pi-aia-asf 0.17.5 → 0.17.7

package/CHANGELOG.md

@@ -7,6 +7,117 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.7] - 2026-11-09
+
+### Fixed — "waiting" is now illegal as a disposition
+
+An agent working a claimed ticket ended its run with this on the reviewer's card:
+*"Left In Progress at testing — deliberately not resolved, because the user-visible
+outcome still isn't confirmed, and not parked, since you told me not to ask you for
+anything."* Nothing blocked it. The run closed and the work stopped. That is a stop
+wearing a status report, and it is the failure this whole process exists to prevent.
+
+The agent did not misbehave; it had no legal state to stand in. The stop policy names
+four things that may halt a run — plan approval, an irreversible action with no safe
+path, an unobtainable credential, a deliverable-shaping either/or — and **"the other
+side has not replied" is none of them**. A contract that forbids stopping without
+naming what to do instead does not produce persistence, it produces paragraphs. And
+the agent had correctly noticed that parking *looks like* asking, so a "don't ask me"
+directive seemed to forbid the one move that was legal.
+
+- **New gate: `lib/gates/tracked.mjs`.** Claims, resolutions and parks are read off the
+  tool *name* (`bmx_claim`, `submit_resolution`, `request_input`, …) — never off shell
+  text, because `git commit` is not a claim. A claimed item with no disposition is a
+  gap that keeps the run open, and the agent's own progress text is read for the
+  confession ("deliberately not resolved", "not parked", "waiting for their reply",
+  "it flips the moment…"), which raises it on the spot.
+- **The three dispositions, all of which the agent can take itself**: park it where a
+  reviewer sees it (parking is a *marker*, not a question, so "don't ask me" never
+  forbids it); take the next action you control; or, if you are genuinely waiting on
+  someone else, make the wait end in one step — the test that will confirm the outcome,
+  the draft mail — and keep going. The gap text offers all three.
+- The gap is worded so it cannot route itself into the report: it names no slash
+  command and never says "ask the PO", because a gap that reads like a human action is
+  filtered out by `splitGaps` and would make the guard decorative. Pinned by a test.
+- **Contract text now lives where the agent reads it.** The no-stops policy existed only
+  in a source docstring; `06i-completeness.md` (always-read) now carries the rule and the
+  DoD has a line for it, with the case study in `06f-stability.md` §6. The always-read
+  load stayed inside its budget (75,953 / 76,000) — detail moved out to 06f rather than
+  the budget being raised.
+
+### Fixed — declaration files that lie about their module
+
+`lib/gates/blockers.d.mts` still declared `RULE_TEXT` / `refusalStage` /
+`__resetRefusals` after they moved to `refusals.mjs` (0.17.5); `lib/gates/settle.d.mts`
+still declared `MAX_IDENTICAL_STEERS` after the cap was deleted; `lib/activation.d.mts`
+still declared `SOURCE_EXTENSIONS` after it was removed. A `.ts` importing any of those
+typechecks clean and gets `undefined` at runtime — the compiler is the tool that is
+wrong. New suite **`test/test-declarations.mjs`** loads every `.mjs` beside each `.d.mts`
+and fails on any declared export the module does not have. It found the third case on
+its first run.
+
+### Fixed — the test runner could not fail
+
+`test/harness.mjs` carried `const ok = globalThis.__tools = tools` where it meant to
+capture the suite's verdict: `ok` was the tools array — always truthy — and the return
+value of `run()` was discarded. A suite reporting failure by returning false printed its
+FAILs and was still counted green, which is precisely the bug the comment above it
+claimed was fixed. The verdict is now captured, and the new declarations suite depends
+on it.
+
+### Also
+
+- `06i-completeness.md` still described the old steering rule ("a gap is steered once,
+  never twice") after 0.16.0 removed the cap.
+
+## [0.17.6] - 2026-11-09
+
+### Fixed — a gate that crashes is not a gate that passed
+
+Both tool handlers were fenced with `catch { return undefined }`, which had two consequences of
+exactly the kind ASF bans:
+
+- A failure inside the **suite recorder** lost the run silently, after which the publish and
+  completion floors demanded a run that could never register — an unclosable gap with no visible
+  cause.
+- Because pi's own semantics for a crashing `tool_call` handler are *block*, returning "allow"
+  overrode them: anything that made the earlier code throw — a config read, the activation
+  observer — disabled the **irreversibility floor** for that call.
+
+Now:
+
+- `reportGateError(gate, e)` records a `gate-error` ledger entry and tells the agent once, as a
+  steer: *"That is not a pass — the check failed to execute."* Guidance, never a stop.
+- When the gate dies **before** the blockers ran, `failSafeBlock(input)` re-runs just the rules
+  whose `failSafe` is `block`, from the raw tool input alone, with no context to fail on. A secret
+  in a tracked file is still refused when the gate itself is broken; ordinary work is never
+  stopped by an internal error.
+- A fail-safe rule that *itself* throws refuses ("could not run") rather than reporting nothing
+  found.
+
+Three assertions pin this, each mutation-tested: removing the report, the fail-closed call, or the
+crash-refusal each fails a test.
+
+- `lib/gates/blockers.d.mts` still declared `RULE_TEXT`, `refusalStage` and `__resetRefusals` after
+  they moved to `lib/gates/refusals.mjs` in 0.17.5 — a `.ts` could import them, typecheck, and get
+  `undefined` at runtime. The declarations now match the modules.
+
+### Removed
+
+- Dead export `SOURCE_EXTENSIONS` from `lib/activation.mjs` (no importer).
+
+### Documented
+
+- **The loaded copy is not the shipped copy** (07-release.md step 7 + hygiene rule): `pi` loads
+  extensions once at process start, so a session open across a release keeps enforcing the previous
+  version and quoting text that no longer exists in the source. Confirm which build is loaded — a
+  string unique to the new release, and the process start time — before concluding a released gate
+  is broken. That is the difference between "the fix did not work" and "the fix is not running", and
+  it cost hours chasing a phantom bug in 0.17.5.
+- `06i-completeness.md` pointed its drift example at `lib/gates/ledger.mjs` / `deriveSuiteRun()`;
+  those moved to `lib/gates/suite-runs.mjs` in 0.17.5, and the doc — which is about not trusting
+  stale references — was itself stale.
+
 ## [0.17.5] - 2026-11-08
 
 ### Fixed — the publish floor could be satisfied by a green that proved nothing

package/lib/activation.d.mts

@@ -12,5 +12,4 @@ export function activationDecision(o?: {
   activeRun?: { phase?: string; runId?: string } | null;
   passiveRunId?: string | null;
 }): { activate: boolean; reason?: string };
-export const SOURCE_EXTENSIONS: string[];
 export function delegatesUnguardedWrites(cmd: unknown): boolean;

package/lib/activation.mjs

@@ -177,5 +177,3 @@ export function activationDecision({ call, activeRun, passiveRunId = null } = {}
   return { activate: true };
 }
 
-/** Exported for the tests and for `/asf` diagnostics. */
-export const SOURCE_EXTENSIONS = SOURCE_EXT;

package/lib/extension/evidence.ts

@@ -27,6 +27,30 @@ export function queueSteer(text: string) {
   pendingSteers.push(text);
 }
 
+/**
+ * An internal gate error must never be able to look like a pass.
+ *
+ * Every ASF handler is fenced, because an observer must not break the work it
+ * watches. Fencing *without* reporting is exactly how the 2026-11-07 loop became
+ * possible: a gate demanded something, the code that would have shown why
+ * swallowed its own error, and the agent was steered forever toward an action
+ * that could not register. So a swallowed error is (a) recorded as evidence and
+ * (b) told to the agent once, as a steer — guidance, never a stop.
+ *
+ * The settle gate has a stronger channel (it returns the entry inline, so the
+ * agent sees it in the same turn); the tool handlers do not, so they use this.
+ */
+export function reportGateError(gate: string, e: unknown) {
+  const message = String((e as Error | null)?.message || e || "unknown");
+  appendEvidence({ kind: "gate-error", gate, error: message.slice(0, 300) });
+  const cls = (e as { code?: string } | null)?.code || (e as Error | null)?.name || "unknown";
+  queueSteer(
+    `ASF: the ${gate} hit an internal error (${cls}: ${message.slice(0, 140)}) and did not run. ` +
+      `That is not a pass — the check failed to execute. Re-issue the action; if it repeats, ` +
+      `this is an ASF bug to report, not a rule to satisfy.`,
+  );
+}
+
 
 export function appendEvidence(entry: Record<string, unknown>) {
   const res = ledger.append(entry);

package/lib/extension/handlers/settle.ts

@@ -163,6 +163,7 @@ async function judgeAndSettle(ctx: SettleContext, priorCount: number): Promise<S
     seenSteers: [...new Set([...(state.seenSteers || []), ...mem.seen])],
     sourceMutated: !!state.sourceMutated,
     testRunRecorded,
+    tracked: runtime.tracked,
   });
   runtime.lastSettleDecision = decision;
   appendEvidence({ kind: "gate-verdict", gate: "completion", fired: decision.missing.length > 0, missing: decision.missing });

package/lib/extension/handlers/tool-call.ts

@@ -15,13 +15,14 @@
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { classifyToolCall, activationDecision } from "../../activation.mjs";
-import { evaluateBlockers, BLOCKERS } from "../../gates/blockers.mjs";
+import { evaluateBlockers, BLOCKERS, failSafeBlock } from "../../gates/blockers.mjs";
 import { deriveSuiteRun } from "../../gates/suite-runs.mjs";
+import { noteTrackedCall } from "../../gates/tracked.mjs";
 import { readProjectConfig } from "../../gates/config.mjs";
 import { projectName, runRoot } from "../paths.ts";
 import { loadState, saveState } from "../state.ts";
 import { openAutoRun, gitDirty, numberConfig } from "../run.ts";
-import { appendEvidence, queueSteer } from "../evidence.ts";
+import { appendEvidence, queueSteer, reportGateError } from "../evidence.ts";
 import { gateStats, pendingSuiteRuns, suiteRuns, recordVerdict } from "../gate-state.ts";
 import { authority } from "../gate-state.ts";
 import { runtime, BLIND_EDIT_NUDGE_AFTER } from "../runtime.ts";
@@ -102,6 +103,28 @@ function observeWebTouch(input: Input): void {
   if (touched && /\.(tsx|jsx|html|vue|svelte|css)$/i.test(touched)) runtime.webTouched = true;
 }
 
+/**
+ * What this call did to tracked work (a claimed ticket, an assigned issue).
+ *
+ * The gate needs to know that the session *owns* something, because the failure
+ * it prevents is invisible in the source tree: an agent that ends its run with a
+ * claimed item neither resolved nor parked has stopped, and written a paragraph
+ * about it instead. Claim / resolve / park are read off the tool's name; a
+ * narrated wait is read off the text the agent wrote for the reviewer.
+ */
+function observeTrackedWork(toolName: string, input: Input): void {
+  const kind = noteTrackedCall(runtime.tracked, { toolName, input });
+  if (!kind) return;
+  appendEvidence({ kind: "tracked", action: kind, tool: toolName, item: String(input.ticket_id || input.ticketId || input.id || "") || null });
+  if (kind === "wait") {
+    queueSteer(
+      `ASF: you described tracked work as waiting — that is not a disposition ASF recognises, and the run cannot close on it. ` +
+        `Park it where the reviewer sees it (parking is a marker, not a question, so "do not ask me" never forbids it), take the next ` +
+        `action you control, or do the work that makes the wait end in one step and keep going.`,
+    );
+  }
+}
+
 /** Gate switches the project turned off, as evaluateBlockers wants them. */
 function blockerSwitches(config: Record<string, unknown>): Record<string, boolean> {
   const enabled: Record<string, boolean> = {};
@@ -209,6 +232,7 @@ export function registerToolCallHandler(pi: ExtensionAPI): void {
       }
       observeSuiteAttempt(input, ev);
       observeWebTouch(input);
+      observeTrackedWork(toolName, input);
 
       const config = readProjectConfig(runRoot());
       const res = evaluateBlockers(toolName, input, {
@@ -230,10 +254,14 @@ export function registerToolCallHandler(pi: ExtensionAPI): void {
       if (park) await parkRun(park);
       if (!res.block) return undefined;
       return await handleBlock({ pi, res: res as Refusal["res"], park, config });
-    } catch {
-      // An observer must never break the thing it observes. The fail-safe for
-      // the secret rule lives inside evaluateBlockers, where it is explicit.
-      return undefined;
+    } catch (e) {
+      // An observer must never break the thing it observes — so this does not
+      // stop the work. But it must not look like a clean pass either, and it must
+      // not hand anyone a way past the irreversibility floor: an error raised
+      // before the blockers ran is re-checked against the rules that guard
+      // irreversible actions, from the raw tool input alone.
+      reportGateError("tool_call gate", e);
+      return failSafeBlock((event as { input?: Input } | null)?.input || {});
     }
   });
 }

package/lib/extension/handlers/tool-result.ts

@@ -9,7 +9,7 @@
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { deriveSuiteRun } from "../../gates/suite-runs.mjs";
-import { appendEvidence } from "../evidence.ts";
+import { appendEvidence, reportGateError } from "../evidence.ts";
 import { pendingSuiteRuns, suiteRuns } from "../gate-state.ts";
 import { runtime } from "../runtime.ts";
 
@@ -52,7 +52,11 @@ export function registerToolResultHandler(pi: ExtensionAPI): void {
       pendingSuiteRuns.delete(id);
       completeSuiteRun(ev, pending);
       return undefined;
-    } catch {
+    } catch (e) {
+      // Swallowing this one silently is how the publish floor becomes an
+      // unclosable gap: the run happened, the recorder failed, and the gate then
+      // demands a run that can never register.
+      reportGateError("suite recorder", e);
       return undefined;
     }
   });

package/lib/extension/runtime.ts

@@ -7,6 +7,8 @@
  * 2026-11-07 loop possible in the first place (state nobody owned).
  */
 
+import { createTracked, type TrackedState } from "../gates/tracked.mjs";
+
 /** P5: machine turns before a re-anchor is due. */
 export const REANCHOR_AFTER_MACHINE_TURNS = 25;
 /** P5: and never more often than this, however many turns pass. */
@@ -40,6 +42,12 @@ export interface RuntimeState {
   lastScaleWasSmall: boolean;
   /** Re-anchoring is count-limited per run. */
   reanchorsThisRun: number;
+  /**
+   * Tracked work opened this session (a claimed ticket, an assigned issue) and
+   * whether it has a disposition. Session-scoped on purpose: a claim made before
+   * a restart is re-opened by the agent's own progress text if it is still dangling.
+   */
+  tracked: TrackedState;
 }
 
 export const runtime: RuntimeState = {
@@ -56,4 +64,5 @@ export const runtime: RuntimeState = {
   passiveHeartbeatWritten: false,
   lastScaleWasSmall: false,
   reanchorsThisRun: 0,
+  tracked: createTracked(),
 };

package/lib/gates/blockers.d.mts

@@ -34,9 +34,8 @@ export function evaluateBlockers(
   verdicts: BlockerVerdict[];
   steers?: Array<{ gate: string; reason: string }>;
 };
-export const RULE_TEXT: Record<string, string>;
-export function refusalStage(gate: string, fingerprint: string): number;
-export function __resetRefusals(): void;
+/** Re-run the fail-safe-block rules from the raw input alone, when the gate itself could not run. */
+export function failSafeBlock(input: Record<string, unknown>): { block: true; reason: string } | undefined;
 export function blockSecretWrite(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;
 export function blockTestSubset(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;
 export function blockPushWithoutGreen(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;

package/lib/gates/blockers.mjs

@@ -160,6 +160,30 @@ export const BLOCKERS = [
   { name: "destructive-git-dirty-tree", run: blockDestructiveGitDirty, failSafe: "allow", switch: "gate.block.destructiveGit", criticality: "medium", bypassable: true, mode: "block" },
 ];
 
+/**
+ * The floor that must not fail open.
+ *
+ * A fenced handler that returns "allow" on its own internal error hands anyone
+ * who can make the *other* code throw a way past the irreversibility floor — the
+ * secret rule would be disabled by a bug in a config read. So when the gate
+ * could not run, the rules whose `failSafe` is `block` are re-run from the raw
+ * tool input alone, with no context to fail on; and if even one of those throws,
+ * that is a refusal, not a pass.
+ */
+export function failSafeBlock(input) {
+  for (const b of BLOCKERS) {
+    if (b.failSafe !== "block") continue;
+    let res;
+    try {
+      res = b.run(input, {});
+    } catch {
+      res = { fired: true, reason: `${b.name} could not run, and it guards an irreversible action.` };
+    }
+    if (res?.fired) return { block: true, reason: `${b.name}: ${res.reason || "refused"}` };
+  }
+  return undefined;
+}
+
 function str(input, keys) {
   if (!input || typeof input !== "object") return null;
   for (const k of keys) {

package/lib/gates/settle.d.mts

@@ -25,10 +25,11 @@ export function decideSettlement(
     testRunRecorded?: boolean;
     reportFields?: string[];
     untracedMet?: string[];
+    /** Tracked work opened this session; dangling items are a gap. */
+    tracked?: import("./tracked.mjs").TrackedState;
   },
 ): SettleDecision;
 export function renderCompletionGate(decision: { missing: string[]; exhausted?: boolean; park?: ParkRequest }): string;
 export function classifyPark(missing?: string[]): ParkRequest | null;
 export function steerFingerprint(missing?: string[]): string;
-export const MAX_IDENTICAL_STEERS: number;
 export const MAX_STEERS: number;

package/lib/gates/settle.mjs

@@ -11,6 +11,14 @@
  * credential ASF cannot get, or a deliverable-shaping either/or that cannot be
  * inferred from the artifacts. Everything else is a steer.
  *
+ * **And a fifth thing that is NOT a halt (PO, 2026-11-09): someone else has not
+ * replied.** After the guard shipped, an agent left a claimed ticket In Progress,
+ * neither resolved nor parked, and explained it was waiting and had not parked
+ * because it had been told not to ask anything. Four named halts with no rule for
+ * "the other side is slow" does not produce persistence — it produces a run that
+ * closes on a paragraph. Tracked work left dangling is therefore a gap like any
+ * other, steered until it has one of the three dispositions in `tracked.mjs`.
+ *
  * **What replaced the cap.** The old rule was `MAX_CONTINUATIONS = 2`, then the
  * gate declined to ask again. A fixed cap is the wrong instrument under "no
  * stops": two is far too few for an honest implement → test → fix → verify loop,
@@ -27,6 +35,7 @@
  */
 
 import { sessionFacts } from "./ledger.mjs";
+import { danglingGaps } from "./tracked.mjs";
 
 /**
  * A REPORTING number only — never a stop, and no longer referenced by any
@@ -187,6 +196,9 @@ function collectGaps(ledger, opts) {
     ...validationGap(ledger, opts),
     ...traceGap(opts.untracedMet),
     ...reportGaps(ledger, opts),
+    // "Waiting" is not a disposition: tracked work left neither resolved nor
+    // parked is a stop wearing a status report, and it is steered like one.
+    ...danglingGaps(opts.tracked),
   ];
 }
 

package/lib/gates/tracked.d.mts

@@ -0,0 +1,28 @@
+/** Type surface for the tracked-work gate (`tracked.mjs`). */
+
+export interface TrackedItem {
+  at: number;
+  by: string;
+}
+
+export interface TrackedState {
+  /** Open items by id. A key here is work with no disposition yet. */
+  open: Record<string, TrackedItem>;
+  /** Ids whose agent has narrated a wait instead of acting. */
+  waits: string[];
+  /** Every id ever opened, for the evidence trail. */
+  seen: string[];
+}
+
+export declare const DISPOSITIONS: string[];
+
+export function createTracked(): TrackedState;
+
+export function noteTrackedCall(
+  tracked: TrackedState,
+  call: { toolName?: string; input?: Record<string, unknown> },
+): "claim" | "resolve" | "park" | "wait" | null;
+
+export function danglingGaps(tracked: TrackedState | undefined): string[];
+
+export function trackedClear(tracked: TrackedState | undefined): boolean;

package/lib/gates/tracked.mjs

@@ -0,0 +1,151 @@
+/**
+ * "Waiting" is not a disposition.
+ *
+ * On 2026-11-09 an agent working a claimed ticket ended its run with this on the
+ * card: *"Left In Progress at testing — deliberately not resolved, because the
+ * user-visible outcome still isn't confirmed, and not parked, since you told me
+ * not to ask you for anything."* Nothing was blocked, nothing was parked, the
+ * run closed, and the work stopped. That is a stop wearing a status report.
+ *
+ * It was ASF's fault, not the agent's. The contract names four things that may
+ * halt a run — plan approval, an irreversible action with no safe path, an
+ * unobtainable credential, a deliverable-shaping either/or. "The other side has
+ * not replied" is none of them, so the agent had no legal state to stand in and
+ * improvised an illegal one. A contract that forbids stopping without naming
+ * what to do instead does not produce persistence; it produces narratives.
+ *
+ * So the illegal state is named, and the legal answers are exactly three. They
+ * are all actions, and the agent can take every one of them — which is what
+ * makes this gap steerable rather than the 2026-11-07 kind that loops forever.
+ */
+
+/** The only three things an agent may do with work it cannot finish right now. */
+export const DISPOSITIONS = [
+  "park it where a reviewer sees it (the needs-input queue) — parking is a marker, not a question, so a 'do not ask me' instruction never forbids it",
+  "take the next action you control, now, in this run",
+  "if you are genuinely waiting on someone else, do the work that makes the wait end in one step — the test that will confirm the outcome, the draft, the verification you can run today — and then keep going",
+];
+
+/**
+ * Tool names that open a tracked item. Matched on the tool name, never on shell
+ * text: `bmx_claim`, `linear_claim`, `ticket_assign`. A bash command is not a
+ * claim, because `git commit` is not one either.
+ */
+const CLAIM_RE = /(^|[_-])(claim|assign|take|acquire)([_-]|$)/i;
+/** Tool names that close one. `submit_resolution`, `resolve_ticket`, `finish`… */
+const RESOLVE_RE = /(^|[_-])(resolve|resolution|finish|complete|close|deliver)([_-]|$)/i;
+/** Tool names that park one where a human sees it. */
+const PARK_RE = /(^|[_-])(park|escalate|needs?[_-]?input|request[_-]?input|request[_-]?review|block[_-]?review|hand[_-]?off)([_-]|$)/i;
+/** Tool names whose text the agent writes for a human to read. */
+const NARRATE_RE = /(^|[_-])(progress|status|update|comment|note|report)([_-]|$)/i;
+
+/**
+ * The confession. An agent narrating a wait has usually said it out loud, in the
+ * very message meant for the reviewer. Deliberately narrow: it must describe
+ * leaving work unfinished, not merely mention a test or a queue.
+ */
+const WAITING_ALTERNATIVES = [
+  "(left|stays?|kept|remain(?:s|ing)?)\\s+(?:it\\s+)?(in\\s+progress|in\\s+the\\s+queue|unresolved|not\\s+resolved|open\\s+deliberately)",
+  "deliberately\\s+not\\s+(resolved|closed|parked|finished)",
+  "not\\s+parked",
+  "waiting\\s+(for|on)\\s+(the|their|your|a\\s+reply|them)",
+  "as\\s+soon\\s+as\\s+(they|he|she|it)\\s+repl(?:y|ies|ied)",
+  "it\\s+flips\\s+(the\\s+moment|when|once)",
+  "pend(?:ing|s)\\s+(their|the|his|her)\\s+repl(?:y|ies)",
+  "until\\s+(they|he|she|it)\\s+(repl(?:y|ies|ied)|answers?|responds?)",
+  "resume[sd]?\\s+(when|once|the\\s+moment)",
+];
+const WAITING_RE = new RegExp(WAITING_ALTERNATIVES.join("|"), "i");
+
+/** Identify the item a call is about, so one ticket is one entry. */
+function itemId(input) {
+  if (!input || typeof input !== "object") return null;
+  for (const k of ["ticket_id", "ticketId", "id", "issue", "issue_id", "work_item_id"]) {
+    const v = input[k];
+    if (typeof v === "string" && v.trim()) return v.trim().slice(0, 60);
+    if (typeof v === "number") return String(v);
+  }
+  return null;
+}
+
+function textOf(input) {
+  if (!input || typeof input !== "object") return "";
+  const parts = [];
+  for (const k of ["text", "body", "comment", "message", "summary", "reason", "note", "status"]) {
+    const v = input[k];
+    if (typeof v === "string") parts.push(v);
+  }
+  return parts.join("\n").slice(0, 4000);
+}
+
+/** Fresh tracked-work state. `open` maps an item id to what opened it. */
+export function createTracked() {
+  return { open: {}, waits: [], seen: [] };
+}
+
+function openItem(tracked, id, toolName) {
+  if (tracked.open[id]) return;
+  tracked.open[id] = { at: Date.now(), by: toolName };
+  tracked.seen.push(id);
+}
+
+function closeItem(tracked, id) {
+  delete tracked.open[id];
+}
+
+/**
+ * Record what a tool call did to tracked work.
+ *
+ * Returns a short label for the evidence trail (`claim` / `resolve` / `park` /
+ * `wait` / null). Never throws on odd input: this is an observer on the hot path.
+ */
+export function noteTrackedCall(tracked, { toolName = "", input = {} } = {}) {
+  if (!tracked || !toolName) return null;
+  const id = itemId(input) || `tool:${toolName}`;
+  if (PARK_RE.test(toolName)) {
+    closeItem(tracked, id);
+    return "park";
+  }
+  if (RESOLVE_RE.test(toolName)) {
+    closeItem(tracked, id);
+    return "resolve";
+  }
+  if (CLAIM_RE.test(toolName)) {
+    openItem(tracked, id, toolName);
+    return "claim";
+  }
+  if (NARRATE_RE.test(toolName) && WAITING_RE.test(textOf(input))) {
+    // Narrating a wait does not make it legal; it makes it visible to the gate.
+    openItem(tracked, id, toolName);
+    if (!tracked.waits.includes(id)) tracked.waits.push(id);
+    return "wait";
+  }
+  return null;
+}
+
+/**
+ * Gaps for work left dangling at settle time.
+ *
+ * Wording matters: these gaps must survive `splitGaps`, so they never say "ask
+ * the PO", "needs your input" or a slash command — a gap that reads like a human
+ * action is routed to the report and stops blocking, which would make this guard
+ * decorative. It names only moves the agent can make itself.
+ */
+export function danglingGaps(tracked) {
+  const ids = Object.keys(tracked && tracked.open ? tracked.open : {});
+  if (!ids.length) return [];
+  const how = DISPOSITIONS.map((d, i) => `${i + 1}) ${d}`).join(" ");
+  return ids.map((id) => {
+    const waited = tracked.waits.includes(id);
+    return (
+      `tracked work "${id}" is still open and this run is ending with it neither resolved nor parked` +
+      (waited ? " — and the agent has just narrated waiting for it, which is not a state ASF recognises" : "") +
+      `. Nothing here stops you. Do one of: ${how}. A run does not close while tracked work dangles.`
+    );
+  });
+}
+
+/** True when nothing is dangling (used by tests and by the run card). */
+export function trackedClear(tracked) {
+  return Object.keys(tracked && tracked.open ? tracked.open : {}).length === 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-aia-asf",
-  "version": "0.17.5",
+  "version": "0.17.7",
   "description": "Ai Applied Agentic Software Factory — codifies the full software development flow: intake, research, spec capture, adversarial analysis, planning with approval gates, test-first implementation, and release. Requires pi-vigilant, pi-smart-web-search, pi-smart-fetch, and pi-aia-browser.",
   "keywords": [
     "pi-package",

package/skills/aia-asf/references/06f-stability.md

@@ -86,6 +86,60 @@ correlation IDs, and a runbook exist."*
   unbounded wait, retry, or result set.
 - **Phase 7 (verification):** DoD includes the stability line above.
 
+## 5. Your own artifacts: the drift check
+
+`checkDrift` in `lib/gates/drift.mjs` reads this task's own artifacts (PLAN.md, the
+spec tree, a design doc) and checks the files and symbols they name still exist.
+Invoke it before claiming done:
+
+```bash
+node --input-type=module -e "
+import {checkDrift, renderDrift} from './lib/gates/drift.mjs';
+import fs from 'node:fs';
+const arts = ['PLAN.md'].filter(f => fs.existsSync(f)).map(path => ({path, text: fs.readFileSync(path,'utf8')}));
+console.log(renderDrift(checkDrift({artifacts: arts, repoRoot: process.cwd(), fs})));
+"
+```
+
+Three things it deliberately does **not** do:
+
+- It does not scan the whole repo's documentation. Repo-wide docs drift presumes the
+  documentation exists and is maintained, and products legitimately evolve — a check
+  that produces permanent noise gets switched off, which is worse than never having it.
+- It does not treat "0 unresolved" as a pass on its own. `status: "no-claims"` means
+  the artifact named no files or symbols at all, and that is reported as
+  examined-nothing, never as clean (06b Rule 10: `scanned: 0` is never a pass).
+- It does not replace the traceability matrix. Drift says the artifact still describes
+  the code; the matrix says the spec was actually delivered.
+
+## 6. The stop that looked like a status report (2026-11-09)
+
+An agent working a claimed ticket ended its run with this on the reviewer's card:
+
+> *"Left In Progress at testing — deliberately not resolved, because the user-visible
+> outcome still isn't confirmed, and not parked, since you told me not to ask you for
+> anything. It flips the moment their thread replies: Resume succeeds and I resolve it
+> with mail to ClearStory; fails and I re-diagnose from the factory's own sentence."*
+
+Nothing blocked it. No gate fired. The run closed and the work stopped. The reasoning
+was internally consistent and completely wrong: the agent had been told not to ask
+questions, had correctly worked out that parking *looks like* asking, and so had
+chosen a fifth state that the contract did not name — "in progress, waiting" — and
+explained it. Every clause of that sentence is a stop.
+
+Why it was ASF's bug, not the agent's: the stop policy names four things that may halt
+a run, and "the other side has not replied" is none of them. A contract that forbids
+stopping without naming what to do instead does not produce persistence, it produces
+paragraphs. So the state is now named and illegal, the three legal dispositions are
+listed (06i, "Waiting is not a disposition"), and the gate enforces it: `lib/gates/tracked.mjs`
+records claims, resolutions and parks off the tool names, reads the agent's own progress
+text for the confession, and a claimed item with no disposition is a gap that keeps the
+run open — steered, never stopped, and closable by the agent alone.
+
+Two things this is **not**: it is not a ban on saying "blocked" honestly (say it, in the
+report, with the disposition you took); and it is not a reason to resolve work that is
+not done — a false `resolved` is the worse failure. Park it.
+
 ## Anti-patterns
 
 - ❌ Unbounded retries on non-idempotent writes

package/skills/aia-asf/references/06i-completeness.md

@@ -4,10 +4,9 @@
 every deliverable with real behaviour. **Skip when:** never. Small work needs only
 the Core rule and the DoD checklist at the bottom.
 
-Newer models can produce work that *looks* finished: a function with the right name
-whose body is a placeholder, a screen populated with invented records, a report that
-cites a limit nobody checked. Green tests do not disprove it — the tests were written
-against the stub. This reference is the standing answer.
+Work can *look* finished: the right function name over a placeholder body, a screen of
+invented records, a report citing a limit nobody checked. Green tests do not disprove
+it — they were written against the stub.
 
 ## Core rule
 
@@ -60,31 +59,16 @@ goes in the final message in plain words — never discovered by the user throug
 ## Your own artifacts are part of the deliverable (task-scoped drift)
 
 The plan and the spec tree are artifacts too, and they make checkable claims: a PLAN.md
-that names `lib/gates/ledger.mjs` or `deriveSuiteRun()` is asserting those exist. When the
-code has moved and the artifact has not, the delivery report describes something that is
-not there — which is the same defect as a stub, just further from the user's eye.
-
-Before claiming done, run the drift check against **this task's own artifacts**:
-
-```bash
-node --input-type=module -e "
-import {checkDrift, renderDrift} from './lib/gates/drift.mjs';
-import fs from 'node:fs';
-const arts = ['PLAN.md'].filter(f => fs.existsSync(f)).map(path => ({path, text: fs.readFileSync(path,'utf8')}));
-console.log(renderDrift(checkDrift({artifacts: arts, repoRoot: process.cwd(), fs})));
-"
-```
-
-Three things this deliberately does **not** do:
-
-- It does not scan the whole repo's documentation. Repo-wide docs drift presumes the
-  documentation exists and is maintained, and products legitimately evolve — a check that
-  produces permanent noise gets switched off, which is worse than never having it.
-- It does not treat "0 unresolved" as a pass on its own. `status: "no-claims"` means the
-  artifact named no files or symbols at all, and that is reported as examined-nothing,
-  never as clean (06b Rule 10: `scanned: 0` is never a pass).
-- It does not replace the traceability matrix. Drift says the artifact still describes
-  the code; the matrix says the spec was actually delivered.
+naming `lib/gates/suite-runs.mjs` asserts that file exists. When the code moved and the
+artifact did not, the delivery report describes something that is not there — the same
+defect as a stub, further from the user's eye.
+
+Before claiming done, run `checkDrift` from `lib/gates/drift.mjs` against **this
+task's own artifacts** (PLAN.md, spec tree, design doc) and put its status in the
+delivery report; the invocation is in 06f, section 5.
+
+What the drift check deliberately does **not** do (and why a check that produces
+permanent noise gets switched off) is in 06f, section 5.
 
 ## Active process (enforced by the harness)
 
@@ -93,14 +77,36 @@ Three things this deliberately does **not** do:
   scratch do not.
 - **Floor:** a passing test run that started after the last change (a lint is not
   a test); a spec met this run needs `trace.outcome` + `trace.codePath`.
-- A gap is steered once, never twice; unclosable gaps are reported **unverified**.
-  Park only for: plan approval, irreversible step, credential, deliverable choice.
+- A **warranted** gap (one you can close) is re-raised until closed — no ceiling on
+  real work. An **unwarranted** one (only a human, or a pi slash command, can close
+  it) is reported **unverified** and never blocks: that was the 2026-11-07 loop.
 - Always refused, even under `/asf passive`: secret in a tracked file, push without
   full-suite green, destructive git on a dirty tree.
 - `/asf passive` = this run only. `/asf abort` ends a run; deleting state does not.
 
+## Waiting is not a disposition
+
+Four things may halt a run: plan approval, an irreversible step, a credential, a
+deliverable choice. **"The other side has not replied" is not one of them.** Never
+leave tracked work — a claimed ticket, an assigned issue — in an intermediate state
+with an explanation of why it is stuck: that is a stop wearing a status report, and
+the run may not close on it (06f carries the case that proved it).
+
+Three dispositions, all yours to take:
+
+1. **Park it where a reviewer sees it** (needs-input). Parking is a *marker*, not a
+   question — "don't ask me anything" never forbids it.
+2. **Take the next action you control, now.** There is always one.
+3. **Waiting on someone else? Make the wait end in one step** — the test that will
+   confirm the outcome, the draft mail, the check you can run today — then keep going.
+
+A claimed item with no disposition is a gap like any other; narrating a wait in a
+progress message raises it on the spot.
+
 ## Definition of Done — completeness
 
+- [ ] No claimed/tracked item left without a disposition: resolved, parked, or acted on.
+
 - [ ] No stub, unimplemented path, placeholder or fabricated data remains on a
       user-reachable path — or it is declared to the user with the reason.
 - [ ] Every part of the ask is reachable from where the user enters it; the delivery

package/skills/aia-asf/references/07-release.md

@@ -63,6 +63,13 @@ in the absence of a user definition.
    - **Deployed app:** smoke-test in **production** (health endpoint, key user journey) — a deploy that breaks prod is not a successful release.
    - **Not applicable** (internal-only experiment, no runtime surface): say so explicitly in the report (06b Rule 11).
    - If the published artifact is broken: **fix forward** (new patch), never pretend the release succeeded.
+   - **The copy you are testing may not be the copy you shipped.** `pi` loads extensions once at
+     process start: a session that was already open keeps enforcing the *previous* version's
+     gates no matter what you publish, and its messages quote text that no longer exists in the
+     source. Before concluding a released gate is broken, confirm which build is loaded — compare
+     a string unique to the new release against the behaviour you saw, and check the process
+     start time (`ps -o lstart -p <pid>`). `/reload`, or a new session, is what picks up the new
+     code. This is the difference between "the fix did not work" and "the fix is not running".
 
 ## CI/CD offer
 
@@ -79,3 +86,4 @@ After a successful release (or for a new project), **offer** to set up a CI/CD p
 - The version in package.json, the git tag, and the npm release must match
 - If publishing fails partway, fix forward; never publish a second version with the same number
 - **Test on publish / in production, if applicable — always** (step 7)
+- **Never diagnose a gate from a session that predates the release** — confirm the loaded build first (step 7)