fix(gate): stop treating stdout text as failure; cap finish-the-work blocks

[trac3r00]

Two independent defects in the observation gate, both found while QA'ing a fresh 2.1.1 install alongside other hook-heavy plugins. Fixes #19.

1. detect_failure() treats stdout text as a failure signal

detect_failure() runs on every Bash/Edit/Write. When no structured exit signal is present it matches FAILURE_RE (failed|failure|\berror:|traceback|...) against response_text(), which joins stdout, stderr, output, message, text, content, error, summary.

Command output lands in stdout — so reading or grepping any source that discusses errors is classified as encountering one, and the gate emits:

fablize gate observed a tool failure. Do not report completion until it is fixed, isolated as a known baseline, or explicitly documented.

This fired 6 times in one session purely from cat/grep over plugin source — including once while writing a markdown document about the bug, because the document contains the word "failure". False failures also accumulate in ledger["failures"], which drives repeated_failure(), so two unrelated file reads can normalize to the same signature and trigger the silent-recovery disclosure.

Fix. Split the heuristic rather than weakening the regex:

• structured_exit() — reads only success/ok booleans and exit_code/exitCode/returncode/status. Never guesses from text.
• error_stream_text() — collects only stderr/error fields, never stdout.
• detect_failure() — uses the structured signal; falls back to stderr-only matching when none exists.

exit_success() and verification_record() are deliberately unchanged. The text heuristic is correct there: the command already matched VERIFY_RE, so it is a known test/build/lint run and its stdout genuinely is a verdict.

2. finish-the-work.sh has no cumulative cap

stop_hook_active only alternates block/allow, so it prevents a tight loop but not an unbounded one. A phrasing that keeps tripping the promise regex blocks on every other Stop, indefinitely — measured at 5/5 consecutive stops before the fix.

Both sibling gates already self-limit: gate_stop at MAX_STOP_BLOCKS = 2, context-guard-stop at MAX_BLOCKS = 2. This one was the outlier, and the README acknowledges the regex can fire on declarative offers ("I'll add X if you want"), which is exactly the input that makes an uncapped blocker painful.

Fix. MAX_FINISH_BLOCKS = 2, counted per session in a finish-blocks/ sidecar keyed exactly like ledger_key (sha256(session_id|cwd)[:24]) and honoring FABLIZE_DATA. Kept out of the ledger itself so it cannot corrupt gate_stop state. Counter writes fail open — a counter that can't be persisted must not break the hook.

	stop 1	2	3	4	5
before	BLOCK	BLOCK	BLOCK	BLOCK	BLOCK
after	BLOCK 1/2	BLOCK 2/2	allow	allow	allow

Tests

New tests/test_gate_stream_and_cap.py (10 checks), following the existing standalone-script convention — exits non-zero on mismatch:

detect_failure: stdout must not imply failure
  [OK] read source containing 'failed'/'error:' in stdout
  [OK] grep hitting 'Traceback' inside a log file
  [OK] real failure via structured exit_code=1
  [OK] real failure via stderr, no exit code
  [OK] clean success is not a failure
  [OK] verification_record still reads a failing test run

finish-the-work.sh: cumulative block cap
  [OK] blocks exactly twice, then steps aside
  [OK] loop guard still short-circuits
  [OK] honest completion passes
  [OK] question ending passes

RESULT: all pass (10 checks)

Existing suites all still pass (test_gate.py 6/6 scenarios with S2/S3 still caught, test_gate_robustness.py 12 checks, test_recovery.py).

Note for anyone running these: they're standalone scripts, not pytest modules — pytest tests/ hits an INTERNALERROR because test_gate_robustness.py:109 calls sys.exit() at import. Run them directly (python3 tests/test_gate.py). Happy to add a tiny runner script if that'd be useful.

Not changed

FAILURE_RE itself is untouched. Tightening the pattern would have been the smaller diff but the wrong fix — the problem isn't which words it matches, it's which stream it reads.