
- *  not, and the form then submits empty). */
-function fillExpr(identifier, password) {
+ *  not, and the form then submits empty).
+ *
+ *  @internal Exported so the credential ESCAPING is testable: a password with a
+ *  quote or a backslash in it must not break out of the injected expression. */
+export function fillExpr(identifier, password) {
     return `(() => {
     const setValue = (el, v) => {
         const proto = el instanceof HTMLTextAreaElement ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype
@@ -457,8 +463,10 @@ const SUBMIT_EXPR = `(() => {
     if (submit) { submit.click(); return {ok: true, how: 'click'} }
     return {ok: false, reason: 'no submit control'}
 })()`;
-/** Wait until `ms` of silence pass with no new request, or `cap` elapses. */
-async function settle(lastActivity, cap, quiet = QUIET_MS) {
+/** Wait until `ms` of silence pass with no new request, or `cap` elapses.
+ *  @internal Exported for its own tests — the quiet/cap arithmetic decides
+ *  whether a slow page is judged half-loaded. */
+export async function settle(lastActivity, cap, quiet = QUIET_MS) {
     const deadline = Date.now() + cap;
     for (;;) {
         const idleFor = Date.now() - lastActivity();
@@ -514,7 +522,7 @@ export async function runDeepRenderCheck(url, cwd, opts = {}) {
             child = c;
         }, s => {
             socket = s;
-        }, opts.onFacts), budget);
+        }, opts.onFacts, opts.quietMs), budget);
     }
     catch (e) {
         const why = e instanceof Error ? e.message : String(e);
@@ -540,7 +548,7 @@ function withTimeout(p, ms) {
         });
     });
 }
-async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket, onFacts) {
+async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket, onFacts, quietMs) {
     const origin = new URL(url).origin;
     /** Every verdict goes through here, so a recorder sees the same facts the judge
      *  does — the corpus is what the gate itself read, not a reconstruction. */
@@ -626,7 +634,7 @@ async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket,
         return r.result?.value;
     };
     await cdp.send('Page.navigate', { url }, sessionId);
-    await settle(() => lastActivity, SETTLE_CAP_MS);
+    await settle(() => lastActivity, SETTLE_CAP_MS, quietMs);
     const before = await evaluate(INSPECT_EXPR);
     if (!before)
         throw new Error('the page could not be inspected');
@@ -698,7 +706,7 @@ async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket,
     if (!submitted?.ok)
         return judge(unsubmitted({ submitted: false }));
     lastActivity = Date.now();
-    await settle(() => lastActivity, POST_SUBMIT_CAP_MS);
+    await settle(() => lastActivity, POST_SUBMIT_CAP_MS, quietMs);
     // The sign-in request: the first same-origin non-GET issued by the submit. Its
     // own 2xx is the precondition for judging anything, and it is excluded from the
     // data evidence (STEP 0: the broken build satisfies "≥1 same-origin 2xx" with
@@ -731,7 +739,7 @@ async function drive(url, bin, userDataDir, credentials, holdChild, holdSocket,
     if (authAccepted && leftAuthWall) {
         await cdp.send('Page.navigate', { url }, sessionId);
         lastActivity = Date.now();
-        await settle(() => lastActivity, RE_NAV_CAP_MS);
+        await settle(() => lastActivity, RE_NAV_CAP_MS, quietMs);
     }
     return judge(facts(sessionLog(authId, authAt), {
         submitted: true,

package/dist/task/enforce-guidelines.d.ts

@@ -1,4 +1,5 @@
 import type { SpawnFn } from '../shared/child-process.js';
+import { type WorkerFailureInput } from '../workers/worker-failure.js';
 /** Filenames discovered in the working directory (cwd only — no tree walk). */
 export declare const GUIDELINE_FILENAMES: readonly ["AGENTS.md", "CLAUDE.md"];
 /**
@@ -82,29 +83,25 @@ export declare function parseEnforceVerdict(text: string): {
     detail: string;
 };
 /** The subset of a runWorker result the enforcement-child mapping reads. */
-export interface EnforceChildResult {
+export interface EnforceChildResult extends WorkerFailureInput {
     text: string;
-    exitCode: number;
-    aborted: boolean;
-    timedOut?: boolean;
-    loopHit?: unknown;
-    leakedToolCall?: unknown;
-    stalled?: boolean;
-    commandTimedOut?: {
-        toolName: string;
-        timeoutMs: number;
-    };
 }
 /**
  * Map the enforcement child's runWorker result to a fatal error message, or null
  * when it finished cleanly enough to parse a verdict from its text.
  *
- * The order is load-bearing. A loop-kill AND a wall-clock timeout BOTH also set
- * `aborted` (and a non-zero exit) — killProc flips it on every kill path — so the
- * specific causes (timeout, loop, leaked tool call) must be handled BEFORE the
- * generic `aborted → user-cancel` and `exitCode` mappings. Checking `aborted`
- * first (as the original inline code did) mislabels a loop-killed enforcement
- * child as a user cancel.
+ * The ORDER is load-bearing and no longer lives here: every kill path also sets
+ * `aborted` and a non-zero exit, so the specific causes must be matched before
+ * the generic ones, and that precedence is stated once in `classifyWorkerFailure`
+ * (workers/worker-failure.ts). This function is now only the enforce-specific
+ * half — what each cause MEANS to guideline enforcement.
+ *
+ * Writing the ladder out by hand here is exactly what cost us the stream-stall
+ * bug: `streamStalled` was added to the worker result and to `finalAttemptFailed`
+ * but never to this ladder, so a child killed for a dead model stream fell
+ * through to `aborted → USER_CANCELLED` and a hung backend was reported to the
+ * user as their own cancel. The switch below is exhaustive, so the next cause
+ * added to the union is a compile error here rather than a silent mislabel.
  *
  * A loop is NOT fatal: enforce attaches the detector in nudge-then-warn mode, so a
  * loop that survived its restart-with-hint nudges returns null here (the caller

package/dist/task/enforce-guidelines.js

@@ -25,6 +25,7 @@ import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import { makeGit } from '../shared/git-runner.js';
 import { USER_CANCELLED } from './child-runner.js';
+import { classifyWorkerFailure } from '../workers/worker-failure.js';
 import { TASKS_DIR_NAME } from './task-types.js';
 import { findProbeGamingInDiff } from './probe-gaming.js';
 /** Filenames discovered in the working directory (cwd only — no tree walk). */
@@ -204,12 +205,18 @@ export function parseEnforceVerdict(text) {
  * Map the enforcement child's runWorker result to a fatal error message, or null
  * when it finished cleanly enough to parse a verdict from its text.
  *
- * The order is load-bearing. A loop-kill AND a wall-clock timeout BOTH also set
- * `aborted` (and a non-zero exit) — killProc flips it on every kill path — so the
- * specific causes (timeout, loop, leaked tool call) must be handled BEFORE the
- * generic `aborted → user-cancel` and `exitCode` mappings. Checking `aborted`
- * first (as the original inline code did) mislabels a loop-killed enforcement
- * child as a user cancel.
+ * The ORDER is load-bearing and no longer lives here: every kill path also sets
+ * `aborted` and a non-zero exit, so the specific causes must be matched before
+ * the generic ones, and that precedence is stated once in `classifyWorkerFailure`
+ * (workers/worker-failure.ts). This function is now only the enforce-specific
+ * half — what each cause MEANS to guideline enforcement.
+ *
+ * Writing the ladder out by hand here is exactly what cost us the stream-stall
+ * bug: `streamStalled` was added to the worker result and to `finalAttemptFailed`
+ * but never to this ladder, so a child killed for a dead model stream fell
+ * through to `aborted → USER_CANCELLED` and a hung backend was reported to the
+ * user as their own cancel. The switch below is exhaustive, so the next cause
+ * added to the union is a compile error here rather than a silent mislabel.
  *
  * A loop is NOT fatal: enforce attaches the detector in nudge-then-warn mode, so a
  * loop that survived its restart-with-hint nudges returns null here (the caller
@@ -218,32 +225,38 @@ export function parseEnforceVerdict(text) {
  * effects don't get re-classified as a user cancel or a crash.
  */
 export function classifyEnforceChildFailure(r) {
-    // Stall-kill must be matched BEFORE `aborted`: the kill sets aborted too,
-    // and mislabeling a dead model backend as a user cancel hides the cause
-    // (mx5 run 7: 64 minutes of silence).
-    if (r.stalled) {
-        return 'model server unreachable — the child produced no output and the model endpoint did not respond';
-    }
-    // Same rule, same reason: the command watchdog's kill sets `aborted` too, so
-    // a child killed for a command that never returned would otherwise report as
-    // a user cancel. Its text is truncated mid-run — the verdict in it is partial
-    // and must never be parsed as a real one.
-    if (r.commandTimedOut) {
-        const mins = Math.max(1, Math.round(r.commandTimedOut.timeoutMs / 60_000));
-        return (`child ran a \`${r.commandTimedOut.toolName}\` command that had not returned after `
-            + `${mins} minute${mins === 1 ? '' : 's'} and was killed — it never bounded the command`);
+    const failure = classifyWorkerFailure(r);
+    if (!failure)
+        return null;
+    switch (failure.kind) {
+        case 'stalled':
+            // mx5 run 7: 64 minutes of silence reported as a user cancel.
+            return 'model server unreachable — the child produced no output and the model endpoint did not respond';
+        case 'command-timeout': {
+            // Its text is truncated mid-run — the verdict in it is partial and
+            // must never be parsed as a real one.
+            const mins = Math.max(1, Math.round(failure.timeoutMs / 60_000));
+            return (`child ran a \`${failure.toolName}\` command that had not returned after `
+                + `${mins} minute${mins === 1 ? '' : 's'} and was killed — it never bounded the command`);
+        }
+        case 'stream-stall': {
+            // The arm this ladder was missing. Same class as the two above: a
+            // watchdog, not the model, ended the run, and the text is partial.
+            const secs = Math.max(1, Math.round(failure.idleMs / 1000));
+            return (`model stream went silent for ${secs}s with no tool running and the child was `
+                + 'killed — the backend stopped producing, the child did not stop working');
+        }
+        case 'worker-timeout':
+            return 'enforcement child timed out';
+        case 'loop':
+            return null; // looped past the nudges → warning, handled by caller
+        case 'leaked-tool-call':
+            return 'enforcement child leaked a tool call';
+        case 'aborted':
+            return USER_CANCELLED;
+        case 'exit':
+            return `enforcement child exited ${failure.code}`;
     }
-    if (r.timedOut)
-        return 'enforcement child timed out';
-    if (r.loopHit)
-        return null; // looped past the nudges → warning, handled by caller
-    if (r.leakedToolCall)
-        return 'enforcement child leaked a tool call';
-    if (r.aborted)
-        return USER_CANCELLED;
-    if (r.exitCode !== 0)
-        return `enforcement child exited ${r.exitCode}`;
-    return null;
 }
 /**
  * The git "empty tree" object — the canonical base for diffing a ROOT commit

package/dist/task/final-gate.d.ts

@@ -2,6 +2,7 @@ import { type HealthCommand } from './repo-health-check.js';
 import { type AcceptDebt, type VerifyRerunResult } from './accept-debt.js';
 import { type RenderOutcome } from './render-check.js';
 import { type DeepRenderOutcome } from './deep-render-check.js';
+import { type CommandRunner } from './command-run.js';
 import { taskThatIntroduced } from './task-provenance.js';
 export interface FinalGateOutcome {
     /** true → statics and every runnable integration command passed (or nothing to run). */
@@ -336,14 +337,6 @@ export declare function discoverGateCommandLabels(cwd: string): string[];
  * guard already owns.
  */
 export declare function discoverGateCommandBodies(cwd: string): Record<string, string>;
-/**
- * A non-zero exit whose output shows the EXTERNAL INFRASTRUCTURE a launch script
- * talks to is absent HERE — a database/daemon that is not running or not
- * installed — rather than a fault in the script itself. Applied ONLY to
- * launch-contract scripts (a migrate/seed against no DB is an environment gap on
- * this box; the same wording in a `test` run is a real failure the suite must own).
- */
-export declare const INFRA_GAP_OUTPUT_RE: RegExp;
 /**
  * How a re-run of ONE recorded VERIFY command line ended.
  *   pass — it ran and exited 0. The ONLY outcome that may close a debt.
@@ -377,7 +370,9 @@ export type VerifyRerunOutcome = {
  * failure, missing tool, unreachable database, timeout, no POSIX shell — leaves the
  * debt exactly as open as it was.
  */
-export declare function runVerifyCommandLine(cwd: string, line: string, timeoutMs: number, extraGapRe?: RegExp): VerifyRerunOutcome;
+export declare function runVerifyCommandLine(cwd: string, line: string, timeoutMs: number, extraGapRe?: RegExp, 
+/** The spawner. Injected so a re-run's outcome can be tested without one. */
+run?: CommandRunner): VerifyRerunOutcome;
 /**
  * The full-skip blindness guard (mx5 run 16, validated): dynamic commands were
  * DISCOVERED but every single one skipped as an environment gap, so the gate
@@ -537,7 +532,10 @@ export declare function deriveOpenDebts(cwd: string, staticOk: boolean): Promise
  * the guard: the re-run is INCONCLUSIVE there, because "nothing changed" would be an
  * assumption rather than an observation.
  */
-export declare function rerunDebtVerifyCommand(cwd: string, command: string): VerifyRerunResult;
+export declare function rerunDebtVerifyCommand(cwd: string, command: string, 
+/** The spawner, for BOTH the command and the tracked-state reads. Injected so
+ *  the guard's four outcomes are testable without a repo or a real command. */
+run?: CommandRunner): VerifyRerunResult;
 /**
  * Where in the gate a closure scan runs. The two stages are NOT interchangeable
  * and neither is a scheduling preference: