@mjasnikovs/pi-task 0.38.29 → 0.38.31

package/dist/task/final-gate-fix.js

@@ -1,47 +1,37 @@
 /**
- * final-gate-fix — the bounded, model-driven fix pass offered when the FINAL
- * integration gate fails.
+ * final-gate-fix — the bounded, model-driven fix pass the FINAL integration
+ * gate's resolution picker offers as its second card.
  *
- * The failure this closes (mx5 run 7, validated): the final gate's first live
- * firing was a TRUE POSITIVE — the project's own `test` command genuinely failed
- * whole-repo while every per-slice check was green — but the resolution picker
- * offered only "Leave failed" / "Accept". There was NO automated path to fix a
- * defect the run itself shipped; the user had to leave the run failed, fix by
- * hand, and resume.
- *
- * This mirrors the per-task graduated-resolution shape (lint-fix.ts): a bounded
- * write-enabled child (read, edit, bash) is seeded with the gate's exact failure
- * (command + exit code + output tail), fixes the defect in place, and the gate
- * itself is re-run as the only arbiter — the child's self-report is never
- * trusted. The user always chooses this path from the picker ("Leave failed"
- * stays the recommended default), and attempts are capped so a non-converging
- * loop hands control back to a person.
+ * This mirrors the per-task graduated-resolution shape (lint-fix.ts) and shares
+ * its child ladder through `runFixChild`: a write-enabled child limited to
+ * `read,edit,bash` is seeded with the gate's own failure text, edits in place,
+ * and then the gate is RE-RUN. The child's self-report can only end an attempt
+ * early as BLOCKED; it can never produce a PASS. `run-final-gate.ts` keeps
+ * "Leave failed" as the recommended card and stops offering Autofix after
+ * MAX_FINAL_GATE_AUTOFIX attempts, so a non-converging loop hands control back
+ * to a person.
  *
  * CHEAT GUARD (deterministic): the cheapest way for a fix child to "converge" is
  * to remove the failing command itself — delete the `test` script, drop the
- * Makefile target — so the gate discovers nothing and vacuously passes. Both
- * live lint-fix validation runs cheated exactly this way (via git checkout)
- * until a guard existed. So the discovered gate commands are snapshotted before
- * the child runs; any previously-discovered command that is no longer
- * discoverable afterwards rejects the attempt and discards its edits. A fix may
- * change what a command DOES, never make it disappear.
+ * Makefile target — so the gate discovers nothing and vacuously passes. The
+ * discovered gate commands are therefore snapshotted before the child runs; a
+ * previously-discovered command that is no longer discoverable afterwards
+ * rejects the attempt and discards its edits, and so does one whose resolved
+ * BODY narrowed. A fix may change what a command DOES, never make it disappear
+ * or shrink what it covers.
  *
- * WRITE-GUARD STACK (mx5 run 11): this child was added after the run-8 guard
- * generation and inherited none of them — it ran `rm` on a sibling task's
- * verified deliverable to satisfy a recorded debt claim and hand-copied a pinned
- * contract to green the lint, with free bash and no trace. Every attempt now
- * runs, deterministically and in order: frozen-path revert (when a freeze set is
- * wired — see below) → deletion guard (a tracked file deleted without relocation
- * rejects the attempt) → shrink guard (above) → probe-gaming scan over the added
- * lines (a fix that SAYS it games a check rejects the attempt). Diff capture for
- * every write-capable gate child lives at the gate-deps seam, keyed on the
- * child's TOOLS, so the next write-capable kind cannot run invisibly either.
+ * WRITE-GUARD STACK, in the order `runFinalGateAutofix` runs it: frozen-path
+ * revert (only when a freeze set is wired) → deletion guard (a tracked file
+ * deleted without relocation rejects the attempt) → shrink guard → scope-shrink
+ * guard → probe-gaming scan over the added lines. Diff capture is NOT here: it
+ * lives at the gate-child seam, where a `/\b(?:edit|bash|write)\b/` test on the
+ * child's TOOLS decides it, so any future write-capable kind is logged too.
  *
- * The frozen-path deny is implemented but NOT wired by gate-deps: per-task
- * frozen fences are task-SCOPED (they fence a task off a sibling's territory),
- * and the measured union over the run-11 specs would have reverted the one
- * legitimate whole-repo fix that run needed (migrate.ts — frozen by its own
- * producing task). It activates only when a run-GLOBAL freeze source exists.
+ * The frozen-path deny is implemented here but NOT wired by gate-deps — the
+ * `finalGateFix` wiring there passes every other dep and omits these two.
+ * Per-task frozen fences are task-SCOPED, so their union across a run's specs
+ * can fence off a file a legitimate whole-repo fix has to touch. It activates
+ * only when a run-GLOBAL freeze source exists.
  */
 import { parseFixMarker, runFixChild } from './fix-child.js';
 import { findForbiddenDeletions, diffIgnoredSnapshots, ignoredWriteTrailLine, ignoredWriteUnobservedNote } from './write-guard.js';
@@ -51,13 +41,15 @@ import { findNarrowedCommands, narrowingRejectionText } from './command-shrink.j
 export const FINAL_FIX_TOOLS = 'read,edit,bash';
 /**
  * How many fix passes the user may launch from the picker before the option is
- * withdrawn (mirrors the per-task MAX_AUTO_AUTOFIX budget). Each attempt is a
- * full model child plus a full gate re-run — after this many that still FAIL,
- * only Leave-failed / Accept remain so a person breaks the loop.
+ * withdrawn. Same value as the per-task MAX_AUTO_AUTOFIX budget. Each attempt is
+ * a full model child plus a full gate re-run — after this many that still FAIL,
+ * `run-final-gate.ts` drops the Autofix card and only Leave-failed / Accept
+ * remain, so a person breaks the loop.
  */
 export const MAX_FINAL_GATE_AUTOFIX = 3;
-/** Picker labels/values. Classification accepts the value token, the label, or
- *  free text (→ autofix guidance), same contract as the per-task resolution. */
+/** Picker labels/values. Each label starts with its own value word, so
+ *  `classifyFinalGateAnswer` accepts the value token and the label alike;
+ *  anything else is free text and becomes autofix guidance. */
 export const FINAL_LEAVE_VALUE = 'fail';
 export const FINAL_ACCEPT_VALUE = 'accept';
 export const FINAL_AUTOFIX_VALUE = 'autofix';
@@ -66,9 +58,9 @@ export const FINAL_ACCEPT_LABEL = 'Accept — complete the run anyway';
 export const FINAL_AUTOFIX_LABEL = 'Autofix — run a bounded fix pass and re-run the gate';
 /**
  * Map a final-gate picker answer to an action. Dismissal (undefined/empty) and
- * an explicit leave stay "leave" — exactly what the two-option picker did.
- * Free text becomes autofix guidance, mirroring classifyResolutionAnswer; the
- * caller demotes autofix back to "leave" when the option was not offered.
+ * an explicit leave both stay "leave". Free text becomes autofix guidance; the
+ * caller's `choice.action === 'autofix' && canAutofix` test demotes autofix back
+ * to leave when the card was not offered.
  */
 export function classifyFinalGateAnswer(answer) {
     if (answer === undefined)
@@ -85,10 +77,11 @@ export function classifyFinalGateAnswer(answer) {
     return { action: 'autofix', guidance: t };
 }
 /**
- * The gate's fail reason always carries the failing command in backticks
- * (`` `bun run test` exited 1 — … `` / ``static checks: `make lint` exited 2``).
- * Extract it for reporting; the shrink guard itself compares the FULL
- * discovered-command sets, so a reason this cannot parse still guards.
+ * The gate's fail reason carries the failing command in backticks — final-gate
+ * mints `` `<label>` exited <status> — <tail> ``, with a `lockfile check: ` or
+ * `launch script: ` prefix on two of the sections. Extract it for reporting
+ * only; the shrink guard compares the FULL discovered-command sets, so a reason
+ * this cannot parse still guards.
  */
 export function exitedCommandFromReason(reason) {
     const m = /`([^`]+)`\s+exited\b/.exec(reason);
@@ -96,11 +89,11 @@ export function exitedCommandFromReason(reason) {
 }
 /**
  * Build the fix child's prompt. Generic by construction: the only project facts
- * in it are the gate's own failure text — the command comes from the project's
- * discovered manifest, never from a hardcoded ecosystem. The seed may carry
- * SEVERAL failures (the gate aggregates every section since mx5 run 13, ranked
- * most load-bearing first); convergence means the WHOLE list is empty, so the
- * child is told to fix all of them.
+ * in it are the gate's own failure text, whose command labels come from the
+ * project's discovered manifest. The seed may carry SEVERAL failures — the gate
+ * runs every section and aggregates, emitting "N failures (ranked, most
+ * load-bearing first)" — and it reports `ok` only when that list is empty, so
+ * the child is told to fix all of them.
  */
 export function buildFinalFixPrompt(failReason) {
     return [
@@ -144,41 +137,28 @@ export function buildFinalFixPrompt(failReason) {
         '  FINAL-GATE-FIX: BLOCKED <why you could not fix it>'
     ].join('\n');
 }
-/**
- * Parse the child's final marker. Last match wins (the model reasons before
- * concluding and bash output can echo the words). No marker → treated as DONE:
- * the gate re-run is the arbiter either way, so a missing marker only skips the
- * early-out on a self-declared BLOCKED.
- */
+/** This pass's marker word, parsed by the shared `parseFixMarker` (last match
+ *  wins; no marker → DONE). */
 export function parseFinalFixMarker(text) {
     return parseFixMarker('FINAL-GATE-FIX', text);
 }
 /**
- * STRANDED SUB-FIXES (mx5 run 13, PROMPT 4 item 3).
- *
- * A fix attempt that does not converge keeps its edits: they are NOT discarded
- * (only a guard trip discards), and `deps.commit` runs only on `fix.ok`. So a
- * partial fix that genuinely repaired something sits in the working tree, uncommitted,
- * and if the user then ACCEPTs the FAIL the run completes around it — leaving HEAD
- * broken while the repair is invisible unless someone runs `git status`.
+ * STRANDED SUB-FIXES.
  *
- * That is exactly what run 13 shipped: the fix child's bunfig.toml change made
- * `bun run test` pass 116/116, attempt 1 did not converge overall, the user accepted
- * the FAIL, and the tree still shows the file modified while HEAD's `bun run test` is
- * broken. The repair and the breakage were BOTH real; only the repair was discarded
- * by default.
+ * An attempt that does not converge KEEPS its edits — only a guard trip
+ * discards — and the caller commits only on `fix.ok`. So a partial fix that
+ * genuinely repaired something sits uncommitted in the working tree while HEAD
+ * still carries the defect, invisible unless someone runs `git status`.
  *
- * The rule: a partial fix is either committed (its own commit, named in the trail) or
- * explicitly surfaced — never silently stranded.
+ * The rule: a partial fix is either committed as its own named commit or
+ * explicitly surfaced — never silently stranded. `run-final-gate.ts` calls
+ * `commitStranded` on BOTH terminal outcomes, accept and leave-failed, so an
+ * unattended run that ends on LEAVE does not leave real repairs one `git
+ * checkout` from gone.
  *
- * mx5 run 14 proved the committing half only ever ran on the ACCEPT path. The run
- * ended on LEAVE (YOLO, budget spent) and 13 real repairs — the dev script, the
- * teardown bug, test serialization, the migrate script: the changes that make that
- * app work today — were left dirty in the tree, one `git checkout` from gone, after
- * an UNATTENDED run nobody was watching. So EVERY terminal non-converged outcome
- * commits them now, not just ACCEPT. Only guard-CLEAN edits qualify: an attempt a
- * write-guard rejected without discarding leaves REJECTED edits in the tree, and
- * those are never committed (the guard is not weakened to make committing easier).
+ * Only guard-CLEAN edits qualify. `AutofixLedger.mayCommitTree()` goes false
+ * once a guard has rejected an attempt whose edits could not be discarded, and
+ * never flips back: the guard is not weakened to make committing easier.
  */
 /** Commit subject for partial fixes committed alongside a terminal gate FAIL. */
 export const STRANDED_FIX_COMMIT = (runId, outcome = 'accepted') => `FINAL GATE PARTIAL FIX (${runId}) — ${outcome === 'accepted' ?
@@ -198,10 +178,11 @@ export function strandedFixNote(paths) {
         + `checkout — the run's outcome is recorded in the gate trail either way.`);
 }
 /**
- * Run one bounded final-gate fix attempt: snapshot discovery → child → write-guard
- * stack (diff capture → frozen-path revert → deletion guard → shrink guard → probe
- * scan) → gate re-run. Never throws for an outcome; only a user cancel inside
- * runChild propagates (the caller's USER_CANCELLED path handles it).
+ * Run one bounded final-gate fix attempt: snapshot discovery and ignored paths →
+ * child → frozen-path revert → deletion guard → shrink guard → scope-shrink
+ * guard → probe scan → gate re-run. Never throws for an outcome; only a user
+ * cancel inside runChild propagates, and the caller's USER_CANCELLED path
+ * handles that.
  */
 export async function runFinalGateAutofix(deps) {
     const before = deps.discoverLabels(deps.cwd);
@@ -210,7 +191,7 @@ export async function runFinalGateAutofix(deps) {
     // ignored files are untracked, so git alone cannot tell a file this pass wrote
     // from one that was already sitting in the worktree.
     const ignoredBefore = deps.ignoredSnapshot ? await deps.ignoredSnapshot() : null;
-    // The four-rung ladder is task/fix-child.ts, shared with the per-task pass.
+    // The child ladder is task/fix-child.ts, shared with the per-task pass.
     const end = await runFixChild({
         runChild: deps.runChild,
         tools: FINAL_FIX_TOOLS,
@@ -241,12 +222,13 @@ export async function runFinalGateAutofix(deps) {
         guardTripped: true,
         editsDiscarded: deps.discard !== undefined
     });
-    // (Diff capture — what the pass changed, durably — happens at the gate-deps
-    // seam for every write-capable child; here only the guards act on it.)
-    // FROZEN-PATH WRITE-DENY: undo the child's edits to any path a task spec
-    // froze, before anything downstream can act on them — same mechanical deny
-    // the enforce pass carries (prompt framing is A/B-proven insufficient).
-    // Non-fatal: the rest of the fix survives, only the frozen edits are undone.
+    // (Diff capture — what the pass changed, durably — happens in gate-child.ts,
+    // which logs the tree changes of any child whose TOOLS include edit/bash/
+    // write; here only the guards act on them.)
+    // FROZEN-PATH WRITE-DENY: undo the child's edits to any path a task's spec
+    // froze, before anything downstream can act on them — the same mechanical
+    // revert the per-task passes carry, not prompt framing. Non-fatal: the rest
+    // of the fix survives, only the frozen edits are undone.
     if (deps.frozenPaths && deps.revertFrozen) {
         const frozen = await deps.frozenPaths();
         if (frozen.length > 0) {
@@ -256,8 +238,10 @@ export async function runFinalGateAutofix(deps) {
             }
         }
     }
-    // DELETION GUARD (post-revert state): a tracked file the pass deleted without
-    // relocating it is a committed deliverable destroyed — reject the attempt.
+    // DELETION GUARD (post-revert state): a tracked file the pass deleted is a
+    // completed task's committed deliverable destroyed — reject the attempt. A
+    // deletion paired with an added file of the SAME BASENAME is a relocation and
+    // passes, as do the regenerable artifacts write-guard.ts exempts.
     const changes = deps.treeChanges ? await deps.treeChanges() : null;
     if (changes) {
         const gone = findForbiddenDeletions(changes);
@@ -280,14 +264,12 @@ export async function runFinalGateAutofix(deps) {
             await deps.discard(deps.cwd);
         return rejected(`fix pass removed the gate's own command(s) (${vanished.join(', ')})`);
     }
-    // SCOPE-SHRINK GUARD (mx5 run 19): the label surviving is not enough. The
-    // autofix kept `bun run test` and rewrote its BODY from `AGENT=1 bun test`
-    // to `AGENT=1 bun test ./test`, so the set difference above was empty while
-    // the suite stopped covering the repository — and the gate re-ran, went
-    // green, and reported "converged". Compare the resolved bodies and reject a
-    // fix that shrinks what the gate measures (command-shrink.ts: four
-    // mechanical shapes, measured at 3 hits in 274 manifest-touching corpus
-    // commits, all three read by hand as real narrowings).
+    // SCOPE-SHRINK GUARD: the label surviving is not enough. A child can keep
+    // `bun run test` and rewrite its BODY to run a subdirectory instead of the
+    // repository — the set difference above stays empty while the suite stops
+    // covering what the gate is meant to measure, and the re-run then goes green
+    // and reports "converged". So compare the resolved bodies too
+    // (command-shrink.ts holds the mechanical narrowing shapes).
     if (deps.discoverBodies) {
         const addedByFix = new Set((changes?.added ?? []).map(p => p.replace(/^\.\//, '')));
         const narrowed = findNarrowedCommands(bodiesBefore, deps.discoverBodies(deps.cwd), {
@@ -304,10 +286,10 @@ export async function runFinalGateAutofix(deps) {
             return r;
         }
     }
-    // PROBE SCAN (F6): added lines whose stated purpose is to make a check pass
-    // rather than meet the requirement reject the attempt — there is no verify
-    // child downstream of this pass to judge the finding, and the probe is
-    // FP-measured at 1 true hit in 50,735 added lines on the real corpus.
+    // PROBE SCAN: added lines whose own stated purpose is to make a check pass
+    // rather than meet the requirement reject the attempt. Nothing downstream of
+    // this pass would judge such a finding — the gate re-run only sees exit
+    // codes.
     if (deps.probeScan) {
         const findings = await deps.probeScan();
         if (findings.length > 0) {
@@ -326,15 +308,14 @@ export async function runFinalGateAutofix(deps) {
     if (!fin.ok) {
         return withIgnored({ ok: false, reason: `did not converge: ${fin.reason}`, gate: fin });
     }
-    // IGNORED-DEPENDENCY DOWNGRADE (mx5 run 19). The gate says PASS; the question
-    // this answers is whether that PASS belongs to the REPOSITORY or only to this
-    // worktree. Decided mechanically, never by judgement: move the ignored files
-    // the pass wrote aside, re-run the gate once, put them back. Still passing ⇒
-    // they were incidental and the PASS stands. Failing ⇒ the checks were passing
-    // on state no fresh clone has, which is the definition of UNOBSERVED (see
-    // final-gate.ts unobservedVerdict) — not a FAIL: the fix is real, it just did
-    // not ship. The probe runs only here, so a run with no ignored writes (the
-    // overwhelming majority — 1 of 68 recorded child logs) pays nothing.
+    // IGNORED-DEPENDENCY DOWNGRADE. The gate says PASS; this decides whether the
+    // PASS belongs to the REPOSITORY or only to this worktree. Mechanical, never
+    // judgement: move the ignored files the pass wrote aside, re-run the gate
+    // once, put them back. Still passing ⇒ incidental, the PASS stands. Failing ⇒
+    // the checks were passing on state no fresh clone has, which is UNOBSERVED
+    // (final-gate.ts unobservedVerdict), not a FAIL — the fix is real, it just
+    // did not ship. Guarded on a non-empty `ignoredWrites`, so a pass that wrote
+    // no ignored paths runs no extra gate.
     let ignoredDependent;
     if (ignoredWrites.length > 0 && deps.gateWithoutIgnored) {
         const passesWithout = await deps.gateWithoutIgnored(ignoredWrites);

package/dist/task/final-gate-progress.d.ts

@@ -1,33 +1,23 @@
 /**
- * final-gate-progress — the non-progress classifier for the final-gate autofix loop.
+ * final-gate-progress — the non-progress classifier for the final-gate autofix
+ * loop. `AutofixLedger.judge` is its only caller.
  *
- * The failure this closes (mx5 run 14, validated from TASK_AUTO_0001.md's gates
- * trail): the gate's boot check asserted "the app never opened a listening socket"
- * in a sandbox where NO tool the probe knows (`ss`, `lsof`) exists — the check was
- * UNFALSIFIABLE there. Three autofix attempts each edited real files, re-ran, and
- * came back with a byte-identical ranked-first failure; the budget was spent on a
- * check no edit could ever move, the two checks that WERE fixable had converged by
- * attempt 2, and the run ended `failed` with 13 genuinely repaired files sitting
- * uncommitted in the working tree.
- *
- * The rule this encodes: an attempt that CHANGED the tree and re-ran the gate, and
- * got the same first failure back as the previous attempt, is evidence about the
- * CHECK, not about the fix. Two identical post-fix results ⇒ the check is
- * env-shaped/unfalsifiable in this environment ⇒ stop paying for it: demote that
- * one check to UNOBSERVED-with-debt (durable, so the NEXT run's gate re-checks it)
- * and let the REMAINING checks decide whether the gate converged. Run 14 replay:
- * checks 2 and 3 were fixed by attempts 1–2, so the run converges with the boot
- * check carried as debt instead of failing with the repairs stranded.
+ * The rule: an attempt that CHANGED the tree and re-ran the gate, and got the
+ * same ranked-first failure back as the previous attempt, is evidence about the
+ * CHECK, not about the fix. A check that survives two post-fix results
+ * identically is unfalsifiable in this environment, so stop paying for it —
+ * demote that ONE check to UNOBSERVED-with-debt and let the remaining checks
+ * decide whether the gate converged. The debt is appended to the ledger file
+ * under `.pi-tasks/`, so it outlives the run and the next gate re-checks it.
  *
  * Deliberately conservative:
- *   - It never fires on attempt 1. The first repeat can be an ordinary
- *     didn't-fix-it-yet; only a SECOND identical post-fix result is evidence.
- *   - It never fires when the attempt changed nothing (a BLOCKED child, a
- *     guard-discarded attempt): with no edit there is nothing to conclude about
- *     falsifiability.
- *   - It demotes exactly the one repeated check. Every other failure still has to
- *     pass for real; the debt keeps the demoted one visible at run end and in the
- *     next run's gate.
+ *   - It never fires on attempt 1: `previousSignature` is null until an attempt
+ *     has produced one, and null returns false.
+ *   - It never fires when the attempt changed nothing. The caller passes
+ *     `edited` as "the gate re-ran AND the tree is dirty", and a guard-rejected
+ *     attempt returns before the re-run, so its `gate` is undefined.
+ *   - It demotes exactly the one repeated signature. Every other failure still
+ *     has to pass for real.
  */
 /**
  * Comparison key for a gate failure entry: lowercased, volatile substrings erased,
@@ -51,7 +41,7 @@ export interface NonProgressInput {
      *  attempt that edited and re-tested says anything about falsifiability. */
     edited: boolean;
     /**
-     * Did a PROBE return this failure after OBSERVING? (nexttask 19A.) Read off
+     * Did a PROBE return this failure after OBSERVING? Read off
      * `FinalGateOutcome.observedFailures` by exact text identity — never re-derived
      * from the failure string.
      *
@@ -64,24 +54,17 @@ export interface NonProgressInput {
  * here: it edited the tree, the gate re-ran, and returned the same first failure
  * as the previous attempt.
  *
- * …EXCEPT when the probe OBSERVED the failure (nexttask 19A). This rule was built
- * as a blind compensator for a probe limitation — run 14's boot check "could not
- * observe a listener in that sandbox at all" — and that limitation was fixed
- * upstream ELEVEN MINUTES BEFORE this rule landed (`b0f90a7` 23:34:05, `dd3b0c3`
- * 23:45:09, both 2026-07-19). Every probe now reports "I could not look" as its
- * own outcome, with the reason. What was left was a second, blind judgment of the
- * same question, made DOWNSTREAM from the evidence — and its only reachable effect
- * was to overrule a probe that DID look.
- *
- * It has to be overruled, because a deterministic un-fixed defect emits an
- * IDENTICAL failure by definition. String equality therefore reads reproducibility
- * as evidence against the instrument, which is backwards for every project type: a
- * CLI that exits 2 twice, a build that fails on the same symbol twice, a C++ plugin
- * missing the same export twice. mx5 run 21 is the one recorded instance and it
- * released a product whose every page was blank as a `completed` run.
+ * …EXCEPT when a probe OBSERVED the failure, which is checked FIRST and wins
+ * outright. A probe that looked and saw the defect has already answered the
+ * question this rule guesses at, and it answered it where the evidence is. A
+ * probe that could NOT look reports that as its own outcome instead, so it never
+ * reaches `observedFailures`.
  *
- * The fix is NOT a better string pattern — the bug is that the decision was made
- * downstream from the evidence, not that the pattern was too coarse.
+ * The observed guard has to win, because a deterministic un-fixed defect emits an
+ * IDENTICAL failure by definition. Without it, string equality reads
+ * reproducibility as evidence against the instrument — a CLI that exits 2 twice,
+ * a build that fails on the same symbol twice — and demotes a real, still-broken
+ * check to debt.
  */
 export declare function isNonProgress(input: NonProgressInput): boolean;
 /**
@@ -89,6 +72,6 @@ export declare function isNonProgress(input: NonProgressInput): boolean;
  * what still has to pass for the gate to converge; empty ⇒ converged-with-debt.
  */
 export declare function applyDemotions(failures: string[], demoted: ReadonlySet<string>): string[];
-/** The debt reason recorded for a demoted check, and the gate-trail wording. Kept
- *  in one place so the ledger line and the trail line cannot drift apart. */
+/** The debt reason recorded for a demoted check. One function so the ledger entry
+ *  and the wording the user reads cannot drift apart. */
 export declare function unobservedDebtReason(detail: string): string;

package/dist/task/final-gate-progress.js

@@ -1,33 +1,23 @@
 /**
- * final-gate-progress — the non-progress classifier for the final-gate autofix loop.
+ * final-gate-progress — the non-progress classifier for the final-gate autofix
+ * loop. `AutofixLedger.judge` is its only caller.
  *
- * The failure this closes (mx5 run 14, validated from TASK_AUTO_0001.md's gates
- * trail): the gate's boot check asserted "the app never opened a listening socket"
- * in a sandbox where NO tool the probe knows (`ss`, `lsof`) exists — the check was
- * UNFALSIFIABLE there. Three autofix attempts each edited real files, re-ran, and
- * came back with a byte-identical ranked-first failure; the budget was spent on a
- * check no edit could ever move, the two checks that WERE fixable had converged by
- * attempt 2, and the run ended `failed` with 13 genuinely repaired files sitting
- * uncommitted in the working tree.
- *
- * The rule this encodes: an attempt that CHANGED the tree and re-ran the gate, and
- * got the same first failure back as the previous attempt, is evidence about the
- * CHECK, not about the fix. Two identical post-fix results ⇒ the check is
- * env-shaped/unfalsifiable in this environment ⇒ stop paying for it: demote that
- * one check to UNOBSERVED-with-debt (durable, so the NEXT run's gate re-checks it)
- * and let the REMAINING checks decide whether the gate converged. Run 14 replay:
- * checks 2 and 3 were fixed by attempts 1–2, so the run converges with the boot
- * check carried as debt instead of failing with the repairs stranded.
+ * The rule: an attempt that CHANGED the tree and re-ran the gate, and got the
+ * same ranked-first failure back as the previous attempt, is evidence about the
+ * CHECK, not about the fix. A check that survives two post-fix results
+ * identically is unfalsifiable in this environment, so stop paying for it —
+ * demote that ONE check to UNOBSERVED-with-debt and let the remaining checks
+ * decide whether the gate converged. The debt is appended to the ledger file
+ * under `.pi-tasks/`, so it outlives the run and the next gate re-checks it.
  *
  * Deliberately conservative:
- *   - It never fires on attempt 1. The first repeat can be an ordinary
- *     didn't-fix-it-yet; only a SECOND identical post-fix result is evidence.
- *   - It never fires when the attempt changed nothing (a BLOCKED child, a
- *     guard-discarded attempt): with no edit there is nothing to conclude about
- *     falsifiability.
- *   - It demotes exactly the one repeated check. Every other failure still has to
- *     pass for real; the debt keeps the demoted one visible at run end and in the
- *     next run's gate.
+ *   - It never fires on attempt 1: `previousSignature` is null until an attempt
+ *     has produced one, and null returns false.
+ *   - It never fires when the attempt changed nothing. The caller passes
+ *     `edited` as "the gate re-ran AND the tree is dirty", and a guard-rejected
+ *     attempt returns before the re-run, so its `gate` is undefined.
+ *   - It demotes exactly the one repeated signature. Every other failure still
+ *     has to pass for real.
  */
 /**
  * Volatile substrings that differ between two runs of the SAME failing check —
@@ -60,12 +50,18 @@ const VOLATILE = [
  * A bare `:NNNN` port, which the localhost/`port N` rules above do not reach (a
  * failure that just says "no listener on :3000").
  *
- * NOT applied when the colon follows a SOURCE LOCATION — `src/db.ts:41`,
- * `Cart.tsx:88:12`. A failure detail embeds the failing command's output tail
- * verbatim (final-gate.ts `r.tail`), and tsc/eslint/bun-test tails are mostly
- * file:line. Collapsing those made two DIFFERENT defects in one file — the second
- * uncovered by fixing the first — compare equal, which reads as non-progress and
- * demotes a genuinely fixable check to UNOBSERVED debt. A moved error is progress.
+ * NOT applied when the colon follows a SOURCE LOCATION. A failure detail embeds
+ * the failing command's output tail verbatim (final-gate.ts interpolates
+ * `r.tail`), and tsc/eslint/bun-test tails are mostly `file:line`. Collapsing
+ * those would make two DIFFERENT defects in one file compare equal, which reads
+ * as non-progress and demotes a genuinely fixable check. A moved error is
+ * progress.
+ *
+ * The exemption covers the FILE:LINE colon only. Measured: `src/db.ts:41` and
+ * `src/db.ts:88` keep their line numbers and stay different, but the COLUMN in
+ * `Cart.tsx:88:12` normalises to `cart.tsx:88:<port>` — the prefix at that colon
+ * is the bare `88`, which is neither a path nor a filename. Two defects that
+ * differ only in column therefore compare equal.
  */
 const BARE_PORT = /(\S*?):(\d{2,5})\b/g;
 /** A path (has a separator) or a filename with an extension ⇒ a source location. */
@@ -97,24 +93,17 @@ export function rankedFirstFailure(outcome) {
  * here: it edited the tree, the gate re-ran, and returned the same first failure
  * as the previous attempt.
  *
- * …EXCEPT when the probe OBSERVED the failure (nexttask 19A). This rule was built
- * as a blind compensator for a probe limitation — run 14's boot check "could not
- * observe a listener in that sandbox at all" — and that limitation was fixed
- * upstream ELEVEN MINUTES BEFORE this rule landed (`b0f90a7` 23:34:05, `dd3b0c3`
- * 23:45:09, both 2026-07-19). Every probe now reports "I could not look" as its
- * own outcome, with the reason. What was left was a second, blind judgment of the
- * same question, made DOWNSTREAM from the evidence — and its only reachable effect
- * was to overrule a probe that DID look.
- *
- * It has to be overruled, because a deterministic un-fixed defect emits an
- * IDENTICAL failure by definition. String equality therefore reads reproducibility
- * as evidence against the instrument, which is backwards for every project type: a
- * CLI that exits 2 twice, a build that fails on the same symbol twice, a C++ plugin
- * missing the same export twice. mx5 run 21 is the one recorded instance and it
- * released a product whose every page was blank as a `completed` run.
+ * …EXCEPT when a probe OBSERVED the failure, which is checked FIRST and wins
+ * outright. A probe that looked and saw the defect has already answered the
+ * question this rule guesses at, and it answered it where the evidence is. A
+ * probe that could NOT look reports that as its own outcome instead, so it never
+ * reaches `observedFailures`.
  *
- * The fix is NOT a better string pattern — the bug is that the decision was made
- * downstream from the evidence, not that the pattern was too coarse.
+ * The observed guard has to win, because a deterministic un-fixed defect emits an
+ * IDENTICAL failure by definition. Without it, string equality reads
+ * reproducibility as evidence against the instrument — a CLI that exits 2 twice,
+ * a build that fails on the same symbol twice — and demotes a real, still-broken
+ * check to debt.
  */
 export function isNonProgress(input) {
     if (input.observed === true)
@@ -134,8 +123,8 @@ export function applyDemotions(failures, demoted) {
         return [...failures];
     return failures.filter(f => !demoted.has(normalizeFailureDetail(f)));
 }
-/** The debt reason recorded for a demoted check, and the gate-trail wording. Kept
- *  in one place so the ledger line and the trail line cannot drift apart. */
+/** The debt reason recorded for a demoted check. One function so the ledger entry
+ *  and the wording the user reads cannot drift apart. */
 export function unobservedDebtReason(detail) {
     return (`final gate check UNOBSERVED — ${detail.trim().slice(0, 200)} — `
         + 'repeated identically across two fix attempts that both changed the tree and '