@mjasnikovs/pi-task 0.38.5 → 0.38.6

package/dist/task/accept-debt.js

@@ -29,6 +29,7 @@ import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import { parseVerifyBlockStrict } from './spec-validation.js';
 import { taskFilePath, tasksDir } from './task-io.js';
+import { isUnfailableCommand } from './unfailable-command.js';
 const ACCEPT_DEBT_FILE = 'accept-debt.md';
 /** Cap kept records so a run that accepts many FAILs cannot grow the report unboundedly. */
 const MAX_DEBTS = 60;
@@ -264,9 +265,23 @@ export function isStaticClassDebt(reason) {
  * would split it into two, and an over-long line is a heredoc/prose artefact rather
  * than a command. Any of those ⇒ not stored ⇒ the debt is simply unclassified, i.e.
  * exactly as un-closable as it is today.
+ *
+ * …and one more condition (nexttask 19C): a command whose EXIT STATUS IS DESTROYED
+ * BY ITS OWN CONSTRUCTION is not storable either. The whole auto-close rests on a
+ * ZERO exit meaning "the check passed" (see recheckAcceptDebts below), and 16 of
+ * the 612 store-eligible VERIFY lines on this box exit zero whatever the tree
+ * contains — 12 of them in IAR1, a CMake/C++ OBS plugin with no database, no
+ * frontend and no HTTP server, where one task is seven consecutive
+ * `test -f … && echo "PASS" || echo "FAIL"` lines standing in for a build check.
+ * Refusing to store one leaves the debt OPEN and surfaced, which is strictly the
+ * smaller claim. See unfailable-command.ts for what is and is not decidable, and
+ * why bare `|| true` stays out of scope.
  */
 function isStorableCommand(cmd) {
-    return cmd.length > 0 && cmd.length <= MAX_REASON_LENGTH && !/[\t\n\r]/.test(cmd);
+    return (cmd.length > 0
+        && cmd.length <= MAX_REASON_LENGTH
+        && !/[\t\n\r]/.test(cmd)
+        && !isUnfailableCommand(cmd));
 }
 /**
  * Read the owning task's spec and return the VERIFY command its FAIL reason names,

package/dist/task/clamp-output.d.ts

@@ -0,0 +1 @@
+export declare function clampOutput(output: string): string;

package/dist/task/clamp-output.js

@@ -0,0 +1,15 @@
+/**
+ * clamp-output — the ONE trail-side ceiling for captured tool output.
+ *
+ * `appendGateRecord` flattens newlines to spaces, so the gate trail stays one line
+ * per entry; this caps the volume, because a wedged tool can emit megabytes.
+ * Extracted from task-gates.ts so every probe that carries evidence into a failure
+ * detail clamps the SAME way: a second clamp with a second ceiling is how two
+ * trails start disagreeing about what was captured.
+ */
+const TRAIL_OUTPUT_MAX_CHARS = 1200;
+export function clampOutput(output) {
+    return output.length > TRAIL_OUTPUT_MAX_CHARS ?
+        `${output.slice(0, TRAIL_OUTPUT_MAX_CHARS)}…`
+        : output;
+}

package/dist/task/final-gate-fix.d.ts

@@ -103,6 +103,12 @@ export interface FinalFixResult {
     /** The fresh gate's individual ranked failures (see FinalGateOutcome.failures),
      *  so the caller can trail each entry — never just the first. */
     gateFailures?: string[];
+    /** …and which of them a PROBE returned after OBSERVING (see
+     *  FinalGateOutcome.observedFailures). Carried so the caller's non-progress
+     *  classifier can ask the probe's own verdict instead of guessing from the
+     *  failure text — a check that was observed to FAIL is never demote-eligible
+     *  (nexttask 19A). */
+    gateObservedFailures?: string[];
     /** On a converged outcome: the re-run gate's UNOBSERVED note, if it observed
      *  nothing dynamic (see FinalGateOutcome.unobserved). Carried so the caller
      *  labels a converge-on-statics-alone the same way it labels a first-pass one —
@@ -139,6 +145,10 @@ export interface FinalFixDeps {
         ok: boolean;
         reason: string;
         failures?: string[];
+        /** Which of them a probe returned after OBSERVING (nexttask 19A) — carried
+         *  through so the caller's demote decision can ask the probe's own verdict
+         *  instead of re-deriving observability from the failure string. */
+        observedFailures?: string[];
         unobserved?: string;
     }>;
     /** Labels of every currently-discoverable gate command (static + integration),

package/dist/task/final-gate-fix.js

@@ -338,7 +338,8 @@ export async function runFinalGateAutofix(deps) {
             ok: false,
             reason: `did not converge: ${fin.reason}`,
             gateReason: fin.reason,
-            gateFailures: fin.failures
+            gateFailures: fin.failures,
+            ...(fin.observedFailures ? { gateObservedFailures: fin.observedFailures } : {})
         });
     }
     // IGNORED-DEPENDENCY DOWNGRADE (mx5 run 19). The gate says PASS; the question

package/dist/task/final-gate-progress.d.ts

@@ -50,11 +50,38 @@ export interface NonProgressInput {
     /** Did this attempt actually change the tree AND survive the guards? Only an
      *  attempt that edited and re-tested says anything about falsifiability. */
     edited: boolean;
+    /**
+     * Did a PROBE return this failure after OBSERVING? (nexttask 19A.) Read off
+     * `FinalGateOutcome.observedFailures` by exact text identity — never re-derived
+     * from the failure string.
+     *
+     * True ⇒ never non-progress. See the guard in `isNonProgress` for why.
+     */
+    observed?: boolean;
 }
 /**
  * True when this attempt is evidence that the ranked-first check is unfalsifiable
  * here: it edited the tree, the gate re-ran, and returned the same first failure
  * as the previous attempt.
+ *
+ * …EXCEPT when the probe OBSERVED the failure (nexttask 19A). This rule was built
+ * as a blind compensator for a probe limitation — run 14's boot check "could not
+ * observe a listener in that sandbox at all" — and that limitation was fixed
+ * upstream ELEVEN MINUTES BEFORE this rule landed (`b0f90a7` 23:34:05, `dd3b0c3`
+ * 23:45:09, both 2026-07-19). Every probe now reports "I could not look" as its
+ * own outcome, with the reason. What was left was a second, blind judgment of the
+ * same question, made DOWNSTREAM from the evidence — and its only reachable effect
+ * was to overrule a probe that DID look.
+ *
+ * It has to be overruled, because a deterministic un-fixed defect emits an
+ * IDENTICAL failure by definition. String equality therefore reads reproducibility
+ * as evidence against the instrument, which is backwards for every project type: a
+ * CLI that exits 2 twice, a build that fails on the same symbol twice, a C++ plugin
+ * missing the same export twice. mx5 run 21 is the one recorded instance and it
+ * released a product whose every page was blank as a `completed` run.
+ *
+ * The fix is NOT a better string pattern — the bug is that the decision was made
+ * downstream from the evidence, not that the pattern was too coarse.
  */
 export declare function isNonProgress(input: NonProgressInput): boolean;
 /**

package/dist/task/final-gate-progress.js

@@ -96,8 +96,29 @@ export function rankedFirstFailure(outcome) {
  * True when this attempt is evidence that the ranked-first check is unfalsifiable
  * here: it edited the tree, the gate re-ran, and returned the same first failure
  * as the previous attempt.
+ *
+ * …EXCEPT when the probe OBSERVED the failure (nexttask 19A). This rule was built
+ * as a blind compensator for a probe limitation — run 14's boot check "could not
+ * observe a listener in that sandbox at all" — and that limitation was fixed
+ * upstream ELEVEN MINUTES BEFORE this rule landed (`b0f90a7` 23:34:05, `dd3b0c3`
+ * 23:45:09, both 2026-07-19). Every probe now reports "I could not look" as its
+ * own outcome, with the reason. What was left was a second, blind judgment of the
+ * same question, made DOWNSTREAM from the evidence — and its only reachable effect
+ * was to overrule a probe that DID look.
+ *
+ * It has to be overruled, because a deterministic un-fixed defect emits an
+ * IDENTICAL failure by definition. String equality therefore reads reproducibility
+ * as evidence against the instrument, which is backwards for every project type: a
+ * CLI that exits 2 twice, a build that fails on the same symbol twice, a C++ plugin
+ * missing the same export twice. mx5 run 21 is the one recorded instance and it
+ * released a product whose every page was blank as a `completed` run.
+ *
+ * The fix is NOT a better string pattern — the bug is that the decision was made
+ * downstream from the evidence, not that the pattern was too coarse.
  */
 export function isNonProgress(input) {
+    if (input.observed === true)
+        return false;
     if (!input.edited)
         return false;
     if (input.previousSignature === null || input.currentDetail === null)

package/dist/task/final-gate.d.ts

@@ -27,6 +27,28 @@ export interface FinalGateOutcome {
      * each entry and show the full list wherever an ACCEPT decision is made.
      */
     failures?: string[];
+    /**
+     * The SUBSET of `failures` that a PROBE returned after actually observing —
+     * entries whose evidence is "we looked, and what we saw was bad", as opposed to
+     * "we could not look" (nexttask 19A).
+     *
+     * The probes have always known this about themselves: `RenderOutcome` is
+     * `pass | fail | skip`, `f648f5b` (2026-07-14) turned a render `skip` into
+     * "render check UNOBSERVED: <reason>", and `b0f90a7` (2026-07-19) made an
+     * unenumerable boot return PASS-stamped-UNOBSERVED rather than FAIL. What was
+     * missing is that the outcome CLASS never travelled with the failure TEXT, so
+     * the non-progress classifier downstream had to guess — and guessed by string
+     * equality, which a deterministic un-fixed defect satisfies by definition.
+     *
+     * mx5 run 21: the render probe FAILED on a blank page, the same failure came
+     * back from two tree-changing fix attempts (because the defect was real and
+     * unfixed), the classifier read that as evidence against the INSTRUMENT, and
+     * the run shipped a product whose every page was blank as `completed`.
+     *
+     * Membership is by exact text identity with an entry of `failures` — never a
+     * pattern, never a re-derivation. Absent/empty on a pass.
+     */
+    observedFailures?: string[];
     /**
      * Human-facing suffix listing the still-open accepted-defect claims (see
      * buildAcceptDebtNote) — for the picker question and the trail, NEVER for the

package/dist/task/final-gate.js

@@ -1427,6 +1427,15 @@ export async function runFinalIntegrationGate(cwd, timeoutMs = 900_000, bootGrac
     const fail = (text, rank = 1) => {
         failures.push({ rank, text });
     };
+    /**
+     * A failure a PROBE returned after observing (nexttask 19A — see
+     * FinalGateOutcome.observedFailures). Used by exactly one caller: the boot
+     * section, whose `fail` outcome can only arise from a probe that looked. Every
+     * other `fail()` keeps today's class, so nothing else changes.
+     */
+    const failObserved = (text, rank = 1) => {
+        failures.push({ rank, text, observed: true });
+    };
     if (!stat.ok)
         fail(`static checks: ${stat.reason}`);
     // Launch-contract diff (mx5 run 10 item 4): the design declared `migrate`/`seed`
@@ -1669,7 +1678,14 @@ export async function runFinalIntegrationGate(cwd, timeoutMs = 900_000, bootGrac
             expectServer
         });
         if (b.outcome === 'fail') {
-            fail(`boot check: \`${label}\` ${b.detail}`, 0);
+            // OBSERVED (nexttask 19A). Every path that produces `fail` here is a
+            // probe that looked: the render judge saw an empty body, the deep
+            // session saw the authenticated half dead, the enumerator saw no
+            // listener, or the launch command itself exited non-zero. The one
+            // condition that means "we could not look" — no ss/netstat/lsof, mx5
+            // run 14 — returns PASS stamped UNOBSERVED and never reaches here
+            // (`b0f90a7`, final-gate.ts `if (!canEnumerate) return passAndKill(…)`).
+            failObserved(`boot check: \`${label}\` ${b.detail}`, 0);
         }
         else if (b.outcome === 'orphan-port') {
             // Could not clear the port. Distinct HARNESS diagnosis, never a bare app
@@ -1723,7 +1739,12 @@ export async function runFinalIntegrationGate(cwd, timeoutMs = 900_000, bootGrac
         // order. One failure keeps the exact single-failure wording; several become
         // a numbered list so the trail, the ACCEPT picker, and the autofix seed all
         // carry the complete ranked picture.
-        const texts = [...failures].sort((a, b) => a.rank - b.rank).map(f => f.text);
+        const ranked = [...failures].sort((a, b) => a.rank - b.rank);
+        const texts = ranked.map(f => f.text);
+        // The observed subset rides along by exact text identity (19A) — the demote
+        // decision downstream reads THIS, instead of re-deriving observability from
+        // the failure string.
+        const observed = ranked.filter(f => f.observed === true).map(f => f.text);
         return withDebts({
             ok: false,
             reason: texts.length === 1 ?
@@ -1731,7 +1752,8 @@ export async function runFinalIntegrationGate(cwd, timeoutMs = 900_000, bootGrac
                 : `${texts.length} failures (ranked, most load-bearing first):\n${texts
                     .map((t, i) => `${i + 1}. ${t}`)
                     .join('\n')}`,
-            failures: texts
+            failures: texts,
+            ...(observed.length > 0 ? { observedFailures: observed } : {})
         });
     }
     const warningNote = warnings.length > 0 ? ` — WARNING: ${warnings.join('; WARNING: ')}` : '';

package/dist/task/render-check.d.ts

@@ -34,6 +34,37 @@ export declare function judgeRenderedDom(html: string): {
     ok: boolean;
     detail: string;
 };
+/**
+ * The page's console output, as captured while the DOM was being rendered.
+ *
+ * MEASURED on this box (2026-08-14) against the shipped mx5 run-21 bundle, both
+ * binaries the probe can discover:
+ *
+ *     /usr/bin/chromium              --dump-dom alone → 0 bytes of stderr
+ *                                    + --enable-logging=stderr --v=0 → 2 CONSOLE
+ *                                      lines, one of them the cause
+ *     playwright chrome-headless-shell
+ *                                    → the 2 CONSOLE lines either way
+ *
+ * and in ALL FOUR arms stdout was byte-identical at 318 bytes, so the DOM the
+ * judge reads is untouched by the flags.
+ */
+export declare function parseConsoleLines(stderr: string): string[];
+/**
+ * Append the console output to a FAIL detail — and to nothing else.
+ *
+ * WHY (nexttask 19B; the class 18A opened for repo-health). Run 21's fix child was
+ * told "the body is EMPTY" and nothing more. It spent 45 minutes on tests, bundler
+ * config and static serving, read the offending line twice, and moved on. The
+ * probe was holding the answer the whole time: `Uncaught ReferenceError: process
+ * is not defined`, at main.js:322.
+ *
+ * Strictly additive by construction: it takes an existing FAIL detail and returns
+ * it with text appended. It cannot turn a PASS into a FAIL, cannot reach
+ * `judgeRenderedDom`, and returns the detail unchanged when the page logged
+ * nothing.
+ */
+export declare function withConsoleEvidence(detail: string, stderr: string): string;
 /**
  * Load `url` once in a headless Chrome and judge the rendered DOM. Blocking
  * (spawnSync) by design — the caller holds the booted server alive exactly for

package/dist/task/render-check.js

@@ -29,6 +29,7 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, readdirSync } from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { clampOutput } from './clamp-output.js';
 /** PATH names tried in order for a system Chrome-family binary. */
 const CHROME_PATH_CANDIDATES = [
     'chromium',
@@ -144,6 +145,74 @@ export function judgeRenderedDom(html) {
 /** Wall-clock cap for the whole browser run; virtual-time budget for the page JS. */
 const RENDER_TIMEOUT_MS = 30_000;
 const VIRTUAL_TIME_BUDGET_MS = 8_000;
+/**
+ * A Chrome console line on stderr:
+ *
+ *     [11506:11506:0814/090315.702981:INFO:CONSOLE:322] "Uncaught ReferenceError:
+ *         process is not defined", source: http://localhost:8791/main.js (322)
+ *
+ * Only the severity and the message survive. The bracketed pid/tid/timestamp
+ * prefix is DROPPED on purpose: it changes every run, and the failure detail is
+ * the string `normalizeFailureDetail` compares across autofix attempts. A volatile
+ * prefix in there would make two runs of the SAME defect look different, which is
+ * a change to the non-progress classifier's behaviour — and 19B may not change any
+ * verdict, only explain one.
+ */
+const CONSOLE_LINE_RE = /^\[[^\]]*:(INFO|WARNING|ERROR|VERBOSE\d*):CONSOLE:\d*\]\s*(.*)$/;
+/** At most this many console lines ride along; the whole block is clamped again. */
+const MAX_CONSOLE_LINES = 12;
+/**
+ * The page's console output, as captured while the DOM was being rendered.
+ *
+ * MEASURED on this box (2026-08-14) against the shipped mx5 run-21 bundle, both
+ * binaries the probe can discover:
+ *
+ *     /usr/bin/chromium              --dump-dom alone → 0 bytes of stderr
+ *                                    + --enable-logging=stderr --v=0 → 2 CONSOLE
+ *                                      lines, one of them the cause
+ *     playwright chrome-headless-shell
+ *                                    → the 2 CONSOLE lines either way
+ *
+ * and in ALL FOUR arms stdout was byte-identical at 318 bytes, so the DOM the
+ * judge reads is untouched by the flags.
+ */
+export function parseConsoleLines(stderr) {
+    const out = [];
+    for (const raw of stderr.split('\n')) {
+        const m = CONSOLE_LINE_RE.exec(raw.trim());
+        if (!m)
+            continue;
+        const text = m[2].trim();
+        if (text.length === 0)
+            continue;
+        const line = `${m[1].toLowerCase()}: ${text}`;
+        if (!out.includes(line))
+            out.push(line);
+        if (out.length >= MAX_CONSOLE_LINES)
+            break;
+    }
+    return out;
+}
+/**
+ * Append the console output to a FAIL detail — and to nothing else.
+ *
+ * WHY (nexttask 19B; the class 18A opened for repo-health). Run 21's fix child was
+ * told "the body is EMPTY" and nothing more. It spent 45 minutes on tests, bundler
+ * config and static serving, read the offending line twice, and moved on. The
+ * probe was holding the answer the whole time: `Uncaught ReferenceError: process
+ * is not defined`, at main.js:322.
+ *
+ * Strictly additive by construction: it takes an existing FAIL detail and returns
+ * it with text appended. It cannot turn a PASS into a FAIL, cannot reach
+ * `judgeRenderedDom`, and returns the detail unchanged when the page logged
+ * nothing.
+ */
+export function withConsoleEvidence(detail, stderr) {
+    const lines = parseConsoleLines(stderr);
+    if (lines.length === 0)
+        return detail;
+    return `${detail} — console output during the load: ${clampOutput(lines.join(' | '))}`;
+}
 /**
  * Load `url` once in a headless Chrome and judge the rendered DOM. Blocking
  * (spawnSync) by design — the caller holds the booted server alive exactly for
@@ -163,6 +232,11 @@ export function runRenderCheck(url, browser) {
         '--no-sandbox',
         '--disable-dev-shm-usage',
         `--virtual-time-budget=${VIRTUAL_TIME_BUDGET_MS}`,
+        // Route the page's console to stderr (nexttask 19B). stdout — the DOM
+        // the judge reads — is byte-identical with and without these; measured
+        // on both discoverable binaries, see withConsoleEvidence.
+        '--enable-logging=stderr',
+        '--v=0',
         '--dump-dom',
         url
     ], { encoding: 'utf8', timeout: RENDER_TIMEOUT_MS, env: { ...process.env } });
@@ -180,7 +254,9 @@ export function runRenderCheck(url, browser) {
         };
     }
     const judged = judgeRenderedDom(dom);
+    // The verdict is the judge's, unchanged. Only a FAIL grows: it carries the
+    // console output the probe already had at the moment it judged (19B).
     return judged.ok ?
         { outcome: 'pass', detail: judged.detail }
-        : { outcome: 'fail', detail: judged.detail };
+        : { outcome: 'fail', detail: withConsoleEvidence(judged.detail, r.stderr ?? '') };
 }

package/dist/task/run-final-gate.js

@@ -412,8 +412,17 @@ export async function runFinalGateStage(active, deps, p) {
                 failures: fix.gateFailures
             });
             const edited = fix.gateReason !== undefined && stranded.length > 0;
+            // …and whether a PROBE OBSERVED this failure (nexttask 19A). Exact text
+            // identity against the gate's own observed subset — not a second string
+            // pattern, which is the mistake `isNonProgress` already made once.
+            const observed = fix.gateObservedFailures?.includes(detail ?? '') === true;
             if (detail !== null
-                && isNonProgress({ previousSignature: prevFailSig, currentDetail: detail, edited })) {
+                && isNonProgress({
+                    previousSignature: prevFailSig,
+                    currentDetail: detail,
+                    edited,
+                    observed
+                })) {
                 demoted.add(normalizeFailureDetail(detail));
                 prevFailSig = null;
                 await carryDebt(unobservedDebtReason(detail));

package/dist/task/task-gates.js

@@ -8,6 +8,7 @@ import { attributeEnforceFailure } from './enforce-attribution.js';
 // come from accept-debt.ts directly — the latter because its writer and its
 // re-check-side parser (extractDeletedDebtPath) have to move together.
 import { crossTaskDeletionReason } from './accept-debt.js';
+import { clampOutput } from './clamp-output.js';
 /**
  * How many times a verify FAIL may be auto-fixed UNATTENDED (the research
  * recommended AUTOFIX, so pi re-runs the impl turn without prompting) before the
@@ -41,18 +42,8 @@ export function yoloAcceptReason(c) {
         `judge recommended ACCEPT (autofix budget 0/${MAX_AUTO_AUTOFIX} unused)`
         : `judge recommended ACCEPT (autofix budget ${c.autoFixCount}/${MAX_AUTO_AUTOFIX} already spent)`;
 }
-/**
- * Bound a captured health-check output before it is embedded in a gate-trail line.
- * appendGateRecord flattens newlines to spaces, so the trail stays one line per
- * entry; this just caps the volume (a wedged tool can emit megabytes). The health
- * check already trims to its own first-N lines — this is the trail-side ceiling.
- */
-const TRAIL_OUTPUT_MAX_CHARS = 1200;
-function clampOutput(output) {
-    return output.length > TRAIL_OUTPUT_MAX_CHARS ?
-        `${output.slice(0, TRAIL_OUTPUT_MAX_CHARS)}…`
-        : output;
-}
+// The trail-side output ceiling lives in clamp-output.ts, so the render probe's
+// evidence clamps identically (nexttask 19B) — one ceiling, one implementation.
 /**
  * Show the boxed two-choice picker after a verify FAIL and return what the user
  * decided. The model-recommended card is placed first so the renderer tints it

package/dist/task/unfailable-command.d.ts

@@ -0,0 +1,56 @@
+/**
+ * unfailable-command — is this shell command's exit status DESTROYED by its own
+ * construction? (nexttask 19C)
+ *
+ * WHY THIS EXISTS. `recheckAcceptDebts` may auto-close an accepted debt on exactly
+ * one piece of evidence: the debt named a VERIFY command, that command was re-run,
+ * and it exited ZERO (accept-debt.ts — "the debt named a command, the command was
+ * run, and it passed"). `isStorableCommand` used to filter only on length and
+ * control characters, so nothing asked whether a ZERO exit could ever mean
+ * anything. Sixteen stored-eligible VERIFY lines in the corpus on this box cannot
+ * exit non-zero no matter what the tree contains:
+ *
+ *     C  `test -f "$SO_LIB" && echo "PASS: …" || echo "FAIL: …"`     15  ← both
+ *        branches that can be LAST are echoes, so the status is echo's: 0.
+ *     A  `bun -e "console.assert(…)"`                                 1  ← measured
+ *        in both runtimes: `console.assert(1===2,'X')` prints and exits 0.
+ *     B  `npx tsc --noEmit 2>&1 | tail -5; test $? -eq 0 && …`        1  ← `$?` is
+ *        tail's status, not tsc's.
+ *
+ * IAR1 (CMake / C++ / OBS plugin — no database, no frontend, no HTTP server)
+ * carries 11 of the 16; one of its tasks is SEVEN consecutive `test -f … && echo
+ * "PASS" || echo "FAIL"` lines standing in for a build verification.
+ *
+ * THE VERDICT IS A REFUSAL, NOT A CLAIM. An unfailable command is not stored, so
+ * the debt stays OPEN and surfaced — the strictly smaller claim. Nothing here can
+ * close a debt, fail a gate, or edit a spec.
+ *
+ * DECIDED ON SHELL SHAPE, NEVER ON THE VERB. `grep -q …` and `ctest …` set a real
+ * status and are untouched; `test -f X || { echo …; exit 1; }` exits non-zero and
+ * is untouched. Naming verbs is the mistake nexttask 3 already paid for
+ * (command-shrink's guard compared NAMES) and 16B re-bought.
+ *
+ * OUT OF SCOPE BY DESIGN: bare `|| true`. skip-escape.ts:11-19 records the FP
+ * measurement — of 45 `||` uses in the historical VERIFY blocks exactly one was a
+ * real skip-escape; a blanket `|| true` rule is ~90% false positives (teardown,
+ * setup, negative tests). `rm -rf build || true` classifies CAN-FAIL here and must
+ * keep doing so.
+ *
+ * THREE OUTCOMES, and `unknown` is a first-class answer: a shape this cannot
+ * decide is never guessed at, it is left alone (which is today's behaviour).
+ */
+/** How a command's exit status behaves. `unknown` ⇒ do not act. */
+export type ExitStatusClass = 'unfailable' | 'can-fail' | 'unknown';
+export interface UnfailableVerdict {
+    cls: ExitStatusClass;
+    /** Which sub-rule decided it (A/B/C), and in prose. Empty for `can-fail`. */
+    reason: string;
+}
+/**
+ * Is this command's exit status destroyed by construction? The only caller that
+ * may ACT on `unfailable` is `isStorableCommand`, and the only action is a refusal
+ * to store — never a close, never a gate failure.
+ */
+export declare function classifyExitStatus(cmd: string): UnfailableVerdict;
+/** Convenience predicate for the one place that acts on this. */
+export declare function isUnfailableCommand(cmd: string): boolean;

package/dist/task/unfailable-command.js

@@ -0,0 +1,263 @@
+/**
+ * unfailable-command — is this shell command's exit status DESTROYED by its own
+ * construction? (nexttask 19C)
+ *
+ * WHY THIS EXISTS. `recheckAcceptDebts` may auto-close an accepted debt on exactly
+ * one piece of evidence: the debt named a VERIFY command, that command was re-run,
+ * and it exited ZERO (accept-debt.ts — "the debt named a command, the command was
+ * run, and it passed"). `isStorableCommand` used to filter only on length and
+ * control characters, so nothing asked whether a ZERO exit could ever mean
+ * anything. Sixteen stored-eligible VERIFY lines in the corpus on this box cannot
+ * exit non-zero no matter what the tree contains:
+ *
+ *     C  `test -f "$SO_LIB" && echo "PASS: …" || echo "FAIL: …"`     15  ← both
+ *        branches that can be LAST are echoes, so the status is echo's: 0.
+ *     A  `bun -e "console.assert(…)"`                                 1  ← measured
+ *        in both runtimes: `console.assert(1===2,'X')` prints and exits 0.
+ *     B  `npx tsc --noEmit 2>&1 | tail -5; test $? -eq 0 && …`        1  ← `$?` is
+ *        tail's status, not tsc's.
+ *
+ * IAR1 (CMake / C++ / OBS plugin — no database, no frontend, no HTTP server)
+ * carries 11 of the 16; one of its tasks is SEVEN consecutive `test -f … && echo
+ * "PASS" || echo "FAIL"` lines standing in for a build verification.
+ *
+ * THE VERDICT IS A REFUSAL, NOT A CLAIM. An unfailable command is not stored, so
+ * the debt stays OPEN and surfaced — the strictly smaller claim. Nothing here can
+ * close a debt, fail a gate, or edit a spec.
+ *
+ * DECIDED ON SHELL SHAPE, NEVER ON THE VERB. `grep -q …` and `ctest …` set a real
+ * status and are untouched; `test -f X || { echo …; exit 1; }` exits non-zero and
+ * is untouched. Naming verbs is the mistake nexttask 3 already paid for
+ * (command-shrink's guard compared NAMES) and 16B re-bought.
+ *
+ * OUT OF SCOPE BY DESIGN: bare `|| true`. skip-escape.ts:11-19 records the FP
+ * measurement — of 45 `||` uses in the historical VERIFY blocks exactly one was a
+ * real skip-escape; a blanket `|| true` rule is ~90% false positives (teardown,
+ * setup, negative tests). `rm -rf build || true` classifies CAN-FAIL here and must
+ * keep doing so.
+ *
+ * THREE OUTCOMES, and `unknown` is a first-class answer: a shape this cannot
+ * decide is never guessed at, it is left alone (which is today's behaviour).
+ */
+const CAN_FAIL = { cls: 'can-fail', reason: '' };
+// ─── a quote- and group-aware splitter ───────────────────────────────────────
+/**
+ * Split `s` on the top-level occurrences of `seps` (longest first), respecting
+ * single quotes, double quotes, `$(…)`/backtick substitution and `(…)`/`{…}`
+ * groups. Returns the pieces and the separators that joined them.
+ */
+function splitTopLevel(s, seps) {
+    const parts = [];
+    const ops = [];
+    let buf = '';
+    let depth = 0;
+    let quote = null;
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (quote !== null) {
+            buf += c;
+            if (c === '\\' && quote === '"') {
+                if (i + 1 < s.length)
+                    buf += s[++i];
+                continue;
+            }
+            if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '\\') {
+            buf += c;
+            if (i + 1 < s.length)
+                buf += s[++i];
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+            buf += c;
+            continue;
+        }
+        if (c === '(' || (c === '{' && /(?:^|\s)$/.test(buf))) {
+            depth++;
+            buf += c;
+            continue;
+        }
+        if (c === ')' || (c === '}' && depth > 0)) {
+            depth = Math.max(0, depth - 1);
+            buf += c;
+            continue;
+        }
+        if (depth === 0) {
+            const hit = seps.find(sep => s.startsWith(sep, i));
+            if (hit !== undefined) {
+                parts.push(buf);
+                ops.push(hit);
+                buf = '';
+                i += hit.length - 1;
+                continue;
+            }
+        }
+        buf += c;
+    }
+    parts.push(buf);
+    return { parts, ops };
+}
+/** `a; b; c` — the LINE's exit status is the LAST segment's. */
+function segments(cmd) {
+    return splitTopLevel(cmd, [';'])
+        .parts.map(p => p.trim())
+        .filter(p => p.length > 0);
+}
+/** `a && b || c` — the pieces and the operators between them. */
+function chain(seg) {
+    const { parts, ops } = splitTopLevel(seg, ['&&', '||']);
+    return { parts: parts.map(p => p.trim()), ops };
+}
+/** A top-level `|` that is not `||`. */
+function hasPipeline(seg) {
+    const { ops } = splitTopLevel(seg, ['||', '|']);
+    return ops.includes('|');
+}
+/**
+ * Which commands of an `&&`/`||` chain can be the LAST one executed — i.e. whose
+ * exit status can become the chain's.
+ *
+ * `c_i` (before the end) can be terminal only if some single status short-circuits
+ * EVERY remaining operator: `&&` skips what follows when the status is non-zero,
+ * `||` skips it when the status is zero. A chain that mixes the two after `c_i`
+ * therefore always runs on past it. For `A && B || C`: A is never terminal (the
+ * `||` picks C up after A fails), B is terminal when it succeeds, C is terminal —
+ * so the status is always an echo's, which is the run-21 shape.
+ */
+function terminalIndices(ops, n) {
+    const out = [];
+    for (let i = 0; i < n; i++) {
+        if (i === n - 1) {
+            out.push(i);
+            continue;
+        }
+        const rest = ops.slice(i, n - 1);
+        const skipsOnFail = rest.every(o => o === '&&');
+        const skipsOnOk = rest.every(o => o === '||');
+        if (skipsOnFail || skipsOnOk)
+            out.push(i);
+    }
+    return out;
+}
+// ─── the three sub-rules ─────────────────────────────────────────────────────
+/** The command word, with leading `VAR=value` assignments and `env` stripped. */
+function commandWord(cmd) {
+    let rest = cmd.trim();
+    for (;;) {
+        const m = /^(?:env\s+|[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S*)\s+)/.exec(rest);
+        if (!m)
+            break;
+        rest = rest.slice(m[0].length);
+    }
+    return /^[^\s]*/.exec(rest)?.[0] ?? '';
+}
+/**
+ * A branch that cannot do anything but succeed: `echo …` / `printf …` with no
+ * redirection to a file (a redirect CAN fail on a bad path, and this class is
+ * about statuses destroyed by construction, not about likely ones).
+ */
+function isPureEcho(cmd) {
+    const word = commandWord(cmd);
+    if (word !== 'echo' && word !== 'printf')
+        return false;
+    return !splitTopLevel(cmd, ['>>', '>']).ops.length;
+}
+/**
+ * RULE A — a `console.assert` check. Measured, not assumed, in both runtimes:
+ *
+ *     $ bun  -e "console.assert(1===2,'X'); console.log('end')"; echo $?   → 0
+ *     $ node -e "console.assert(1===2,'X'); console.log('end')"; echo $?   → 0
+ *
+ * It prints and continues. Narrowed so an eval that ALSO has a real exit path
+ * (`process.exit`, `throw`, a shell `exit`) is untouched — those can fail.
+ */
+function ruleA(cmd) {
+    if (!cmd.includes('console.assert'))
+        return false;
+    return !/\bprocess\.exit\b|\bthrow\b|\bexit\s+\d/.test(cmd);
+}
+/**
+ * RULE B — `$?` read after a PIPELINE. `a | b ; test $? …` tests b's status, not
+ * a's, so the check reports on the filter rather than on the thing being checked.
+ * Shape-only: which command ends the pipeline is never inspected.
+ */
+function ruleB(segs) {
+    for (let i = 1; i < segs.length; i++) {
+        if (segs[i].includes('$?') && hasPipeline(segs[i - 1]))
+            return true;
+    }
+    return false;
+}
+/**
+ * RULE C — every branch of the top-level `&&`/`||` chain that can be LAST is a
+ * pure echo/printf, so the chain's status is an echo's: zero, always.
+ */
+function ruleC(seg) {
+    const { parts, ops } = chain(seg);
+    if (parts.length < 2)
+        return false;
+    const terms = terminalIndices(ops, parts.length);
+    return terms.length > 0 && terms.every(i => isPureEcho(parts[i]));
+}
+// ─── the verdict ─────────────────────────────────────────────────────────────
+/** Shapes this refuses to judge — never a guess, always today's behaviour. */
+function undecidable(cmd) {
+    const t = cmd.trim();
+    // `set -e` changes what a non-zero status DOES, all the way up the line.
+    if (/(?:^|[;&|(]\s*)set\s+-[a-z]*e/.test(t))
+        return '`set -e` is in effect for this line';
+    // The whole line wrapped in a command substitution: the status is the outer
+    // context's, which is not in the text.
+    if (/^\$\([\s\S]*\)$/.test(t) || /^`[\s\S]*`$/.test(t)) {
+        return 'the whole line is a command substitution';
+    }
+    return null;
+}
+/**
+ * Is this command's exit status destroyed by construction? The only caller that
+ * may ACT on `unfailable` is `isStorableCommand`, and the only action is a refusal
+ * to store — never a close, never a gate failure.
+ */
+export function classifyExitStatus(cmd) {
+    const t = cmd.trim();
+    if (t.length === 0)
+        return CAN_FAIL;
+    const skip = undecidable(t);
+    if (skip !== null)
+        return { cls: 'unknown', reason: skip };
+    const segs = segments(t);
+    if (segs.length === 0)
+        return CAN_FAIL;
+    if (ruleB(segs)) {
+        return {
+            cls: 'unfailable',
+            reason: 'B: `$?` is read after a pipeline, so it holds the LAST pipeline element’s '
+                + 'status and not the checked command’s'
+        };
+    }
+    // The line's status is the LAST segment's; earlier segments cannot change it.
+    const last = segs[segs.length - 1];
+    if (ruleA(last)) {
+        return {
+            cls: 'unfailable',
+            reason: 'A: `console.assert` never exits non-zero and never throws — it prints and '
+                + 'continues, in both bun and node'
+        };
+    }
+    if (ruleC(last)) {
+        return {
+            cls: 'unfailable',
+            reason: 'C: every branch of the `&&`/`||` chain that can run LAST is an `echo`/`printf`, '
+                + 'so the exit status is the echo’s — zero whatever the check found'
+        };
+    }
+    return CAN_FAIL;
+}
+/** Convenience predicate for the one place that acts on this. */
+export function isUnfailableCommand(cmd) {
+    return classifyExitStatus(cmd).cls === 'unfailable';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.38.5",
+    "version": "0.38.6",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",