Autopilot closed loop (advisory + opt-in auto-apply)

Phase G — bounded autopilot stack: `src/lib/autopilot/jobPilotFusion.ts` fuses DAS-cluster-efficiency, TLP traffic-light, screen-out leading-indicator, and live-HM RMSE signals into a single ranked `PilotAction`, with priority ladder shut-in > rate-cut > monitor > advance-stage > hold. Operator-facing surface is `JobPilotPanel` on `/live-pumping` and `/autopilot` (dashboard). Per-action auto-apply is gated by `autopilotPolicyStore.ts` (default ENABLED but auto-apply OFF for every kind; `shouldAutoApply` enforces the shut-in hard-floor, the `maxRateStepBpm` cap, and Phase G inc 17 TLP cross-block — amber/red blocks advance-stage/hold and only permits a rate-cut whose target is strictly LOWER than current). Audit trail is `autopilotAuditLog.ts` (append-only FIFO, cap 200, CSV export via `AUTOPILOT_AUDIT_CSV_HEADERS`); per-source rejection rollup is `autopilotRejectionStats.ts` (auto-applied vs rejected per `PilotSource` over a rolling window, surfaced as the `RejectionHistogramCard` under the audit table). Global kill-switch is `AutopilotKillSwitch.tsx` mounted in `__root.tsx` (⌘⇧K / Ctrl⇧K or double-Escape → flips `policy.enabled = false`, logs an `operator` audit entry tagged `kill-switch:…`, dispatches a `downhole.autopilot.policy.changed` custom event for live re-sync without a page reload). Snapshot bundle is `autopilotSnapshot.ts` (`buildAutopilotSnapshot` + `serializeAutopilotSnapshot` + `buildAutopilotSnapshotCsv` — envelope version `downhole-autopilot-snapshot-v1`, audit tail capped at 50, rollup uses the FULL log over a 24 h default window). **Phase G inc 23 — per-(pad, vendor, kind) cooldown ledger** via `src/lib/autopilot/cooldownLedger.ts` (`makeCooldownLedger` / `cooldownRemainingMs` / `isInCooldown` / `recordCooldown` / `pruneCooldownLedger` / `listCooldownLedger`) gives the proposal bus cross-source debounce: same-key proposals within the per-kind window (default rate-cut 30 s, advance-stage 120 s, monitor 10 s, hold 5 s, shut-in 0 s — safety-critical never debounces) are blocked, while different (padId, vendor, kind) keys remain independent. Operator-overridable `windowMs` per call. **Snapshot envelope extended** to optionally carry the last-N raw `fusionInputs[]` (default tail cap 25) AND the cooldown ledger entries (sorted by key for deterministic serialisation) so post-job replays can re-derive the chosen action without rehydrating DAS/TLP/screen-out/live-HM source streams; both fields absent on the legacy bare-bones snapshot path (byte-identical to pre-inc-23). NEVER mutates pump state; auto-apply is a UI concern routed through the proposal bus. Drift-guards: `autopilotPolicyStore.test.ts` (TLP cross-block + shut-in hard-floor + step cap) + `autopilotRejectionStats.test.ts` (per-source tally + rolling window) + `autopilotSnapshot.test.ts` (10 — envelope shape, audit-tail truncation, rollup-uses-full-log, window honoured, advisory/operator excluded, JSON serialise, CSV embed, note passthrough, **inc-23 fusionInputs tail cap, inc-23 cooldownLedger deterministic flow-through**) + `cooldownLedger.test.ts` (9 — empty-free, shut-in default 0, rate-cut 30 s window, key-independence, override beats default, last-write-wins, prune by maxAge, deterministic list, NaN-clock guard).

Phase G inc 23 promotion CLOSED — per-(pad, vendor, kind) cooldown ledger + fusion-input replay shipped as pure library + snapshot extension. Out of scope: fully unattended autopilot, ML-trained setter policies, multi-pad coordination (lives in `multi-pad-coordination` row). Next wiring PR: hand the proposal bus on `JobPilotPanel` a live `CooldownLedger` ref + the rolling fusion-input ring buffer so the in-app advisory surface debounces visibly and the snapshot Download buttons include the new fields automatically.

• Fully unattended autopilot
• ML-trained setter policies

No phase markers extracted from this row's prose yet.