@mjasnikovs/pi-task 0.40.50 → 0.42.0

package/dist/task/task-gates.js

@@ -1,9 +1,12 @@
 import { verifyFailClass } from './verify-work.js';
 import { resolutionOptions, classifyResolutionAnswer } from './verify-resolution.js';
+import { resolveDisposition } from './gate-resolution.js';
+import { classifyHealthDelta } from './health-baseline.js';
 import { SessionUI, notifyBoth, notifyRun } from '../remote/bridge.js';
-import { isYoloMode, yoloVerifyResolution, YOLO_STAMP } from './yolo.js';
+import { isYoloMode, YOLO_STAMP } from './yolo.js';
 import { extractFailingCommand, findRepairCandidate, summariseDefect } from './root-cause-repair.js';
 import { attributeEnforceFailure } from './enforce-attribution.js';
+import { healthRedSubject, parseHealthRepairTitle } from './health-repair.js';
 // The debt ledger is reached through the injected `recordDebt` dep (so it stays
 // absent-in-tests); only the origin TYPE and the cross-task-deletion reason SHAPE
 // come from accept-debt.ts directly — the latter because its writer and its
@@ -12,38 +15,6 @@ import { crossTaskDeletionReason } from './accept-debt.js';
 import { clampOutput } from './clamp-output.js';
 import { cancelCheckpoint } from './cancel-points.js';
 import { updateTaskFrontMatter } from './task-io.js';
-/**
- * How many times a verify FAIL may be auto-fixed UNATTENDED (the research
- * recommended AUTOFIX, so pi re-runs the impl turn without prompting) before the
- * loop falls back to the human picker. Each AUTOFIX is a full implementation
- * re-run, so a non-converging loop must not run forever with nobody able to break
- * it — after this many consecutive auto attempts that still FAIL, the picker is
- * shown so a person can decide. A recommendation to ACCEPT always shows the picker
- * regardless of this count (blessing an artifact as-is is a human's call).
- */
-export const MAX_AUTO_AUTOFIX = 3;
-/**
- * The reason an auto-ACCEPT is being written — NAMED, not assumed.
- *
- * Four disjoint branches reach the terminal auto-ACCEPT, and only ONE of them has
- * spent the autofix budget. An UNOBSERVED FAIL never consults the research; a
- * frozen-blocked one is a contradiction no re-run can resolve; an ACCEPT
- * recommendation can arrive with the budget untouched. A single "autofix budget
- * spent" line would be false on three of the four, and a durable trail that
- * misstates why a defect shipped reads as an exhausted fixer that never tried.
- */
-export function yoloAcceptReason(c) {
-    if (c.isUnobserved)
-        return 'verify UNOBSERVED — tooling absent, an unattended re-run cannot provision it';
-    if (c.isFrozenBlocked)
-        return 'repo-health blocked by a spec-frozen path — an impl re-run under the same freeze cannot converge';
-    if (c.recommend === 'autofix') {
-        return `autofix budget spent (${c.autoFixCount}/${MAX_AUTO_AUTOFIX})`;
-    }
-    return c.autoFixCount === 0 ?
-        `judge recommended ACCEPT (autofix budget 0/${MAX_AUTO_AUTOFIX} unused)`
-        : `judge recommended ACCEPT (autofix budget ${c.autoFixCount}/${MAX_AUTO_AUTOFIX} already spent)`;
-}
 // The trail-side output ceiling lives in clamp-output.ts, so the render probe's
 // evidence clamps identically — one ceiling, one implementation.
 /**
@@ -53,10 +24,13 @@ export function yoloAcceptReason(c) {
  * clarify/grill dialog: the same SessionUI.ask races the local boxed picker against
  * a remote answer, with the two actions also surfaced as remote buttons.
  */
-export async function askVerifyResolution(ctx, title, failReason, rec) {
-    const options = resolutionOptions(rec.recommend);
+export async function askVerifyResolution(ctx, title, failReason, rec, 
+/** The repair ACCEPT would queue (a regressed health check), if any. */
+acceptQueues) {
+    const options = resolutionOptions(rec.recommend, acceptQueues);
     const question = `Verification FAILED for "${title}".\n\n${failReason}\n\n`
-        + `Recommended: ${rec.recommend.toUpperCase()} — ${rec.rationale}`;
+        + `Recommended: ${rec.recommend.toUpperCase()} — ${rec.rationale}`
+        + (acceptQueues ? `\n\nACCEPT queues ${acceptQueues} before the next task.` : '');
     const answer = await new SessionUI(ctx).ask({
         localTitle: 'Verification failed — how should pi proceed?',
         displayQuestion: question,
@@ -68,11 +42,17 @@ export async function askVerifyResolution(ctx, title, failReason, rec) {
     });
     return classifyResolutionAnswer(answer);
 }
+/** The repair a red health check earns, as the picker and the trail name it. */
+function describeHealthRepair(red) {
+    return red.files.length > 0 ?
+        `a repair for ${red.files.join(', ')} (\`${red.command}\`)`
+        : `a repair for \`${red.command}\``;
+}
 /**
  * The VERIFY resolution loop: run the task's verification against the finished
- * work, and negotiate a FAIL through the graduated ladder (bounded lint fix →
- * recommendation → unattended autofix → picker) until it verifies, is accepted,
- * or terminates.
+ * work, and carry out what gate-resolution.ts's decision table says to do with a
+ * FAIL (bounded lint fix first, then the table's autofix / accept / ask) until it
+ * verifies, is accepted, or terminates.
  *
  * Split from `runGatesForTask` at the single boolean that crosses to the ENFORCE
  * half (`cleanPass`). This loop has four terminal exits and carries the whole
@@ -85,7 +65,31 @@ export async function resolveVerifyGate(ctxIn, deps, p, rec, routeRootCause) {
         v.reason ?
             `verify: PASS (${v.reason})`
             : 'verify: PASS'
-        : `verify: FAIL — ${v.reason ?? 'did not verify'}`;
+        : `verify: FAIL — ${v.reason}`;
+    /**
+     * The loop's ONLY debt-bearing exit. Every way out of a FAIL that leaves the
+     * task FINISHED — accepted by a human, accepted unattended, blocked by a spec
+     * contradiction, or dismissed at the picker — goes through here, so a defect
+     * cannot leave this gate with no ledger entry (five did in AUTO_0002). The
+     * exits that leave the task UNFINISHED and resumable (a cancel, a re-run that
+     * could not start) are deliberately not debts: that work is coming back.
+     */
+    const settleDebt = async (origin, reason) => {
+        try {
+            await deps.recordDebt?.(p.cwd, p.taskId, reason, origin);
+        }
+        catch {
+            // recording must never break the gate sequence
+        }
+    };
+    const healthRedOf = async (health) => {
+        try {
+            return healthRedSubject(health, p.cwd, (await deps.repoFiles?.(p.cwd)) ?? null);
+        }
+        catch {
+            return null;
+        }
+    };
     // GATE: actually RUN the task's verification against the just-finished work
     // BEFORE it is checked off or committed. Whether this produced a GENUINE clean
     // pass (a real signal ran and the work met it) also decides how the enforce pass
@@ -97,24 +101,12 @@ export async function resolveVerifyGate(ctxIn, deps, p, rec, routeRootCause) {
         notifyBoth(active, `${p.tag}: verifying "${p.title}"…`, 'info');
         let verified = await deps.verify(active, p.cwd, p.title, p.taskId);
         await rec(verdictLine(verified));
-        // A FAIL no longer dead-stops. When the research recommends AUTOFIX, pi
-        // re-runs the impl turn UNATTENDED (no picker) — the human is consulted only
-        // when the recommendation is ACCEPT (blessing the artifact as-is). The
-        // unattended fix is BOUNDED by MAX_AUTO_AUTOFIX: once that many consecutive
-        // auto attempts still FAIL, the picker returns so a person can break the loop.
         let lintFixAttempted = false;
         let autoFixCount = 0;
-        // Set when the bounded lint-fix reports the `frozen-path:` rejection: the
-        // repo-health FAIL can only be fixed by editing a path THIS task's spec
-        // froze. An impl re-run happens under the same freeze — rule 4b fails the
-        // task if it complies with the linter — so unattended AUTOFIX rounds
-        // CANNOT converge and are skipped;
-        // the picker is forced with the cross-task contradiction named, and the
-        // defect is recorded as a durable debt for the final gate.
-        let frozenContradiction = null;
-        let frozenDebtRecorded = false;
-        // YOLO only: has the one-attempt rescue below already been spent on this task?
-        let yoloRescueUsed = false;
+        // A contradiction outlives the round that proved it: it is a fact about the
+        // SPEC, not about one verdict. Re-deriving it per round is how a loop spends
+        // its whole budget on a freeze that was already named in round one (0053).
+        let contradiction = null;
         while (!verified.ok) {
             // SAFE CHECKPOINT (before a resolution round): a round is a bounded
             // lint fix, a research child and possibly a whole implementation
@@ -134,12 +126,12 @@ export async function resolveVerifyGate(ctxIn, deps, p, rec, routeRootCause) {
                 await updateTaskFrontMatter(p.cwd, p.taskId, { state: 'cancelled' }).catch(() => { });
                 return { stop: { kind: 'cancelled', ctx: active } };
             }
-            const failReason = verified.reason ?? 'did not verify';
+            const failReason = verified.reason;
             // GRADUATED resolution: a repo-health FAIL (pure static findings) gets ONE
             // bounded fix attempt before the picker — smallest tool first. Applied →
             // re-verify and re-enter the loop on the fresh verdict; not applied (guard
-            // trip, no convergence) → fall through to the ordinary picker unchanged.
-            const failClass = verifyFailClass(verified);
+            // trip, no convergence) → fall through to the decision table unchanged.
+            const failClass = verifyFailClass(verified) ?? 'model-verdict';
             if (!lintFixAttempted && deps.lintFix && failClass === 'repo-health') {
                 lintFixAttempted = true;
                 notifyRun(active, `${p.tag}: static findings on "${p.title}" — attempting bounded lint fix…`, 'info');
@@ -152,143 +144,81 @@ export async function resolveVerifyGate(ctxIn, deps, p, rec, routeRootCause) {
                     await rec(verdictLine(verified));
                     continue;
                 }
-                if ((fix.reason ?? '').startsWith('frozen-path:')) {
-                    frozenContradiction = fix.reason ?? null;
-                }
-            }
-            // UNOBSERVED (rule 5c): a spec-required behavioral check could not run because
-            // its observation tooling is absent. An unattended AUTOFIX re-run cannot install
-            // a missing tool, so it would only burn MAX_AUTO_AUTOFIX turns and re-FAIL — the
-            // decision (provision the tool, or accept the unproven behavior) is the human's.
-            // Skip the (moot) recommendation research and force the picker.
-            const isUnobserved = verified.unobserved === true;
-            // FROZEN-BLOCKED (cross-task contradiction): skip the recommendation
-            // research too — it would only re-derive what the deterministic lint-fix
-            // rejection already proved. The picker shows the contradiction; ACCEPT
-            // records the (already-recorded) defect as the human's call. Applies
-            // only while the FAIL is still the repo-health one the contradiction
-            // explains — a later, different FAIL gets the ordinary resolution path.
-            const isFrozenBlocked = frozenContradiction !== null && failClass === 'repo-health';
-            const recOutcome = isUnobserved ? { recommend: 'autofix', rationale: failReason }
-                : isFrozenBlocked ?
-                    {
-                        recommend: 'accept',
-                        rationale: `${frozenContradiction} — the failing static check can only be fixed by `
-                            + `editing a path this task's spec freezes (a cross-task contradiction: `
-                            + `the spec forbids the very edit the repo needs; the "owning" earlier `
-                            + `step already completed). An implementation re-run under the same `
-                            + `freeze cannot converge. ACCEPT records it as durable debt the final `
-                            + `gate re-checks; fixing it needs a plan-level change, not a re-run.`
-                    }
-                    : deps.recommend ?
-                        await deps.recommend(active, p.cwd, p.title, p.taskId, failReason)
-                        : { recommend: 'autofix', rationale: failReason };
-            await rec(isUnobserved ?
-                'resolution: verify UNOBSERVED — spec-required check could not run (tooling absent); '
-                    + 'forcing the human picker, an unattended re-run cannot provision it'
-                : isFrozenBlocked ?
-                    'resolution: repo-health FAIL is blocked by spec-frozen path(s) — cross-task '
-                        + 'contradiction; unattended AUTOFIX skipped (an impl re-run under the same '
-                        + 'freeze cannot converge), forcing the human picker'
-                    : `resolution: recommended ${recOutcome.recommend.toUpperCase()}`);
-            if (isFrozenBlocked && !frozenDebtRecorded) {
-                frozenDebtRecorded = true;
-                // Durable regardless of what the human picks next: the contradiction
-                // is real, cross-task, and outside this task's power to fix — the
-                // final gate must surface it at run end (static-class: it auto-closes
-                // iff the run-end static check passes).
-                try {
-                    await deps.recordDebt?.(p.cwd, p.taskId, `${failReason} — ${frozenContradiction}`, 'frozen-blocked');
-                }
-                catch {
-                    // recording must never break the gate sequence
-                }
+                if (fix.contradiction)
+                    contradiction = fix.contradiction;
             }
-            // AUTO-RESOLVE the AUTOFIX path: when the research says the work is
-            // genuinely wrong, re-run the fix WITHOUT prompting the user. The picker is
-            // reserved for the ACCEPT recommendation (the human decides whether to bless
-            // an artifact the gate FAILed) and for the bounded fallback: after
-            // MAX_AUTO_AUTOFIX consecutive unattended attempts that still FAIL, hand
-            // control back so a person can break a non-converging loop.
-            const autoFixNow = !isUnobserved
-                && !isFrozenBlocked
-                && recOutcome.recommend === 'autofix'
-                && autoFixCount < MAX_AUTO_AUTOFIX
-                // A rescue attempt that still FAILed is terminal under YOLO: the
-                // recommendation that got us here was ACCEPT, so a later flip to
-                // AUTOFIX must not bootstrap the full budget from it.
-                && !yoloRescueUsed;
-            // YOLO, THE RESCUE BRANCH: the recommendation is ACCEPT, nobody can be
-            // asked, and the unattended budget is UNTOUCHED. Accepting here would
-            // ship a defect having attempted nothing, on a judgement the human who
-            // would normally weigh it never saw. So spend ONE attempt first.
-            // Bounded by construction: one, not MAX_AUTO_AUTOFIX, so an ACCEPT
-            // recommendation can never restart a full loop; if it still FAILs the
-            // next turn falls through to the same auto-ACCEPT and the same debt.
-            const yoloRescueNow = isYoloMode()
-                && !yoloRescueUsed
-                && !isUnobserved
-                && !isFrozenBlocked
-                && recOutcome.recommend === 'accept'
-                && autoFixCount === 0;
-            // YOLO: the picker is unreachable with nobody watching, and every
-            // unattended attempt this task may make has been made — so the only
-            // option left that terminates is ACCEPT, recorded as its own
-            // 'yolo-accepted' debt. Deliberately NOT a re-entry into autofix:
-            // MAX_AUTO_AUTOFIX exists to break a non-converging loop, and an
-            // auto-pick here would restart the budget from the site that proves it ran out.
-            const yoloChoice = autoFixNow || yoloRescueNow ? null : yoloVerifyResolution(isYoloMode());
+            // Two FAILs make the recommendation research MOOT before it runs. An
+            // UNOBSERVED one (rule 5c) is a check that could not RUN for want of
+            // tooling, and a contradiction has already been PROVEN deterministically
+            // — asking a model to re-derive either costs a child and decides nothing.
+            const unobserved = verified.unobserved === true;
+            const judge = contradiction === null && !unobserved ? deps.recommend : undefined;
+            const recOutcome = judge ?
+                await judge(active, p.cwd, p.title, p.taskId, failReason)
+                : { recommend: 'autofix', rationale: failReason };
+            if (judge)
+                await rec(`resolution: recommended ${recOutcome.recommend.toUpperCase()}`);
+            contradiction ??= recOutcome.contradiction ?? null;
+            const unattended = isYoloMode();
+            // A regressed health check is THIS task's red. Accepting it ships the
+            // red, and the next checkpoint splices a repair before anything builds
+            // on it (health-repair.ts) — named here so a human choosing ACCEPT
+            // sees what the choice queues, and the trail says the same.
+            const regression = verified.health ? await healthRedOf(verified.health) : null;
+            const acceptQueues = regression ? describeHealthRepair(regression) : undefined;
+            const disposition = resolveDisposition({
+                failClass,
+                recommend: recOutcome.recommend,
+                unobserved,
+                contradiction,
+                attempts: autoFixCount,
+                unattended
+            });
             let choice;
-            if (yoloChoice !== null) {
-                choice = yoloChoice;
-                // NAME the branch. This line is the durable record of why a defect
-                // shipped, and three of the four branches that reach it have spent
-                // no budget at all.
-                await rec(`resolution: auto-ACCEPTED despite verify FAIL — ${yoloAcceptReason({
-                    isUnobserved,
-                    isFrozenBlocked,
-                    recommend: recOutcome.recommend,
-                    autoFixCount
-                })}, nobody to ask ${YOLO_STAMP}`);
-            }
-            else if (autoFixNow || yoloRescueNow) {
+            if (disposition.action === 'autofix') {
                 autoFixCount += 1;
-                if (yoloRescueNow)
-                    yoloRescueUsed = true;
-                await rec(yoloRescueNow ?
-                    `resolution: auto-AUTOFIX (${YOLO_STAMP} rescue — judge recommended ACCEPT with the unattended `
-                        + `budget unspent; one attempt, ${autoFixCount}/${MAX_AUTO_AUTOFIX})`
-                    : `resolution: auto-AUTOFIX (recommended, unattended ${autoFixCount}/${MAX_AUTO_AUTOFIX})`);
-                notifyRun(active, `${p.tag}: verify FAIL on "${p.title}" — auto-fixing (${yoloRescueNow ? `${YOLO_STAMP} one attempt before accepting` : 'recommended'}, ${autoFixCount}/${MAX_AUTO_AUTOFIX})…`, 'info');
+                await rec(`resolution: auto-AUTOFIX (${disposition.reason})`);
+                notifyRun(active, `${p.tag}: verify FAIL on "${p.title}" — auto-fixing (${disposition.reason})…`, 'info');
                 choice = { action: 'autofix' };
             }
+            else if (disposition.action === 'accept') {
+                // NAME the rule that decided. This line is the durable record of why
+                // a defect shipped, and the rules that reach it have spent wildly
+                // different amounts of the budget — some none at all.
+                await rec(`resolution: auto-ACCEPTED despite verify FAIL — ${disposition.reason}${unattended ? `, nobody to ask ${YOLO_STAMP}` : ''}`);
+                choice = { action: 'accept' };
+            }
             else {
-                choice = await askVerifyResolution(active, p.title, failReason, recOutcome);
+                // Why the picker is up, when that is not already the line above:
+                // the judge-accept row's reason only restates the recommendation.
+                if (disposition.rule !== 'judge-accept') {
+                    await rec(`resolution: asking the human — ${disposition.reason}`);
+                }
+                choice = await askVerifyResolution(active, p.title, failReason, recOutcome, acceptQueues);
             }
             if (choice.action === 'cancel') {
                 await rec('resolution: user dismissed the verify-FAIL picker — paused');
+                await settleDebt('dismissed', failReason);
                 return { stop: { kind: 'paused', ctx: active, reason: failReason } };
             }
             if (choice.action === 'accept') {
-                const byYolo = yoloChoice !== null;
-                if (!byYolo)
+                // Provenance splits here, mandatorily. The table's own accept carries
+                // the origin that names the rule which decided; only a PICKER answer
+                // earns the plain 'accepted' class, which asserts a human weighed
+                // this failing artifact.
+                const origin = disposition.action === 'accept' ? disposition.debtOrigin : 'accepted';
+                if (origin === 'accepted') {
                     await rec('resolution: user ACCEPTED the work despite verify FAIL');
-                // Durable debt: the human blessed a FAILing artifact as-is, so the
-                // defect ships and nothing else in this task revisits it. Record it
-                // to the run ledger; the final integration gate re-checks it at run
-                // end and surfaces it if still open. Best-effort.
-                // The frozen-blocked routing above already recorded this defect (with
-                // the contradiction named) — don't double-enter it in the ledger.
-                if (!frozenDebtRecorded) {
-                    try {
-                        // Provenance splits here, mandatorily: an auto-pick writes the
-                        // 'yolo-accepted' origin, never the plain 'accepted' one that
-                        // asserts a human weighed the failing artifact.
-                        await deps.recordDebt?.(p.cwd, p.taskId, failReason, byYolo ? 'yolo-accepted' : 'accepted');
-                    }
-                    catch {
-                        // recording must never break the gate sequence
-                    }
+                }
+                // Durable debt: the defect ships and nothing else in this task
+                // revisits it. The final integration gate re-checks it at run end and
+                // surfaces it if still open. The reason LEADS with the fail text so
+                // its minted class prefix still routes the run-end re-check.
+                await settleDebt(origin, disposition.rule === 'spec-contradiction' ?
+                    `${failReason} — ${disposition.reason}`
+                    : failReason);
+                if (acceptQueues) {
+                    await rec(`accept: repo health regressed by this task — ${acceptQueues} is spliced before the next task`);
                 }
                 // ROOT CAUSE: an accepted FAIL that some OTHER task's file caused is
                 // not fixed by accepting it — every later task keeps tripping over
@@ -306,7 +236,7 @@ export async function resolveVerifyGate(ctxIn, deps, p, rec, routeRootCause) {
                         // recording must never break the gate sequence
                     }
                 }
-                notifyRun(active, `${p.tag}: accepted "${p.title}" despite verify FAIL (${failReason.slice(0, 120)}) — proceeding.${byYolo ? ` ${YOLO_STAMP}` : ''}`, 'warning');
+                notifyRun(active, `${p.tag}: accepted "${p.title}" despite verify FAIL (${failReason.slice(0, 120)}) — proceeding.${unattended ? ` ${YOLO_STAMP}` : ''}`, 'warning');
                 break;
             }
             // AUTOFIX: re-run the implementation turn with the failure (and any typed
@@ -315,24 +245,31 @@ export async function resolveVerifyGate(ctxIn, deps, p, rec, routeRootCause) {
             // hand its diagnosis to the re-run rather than making it re-derive the
             // cause from the bare FAIL line. Skipped when there is no researched
             // rationale beyond the failure text itself.
-            // Only the picker branch may claim a person chose this: the two
-            // unattended branches already recorded themselves one line above, and a
-            // trail that says "user chose" when nobody was asked is the same lie the
-            // accept line used to tell.
-            if (!autoFixNow && !yoloRescueNow) {
+            // Only the picker branch may claim a person chose this: the unattended
+            // branch already recorded itself one line above, and a trail that says
+            // "user chose" when nobody was asked is the same lie the accept line
+            // used to tell.
+            if (disposition.action === 'ask') {
                 await rec('resolution: user chose AUTOFIX — re-running the implementation turn');
             }
             notifyBoth(active, `${p.tag}: autofixing "${p.title}"…`, 'info');
             const diagnosis = (recOutcome.recommend === 'autofix'
                 && recOutcome.rationale.length > 0
                 && recOutcome.rationale !== failReason) ?
-                `\n\nDIAGNOSIS (a read-only investigation of this failure found):\n${recOutcome.rationale}`
+                recOutcome.rationale
                 : '';
-            const fixInstruction = `${failReason}${diagnosis}${choice.guidance ? `\n\nUser guidance: ${choice.guidance}` : ''}`;
             const fixRes = await deps.runTask(active, p.cwd, p.title, {
                 resumeId: p.taskId,
                 planContext: p.planContext,
-                fixInstruction
+                fixContext: {
+                    outcome: verified,
+                    disposition,
+                    probes: verified.probes ?? {},
+                    attempt: autoFixCount,
+                    contradiction,
+                    ...(diagnosis === '' ? {} : { diagnosis }),
+                    ...(choice.guidance === undefined ? {} : { guidance: choice.guidance })
+                }
             });
             active = fixRes.ctx ?? active;
             // The re-run's ending, mapped to this loop's own terminal kinds. A
@@ -364,6 +301,30 @@ export async function resolveVerifyGate(ctxIn, deps, p, rec, routeRootCause) {
             verified = await deps.verify(active, p.cwd, p.title, p.taskId);
             await rec(verdictLine(verified));
         }
+        // Static checks the repo was ALREADY failing when this task started (see
+        // health-baseline.ts). They did not fail this gate — that is the point — but
+        // dropping them here is how a sibling's defect vanishes until the run-end
+        // gate rediscovers it with nobody's name on it. Recorded once, after the
+        // loop, whatever the verdict was: a task can verify perfectly in a red repo.
+        if (verified.inheritedHealth) {
+            await rec(`accept-debt: inherited repo health — ${verified.inheritedHealth}`);
+            await settleDebt('inherited-health', verified.inheritedHealth);
+        }
+        // A health repair that verified CLEAN — the check it exists for ran green,
+        // nothing inherited — closes the debts that check opened, under its own id.
+        const repair = parseHealthRepairTitle(p.title);
+        if (repair && verified.ok && !verified.reason && !verified.inheritedHealth) {
+            try {
+                const closed = await deps.closeHealthDebts?.(p.cwd, repair.command, p.taskId);
+                if (closed && closed.length > 0) {
+                    await rec(`accept-debt: closed ${closed.length} debt(s) on \`${repair.command}\` — `
+                        + `${closed.map(d => d.taskId).join(', ')} — repaired by ${p.taskId}`);
+                }
+            }
+            catch {
+                // closing debts must never break the gate sequence
+            }
+        }
         // Loop exited because the work verified OR the user accepted the artifact. A
         // genuine clean pass is ok===true with NO reason; a no-op pass or an
         // accept-override (verified.ok still false at break) is NOT a guardable signal.
@@ -448,12 +409,13 @@ export async function runEnforcePass(active, deps, p, rec, routeRootCause, args)
         let enforceEditsBlocked = false;
         if (mode === 'edit' && deps.repoHealth && editsMade !== false) {
             const after = await deps.repoHealth(active, p.cwd, p.title);
-            // A regression needs a clean (or unknown) baseline turning to a fail. If
-            // healthBefore is undefined (repoHealth was absent at baseline time) treat
-            // the baseline as clean — the conservative absolute behavior.
-            const wasHealthyBefore = healthBefore?.ok ?? true;
-            const regressed = !after.ok && wasHealthyBefore;
-            if (regressed) {
+            // The SAME differential the verify gate runs (health-baseline.ts), per
+            // command rather than per overall verdict — two runs can both be red
+            // while a different check failed in each. A missing baseline is no
+            // longer read as a clean one: that default silently turned this
+            // differential back into the absolute check it exists to replace.
+            const delta = classifyHealthDelta(healthBefore ?? null, after);
+            if (delta === 'regressed') {
                 enforceEditsBlocked = true;
                 const outputTail = after.output ? ` — output:\n${clampOutput(after.output)}` : '';
                 if (deps.discardEdits) {
@@ -465,7 +427,7 @@ export async function runEnforcePass(active, deps, p, rec, routeRootCause, args)
                 }
                 notifyRun(active, `${p.tag}: guideline edits on "${p.title}" regressed repo health (${after.reason.slice(0, 120)}) — discarded before commit.`, 'warning');
             }
-            else if (!after.ok) {
+            else if (delta === 'pre-existing') {
                 // Failing both before and after → not enforce's fault. Keep the edits;
                 // record that the repo entered the gate already unhealthy so the trail
                 // explains why a still-failing repo did NOT trigger a discard here.

package/dist/task/task-io.d.ts

@@ -21,6 +21,16 @@ export declare function writeTaskFile(cwd: string, fm: TaskFrontMatter, body: st
 export declare function updateTaskFrontMatter(cwd: string, id: string, patch: Partial<TaskFrontMatter>): Promise<void>;
 export declare function readSection(cwd: string, id: string, heading: string): Promise<string | null>;
 export declare function setTaskSection(cwd: string, id: string, heading: string, content: string): Promise<void>;
+/**
+ * Rewrite a section from its own current contents.
+ *
+ * The read-then-write pair a caller would otherwise inline, kept whole here
+ * because the RE-ENTRY case is where it goes wrong: a resumed run that reaches a
+ * section it did not fully regenerate (an autofix re-entry runs zero phases)
+ * calls `setTaskSection` with what THIS pass produced and erases what the first
+ * pass proved. `merge` receives null when the section is absent.
+ */
+export declare function mergeTaskSection(cwd: string, id: string, heading: string, merge: (old: string | null) => string): Promise<void>;
 /**
  * Append one timestamped line to the task's `## gates` section — the durable
  * per-task trail of gate outcomes (verify verdicts, enforce mode/verdict, commit

package/dist/task/task-io.js

@@ -69,19 +69,51 @@ export async function readTaskFile(cwd, id) {
     const body = raw.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '');
     return { frontMatter: fm, body };
 }
+/**
+ * One writer per task file at a time. Research workers in graph mode, the
+ * loop-events trail and the gate recorder all rewrite the same file from
+ * overlapping continuations; without this, two read-modify-write pairs interleave
+ * and the second one erases the first, or a reader catches a half-written file
+ * and reports it as malformed front matter.
+ */
+const fileChains = new Map();
+async function withTaskFile(file, fn) {
+    const prev = fileChains.get(file) ?? Promise.resolve();
+    const next = prev.then(fn, fn);
+    fileChains.set(file, next.catch(() => { }));
+    try {
+        return await next;
+    }
+    finally {
+        if (fileChains.get(file) === next)
+            fileChains.delete(file);
+    }
+}
 export async function writeTaskFile(cwd, fm, body) {
     await ensureTasksDir(cwd);
+    const file = taskFilePath(cwd, fm.id);
     const content = `${emitFrontMatter(fm)}\n${body}`;
-    await fsp.writeFile(taskFilePath(cwd, fm.id), content, 'utf8');
+    // Written beside and renamed over: a reader never sees a truncated file.
+    const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    await fsp.writeFile(tmp, content, 'utf8');
+    try {
+        await fsp.rename(tmp, file);
+    }
+    catch (err) {
+        await fsp.rm(tmp, { force: true }).catch(() => { });
+        throw err;
+    }
 }
 export async function updateTaskFrontMatter(cwd, id, patch) {
-    const { frontMatter, body } = await readTaskFile(cwd, id);
-    const next = {
-        ...frontMatter,
-        ...patch,
-        updated_at: new Date().toISOString()
-    };
-    await writeTaskFile(cwd, next, body);
+    await withTaskFile(taskFilePath(cwd, id), async () => {
+        const { frontMatter, body } = await readTaskFile(cwd, id);
+        const next = {
+            ...frontMatter,
+            ...patch,
+            updated_at: new Date().toISOString()
+        };
+        await writeTaskFile(cwd, next, body);
+    });
 }
 // ─── Section read/write (append if absent, rewrite if present) ───────────────
 export async function readSection(cwd, id, heading) {
@@ -89,9 +121,15 @@ export async function readSection(cwd, id, heading) {
     const m = sectionRegex(heading).exec(body);
     return m ? m[2].trim() : null;
 }
-export async function setTaskSection(cwd, id, heading, content) {
+export function setTaskSection(cwd, id, heading, content) {
+    return withTaskFile(taskFilePath(cwd, id), () => rewriteSection(cwd, id, heading, () => content));
+}
+/** The read-modify-write itself; callers hold the file's chain. */
+async function rewriteSection(cwd, id, heading, render) {
     const { frontMatter, body } = await readTaskFile(cwd, id);
     const re = sectionRegex(heading);
+    const m = re.exec(body);
+    const content = render(m ? m[2].trim() : null);
     let next;
     if (re.test(body)) {
         // Use a replacer FUNCTION, not a replacement string: `content` is
@@ -112,6 +150,18 @@ export async function setTaskSection(cwd, id, heading, content) {
     }
     await writeTaskFile(cwd, { ...frontMatter, updated_at: new Date().toISOString() }, next);
 }
+/**
+ * Rewrite a section from its own current contents.
+ *
+ * The read-then-write pair a caller would otherwise inline, kept whole here
+ * because the RE-ENTRY case is where it goes wrong: a resumed run that reaches a
+ * section it did not fully regenerate (an autofix re-entry runs zero phases)
+ * calls `setTaskSection` with what THIS pass produced and erases what the first
+ * pass proved. `merge` receives null when the section is absent.
+ */
+export function mergeTaskSection(cwd, id, heading, merge) {
+    return withTaskFile(taskFilePath(cwd, id), () => rewriteSection(cwd, id, heading, merge));
+}
 /**
  * Append one timestamped line to the task's `## gates` section — the durable
  * per-task trail of gate outcomes (verify verdicts, enforce mode/verdict, commit
@@ -124,19 +174,20 @@ export async function appendGateRecord(cwd, id, line) {
     try {
         const stamp = new Date().toISOString();
         const entry = `- ${stamp} ${line.replace(/\s*\n\s*/g, ' ').trim()}`;
-        const existing = await readSection(cwd, id, 'gates');
-        await setTaskSection(cwd, id, 'gates', existing ? `${existing}\n${entry}` : entry);
+        await mergeTaskSection(cwd, id, 'gates', existing => existing ? `${existing}\n${entry}` : entry);
     }
     catch {
         // Recording is observability, not control flow — never propagate.
     }
 }
 /** Remove a section (heading + body) if present; a no-op when it's absent. */
-export async function removeTaskSection(cwd, id, heading) {
-    const { frontMatter, body } = await readTaskFile(cwd, id);
-    const re = sectionRegex(heading);
-    if (!re.test(body))
-        return;
-    const next = body.replace(re, '');
-    await writeTaskFile(cwd, { ...frontMatter, updated_at: new Date().toISOString() }, next);
+export function removeTaskSection(cwd, id, heading) {
+    return withTaskFile(taskFilePath(cwd, id), async () => {
+        const { frontMatter, body } = await readTaskFile(cwd, id);
+        const re = sectionRegex(heading);
+        if (!re.test(body))
+            return;
+        const next = body.replace(re, '');
+        await writeTaskFile(cwd, { ...frontMatter, updated_at: new Date().toISOString() }, next);
+    });
 }