apply one-fix audit gaps in plan-task's fix loop instead of asking

CHANGELOG.md

@@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 * MINOR version when you add functionality in a backwards-compatible manner, and
 * PATCH version when you make backwards-compatible bug fixes.
 
+## Unreleased
+
+- feat: `vault-cli:plan-task`'s fix loop now applies a gap that carries a stated fix and no genuine alternative, and asks the operator only for a real fork. It previously put every auditor finding to the operator as an `AskUserQuestion`, so a gap whose only defensible outcome was the one already written down still cost an interrupt — two workers hit it on 2026-10-17, and in both the operator picked the recommended option every time while the goal's manager independently gave the same answers. (A third was reported by the manager but carries no `AskUserQuestion` in its transcript, so it is not counted.) The loop now classifies each gap by one question ("is there a second answer I would defend?"), applies one-fix gaps via `Edit` and reports them as `🔧 Applied: …`, and reserves the question for two-or-more genuine outcomes or an operator-only decision. A gap whose options would read *"(Recommended) do X · 2. do nothing"* is named as a one-fix gap wearing a menu. Applied fixes still re-enter the same `Score: X → Y` cycle and the `≥ 8` gate is unchanged; the record is kept — every applied fix is printed and any that changed a criterion's claim is recorded in the task's `# Progress`, so the classification removes the question and never the audit trail. Three gap classes still always ask: an unevidenced premise (the fix is a read only the operator can vouch for), a misread operator quote, and a scope change. `--non-interactive` is untouched — its short-circuit still edits nothing. Rationale: `agent-cmd/no-user-prompts`, applied to plan-task's own fix loop.
+
 ## v0.169.5
 
 - fix: `vault-cli:work-on-task-assistant` no longer states conclusions from evidence it merely grepped, and its report block list is declared closed. Dispatched 2026-10-17 to find a task and its guides, the agent added an unsanctioned `🔬 Independent read-only corroboration` block asserting the router log held "exactly one request" in a window that held 16 (five PIDs across four builds), and that "the absence of any worker-attributable line means the request did not arrive" — the opposite of the truth, since that router sampler-gates successful requests out of the log while always logging failures. The owning session had to re-derive both claims, and taken at face value they would have inverted the diagnosis. A second rule requires any inference to be marked `(inference — unverified)`: a log the agent did not write may be sampled, truncated, or shared by concurrent writers, and its silence rarely means absence.

commands/execute-task.md

@@ -204,7 +204,7 @@ Task lifecycle:
 
 1. `/vault-cli:create-task` — capture (lenient)
 2. `/vault-cli:work-on-task` — orient (status + guides + daily note), then auto-chain plan → execute (interactive)
-3. `/vault-cli:plan-task` — sharpen (5 hard gates); never flips phase
+3. `/vault-cli:plan-task` — sharpen (9 hard gates); never flips phase
 4. **`/vault-cli:execute-task`** — the sole gate; flips planning → execution + prints first subtask + DoD reminder — this command
 5. Start work — while working, use any of:
    - `/vault-cli:update-task` — log completed work, sync to daily note / parent goal