@mjasnikovs/pi-task 0.42.1 → 0.42.3

package/dist/index.js

@@ -7,6 +7,7 @@ import { registerRemote } from './remote/register.js';
 import { registerCommandWatchdog } from './task/command-watchdog.js';
 import { registerStreamWatchdog } from './task/stream-watchdog.js';
 import { registerImplementationGuards } from './task/implementation-guards.js';
+import { registerTaskDirCustody } from './task/task-dir-custody.js';
 import { registerModelHoldRestore } from './task/model-hold-stash.js';
 export default function (pi) {
     registerConfig(pi);
@@ -18,5 +19,6 @@ export default function (pi) {
     registerCommandWatchdog(pi);
     registerStreamWatchdog(pi);
     registerImplementationGuards(pi);
+    registerTaskDirCustody(pi);
     registerModelHoldRestore(pi);
 }

package/dist/task/auto-orchestrator.js

@@ -15,6 +15,7 @@ import { RUN_END_POLICY, runSucceeded } from './run-end.js';
 import { parseAutoAnswer, autoAnswerHasTag, deriveTitle } from './parsers.js';
 import { renderInlineMarkdown, stripInlineMarkdown } from './inline-markdown.js';
 import { AUTO_CLARIFY_PROMPT, AUTO_DECOMPOSE_PROMPT, DECOMPOSE_COVERAGE_PROMPT } from './auto-prompts.js';
+import { defersBreakage } from './deferred-breakage.js';
 import { GRILL_AUTO_ANSWER_PROMPT, GRILL_AUTO_FORMAT_HINT } from './prompts.js';
 import { allocateAutoId, buildAutoBody, parseDecomposeList, parseCoverageVerdict, UNNAMED_COVERAGE_GAP, parseTaskList, planKeyAt, checkOffTask, stampTaskInProgress, beginTaskAttempt, recordTaskEnd, insertTaskAfter, insertTaskBefore, findResumableAutoDetailed } from './auto-io.js';
 import { decideResume, UNATTENDED_STATES } from './resume-gap.js';
@@ -220,6 +221,10 @@ async function triageClarifyQuestion(deps, cwd, featureForModel, existingFilesBl
             text = await deps.runChild('clarify-triage', 'read', prependHint(GRILL_AUTO_FORMAT_HINT, basePrompt));
         }
         const parsed = parseAutoAnswer(text);
+        if (parsed.kind === 'answered' && defersBreakage(parsed.text)) {
+            logPlanDebug(cwd, `clarify-triage answer defers a breakage to a nonexistent owner — surfacing: ${parsed.text.replace(/\s+/g, ' ').slice(0, 100)}`);
+            return null;
+        }
         if (parsed.kind === 'answered') {
             logPlanDebug(cwd, `clarify-triage auto-resolved (spec-settled): ${question.replace(/\s+/g, ' ').slice(0, 100)}`
                 + ` → ${parsed.text.replace(/\s+/g, ' ').slice(0, 100)}`);

package/dist/task/deferred-breakage.d.ts

@@ -0,0 +1,3 @@
+export declare function defersBreakage(answer: string): boolean;
+/** The one re-ask a deferring answer gets before it is surfaced instead of promoted. */
+export declare function deferredBreakageReaskHint(answer: string): string;

package/dist/task/deferred-breakage.js

@@ -0,0 +1,48 @@
+/**
+ * Does an auto-answer hand a breakage to someone who does not exist?
+ *
+ * MEASURED (mx5-n TASK_0004, 2026-09-17): "flag the test/migrate.test.ts breakage
+ * as a known issue for the test owner". Nothing in a /task-auto run owns a test:
+ * the answer was stamped `(auto)`, verify passed the task with the suite red, and
+ * four tasks later an unsatisfiable spec looped until the runaway guard fired.
+ *
+ * This is the deterministic backstop behind the prompt's GREEN-SUITE CHECK: a
+ * model that ignores the rule still cannot promote a deferral into a decision.
+ * The phrases are the ones a model reaches for when it wants to defer, not the
+ * word "test" — "add a test later" is a plan, not a deferral.
+ */
+const DEFERRAL_PHRASES = [
+    /\bknown[- ]issue\b/i,
+    /\b(?:test|suite|file|module)[- ]owner\b/i,
+    /\bwhoever\s+(?:owns|revisits|maintains|touches)\b/i,
+    /\bowned by\s+(?:whoever|the\s+\w+\s+owner|a\s+later\s+(?:step|task))/i,
+    /\b(?:a|the)\s+later\s+(?:step|task)\s+(?:will|should|can|to)\s+(?:fix|revisit|update|repair|address)/i,
+    /\bleave\s+(?:the\s+)?(?:test|tests|suite|failure|breakage)\s+(?:failing|red|broken|as[- ]is)\b/i,
+    /\baccept(?:ing)?\s+(?:that\s+)?.{0,60}?\b(?:test|tests|suite|assertions?|lint|build)\b.{0,80}?\b(?:fail|failing|red|broken)\b/i,
+    /\bflag(?:ged|ging)?\s+(?:it\s+|this\s+|the\s+\S+\s+)?(?:as\s+)?(?:a\s+)?(?:known|for\s+(?:the|a|whoever))/i,
+    /\b(?:owned|as the owned|as a)\s+follow-?up\b/i,
+    /\bleft\s+for\s+(?:whoever|the\s+\w+\s+owner)\b/i,
+    /\bownership\s+belongs\s+to\b/i
+];
+/** "do NOT defer", "not a deferral to a test owner", "rather than flag it" — the
+ *  phrase is named to reject it. MEASURED: a treatment answer did exactly that. */
+const NEGATION_BEFORE = /\b(?:not|never|no|don't|do not|rather than|instead of|isn't|is not|without)\b[^.;]{0,40}$/i;
+export function defersBreakage(answer) {
+    return DEFERRAL_PHRASES.some(re => {
+        const m = new RegExp(re.source, re.flags + (re.flags.includes('g') ? '' : 'g'));
+        for (const hit of answer.matchAll(m)) {
+            const before = answer.slice(Math.max(0, hit.index - 60), hit.index);
+            if (!NEGATION_BEFORE.test(before))
+                return true;
+        }
+        return false;
+    });
+}
+/** The one re-ask a deferring answer gets before it is surfaced instead of promoted. */
+export function deferredBreakageReaskHint(answer) {
+    return ('[SYSTEM NOTE: Your previous answer deferred a breakage to someone who does not '
+        + `exist — "${answer.replace(/\s+/g, ' ').slice(0, 160)}". No later step owns a `
+        + 'failing test, lint, or build; each one inherits it and is told not to touch it. '
+        + 'Re-run the GREEN-SUITE CHECK: answer with the option that keeps the suite green, '
+        + 'naming the test file this task must also update. Output ONLY the tagged lines.]');
+}

package/dist/task/final-gate.js

@@ -46,7 +46,7 @@
  */
 import { existsSync, readFileSync } from 'node:fs';
 import * as path from 'node:path';
-import { runRepoHealthCheck, discoverHealthCommands } from './repo-health-check.js';
+import { runRepoHealthCheck, discoverHealthCommands, discoverTestCommands } from './repo-health-check.js';
 import { deriveOpenDebts, rerunDebtVerifyCommand } from './accept-debt.js';
 import { readDeclaredScripts, missingDeclaredScripts, runnableDeclaredScripts } from './launch-contract.js';
 import { readLaunchManifest, inertLaunchContractNote, packageScripts, makeHasTarget } from './launch-manifest.js';
@@ -83,58 +83,21 @@ import { VERIFY_FAIL_PREFIX } from './verify-work.js';
  * tool-by-tool is not the fix either.
  */
 export function discoverIntegrationCommands(cwd) {
-    if (existsSync(path.join(cwd, 'package.json'))) {
-        const s = packageScripts(cwd);
-        const cmds = [];
-        // Every test-shaped script, not just the one literally named `test`: a
-        // project's only browser-executing suite is often `test:ct` or similar, and
-        // looking for `test` alone never runs it. Plain `test` leads, then every
-        // `test:`/`test_`/`test-` prefixed name in declaration order (Array#sort is
-        // stable), then `build`. Measured on a manifest declaring test:ct, build,
-        // test_unit, test-e2e, test, testing and pretest, the result is exactly
-        // test, test:ct, test_unit, test-e2e, build — `testing` and `pretest` do
-        // not match. Env-gap SKIP still applies per command: a suite whose browser
-        // or runtime is absent skips rather than fails (see runGateCommand).
-        const testNames = Object.keys(s).filter(n => n === 'test' || /^test[:_-]/.test(n));
-        testNames.sort((a, b) => a === 'test' ? -1
-            : b === 'test' ? 1
-                : 0);
-        for (const name of testNames)
-            cmds.push(['bun', ['run', name]]);
-        if (s.build)
-            cmds.push(['bun', ['run', 'build']]);
-        return { ecosystem: 'package.json', cmds };
-    }
-    if (existsSync(path.join(cwd, 'Makefile'))) {
-        const cmds = [];
-        for (const target of ['test', 'build']) {
-            if (makeHasTarget(cwd, target))
-                cmds.push(['make', [target]]);
+    const tests = discoverTestCommands(cwd);
+    const build = (() => {
+        if (existsSync(path.join(cwd, 'package.json'))) {
+            return packageScripts(cwd).build ? ['bun', ['run', 'build']] : null;
         }
-        return { ecosystem: 'Makefile', cmds };
-    }
-    if (existsSync(path.join(cwd, 'Cargo.toml'))) {
-        return {
-            ecosystem: 'Cargo.toml',
-            cmds: [
-                ['cargo', ['test', '--quiet']],
-                ['cargo', ['build', '--quiet']]
-            ]
-        };
-    }
-    if (existsSync(path.join(cwd, 'go.mod'))) {
-        return {
-            ecosystem: 'go.mod',
-            cmds: [
-                ['go', ['test', './...']],
-                ['go', ['build', './...']]
-            ]
-        };
-    }
-    if (existsSync(path.join(cwd, 'pyproject.toml'))) {
-        return { ecosystem: 'pyproject.toml', cmds: [['pytest', ['-q']]] };
-    }
-    return { ecosystem: null, cmds: [] };
+        if (existsSync(path.join(cwd, 'Makefile'))) {
+            return makeHasTarget(cwd, 'build') ? ['make', ['build']] : null;
+        }
+        if (existsSync(path.join(cwd, 'Cargo.toml')))
+            return ['cargo', ['build', '--quiet']];
+        if (existsSync(path.join(cwd, 'go.mod')))
+            return ['go', ['build', './...']];
+        return null;
+    })();
+    return { ecosystem: tests.ecosystem, cmds: build ? [...tests.cmds, build] : tests.cmds };
 }
 /**
  * Per-ecosystem lockfile↔manifest consistency checks. A check applies only when

package/dist/task/gate-child.js

@@ -27,6 +27,7 @@
 import { formatLoopHint } from './loop-detector.js';
 import { classifyEnforceChildFailure } from './enforce-guidelines.js';
 import { notifyRun } from '../remote/bridge.js';
+import { restoreTaskDir, snapshotTaskDir, taskDirRestoredNotice } from './task-dir-custody.js';
 /**
  * What each kind may do. Adding a child is a row; it cannot be added without
  * deciding all four questions, which is the point.
@@ -69,6 +70,9 @@ export function makeGateChild(deps) {
         const log = deps.makeDebugAppender(deps.logPath);
         log(`=== ${deps.kind} start: ${deps.taskTitle} ===`);
         const guardSnapshot = row.guarded ? await deps.captureGitState(deps.cwd, sig) : null;
+        // Every kind, whatever its tools: the git-state guard and the discard both
+        // leave `.pi-tasks` alone.
+        const taskDir = await snapshotTaskDir(deps.cwd);
         const frame = deps.loader === false ?
             null
             : () => ({
@@ -132,6 +136,12 @@ export function makeGateChild(deps) {
             finally {
                 // Restore whatever the child moved BEFORE any verdict or failure is
                 // acted on — a crashed child must not skip the restore either.
+                const restored = await restoreTaskDir(deps.cwd, taskDir);
+                if (restored.length > 0) {
+                    log(`=== ${deps.kind} TASK-DIR CUSTODY — restored: ${restored.join(', ')} ===`);
+                    notifyRun(deps.ctx, `${deps.taskTitle}: `
+                        + taskDirRestoredNotice(`the ${deps.kind} child`, restored), 'warning');
+                }
                 if (guardSnapshot) {
                     const rec = await deps.reconcileGitState(deps.cwd, guardSnapshot, sig);
                     deps.onReconcile?.(rec);

package/dist/task/gate-deps.js

@@ -537,7 +537,7 @@ export async function healthBaselineFor(cwd, taskId, signal) {
             return stored;
         const fresh = await lazyHealthBaseline({
             git: makeGit(cwd, signal),
-            runHealthIn: dir => runRepoHealthCheck(dir, { signal })
+            runHealthIn: dir => runRepoHealthCheck(dir, { signal, withTests: true })
         });
         if (fresh) {
             await setTaskSection(cwd, taskId, HEALTH_BASELINE_SECTION, formatHealthBaseline(fresh)).catch(() => { });
@@ -739,6 +739,7 @@ export function buildGateDeps(params) {
         }));
         return runRepoHealthCheck(cwd2, {
             signal,
+            withTests: true,
             onCommand: c => {
                 running = c;
             }
@@ -934,9 +935,11 @@ export function buildGateDeps(params) {
                 onStage: label => {
                     stageLine = label;
                 },
-                // Deterministic whole-repo static-analysis gate — runs the project's
-                // own lint/typecheck and fails on a real non-zero exit, independent of
-                // the model-authored VERIFY block, which may not lint at all. ASYNC,
+                // Deterministic whole-repo gate — runs the project's own
+                // lint/typecheck AND its test suite, independent of the
+                // model-authored VERIFY block, which may not lint at all. The suite
+                // is judged only against the baseline below (a task that turned a
+                // green suite red is this task's FAIL, whatever its spec says). ASYNC,
                 // so the lint does not starve pi-tui's nextTick-scheduled renders.
                 //
                 // ONE call, both arms. A baseline arm that dropped the signal or the
@@ -945,6 +948,7 @@ export function buildGateDeps(params) {
                 // the LOADER, above.
                 repoHealth: () => runRepoHealthCheck(cwd2, {
                     signal,
+                    withTests: true,
                     onCommand: c => {
                         stageLine = `repo health · ${c}`;
                     }

package/dist/task/implementation-guards.d.ts

@@ -16,10 +16,6 @@ export declare function implementationGuardArmed(): boolean;
  * one altered byte is a new key and a clean slate on both counters.
  */
 export declare function blockedCallReason(toolName: string, count: number): string;
-/** Every file under the task dir is host-written. MEASURED: an mx5 implementer
- *  wrote its report over TASK_AUTO_0001.md, and the run died on its front matter. */
-export declare function targetsTaskDir(toolName: string, input: unknown): boolean;
-export declare function taskDirWriteReason(): string;
 /** The reason on the final block, which also ends the turn. */
 export declare function terminalCallReason(): string;
 export declare function consumeGuardTermination(): boolean;

package/dist/task/implementation-guards.js

@@ -1,5 +1,4 @@
 import { LoopDetector, loopKey, LOOP_THRESHOLD, LOOP_WINDOW, MAX_LOOP_RESTARTS } from './loop-detector.js';
-import { TASKS_DIR_NAME } from './task-types.js';
 /**
  * Runaway guard for the IMPLEMENTATION TURN — the one model surface with none.
  *
@@ -82,18 +81,6 @@ export function blockedCallReason(toolName, count) {
     return (`Blocked: this is the ${count}th identical ${toolName} call in this turn. `
         + `Use what you already have, or do something different, then continue the task.`);
 }
-/** Every file under the task dir is host-written. MEASURED: an mx5 implementer
- *  wrote its report over TASK_AUTO_0001.md, and the run died on its front matter. */
-export function targetsTaskDir(toolName, input) {
-    if (!MUTATING_TOOLS.has(toolName))
-        return false;
-    const target = input?.path;
-    return typeof target === 'string' && target.split(/[\\/]/).includes(TASKS_DIR_NAME);
-}
-export function taskDirWriteReason() {
-    return (`Blocked: ${TASKS_DIR_NAME}/ belongs to pi-task and is written only by the host. `
-        + `Put your report in your reply, not in a file, then continue the task.`);
-}
 /** The reason on the final block, which also ends the turn. */
 export function terminalCallReason() {
     return (`Blocked: this turn repeated one call past every warning, so it is being stopped `
@@ -133,9 +120,6 @@ export function registerImplementationGuards(pi) {
             if (state.terminating) {
                 return { block: true, terminate: true, reason: terminalCallReason() };
             }
-            if (targetsTaskDir(event.toolName, event.input)) {
-                return { block: true, reason: taskDirWriteReason() };
-            }
             const call = { name: event.toolName, args: event.input };
             const mutating = MUTATING_TOOLS.has(event.toolName);
             const hit = mutating ? state.edits.record(call) : state.loop.record(call);

package/dist/task/implementation-scope.d.ts

@@ -1,8 +1,8 @@
 /**
- * The implementation-turn bracket: one entry arms both the status widget and the
- * runaway guard, one `leave` disarms both.
+ * The implementation-turn bracket: one entry arms the status widget and the
+ * runaway guard and takes custody of the task dir, one `leave` ends all three.
  *
- * The two modules keep their own lifecycle handlers, and they draw the turn
+ * Each module keeps its own lifecycle handlers, and the first two draw the turn
  * boundary differently on purpose: the widget hides on `agent_end` (a sub-turn is
  * over, the screen should say so), the guard survives until `agent_settled`
  * (compactions and retries fire `agent_end` INSIDE a turn — see its header). What
@@ -13,12 +13,14 @@
 import { type ImplWidgetMeta } from './impl-widget.js';
 /**
  * `oneShot` true (fire-and-forget /task) lets each module's own settle handler
- * disarm after the single turn; false (awaited /task-auto) keeps both armed
+ * end it after the single turn; false (awaited /task-auto) keeps all three
  * across resume and steer turns until `leave` is called.
  *
  * `leave` is idempotent: a second call is a no-op, so a caller can put it in a
- * `finally` and a `catch` without disarming a bracket entered since.
+ * `finally` and a `catch` without ending a bracket entered since. It resolves to
+ * the task files it restored.
  */
 export declare function enterImplementationTurn(meta: ImplWidgetMeta, opts: {
     oneShot: boolean;
-}): () => void;
+    cwd: string;
+}): Promise<() => Promise<string[]>>;

package/dist/task/implementation-scope.js

@@ -1,8 +1,8 @@
 /**
- * The implementation-turn bracket: one entry arms both the status widget and the
- * runaway guard, one `leave` disarms both.
+ * The implementation-turn bracket: one entry arms the status widget and the
+ * runaway guard and takes custody of the task dir, one `leave` ends all three.
  *
- * The two modules keep their own lifecycle handlers, and they draw the turn
+ * Each module keeps its own lifecycle handlers, and the first two draw the turn
  * boundary differently on purpose: the widget hides on `agent_end` (a sub-turn is
  * over, the screen should say so), the guard survives until `agent_settled`
  * (compactions and retries fire `agent_end` INSIDE a turn — see its header). What
@@ -12,23 +12,28 @@
  */
 import { armImplWidget, disarmImplWidget } from './impl-widget.js';
 import { armImplementationGuard, disarmImplementationGuard } from './implementation-guards.js';
+import { takeTaskDirCustody } from './task-dir-custody.js';
 /**
  * `oneShot` true (fire-and-forget /task) lets each module's own settle handler
- * disarm after the single turn; false (awaited /task-auto) keeps both armed
+ * end it after the single turn; false (awaited /task-auto) keeps all three
  * across resume and steer turns until `leave` is called.
  *
  * `leave` is idempotent: a second call is a no-op, so a caller can put it in a
- * `finally` and a `catch` without disarming a bracket entered since.
+ * `finally` and a `catch` without ending a bracket entered since. It resolves to
+ * the task files it restored.
  */
-export function enterImplementationTurn(meta, opts) {
-    armImplWidget(meta, opts);
-    armImplementationGuard(opts);
+export async function enterImplementationTurn(meta, opts) {
+    const { oneShot } = opts;
+    const releaseTaskDir = await takeTaskDirCustody(opts.cwd, { oneShot });
+    armImplWidget(meta, { oneShot });
+    armImplementationGuard({ oneShot });
     let left = false;
-    return () => {
+    return async () => {
         if (left)
-            return;
+            return [];
         left = true;
         disarmImplWidget();
         disarmImplementationGuard();
+        return releaseTaskDir();
     };
 }

package/dist/task/orchestrator.d.ts

@@ -178,6 +178,7 @@ export declare class TaskRunner {
      */
     private _recordHandoff;
     private _deliverSpec;
+    private _reportRestored;
     /**
      * The spec as the implementer should receive it (Layer B). Layer A strips phantom
      * specifiers from the upstream pipeline text, but a residual affirmative can survive

package/dist/task/orchestrator.js

@@ -27,7 +27,8 @@ import { allocateTaskId, ensureTasksDir, mergeTaskSection, readSection, readTask
 import { startWidget } from './widget.js';
 import { setupImplWidget } from './impl-widget.js';
 import { enterImplementationTurn } from './implementation-scope.js';
-import { SessionUI, publishNotify, registerBridgeCommand, getBridge, notifyBoth, isRemoteOrigin } from '../remote/bridge.js';
+import { taskDirRestoredNotice } from './task-dir-custody.js';
+import { SessionUI, publishNotify, registerBridgeCommand, getBridge, notifyBoth, notifyRun, isRemoteOrigin } from '../remote/bridge.js';
 import { pushNotify } from '../remote/push.js';
 import { getConfig } from '../config/config.js';
 import { appendDebugLine, gateDebugWriter } from './debug-log.js';
@@ -473,7 +474,10 @@ export class TaskRunner {
             label: this._widgetState.label
         };
         if (this._sendSpec) {
-            const leave = enterImplementationTurn(meta, { oneShot: !this._implAwaited });
+            const leave = await enterImplementationTurn(meta, {
+                oneShot: !this._implAwaited,
+                cwd: this._cwd
+            });
             let delivered = false;
             try {
                 await this._sendSpec(spec);
@@ -486,14 +490,14 @@ export class TaskRunner {
                 // missing model, or a failed auth. The next unrelated turn would
                 // inherit it, and this guard can end a turn outright.
                 if (this._implAwaited || !delivered)
-                    leave();
+                    this._reportRestored(await leave());
             }
             return;
         }
         if (!piApi) {
             throw new Error('extension not initialised (no ExtensionAPI captured)');
         }
-        const leave = enterImplementationTurn(meta, { oneShot: true });
+        const leave = await enterImplementationTurn(meta, { oneShot: true, cwd: this._cwd });
         // Same reason as the awaited path's `delivered` flag: this send can throw
         // SYNCHRONOUSLY — the loader gates every ExtensionAPI action behind
         // `assertActive()` — and a guard left armed over a turn that never starts
@@ -507,10 +511,17 @@ export class TaskRunner {
             piApi.sendUserMessage(spec, { deliverAs: 'followUp' });
         }
         catch (e) {
-            leave();
+            await leave();
             throw e;
         }
     }
+    _reportRestored(names) {
+        if (names.length === 0)
+            return;
+        const notice = taskDirRestoredNotice('The implementation turn', names);
+        this._deps.logDebug?.(notice);
+        notifyRun(this._ctx, notice, 'warning');
+    }
     /**
      * The spec as the implementer should receive it (Layer B). Layer A strips phantom
      * specifiers from the upstream pipeline text, but a residual affirmative can survive

package/dist/task/parsers.d.ts

@@ -22,7 +22,7 @@ import type { ToolingClass } from './run-context.js';
  *     a recommendation instead of being taken silently.
  *   - 'threw' — the child failed; there is no recommendation at all.
  */
-export type AutoAnswerUnknownReason = 'model-unknown' | 'api-synthesis' | 'integration' | 'threw';
+export type AutoAnswerUnknownReason = 'model-unknown' | 'api-synthesis' | 'integration' | 'threw' | 'deferred-breakage';
 export type AutoAnswer = {
     kind: 'answered';
     text: string;

package/dist/task/phases.js

@@ -18,6 +18,7 @@ import { getConfig } from '../config/config.js';
 import { buildExternalContext, gatherExternalContext } from './external-context.js';
 import { currentRunContext } from './run-context.js';
 import { readableMentions } from './mentions.js';
+import { defersBreakage, deferredBreakageReaskHint } from './deferred-breakage.js';
 import { REFINE_PROMPT, RESEARCH_FILES_PROMPT, RESEARCH_APIS_PROMPT, RESEARCH_CONTEXT_PROMPT, RESEARCH_TOOLING_PROMPT, GRILL_GEN_PROMPT, GRILL_AUTO_ANSWER_PROMPT, GRILL_AUTO_FORMAT_HINT, COMPOSE_PROMPT, CRITIQUE_PROMPT, CRITIQUE_TRIAGE_PROMPT, VERIFY_TOOLING_PROMPT, MAX_GRILL_QUESTIONS } from './prompts.js';
 import { appendGateRecord, readSection, readTaskFile, removeTaskSection, setTaskSection, updateTaskFrontMatter } from './task-io.js';
 import { extractSection } from './task-parsers.js';
@@ -770,6 +771,37 @@ export async function phaseAutoAnswer(deps, refined, research, question) {
                 }
             }
         }
+        // Deterministic backstop behind the prompt's GREEN-SUITE CHECK: an answer
+        // that defers a breakage to "the test owner" gets ONE re-ask, and a second
+        // deferral is surfaced as an unsafe unknown — yolo.ts skips it, a human
+        // sees it. Promoting it is how mx5-n TASK_0004 turned the suite red for
+        // the rest of the run.
+        if (parsed.kind === 'answered' && defersBreakage(parsed.text)) {
+            deps.logDebug?.('grill-auto: answer defers a breakage to a nonexistent owner — re-asking once');
+            let reasked = null;
+            try {
+                const text2 = await runPhaseChild(deps, 'grill-auto', 'read', prependHint(deferredBreakageReaskHint(parsed.text), basePrompt));
+                if (autoAnswerHasTag(text2))
+                    reasked = parseAutoAnswer(text2);
+            }
+            catch (e) {
+                if (isFatalChildCause(e))
+                    throw e;
+                reasked = null;
+            }
+            if (reasked !== null && reasked.kind === 'answered' && !defersBreakage(reasked.text)) {
+                parsed = reasked;
+            }
+            else {
+                deps.logDebug?.('grill-auto: answer still defers the breakage — surfacing to user');
+                parsed = {
+                    kind: 'unknown',
+                    suggested: reasked?.kind === 'answered' ? reasked.text : parsed.text,
+                    raw: (reasked ?? parsed).raw,
+                    reason: 'deferred-breakage'
+                };
+            }
+        }
         // Surviving-unknown routing: an integration / build-wiring unknown whose
         // wrong guess is a structural landmine must NOT be silently auto-answered.
         // We first try to ground it from fetched docs (the enrichment fan-out

package/dist/task/prompts.d.ts

@@ -36,6 +36,15 @@ declare const RESEARCH_APIS_PROMPT: (refined: string, filesMap: string | undefin
 declare const RESEARCH_CONTEXT_PROMPT: (refined: string) => string;
 declare const RESEARCH_TOOLING_PROMPT: (refined: string) => string;
 declare const GRILL_GEN_PROMPT: (refined: string, research: string, priorQA: string) => string;
+/**
+ * The first triage check. MEASURED (mx5-n TASK_0004, 2026-09-17): the auto-answer
+ * chose "flag the test breakage as a known issue for the test owner". No task owns
+ * a test, so the suite stayed red through four tasks, and the fifth was specced
+ * as "add three files, change nothing else, make the whole suite pass" — an
+ * unsatisfiable spec whose implementer looped until the runaway guard fired.
+ * Exported on its own so a harness can measure the prompt with and without it.
+ */
+export declare const GRILL_GREEN_SUITE_CHECK = "1. GREEN-SUITE CHECK \u2014 if an option would leave an existing test, lint, or build failing after this task (\"known issue\", \"for the test owner\", \"whoever revisits it\", \"a later step will fix it\"), that option is NOT available. Nobody downstream owns a breakage: every later task inherits a red suite it is told not to touch, and the run stalls there. A scope rule such as \"only create file X\" does NOT settle this \u2014 a test that asserts on X's output is part of X's change, so updating that test is in scope. If one option keeps the suite green, emit \"ANSWER: <that option>, and update <the test file> so the suite stays green\". If no offered option does, emit \"ANSWER: <the smallest change that keeps the suite green, naming the test file to update>\". Never answer with a deferral.";
 declare const GRILL_AUTO_ANSWER_PROMPT: (refined: string, research: string, question: string) => string;
 export declare const GRILL_AUTO_FORMAT_HINT: string;
 declare function composeRetryEmphasis(problem: string): string;

package/dist/task/prompts.js

@@ -208,6 +208,15 @@ ${research}
 
 Answers so far:
 ${priorQA.trim() || '(none yet)'}`;
+/**
+ * The first triage check. MEASURED (mx5-n TASK_0004, 2026-09-17): the auto-answer
+ * chose "flag the test breakage as a known issue for the test owner". No task owns
+ * a test, so the suite stayed red through four tasks, and the fifth was specced
+ * as "add three files, change nothing else, make the whole suite pass" — an
+ * unsatisfiable spec whose implementer looped until the runaway guard fired.
+ * Exported on its own so a harness can measure the prompt with and without it.
+ */
+export const GRILL_GREEN_SUITE_CHECK = `1. GREEN-SUITE CHECK — if an option would leave an existing test, lint, or build failing after this task ("known issue", "for the test owner", "whoever revisits it", "a later step will fix it"), that option is NOT available. Nobody downstream owns a breakage: every later task inherits a red suite it is told not to touch, and the run stalls there. A scope rule such as "only create file X" does NOT settle this — a test that asserts on X's output is part of X's change, so updating that test is in scope. If one option keeps the suite green, emit "ANSWER: <that option>, and update <the test file> so the suite stays green". If no offered option does, emit "ANSWER: <the smallest change that keeps the suite green, naming the test file to update>". Never answer with a deferral.`;
 const GRILL_AUTO_ANSWER_PROMPT = (refined, research, question) => `You are pre-answering a clarifying question for an AI coding task. You have the refined task and the research notes. You may use the read tool on files mentioned in the research (e.g. package.json) if it helps.
 
 Your job is to produce a recommended default. If the default is one the user would almost certainly accept without thinking, tag it ANSWER and skip the user. Otherwise tag it UNKNOWN. YOU MUST PROPOSE A DEFAULT — never refuse, never leave it empty.
@@ -223,11 +232,13 @@ API-GROUNDING RULE: never name a concrete API (\`Namespace.member\`, an imported
 
 TRIAGE — run these checks IN ORDER first. The REVERSIBILITY TEST below applies ONLY to a question that survives all checks as a genuine preference.
 
-1. ALREADY-DECIDED CHECK — scan the refined task and research for a value, shape, response body, schema, route, or requirement that ALREADY determines the answer. If one does, this is a fact, not a preference. Emit "ANSWER: <value taken from that source>". If your instinct or a "nicer" alternative contradicts that source, the SOURCE WINS — never override a stated contract with a preferred default. (E.g. a stated response shape { items, total, page, pageSize } already answers a pagination question — page/offset — you may NOT answer "cursor".)
+${GRILL_GREEN_SUITE_CHECK}
+
+2. ALREADY-DECIDED CHECK — scan the refined task and research for a value, shape, response body, schema, route, or requirement that ALREADY determines the answer. If one does, this is a fact, not a preference. Emit "ANSWER: <value taken from that source>". If your instinct or a "nicer" alternative contradicts that source, the SOURCE WINS — never override a stated contract with a preferred default. (E.g. a stated response shape { items, total, page, pageSize } already answers a pagination question — page/offset — you may NOT answer "cursor".)
 
-2. FUNCTIONAL-REQUIREMENT CHECK — if the question is whether to include or defer a package, config file, or setup that something THIS task configures needs in order to FUNCTION (a build plugin's engine or required peer dependency, an entry file the build reads, a runtime module an import resolves to), then a "minimize / keep it minimal / defer to the step that uses it" preference does NOT override that functional requirement. A tool you wire up this step must have its required pieces present this step or the build/step is broken. Emit "ANSWER: <include it now, because configuring X requires it>". Do not defer something the step's own configuration depends on.
+3. FUNCTIONAL-REQUIREMENT CHECK — if the question is whether to include or defer a package, config file, or setup that something THIS task configures needs in order to FUNCTION (a build plugin's engine or required peer dependency, an entry file the build reads, a runtime module an import resolves to), then a "minimize / keep it minimal / defer to the step that uses it" preference does NOT override that functional requirement. A tool you wire up this step must have its required pieces present this step or the build/step is broken. Emit "ANSWER: <include it now, because configuring X requires it>". Do not defer something the step's own configuration depends on.
 
-3. PREFERENCE — only if neither check fires (a genuine choice the sources do not determine), apply the REVERSIBILITY TEST.
+4. PREFERENCE — only if no check fires (a genuine choice the sources do not determine), apply the REVERSIBILITY TEST.
 
 REVERSIBILITY TEST:
   ANSWER: cheap to undo (output style, policy, report format, obvious scope, standard convention).

package/dist/task/repo-health-check.d.ts

@@ -56,6 +56,21 @@ export declare function discoverHealthCommands(cwd: string): {
     ecosystem: string | null;
     cmds: HealthCommand[];
 };
+/**
+ * The project's OWN test commands, in the order the run-end gate runs them. One
+ * statement for both gates: final-gate.ts appends `build` to this list for the
+ * integration half, and `runRepoHealthCheck` runs it under `withTests` for the
+ * per-task differential, so the two cannot drift apart.
+ *
+ * Every test-shaped script, not just the one literally named `test`: a project's
+ * only browser-executing suite is often `test:ct`, and looking for `test` alone
+ * never runs it. Plain `test` leads, then every `test:`/`test_`/`test-` name in
+ * declaration order (Array#sort is stable).
+ */
+export declare function discoverTestCommands(cwd: string): {
+    ecosystem: string | null;
+    cmds: HealthCommand[];
+};
 /** Progress hook: called with each command's label as it STARTS, so a caller can
  *  keep a live status line naming what is currently running. */
 export type HealthProgress = (command: string) => void;
@@ -86,4 +101,7 @@ export declare function runRepoHealthCheck(cwd: string, opts?: {
     onCommand?: HealthProgress;
     /** The spawner. Injected so a verdict is testable without a real shell. */
     run?: CommandRunner;
+    /** Also run the project's test commands, after the statics. Only a caller
+     *  that will judge the result DIFFERENTIALLY may set this — see the header. */
+    withTests?: boolean;
 }): Promise<HealthOutcome>;

package/dist/task/repo-health-check.js

@@ -14,11 +14,18 @@
  * verify gate's `repo-health` FAIL (verify-work.ts), which reaches the
  * AUTOFIX / ACCEPT picker in verify-resolution.ts.
  *
- * Scope is deliberately STATIC ANALYSIS ONLY (lint / typecheck / clippy / vet), never
- * `test`, `build`, `run`, or anything that boots a server or needs a database. Those
- * depend on external services the verify prompt already carves out as an environment
- * gap, so running them here would blame code for a missing database. Static analysis
- * is hermetic: it needs no network, no service and no fixtures.
+ * Scope is STATIC ANALYSIS (lint / typecheck / clippy / vet) by default, never
+ * `build`, `run`, or anything that boots a server. Static analysis is hermetic: it
+ * needs no network, no service and no fixtures, so its absolute exit code decides.
+ *
+ * The TEST suite joins only under `withTests`, and only for the DIFFERENTIAL
+ * (health-baseline.ts). MEASURED (mx5-n TASK_0004, 2026-09-17): a task turned a
+ * green suite red, its spec called that a "known issue for the test owner", the
+ * model gate passed it, and four tasks later the run stalled on an unsatisfiable
+ * spec. A suite that needs a database fails the same way before and after the
+ * task, which the differential reads as pre-existing — so running it here does
+ * not blame code for a missing database, and DOES blame the task that broke a
+ * suite the baseline saw green.
  *
  * Absence is a PASS, two ways: (1) no recognised manifest at all (a pure-docs or
  * config-only repo has nothing that can regress); (2) a manifest with no static-check
@@ -118,6 +125,43 @@ export function discoverHealthCommands(cwd) {
     }
     return { ecosystem: null, cmds: [] };
 }
+/**
+ * The project's OWN test commands, in the order the run-end gate runs them. One
+ * statement for both gates: final-gate.ts appends `build` to this list for the
+ * integration half, and `runRepoHealthCheck` runs it under `withTests` for the
+ * per-task differential, so the two cannot drift apart.
+ *
+ * Every test-shaped script, not just the one literally named `test`: a project's
+ * only browser-executing suite is often `test:ct`, and looking for `test` alone
+ * never runs it. Plain `test` leads, then every `test:`/`test_`/`test-` name in
+ * declaration order (Array#sort is stable).
+ */
+export function discoverTestCommands(cwd) {
+    if (existsSync(path.join(cwd, 'package.json'))) {
+        const s = packageScripts(cwd);
+        const names = Object.keys(s).filter(n => n === 'test' || /^test[:_-]/.test(n));
+        names.sort((a, b) => a === 'test' ? -1
+            : b === 'test' ? 1
+                : 0);
+        return { ecosystem: 'package.json', cmds: names.map(n => ['bun', ['run', n]]) };
+    }
+    if (existsSync(path.join(cwd, 'Makefile'))) {
+        return {
+            ecosystem: 'Makefile',
+            cmds: makeHasTarget(cwd, 'test') ? [['make', ['test']]] : []
+        };
+    }
+    if (existsSync(path.join(cwd, 'Cargo.toml'))) {
+        return { ecosystem: 'Cargo.toml', cmds: [['cargo', ['test', '--quiet']]] };
+    }
+    if (existsSync(path.join(cwd, 'go.mod'))) {
+        return { ecosystem: 'go.mod', cmds: [['go', ['test', './...']]] };
+    }
+    if (existsSync(path.join(cwd, 'pyproject.toml'))) {
+        return { ecosystem: 'pyproject.toml', cmds: [['pytest', ['-q']]] };
+    }
+    return { ecosystem: null, cmds: [] };
+}
 /** The nothing-to-run outcome, shared by both runners. */
 function noCommandOutcome(ecosystem) {
     return {
@@ -150,12 +194,18 @@ function noCommandOutcome(ecosystem) {
  * widget has just been cleared.
  */
 export async function runRepoHealthCheck(cwd, opts = {}) {
-    const { ecosystem, cmds } = discoverHealthCommands(cwd);
+    const statics = discoverHealthCommands(cwd);
+    const tests = opts.withTests ? discoverTestCommands(cwd) : { ecosystem: null, cmds: [] };
+    const ecosystem = statics.ecosystem ?? tests.ecosystem;
+    const cmds = [
+        ...statics.cmds.map(([bin, args]) => ({ bin, args, test: false })),
+        ...tests.cmds.map(([bin, args]) => ({ bin, args, test: true }))
+    ];
     if (!ecosystem || cmds.length === 0)
         return noCommandOutcome(ecosystem);
     const run = opts.run ?? spawnCommand;
     const commands = [];
-    for (const [bin, args] of cmds) {
+    for (const { bin, args, test } of cmds) {
         const cmd = `${bin} ${args.join(' ')}`;
         opts.onCommand?.(cmd);
         // Runner resolution: a PATH-stripped environment must not
@@ -175,12 +225,11 @@ export async function runRepoHealthCheck(cwd, opts = {}) {
         // ladder's `tail` keeps 400 characters, and that difference is real — a
         // truncated lint report is unactionable. So the run is classified, not
         // consumed: the verdict decides, the raw streams are what we show.
-        // `runtimeGap: false` — this ladder is NARROWER than the gate's. The
-        // browser/runtime row was written for the gate's TEST commands; here the
-        // commands are lint and typecheck, and its pattern matches ordinary
-        // English, so a genuine report quoting "browsers are not installed" would
-        // skip the static check and certify the repo healthy.
-        const verdict = classifyCommandRun(r, [], { runtimeGap: false });
+        // `runtimeGap` only for a TEST command. The browser/runtime row was
+        // written for the gate's test commands and its pattern matches ordinary
+        // English, so on lint and typecheck a genuine report quoting "browsers are
+        // not installed" would skip the static check and certify the repo healthy.
+        const verdict = classifyCommandRun(r, [], { runtimeGap: test });
         if (verdict.outcome !== 'fail') {
             const passed = verdict.outcome === 'pass';
             commands.push({ cmd, outcome: passed ? 'pass' : 'skip', exitCode: passed ? 0 : null });
@@ -197,7 +246,7 @@ export async function runRepoHealthCheck(cwd, opts = {}) {
     }
     return {
         ok: true,
-        reason: `${ecosystem}: static checks passed`,
+        reason: `${ecosystem}: static checks${tests.cmds.length > 0 ? ' and tests' : ''} passed`,
         ecosystem,
         commands,
         output: ''

package/dist/task/task-dir-custody.d.ts

@@ -0,0 +1,24 @@
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+/** File name → bytes, for the held files only. */
+export type TaskDirSnapshot = ReadonlyMap<string, Buffer>;
+export declare function snapshotTaskDir(cwd: string): Promise<TaskDirSnapshot>;
+/** Rewrite every snapshotted file that changed or is gone. Never throws.
+ *  Returns the names it put back, sorted. */
+export declare function restoreTaskDir(cwd: string, snapshot: TaskDirSnapshot): Promise<string[]>;
+export declare function taskDirRestoredNotice(who: string, names: readonly string[]): string;
+/**
+ * Snapshot before the turn can start, replacing any custody still held.
+ * `oneShot` means the settle ends it; otherwise the returned release does, and
+ * it never releases a custody taken since.
+ */
+export declare function takeTaskDirCustody(cwd: string, opts: {
+    oneShot: boolean;
+}): Promise<() => Promise<string[]>>;
+export declare function releaseTaskDirCustody(): Promise<string[]>;
+/** @internal Test seam: is a turn's task dir held? */
+export declare function taskDirCustodyHeld(): boolean;
+/**
+ * pi awaits these handlers before it wakes a command waiting for idle, so a
+ * one-shot restore finishes before the next run writes anything.
+ */
+export declare function registerTaskDirCustody(pi: ExtensionAPI): void;

package/dist/task/task-dir-custody.js

@@ -0,0 +1,100 @@
+/**
+ * Custody of the task dir while a model can write to it.
+ *
+ * Every markdown file in `.pi-tasks/` is host state. A model reaches it through
+ * edit, write or bash, and pi rewrites a path before it writes (`@x`, `file://`),
+ * so a rule on the tool call sees only some of the writers. The host snapshots
+ * the files before the model runs and puts back whatever changed. MEASURED: an
+ * mx5 implementer wrote its report over TASK_AUTO_0001.md, and the run died on
+ * its front matter.
+ *
+ * Only markdown is held: pi-task's own tools write research-cache.json mid-turn.
+ * A file created in the window is kept, because a run started meanwhile
+ * allocates its own.
+ */
+import * as fsp from 'node:fs/promises';
+import * as path from 'node:path';
+import { notifyRun } from '../remote/bridge.js';
+import { tasksDir } from './task-io.js';
+import { TASKS_DIR_NAME } from './task-types.js';
+export async function snapshotTaskDir(cwd) {
+    const dir = tasksDir(cwd);
+    const out = new Map();
+    const entries = await fsp.readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const e of entries) {
+        if (!e.isFile() || !e.name.endsWith('.md'))
+            continue;
+        const bytes = await fsp.readFile(path.join(dir, e.name)).catch(() => null);
+        if (bytes)
+            out.set(e.name, bytes);
+    }
+    return out;
+}
+/** Rewrite every snapshotted file that changed or is gone. Never throws.
+ *  Returns the names it put back, sorted. */
+export async function restoreTaskDir(cwd, snapshot) {
+    const dir = tasksDir(cwd);
+    const restored = [];
+    for (const [name, bytes] of snapshot) {
+        const file = path.join(dir, name);
+        const now = await fsp.readFile(file).catch(() => null);
+        if (now?.equals(bytes))
+            continue;
+        try {
+            await fsp.mkdir(dir, { recursive: true });
+            await fsp.writeFile(file, bytes);
+            restored.push(name);
+        }
+        catch {
+            // The host's next read of this file reports what is still wrong.
+        }
+    }
+    return restored.sort();
+}
+export function taskDirRestoredNotice(who, names) {
+    const list = names.map(n => `${TASKS_DIR_NAME}/${n}`).join(', ');
+    return `${who} changed ${list}, which only pi-task writes. Restored.`;
+}
+/** The implementation turn's custody. One slot: one task runs at a time. */
+let held = null;
+async function release(custody) {
+    if (held !== custody)
+        return [];
+    held = null;
+    return restoreTaskDir(custody.cwd, custody.snapshot);
+}
+/**
+ * Snapshot before the turn can start, replacing any custody still held.
+ * `oneShot` means the settle ends it; otherwise the returned release does, and
+ * it never releases a custody taken since.
+ */
+export async function takeTaskDirCustody(cwd, opts) {
+    const custody = { cwd, snapshot: await snapshotTaskDir(cwd), oneShot: opts.oneShot };
+    held = custody;
+    return () => release(custody);
+}
+export function releaseTaskDirCustody() {
+    return held ? release(held) : Promise.resolve([]);
+}
+/** @internal Test seam: is a turn's task dir held? */
+export function taskDirCustodyHeld() {
+    return held !== null;
+}
+/**
+ * pi awaits these handlers before it wakes a command waiting for idle, so a
+ * one-shot restore finishes before the next run writes anything.
+ */
+export function registerTaskDirCustody(pi) {
+    pi.on('agent_settled', async (_event, ctx) => {
+        if (!held?.oneShot)
+            return;
+        const restored = await releaseTaskDirCustody();
+        if (restored.length === 0)
+            return;
+        notifyRun(ctx, taskDirRestoredNotice('The implementation turn', restored), 'warning');
+    });
+    // Dropped, not restored: a snapshot this old would revert the next run's writes.
+    pi.on('session_shutdown', () => {
+        held = null;
+    });
+}

package/dist/task/yolo.d.ts

@@ -44,11 +44,12 @@ export declare function yoloPickAnswer(enabled: boolean, opts: {
 }): YoloPick;
 /**
  * The same policy expressed over an {@link AutoAnswer}, for the grill site. Of the
- * four `reason` tags an unknown can carry — `api-synthesis`, `integration`,
- * `threw`, `model-unknown` — only ANTI-SYNTHESIS is unsafe. The other three carry
- * an ordinary best-effort recommendation, which is precisely what a human would be
- * shown as the green card. The variants are told apart by that tag, never by
- * pattern-matching the answer text.
+ * five `reason` tags an unknown can carry — `api-synthesis`, `deferred-breakage`,
+ * `integration`, `threw`, `model-unknown` — the first two are unsafe: one names an
+ * API nobody verified, the other hands a red suite to an owner nobody is. The other
+ * three carry an ordinary best-effort recommendation, which is precisely what a
+ * human would be shown as the green card. The variants are told apart by that tag,
+ * never by pattern-matching the answer text.
  */
 export declare function yoloPickAutoAnswer(enabled: boolean, auto: AutoAnswer): YoloPick;
 /**

package/dist/task/yolo.js

@@ -68,11 +68,12 @@ export function yoloPickAnswer(enabled, opts) {
 }
 /**
  * The same policy expressed over an {@link AutoAnswer}, for the grill site. Of the
- * four `reason` tags an unknown can carry — `api-synthesis`, `integration`,
- * `threw`, `model-unknown` — only ANTI-SYNTHESIS is unsafe. The other three carry
- * an ordinary best-effort recommendation, which is precisely what a human would be
- * shown as the green card. The variants are told apart by that tag, never by
- * pattern-matching the answer text.
+ * five `reason` tags an unknown can carry — `api-synthesis`, `deferred-breakage`,
+ * `integration`, `threw`, `model-unknown` — the first two are unsafe: one names an
+ * API nobody verified, the other hands a red suite to an owner nobody is. The other
+ * three carry an ordinary best-effort recommendation, which is precisely what a
+ * human would be shown as the green card. The variants are told apart by that tag,
+ * never by pattern-matching the answer text.
  */
 export function yoloPickAutoAnswer(enabled, auto) {
     if (!enabled)
@@ -84,6 +85,9 @@ export function yoloPickAutoAnswer(enabled, auto) {
         ...(auto.alt !== undefined && { alt: auto.alt }),
         ...(auto.reason === 'api-synthesis' && {
             unsafe: 'the suggested answer names an unverified API identifier — needs a human'
+        }),
+        ...(auto.reason === 'deferred-breakage' && {
+            unsafe: 'the suggested answer leaves a test or build failing for an owner that does not exist — needs a human'
         })
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.42.1",
+    "version": "0.42.3",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",