test: accept prose-AUQ visible as third valid surface in plan-mode envelopes

The first re-run after wiring the LLM judge revealed that the model also
emits a third surface I hadn't anticipated: a properly-formatted question
with options ("Pick A, B, or C in your reply") rendered as prose AND
followed by ExitPlanMode (outcome=plan_ready). The migrated tests only
accepted (## Decisions section) OR (BLOCKED string) — neither matched
this case, so the test failed even though the user clearly saw the
question.

Three valid surfaces now:
  1. `## Decisions to confirm` section in plan file (legacy fallback path,
     still valid through migration window)
  2. `BLOCKED — AskUserQuestion` string in TTY (post-v1.28 BLOCKED rule)
  3. Numbered/lettered options visible in TTY as prose (post-v1.28 prose
     rendering — uses the existing isProseAUQVisible detector)

Also fixes assertReportAtBottomIfPlanWritten to be tolerant of:
  - Missing files (path detected from TTY but file not persisted) — was
    throwing ENOENT on plan_design_plan_mode and plan_ceo_plan_mode test 1
  - 'asked' outcome (smoke test exited at first AUQ before the model
    reached the report-writing step) — was throwing on the 1 fail in the
    plan-eng-plan-mode --disallowedTools test

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test/helpers/claude-pty-runner.ts

@@ -1034,9 +1034,22 @@ export function assertReviewReportAtBottom(
  * `'wrote_findings_before_asking'` when a plan was already written.
  */
 export function assertReportAtBottomIfPlanWritten(
-  obs: { planFile?: string; evidence: string },
+  obs: { planFile?: string; evidence: string; outcome?: string },
 ): void {
   if (!obs.planFile) return;
+  // Skip when the plan file path was detected from TTY output but no file
+  // exists on disk. This happens when the model mentions a path mid-stream
+  // (e.g., as a tool-call argument that was interrupted, or in a draft that
+  // was never persisted). The report-at-bottom contract is for fully-written
+  // plan files; ENOENT means there's no file content to enforce against.
+  if (!fs.existsSync(obs.planFile)) return;
+  // Skip on 'asked' outcomes — these are smoke tests that exited at the
+  // first AUQ render (Step 0 only). The model never reached the workflow's
+  // report-writing step, so a partial plan file without the report section
+  // is the expected mid-flight state, not a contract violation. The
+  // report-at-bottom check applies to outcomes that imply the workflow
+  // ran end-to-end (plan_ready, completion_summary, etc.).
+  if (obs.outcome === 'asked') return;
   const content = fs.readFileSync(obs.planFile, 'utf-8');
   const verdict = assertReviewReportAtBottom(content);
   if (!verdict.ok) {

test/skill-e2e-autoplan-auto-mode.test.ts

@@ -31,7 +31,11 @@
  */
 
 import { describe, test, expect } from 'bun:test';
-import { runPlanSkillObservation, planFileHasDecisionsSection } from './helpers/claude-pty-runner';
+import {
+  runPlanSkillObservation,
+  planFileHasDecisionsSection,
+  isProseAUQVisible,
+} from './helpers/claude-pty-runner';
 
 const shouldRun = !!process.env.EVALS && process.env.EVALS_TIER === 'gate';
 const describeE2E = shouldRun ? describe : describe.skip;
@@ -56,7 +60,14 @@ describeE2E('autoplan AskUserQuestion-blocked smoke (gate)', () => {
       timeoutMs: 300_000,
     });
 
+    // The user must SEE the question one way or another. Three valid surfaces:
+    //   1. `## Decisions to confirm` section in the plan file (legacy fallback path)
+    //   2. `BLOCKED — AskUserQuestion` string visible in TTY (post-v1.28 BLOCKED rule)
+    //   3. Numbered/lettered options visible in TTY as prose (post-v1.28 prose-AUQ rendering)
+    // If NONE of these are present, the question was silently buried.
     const blockedVisible = /BLOCKED\s*[—-]\s*AskUserQuestion/i.test(obs.evidence);
+    const proseAUQVisible = isProseAUQVisible(obs.evidence);
+    const surfaceVisible = blockedVisible || proseAUQVisible;
 
     if (
       obs.outcome === 'auto_decided' ||
@@ -70,17 +81,17 @@ describeE2E('autoplan AskUserQuestion-blocked smoke (gate)', () => {
           `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
       );
     }
-    if (obs.outcome === 'exited' && !blockedVisible) {
+    if (obs.outcome === 'exited' && !surfaceVisible) {
       throw new Error(
-        `autoplan AskUserQuestion-blocked regression: outcome=exited without BLOCKED — AskUserQuestion string in TTY. Model quit silently instead of surfacing the failure mode.\n` +
+        `autoplan AskUserQuestion-blocked regression: outcome=exited without any visible question surface (no BLOCKED string, no prose-rendered AUQ options). Model quit silently.\n` +
           `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
       );
     }
     if (obs.outcome === 'plan_ready') {
       const decisionsOk = obs.planFile && planFileHasDecisionsSection(obs.planFile);
-      if (!decisionsOk && !blockedVisible) {
+      if (!decisionsOk && !surfaceVisible) {
         throw new Error(
-          `autoplan AskUserQuestion-blocked regression: plan_ready without a "## Decisions" section in ${obs.planFile ?? '<no plan file detected>'} AND no BLOCKED string in TTY — Phase 1 premise gate was silently skipped.\n` +
+          `autoplan AskUserQuestion-blocked regression: plan_ready without any visible question surface (no "## Decisions" section in ${obs.planFile ?? '<no plan file detected>'}, no BLOCKED string, no prose AUQ options) — Phase 1 premise gate was silently skipped.\n` +
             `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
         );
       }

test/skill-e2e-plan-ceo-plan-mode.test.ts

@@ -38,6 +38,7 @@ import {
   runPlanSkillObservation,
   planFileHasDecisionsSection,
   assertReportAtBottomIfPlanWritten,
+  isProseAUQVisible,
 } from './helpers/claude-pty-runner';
 
 const shouldRun = !!process.env.EVALS && process.env.EVALS_TIER === 'gate';
@@ -109,7 +110,13 @@ describeE2E('plan-ceo-review plan-mode smoke (gate)', () => {
       timeoutMs: 300_000,
     });
 
+    // The user must SEE the question one way or another. Three valid surfaces:
+    //   1. `## Decisions to confirm` section in the plan file (legacy fallback)
+    //   2. `BLOCKED — AskUserQuestion` string visible in TTY (post-v1.28 BLOCKED rule)
+    //   3. Numbered/lettered options visible in TTY as prose (post-v1.28 prose-AUQ rendering)
     const blockedVisible = /BLOCKED\s*[—-]\s*AskUserQuestion/i.test(obs.evidence);
+    const proseAUQVisible = isProseAUQVisible(obs.evidence);
+    const surfaceVisible = blockedVisible || proseAUQVisible;
 
     if (
       obs.outcome === 'auto_decided' ||
@@ -123,30 +130,23 @@ describeE2E('plan-ceo-review plan-mode smoke (gate)', () => {
           `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
       );
     }
-    // 'exited' is acceptable ONLY when BLOCKED string is visible (post-fix
-    // path). Without BLOCKED, exited means the model crashed or quit silently.
-    if (obs.outcome === 'exited') {
-      if (!blockedVisible) {
-        throw new Error(
-          `plan-ceo-review AskUserQuestion-blocked regression: outcome=exited without BLOCKED — AskUserQuestion string in TTY. Model quit silently instead of surfacing the failure mode.\n` +
-            `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
-        );
-      }
+    if (obs.outcome === 'exited' && !surfaceVisible) {
+      throw new Error(
+        `plan-ceo-review AskUserQuestion-blocked regression: outcome=exited without any visible question surface (no BLOCKED string, no prose-rendered AUQ options). Model quit silently.\n` +
+          `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
+      );
     }
-    // 'plan_ready' is acceptable when EITHER (legacy) the model wrote a
-    // "## Decisions to confirm" section OR (post-fix) BLOCKED is visible
-    // in the TTY. Neither = silent ExitPlanMode = the regression we catch.
     if (obs.outcome === 'plan_ready') {
       if (!obs.planFile) {
-        if (!blockedVisible) {
+        if (!surfaceVisible) {
           throw new Error(
-            `plan-ceo-review AskUserQuestion-blocked regression: outcome=plan_ready but no plan file path detected and no BLOCKED string in TTY. Cannot verify the model used either the legacy fallback or the post-fix BLOCKED path.\n` +
+            `plan-ceo-review AskUserQuestion-blocked regression: outcome=plan_ready but no plan file path detected, no BLOCKED string, no prose AUQ options. Cannot verify the model used any legitimate path.\n` +
               `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
           );
         }
-      } else if (!planFileHasDecisionsSection(obs.planFile) && !blockedVisible) {
+      } else if (!planFileHasDecisionsSection(obs.planFile) && !surfaceVisible) {
         throw new Error(
-          `plan-ceo-review AskUserQuestion-blocked regression: model wrote ${obs.planFile} without a "## Decisions" section AND no BLOCKED string in TTY. Step 0 was silently skipped.\n` +
+          `plan-ceo-review AskUserQuestion-blocked regression: model wrote ${obs.planFile} without a "## Decisions" section AND no BLOCKED string AND no prose AUQ options in TTY. Step 0 was silently skipped.\n` +
             `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
         );
       }

test/skill-e2e-plan-design-plan-mode.test.ts

@@ -13,6 +13,7 @@ import { describe, test, expect } from 'bun:test';
 import {
   runPlanSkillObservation,
   assertReportAtBottomIfPlanWritten,
+  isProseAUQVisible,
 } from './helpers/claude-pty-runner';
 
 const shouldRun = !!process.env.EVALS && process.env.EVALS_TIER === 'gate';
@@ -59,7 +60,11 @@ describeE2E('plan-design-review plan-mode smoke (gate)', () => {
       timeoutMs: 300_000,
     });
 
+    // Surface visibility check (same as ceo / autoplan migrations): user
+    // must SEE the question via BLOCKED string OR prose-rendered AUQ options.
     const blockedVisible = /BLOCKED\s*[—-]\s*AskUserQuestion/i.test(obs.evidence);
+    const proseAUQVisible = isProseAUQVisible(obs.evidence);
+    const surfaceVisible = blockedVisible || proseAUQVisible;
 
     if (
       obs.outcome === 'auto_decided' ||
@@ -73,9 +78,9 @@ describeE2E('plan-design-review plan-mode smoke (gate)', () => {
           `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
       );
     }
-    if (obs.outcome === 'exited' && !blockedVisible) {
+    if (obs.outcome === 'exited' && !surfaceVisible) {
       throw new Error(
-        `plan-design-review AskUserQuestion-blocked regression: outcome=exited without BLOCKED — AskUserQuestion string in TTY. Model quit silently instead of surfacing the failure mode.\n` +
+        `plan-design-review AskUserQuestion-blocked regression: outcome=exited without any visible question surface (no BLOCKED string, no prose-rendered AUQ options). Model quit silently.\n` +
           `--- evidence (last 2KB visible) ---\n${obs.evidence}`,
       );
     }