@mjasnikovs/pi-task 0.38.28 → 0.38.30

package/dist/task/enforce-attribution.d.ts

@@ -1,69 +1,60 @@
 /**
  * enforce-attribution — decide whether an enforce-pass re-verify FAIL can possibly
- * be the ENFORCE COMMIT's fault (mx5 run 18, nexttask 4).
+ * be the ENFORCE COMMIT's fault.
  *
- * The failure class, measured. Run 18's TASK_0024 enforce commit `ee65661` was, in
- * full, one line:
+ * THE FAILURE CLASS. An enforce commit can be one line:
  *
  *     -  setApiError((usersData).error ?? 'Failed to load users')
  *     +  setApiError(usersData.error ?? 'Failed to load users')
  *
- * The differential re-verify then FAILed on `MyListings.spec.tsx:186`, a Playwright
- * CT file `Admin.tsx` cannot reach (CT bundles per story; the import graph never
- * touches it), and the differential reverted the enforce commit anyway. The defect
- * was real and PRE-EXISTING — `getByText('SOLD')` matched two elements because
- * MOCK_LISTINGS already carries a sold row — and the final gate fixed it five
- * minutes later, in the same commit that RE-MADE the identical paren change. Cost:
- * one correct change destroyed, one permanent false verify-FAIL debt written
- * against work that was fine, and the change re-made anyway.
+ * and the differential re-verify can still FAIL — on a test in a file that change
+ * cannot reach, because the runner bundles per story and the import graph never
+ * touches it. The differential reverts the enforce commit anyway. The defect was
+ * real and PRE-EXISTING, a later pass fixes it and re-makes the identical change,
+ * and the cost is one correct edit destroyed plus a false verify-FAIL debt written
+ * against work that was fine.
  *
- * The mechanism was not broken; it was asked the wrong question. The root-cause
- * channel (root-cause-repair.ts) attributed against `scope: 'committed'` — the
- * TASK's own commit, which touched `MyListings.tsx` — concluded "this task touched
- * the file", and fell through to the conservative revert. But at THIS seam the
- * differential is deciding whether to discard the ENFORCE COMMIT. The causal
- * question is therefore *"could the enforce diff have caused this?"*, never *"could
- * the task have?"*: reverting the enforce commit can only ever repair damage the
- * enforce commit did.
+ * The mechanism is not broken; it is asked the wrong question. The root-cause
+ * channel (root-cause-repair.ts) attributes against `scope: 'committed'` — the
+ * TASK's own commit — concludes "this task touched the file", and falls through to
+ * the conservative revert. But at THIS seam the differential is deciding whether to
+ * discard the ENFORCE COMMIT. The causal question is therefore *"could the enforce
+ * diff have caused this?"*, never *"could the task have?"*: reverting the enforce
+ * commit can only ever repair damage the enforce commit did.
  *
  * So the filter here is mechanical and one-sided:
  *
- *   - the files the FAIL text NAMES are extracted (paths AND bare basenames — run
- *     18's reason named `MyListings.spec.tsx:186`, which carries no separator and
- *     is invisible to root-cause-repair.ts's path-token regex, a second reason
- *     that incident could not be attributed);
+ *   - the files the FAIL text NAMES are extracted, paths AND bare basenames. This
+ *     is not belt-and-braces: run against root-cause-repair.ts's own
+ *     `PATH_TOKEN_RE`, a reason naming `MyListings.spec.tsx:186` matches NOTHING,
+ *     because that pattern needs a `/`. Basenames are not optional here;
  *   - each is compared against the enforce commit's own file set, by path suffix
  *     and by RELATED STEM (`Admin.tsx` ~ `Admin.spec.tsx` ~ `Admin.stories.tsx`),
  *     so a regression in a touched file's own test still counts as overlap;
  *   - DISJOINT ⇒ keep the edits and route the defect. Anything else — an unknown
- *     enforce diff, a FAIL text naming no file at all, any overlap — reverts,
- *     which is exactly the pre-existing behaviour. Never keep on ignorance.
+ *     or empty enforce diff, a FAIL text naming no file at all, any overlap —
+ *     reverts. Never keep on ignorance.
  *
- * Keeping the edits must not mean losing the finding: the caller still records the
- * debt and still queues the repair. Losing the finding was mx5 run 5's mistake.
+ * Run across every branch: a disjoint reason KEEPs and names the file to blame;
+ * an overlap by path and an overlap by related stem (`Admin.spec.tsx` against a
+ * touched `src/client/pages/Admin.tsx`) both REVERT with the overlap recorded;
+ * and a reason naming no file, a null enforce diff and an empty one all REVERT.
+ * Exactly one branch keeps, and it requires positive evidence.
  *
- * MEASURED COVERAGE, and it is the honest weakness of this filter. Live, 40 trials
- * against the run-18 tree with a real verify child
- * (`scripts/live-enforce-attribution-ab.ts`):
+ * Keeping the edits must not mean losing the finding: the caller still records the
+ * debt and still queues the repair.
  *
- *   reachable arm (the enforce edit itself breaks `Admin.tsx`, ground truth REVERT)
- *     20/20 FAILs named a resolvable file, 20/20 decided correctly — tsc prints the
- *     path, so the regression case is fully covered.
- *   disjoint arm (a deterministic failure in `MyListings.spec.tsx`, ground truth KEEP)
- *     only 9/20 FAILs named a file at all. The other 11 named the UNIT — "The
- *     MyListings component test \"edit link navigates…\" fails … expects 4 Edit links"
- *     — with no path and no `.tsx` anywhere. Those 11 fall through to the revert.
+ * THE HONEST WEAKNESS. This only fires when the FAIL text names a file. A type
+ * error does — the compiler prints the path — but a failing unit test often names
+ * the UNIT instead ("The MyListings component test fails"), with no path and no
+ * extension anywhere. Confirmed: that reason extracts nothing and REVERTs with
+ * `no-file-named`, which is exactly the behaviour that shipped before this filter
+ * existed.
  *
- * So this fires on roughly half of live disjoint failures and on the recorded run-18
- * verdict (which did name `MyListings.spec.tsx:186`), and it was NEVER wrong: 29 of
- * 29 extractable decisions matched ground truth across both arms. The arm-level
- * verdict is still FAIL against the pre-registered ≥80%-extractable bar, and the
- * shipped rule is deliberately the conservative half of that trade: a miss costs
- * exactly the behaviour that shipped before, while a false KEEP would ship a real
- * regression. A stem-widened extractor (accept a bare identifier matching a tracked
- * file's stem) reaches 40/40 with 0 errors in the same data and is NOT wired — see
- * VALIDATION-DEBT.md, it resolves prose nouns to files and its FP mode was never
- * exercised.
+ * That is the deliberate half of the trade: a miss changes nothing, while a false
+ * KEEP would ship a real regression. Widening the extractor to accept a bare
+ * identifier matching a tracked file's stem would catch more, and is NOT wired: it
+ * resolves prose nouns to files, and its false-positive mode is unexercised.
  */
 /**
  * The comparable stem of a file name: the base name with its extension and any

package/dist/task/enforce-attribution.js

@@ -1,84 +1,78 @@
 /**
  * enforce-attribution — decide whether an enforce-pass re-verify FAIL can possibly
- * be the ENFORCE COMMIT's fault (mx5 run 18, nexttask 4).
+ * be the ENFORCE COMMIT's fault.
  *
- * The failure class, measured. Run 18's TASK_0024 enforce commit `ee65661` was, in
- * full, one line:
+ * THE FAILURE CLASS. An enforce commit can be one line:
  *
  *     -  setApiError((usersData).error ?? 'Failed to load users')
  *     +  setApiError(usersData.error ?? 'Failed to load users')
  *
- * The differential re-verify then FAILed on `MyListings.spec.tsx:186`, a Playwright
- * CT file `Admin.tsx` cannot reach (CT bundles per story; the import graph never
- * touches it), and the differential reverted the enforce commit anyway. The defect
- * was real and PRE-EXISTING — `getByText('SOLD')` matched two elements because
- * MOCK_LISTINGS already carries a sold row — and the final gate fixed it five
- * minutes later, in the same commit that RE-MADE the identical paren change. Cost:
- * one correct change destroyed, one permanent false verify-FAIL debt written
- * against work that was fine, and the change re-made anyway.
+ * and the differential re-verify can still FAIL — on a test in a file that change
+ * cannot reach, because the runner bundles per story and the import graph never
+ * touches it. The differential reverts the enforce commit anyway. The defect was
+ * real and PRE-EXISTING, a later pass fixes it and re-makes the identical change,
+ * and the cost is one correct edit destroyed plus a false verify-FAIL debt written
+ * against work that was fine.
  *
- * The mechanism was not broken; it was asked the wrong question. The root-cause
- * channel (root-cause-repair.ts) attributed against `scope: 'committed'` — the
- * TASK's own commit, which touched `MyListings.tsx` — concluded "this task touched
- * the file", and fell through to the conservative revert. But at THIS seam the
- * differential is deciding whether to discard the ENFORCE COMMIT. The causal
- * question is therefore *"could the enforce diff have caused this?"*, never *"could
- * the task have?"*: reverting the enforce commit can only ever repair damage the
- * enforce commit did.
+ * The mechanism is not broken; it is asked the wrong question. The root-cause
+ * channel (root-cause-repair.ts) attributes against `scope: 'committed'` — the
+ * TASK's own commit — concludes "this task touched the file", and falls through to
+ * the conservative revert. But at THIS seam the differential is deciding whether to
+ * discard the ENFORCE COMMIT. The causal question is therefore *"could the enforce
+ * diff have caused this?"*, never *"could the task have?"*: reverting the enforce
+ * commit can only ever repair damage the enforce commit did.
  *
  * So the filter here is mechanical and one-sided:
  *
- *   - the files the FAIL text NAMES are extracted (paths AND bare basenames — run
- *     18's reason named `MyListings.spec.tsx:186`, which carries no separator and
- *     is invisible to root-cause-repair.ts's path-token regex, a second reason
- *     that incident could not be attributed);
+ *   - the files the FAIL text NAMES are extracted, paths AND bare basenames. This
+ *     is not belt-and-braces: run against root-cause-repair.ts's own
+ *     `PATH_TOKEN_RE`, a reason naming `MyListings.spec.tsx:186` matches NOTHING,
+ *     because that pattern needs a `/`. Basenames are not optional here;
  *   - each is compared against the enforce commit's own file set, by path suffix
  *     and by RELATED STEM (`Admin.tsx` ~ `Admin.spec.tsx` ~ `Admin.stories.tsx`),
  *     so a regression in a touched file's own test still counts as overlap;
  *   - DISJOINT ⇒ keep the edits and route the defect. Anything else — an unknown
- *     enforce diff, a FAIL text naming no file at all, any overlap — reverts,
- *     which is exactly the pre-existing behaviour. Never keep on ignorance.
+ *     or empty enforce diff, a FAIL text naming no file at all, any overlap —
+ *     reverts. Never keep on ignorance.
  *
- * Keeping the edits must not mean losing the finding: the caller still records the
- * debt and still queues the repair. Losing the finding was mx5 run 5's mistake.
+ * Run across every branch: a disjoint reason KEEPs and names the file to blame;
+ * an overlap by path and an overlap by related stem (`Admin.spec.tsx` against a
+ * touched `src/client/pages/Admin.tsx`) both REVERT with the overlap recorded;
+ * and a reason naming no file, a null enforce diff and an empty one all REVERT.
+ * Exactly one branch keeps, and it requires positive evidence.
  *
- * MEASURED COVERAGE, and it is the honest weakness of this filter. Live, 40 trials
- * against the run-18 tree with a real verify child
- * (`scripts/live-enforce-attribution-ab.ts`):
+ * Keeping the edits must not mean losing the finding: the caller still records the
+ * debt and still queues the repair.
  *
- *   reachable arm (the enforce edit itself breaks `Admin.tsx`, ground truth REVERT)
- *     20/20 FAILs named a resolvable file, 20/20 decided correctly — tsc prints the
- *     path, so the regression case is fully covered.
- *   disjoint arm (a deterministic failure in `MyListings.spec.tsx`, ground truth KEEP)
- *     only 9/20 FAILs named a file at all. The other 11 named the UNIT — "The
- *     MyListings component test \"edit link navigates…\" fails … expects 4 Edit links"
- *     — with no path and no `.tsx` anywhere. Those 11 fall through to the revert.
+ * THE HONEST WEAKNESS. This only fires when the FAIL text names a file. A type
+ * error does — the compiler prints the path — but a failing unit test often names
+ * the UNIT instead ("The MyListings component test fails"), with no path and no
+ * extension anywhere. Confirmed: that reason extracts nothing and REVERTs with
+ * `no-file-named`, which is exactly the behaviour that shipped before this filter
+ * existed.
  *
- * So this fires on roughly half of live disjoint failures and on the recorded run-18
- * verdict (which did name `MyListings.spec.tsx:186`), and it was NEVER wrong: 29 of
- * 29 extractable decisions matched ground truth across both arms. The arm-level
- * verdict is still FAIL against the pre-registered ≥80%-extractable bar, and the
- * shipped rule is deliberately the conservative half of that trade: a miss costs
- * exactly the behaviour that shipped before, while a false KEEP would ship a real
- * regression. A stem-widened extractor (accept a bare identifier matching a tracked
- * file's stem) reaches 40/40 with 0 errors in the same data and is NOT wired — see
- * VALIDATION-DEBT.md, it resolves prose nouns to files and its FP mode was never
- * exercised.
+ * That is the deliberate half of the trade: a miss changes nothing, while a false
+ * KEEP would ship a real regression. Widening the extractor to accept a bare
+ * identifier matching a tracked file's stem would catch more, and is NOT wired: it
+ * resolves prose nouns to files, and its false-positive mode is unexercised.
  */
 /** A path-like token: at least one separator, ending in a file name. */
 const PATH_TOKEN_RE = /(?:[\w.@~-]+\/)+[\w.@-]+\.\w+/g;
 /**
- * A bare file name with a code-ish extension. Deliberately extension-gated: an
- * ungated `\w+\.\w+` matches prose ("e.g.", "v1.2"), object access (`usersData.error`
- * — which run 18's own enforce diff contains) and assertion chains
- * (`toBeVisible()`), and every one of those would be a phantom "named file".
+ * A bare file name with a code-ish extension. Deliberately extension-gated, and
+ * the gate does real work: run against an ungated `\w+\.\w+`, the prose "e.g.", a
+ * version "v1.2", the object access `usersData.error` and method chains like
+ * `page.locator` or `cy.get` ALL match, and every one would be a phantom "named
+ * file". Through this pattern none of them extract anything, while
+ * `MyListings.spec.tsx:186` and `src/server/routes/photos.ts` both do.
  */
 const BARE_FILE_RE = /\b[\w@-]+(?:\.[\w@-]+)*\.(?:tsx?|jsx?|mtsx?|ctsx?|mjs|cjs|vue|svelte|astro|py|go|rs|rb|java|kt|kts|cs|php|swift|scala|c|h|cc|cpp|hpp|css|scss|sass|less|html?|json|jsonc|ya?ml|toml|sql|sh|bash|zsh|md|mdx|prisma|graphql|gql|proto|lock)\b/g;
 /** Line/column suffixes and decoration a reason wraps a file name in. */
 const TRAILING_POSITION_RE = /:(\d+)(?::(\d+))?$/;
 /** Suffixes that make a file a sibling of another (test/story/type companions). */
 const COMPANION_SUFFIXES = ['.spec', '.test', '.stories', '.story', '.d', '.min'];
-/** A pathological reason cannot make this scan unbounded. */
+/** A pathological reason cannot make this scan unbounded — 60 names in yields 24
+ *  out. */
 const MAX_NAMED = 24;
 /** Strip `./`, leading slashes and surrounding whitespace. */
 function normalisePath(p) {

package/dist/task/enforce-guidelines.d.ts

@@ -6,20 +6,25 @@ export declare const GUIDELINE_FILENAMES: readonly ["AGENTS.md", "CLAUDE.md"];
  * The fix pass gets exactly two tools: `read` and `edit`. Deliberately no
  * `write`, `grep`, `find`, or `ls`.
  *
- *  - No `write` (and `edit` ENOENTs on a missing path) → the pass cannot create
- *    new files. Without this the local model, unable to run lint/tsc/tests, wrote
- *    hundreds of scratch "runner" scripts hoping to execute them — 864 junk files
- *    in one real run (see enforce-debug.log analysis). This is the load-bearing
- *    removal: dropping `write` is what stops the runaway file creation.
+ *  - No `write`, and `edit` cannot substitute for it: pi's edit tool calls
+ *    `access(absolutePath)` FIRST and throws `Could not edit file: <path>. Error
+ *    code: ENOENT.` before it ever reads. So the pass cannot create a new file at
+ *    all. This is the load-bearing removal — a model that cannot run lint, tsc or
+ *    tests will otherwise write scratch "runner" scripts by the hundred hoping to
+ *    execute them, and dropping `write` is what stops that.
  *  - No `grep`/`find`/`ls` → the pass cannot enumerate or roam the tree; it is
  *    handed the explicit, closed list of changed files (see captureCommitDiff) and is
  *    told to edit only those.
  *  - `read` IS allowed: the model genuinely needs it — to re-read a file after
  *    editing to confirm the fix landed, and to read a neighbouring file for the
- *    correct import/type when bringing the change into compliance (without it the
- *    model fabricates imports — validated against the local model). `read` has no
- *    per-path sandbox in pi, so "only the changed files" is enforced for EDITS
- *    (the prompt scopes them) but is a soft instruction for READS.
+ *    correct import or type when bringing the change into compliance. Denied that,
+ *    it fabricates imports instead.
+ *
+ *    But `read` has NO per-path sandbox in pi. Its resolver only joins the path to
+ *    cwd and tries filename variants — checked, `/etc/hostname` resolves to
+ *    `/etc/hostname` and `../../../` escapes upward, with no confinement test
+ *    anywhere. So "only the changed files" is ENFORCED for edits, by the closed
+ *    file list the prompt scopes them to, and is a soft instruction for reads.
  */
 declare const ENFORCE_TOOLS = "read,edit";
 /**
@@ -27,13 +32,15 @@ declare const ENFORCE_TOOLS = "read,edit";
  * files and report violations but CANNOT edit, create, or run anything.
  *
  * This is the "no signal ⇒ no license to rewrite logic" half of the gate. When a
- * task ships no behavioral verification to guard a destructive edit (no runnable
- * VERIFY, or the verify gate did not produce a genuine clean pass), letting the
- * weak model rewrite working code is exactly what trashes the build — A/B-proven:
- * with `read,edit` and no guard the model degraded a clean tree in 4/5 runs while
- * declaring CLEAN. Demoted to `read`, it cannot trash anything (5/5 clean) and
- * still names the real violation (5/5). So with no signal to revert against, the
- * pass reports the violation as a warning instead of editing.
+ * task ships no behavioural verification to guard a destructive edit — no runnable
+ * VERIFY, or a verify gate that never produced a genuine clean pass — there is
+ * nothing to revert against if the fix pass makes things worse. A weak model handed
+ * `read,edit` in that state can degrade a working tree and still report CLEAN,
+ * because nothing is able to contradict it.
+ *
+ * Demoted to `read` alone it cannot change anything, and still names the real
+ * violation. So with no signal to check against, the pass reports the violation as
+ * a warning instead of editing.
  */
 declare const ENFORCE_FLAG_TOOLS = "read";
 export interface GuidelineDoc {
@@ -52,9 +59,13 @@ export interface EnforceOutcome {
     reason?: string;
 }
 /**
- * Read the guideline files that live directly in `cwd` (AGENTS.md, CLAUDE.md).
- * Returns null when none exist or all are empty — the caller treats that as a
- * pass. cwd-only by design: no walk up to the git root.
+ * Read the guideline files that live directly in `cwd` (AGENTS.md, CLAUDE.md),
+ * concatenated under a `## <name>` header each, in that order.
+ *
+ * Returns null when none exist OR all are empty — the caller treats either as a
+ * pass. cwd-only by design, with no walk up to the git root: run from a
+ * subdirectory holding only its own AGENTS.md, a CLAUDE.md one level up is not
+ * picked up.
  */
 export declare function discoverGuidelines(cwd: string, readFile?: (p: string) => Promise<string>): Promise<GuidelineDoc | null>;
 /**
@@ -143,7 +154,7 @@ export interface EnforcementDeps {
      *  - `'edit'` (default): `read,edit` — the model fixes violations in place. The
      *    caller is responsible for guarding those edits with a differential
      *    verification check (revert on regression), because a bare edit pass
-     *    trashes working code (A/B: 4/5).
+     *    trashes working code.
      *  - `'flag'`: `read` only — the model reports violations but cannot touch the
      *    tree. Used when there is no verification signal to guard an edit against.
      */

package/dist/task/enforce-guidelines.js

@@ -34,20 +34,25 @@ export const GUIDELINE_FILENAMES = ['AGENTS.md', 'CLAUDE.md'];
  * The fix pass gets exactly two tools: `read` and `edit`. Deliberately no
  * `write`, `grep`, `find`, or `ls`.
  *
- *  - No `write` (and `edit` ENOENTs on a missing path) → the pass cannot create
- *    new files. Without this the local model, unable to run lint/tsc/tests, wrote
- *    hundreds of scratch "runner" scripts hoping to execute them — 864 junk files
- *    in one real run (see enforce-debug.log analysis). This is the load-bearing
- *    removal: dropping `write` is what stops the runaway file creation.
+ *  - No `write`, and `edit` cannot substitute for it: pi's edit tool calls
+ *    `access(absolutePath)` FIRST and throws `Could not edit file: <path>. Error
+ *    code: ENOENT.` before it ever reads. So the pass cannot create a new file at
+ *    all. This is the load-bearing removal — a model that cannot run lint, tsc or
+ *    tests will otherwise write scratch "runner" scripts by the hundred hoping to
+ *    execute them, and dropping `write` is what stops that.
  *  - No `grep`/`find`/`ls` → the pass cannot enumerate or roam the tree; it is
  *    handed the explicit, closed list of changed files (see captureCommitDiff) and is
  *    told to edit only those.
  *  - `read` IS allowed: the model genuinely needs it — to re-read a file after
  *    editing to confirm the fix landed, and to read a neighbouring file for the
- *    correct import/type when bringing the change into compliance (without it the
- *    model fabricates imports — validated against the local model). `read` has no
- *    per-path sandbox in pi, so "only the changed files" is enforced for EDITS
- *    (the prompt scopes them) but is a soft instruction for READS.
+ *    correct import or type when bringing the change into compliance. Denied that,
+ *    it fabricates imports instead.
+ *
+ *    But `read` has NO per-path sandbox in pi. Its resolver only joins the path to
+ *    cwd and tries filename variants — checked, `/etc/hostname` resolves to
+ *    `/etc/hostname` and `../../../` escapes upward, with no confinement test
+ *    anywhere. So "only the changed files" is ENFORCED for edits, by the closed
+ *    file list the prompt scopes them to, and is a soft instruction for reads.
  */
 const ENFORCE_TOOLS = 'read,edit';
 /**
@@ -55,19 +60,25 @@ const ENFORCE_TOOLS = 'read,edit';
  * files and report violations but CANNOT edit, create, or run anything.
  *
  * This is the "no signal ⇒ no license to rewrite logic" half of the gate. When a
- * task ships no behavioral verification to guard a destructive edit (no runnable
- * VERIFY, or the verify gate did not produce a genuine clean pass), letting the
- * weak model rewrite working code is exactly what trashes the build — A/B-proven:
- * with `read,edit` and no guard the model degraded a clean tree in 4/5 runs while
- * declaring CLEAN. Demoted to `read`, it cannot trash anything (5/5 clean) and
- * still names the real violation (5/5). So with no signal to revert against, the
- * pass reports the violation as a warning instead of editing.
+ * task ships no behavioural verification to guard a destructive edit — no runnable
+ * VERIFY, or a verify gate that never produced a genuine clean pass — there is
+ * nothing to revert against if the fix pass makes things worse. A weak model handed
+ * `read,edit` in that state can degrade a working tree and still report CLEAN,
+ * because nothing is able to contradict it.
+ *
+ * Demoted to `read` alone it cannot change anything, and still names the real
+ * violation. So with no signal to check against, the pass reports the violation as
+ * a warning instead of editing.
  */
 const ENFORCE_FLAG_TOOLS = 'read';
 /**
- * Read the guideline files that live directly in `cwd` (AGENTS.md, CLAUDE.md).
- * Returns null when none exist or all are empty — the caller treats that as a
- * pass. cwd-only by design: no walk up to the git root.
+ * Read the guideline files that live directly in `cwd` (AGENTS.md, CLAUDE.md),
+ * concatenated under a `## <name>` header each, in that order.
+ *
+ * Returns null when none exist OR all are empty — the caller treats either as a
+ * pass. cwd-only by design, with no walk up to the git root: run from a
+ * subdirectory holding only its own AGENTS.md, a CLAUDE.md one level up is not
+ * picked up.
  */
 export async function discoverGuidelines(cwd, readFile = p => fsp.readFile(p, 'utf8')) {
     const files = [];
@@ -90,7 +101,7 @@ export async function discoverGuidelines(cwd, readFile = p => fsp.readFile(p, 'u
     return { files, text: sections.join('\n\n') };
 }
 /**
- * Render the deterministic probe-gaming findings (run-8 F6) as a prompt block, or
+ * Render the deterministic probe-gaming findings as a prompt block, or
  * an empty array when there are none. Shared by the edit and flag prompts: the
  * finding is a concrete diff line whose stated purpose is to make a check pass
  * rather than meet the requirement — the reliable lever the prompt rule leans on.
@@ -230,7 +241,7 @@ export function classifyEnforceChildFailure(r) {
         return null;
     switch (failure.kind) {
         case 'stalled':
-            // mx5 run 7: 64 minutes of silence reported as a user cancel.
+            // Otherwise a long silence is reported as a user cancel.
             return 'model server unreachable — the child produced no output and the model endpoint did not respond';
         case 'command-timeout': {
             // Its text is truncated mid-run — the verdict in it is partial and

package/dist/task/enrichment.d.ts

@@ -1,6 +1,11 @@
 /**
- * Research enrichment — extract package names and URLs from text so the
- * orchestrator can fan out docs/URL lookups before the research phase.
+ * Research enrichment — extract package names, URLs and named external services
+ * from text so the orchestrator can fan out lookups before the research phase.
+ *
+ * Everything here is order-preserving and deduped. Run on a mixed input: the
+ * denylisted shell names are dropped, a URL's trailing sentence punctuation is
+ * stripped, docs targets stop at ENRICH_CAP while version targets continue to
+ * ENRICH_VERSION_CAP, and the version list is a strict superset of the docs list.
  */
 export declare function extractEnrichTargets(text: string): {
     /** Packages that get a (heavy) docs fetch — capped at ENRICH_CAP. */

package/dist/task/enrichment.js

@@ -1,6 +1,11 @@
 /**
- * Research enrichment — extract package names and URLs from text so the
- * orchestrator can fan out docs/URL lookups before the research phase.
+ * Research enrichment — extract package names, URLs and named external services
+ * from text so the orchestrator can fan out lookups before the research phase.
+ *
+ * Everything here is order-preserving and deduped. Run on a mixed input: the
+ * denylisted shell names are dropped, a URL's trailing sentence punctuation is
+ * stripped, docs targets stop at ENRICH_CAP while version targets continue to
+ * ENRICH_VERSION_CAP, and the version list is a strict superset of the docs list.
  */
 const ENRICH_PKG_RE = /`((?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*)`/g;
 const ENRICH_URL_RE = /https?:\/\/[^\s)`>]+/g;
@@ -21,12 +26,15 @@ const ENRICH_DENYLIST = new Set([
     'rm'
 ]);
 const ENRICH_CAP = 3;
-// Heavy docs/url fetches stay capped at ENRICH_CAP (each is a worker spawn +
-// page fetch). A live npm VERSION lookup is just one cheap registry GET, so it
-// can cover far more packages — every dependency a task explicitly names should
-// get a grounded latest-version block, not just the first ENRICH_CAP of them. A
-// task that named 6 runtime deps used to leave the 4th–6th (e.g. tailwindcss)
-// with NO live version, so a version question fell back to stale training data.
+// Two different caps because the two lookups cost very different things. A docs
+// or URL fetch is a worker spawn plus a page fetch, so those stay at ENRICH_CAP.
+// A live npm VERSION lookup is one cheap registry GET, so it can cover far more:
+// every dependency a task explicitly names should get a grounded latest-version
+// block, not just the first ENRICH_CAP of them.
+//
+// With a single cap, a task naming several runtime deps leaves the later ones with
+// no live version at all, and a question about one of them falls back to whatever
+// the model remembers.
 const ENRICH_VERSION_CAP = 12;
 const ENRICH_SERVICE_HEADER = 'EXTERNAL-DEPENDENCIES';
 const ENRICH_HEADER_LINE_RE = /^[A-Z][A-Z0-9 -]+$/;
@@ -43,10 +51,11 @@ function parseServices(text) {
         const trimmed = line.trim();
         if (trimmed === '')
             break;
-        // The refine model sometimes emits the section header twice in a row.
-        // A repeated EXTERNAL-DEPENDENCIES line is not a section terminator —
-        // skip it and keep reading bullets. Any *other* all-caps header still
-        // ends the section.
+        // A repeated EXTERNAL-DEPENDENCIES line is not a section terminator: the
+        // model sometimes emits the header twice in a row, and treating the second
+        // one as the end would drop every bullet under it. Skip it and keep
+        // reading. Any OTHER all-caps header still ends the section, and so does a
+        // blank line — both confirmed.
         if (trimmed === ENRICH_SERVICE_HEADER)
             continue;
         if (ENRICH_HEADER_LINE_RE.test(trimmed))
@@ -55,8 +64,11 @@ function parseServices(text) {
         if (!m)
             continue;
         const name = m[1].trim();
-        // Dedupe by name (case-insensitive); the model also duplicates bullets.
-        // Keep the first occurrence's query and count uniques against the cap.
+        // Dedupe by name, case-insensitively, because the model duplicates bullets
+        // as well as headers. The FIRST occurrence's query is kept, and only
+        // uniques count against the cap — so a duplicate cannot crowd out a real
+        // service. Confirmed: `Stripe` and a later `stripe` collapse to one entry
+        // carrying the first query.
         const key = name.toLowerCase();
         if (seen.has(key))
             continue;

package/dist/task/env-notes.d.ts

@@ -4,16 +4,20 @@ export interface EnvNote {
     origin: string;
 }
 /**
- * Parse the stored file into fact+origin records. Legacy lines written before
- * provenance (no separator) parse with an empty origin, so old caches still read.
+ * Parse the stored file into fact+origin records. A line with no separator parses
+ * with an empty origin rather than being dropped, so a cache written before
+ * provenance existed still reads — and `buildEnvNotesBlock` renders those as
+ * "origin unrecorded" instead of silently claiming an author.
  */
 export declare function parseEnvNotes(raw: string): EnvNote[];
 export declare function envNotesFile(cwd: string): string;
 /** The raw stored file ('' when none were recorded yet). Parse with parseEnvNotes. */
 export declare function readEnvNotes(cwd: string): Promise<string>;
 /**
- * Pull `ENV-NOTE: <fact>` lines out of a child's answer text. Deduplicated,
- * length-capped; verdict markers can never match (different prefix).
+ * Pull `ENV-NOTE: <fact>` lines out of a child's answer text: trimmed,
+ * deduplicated case-insensitively, and dropped when empty or over
+ * MAX_NOTE_LENGTH. Run: a `VERDICT:` line and even a near-miss `ENV-NOTES:` line
+ * match nothing, so a verdict cannot leak into the fact cache.
  */
 export declare function extractEnvNotes(text: string): string[];
 /** True when a fact reads like a standing excuse (see EXCUSE_PATTERNS). */
@@ -21,9 +25,14 @@ export declare function isExcuseNote(fact: string): boolean;
 /**
  * Append newly discovered facts to the cache, deduplicated against what is
  * already there (case-insensitive fact match), keeping the newest MAX_NOTES.
- * Each new fact is stamped with the `origin` task that recorded it; a fact
- * already present keeps its ORIGINAL origin (provenance traces to who first
- * established it). Failures are swallowed — the cache is a sharpener, never a
+ * Each new fact is stamped with the `origin` task that recorded it; a fact already
+ * present keeps its ORIGINAL origin, so provenance traces to whoever first
+ * established it. Confirmed by re-appending the same fact under a different task:
+ * one entry survives, still carrying the first writer.
+ *
+ * Tabs in an emitted fact are normalised to spaces before storage, which is what
+ * keeps the separator unambiguous. The cap holds too — sixty further facts leave
+ * MAX_NOTES stored. Failures are swallowed: the cache is a sharpener, never a
  * blocker.
  */
 export declare function appendEnvNotes(cwd: string, notes: string[], origin?: string): Promise<void>;