@cleocode/goal 0.9.2 → 0.9.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.9.4 — 2026-10-28
+
+- **Fixed — a contract locked before a validator tightening no longer bricks its run (D10).** A run whose locked generation carries a key the current validator rejects (the reported case: a free-text `budget.rationale` locked under 0.9.2) used to be unresumable: resume called it read-only, `goal_propose_amendment` claimed the disk differed, and `goal_recover_divergence` correctly said nothing differed. The locked bytes are now read leniently **only** to form the prior side of a repair amendment, the repair can be staged and owner-reviewed, and the resume refusal names the failing key and the exact `goal_propose_amendment` call instead of a generic read-only message. Strict validation of new and repaired contracts is unchanged.
+- **Fixed — divergence detection reaches recovery even when the disk copy is invalid.** Differing bytes are a divergence; recovery now explains an invalid edit rather than reporting "nothing to recover" from a path that also refuses to stage.
+
+## 0.9.3 — 2026-10-28
+
+- **Fixed — uncommitted work in a linked worktree now counts as progress (T116).** The fingerprint already covered a linked worktree's commits; it now also hashes each linked worktree's staged/unstaged diff and untracked sizes/mtimes. A run that works only in `.worktrees/<slug>` no longer records `changed:false` and auto-pauses as stalled. Measured cost on this repo with 6 worktrees: ~200 ms per fingerprint.
+- **Renamed to open-goal.** The GitHub repo, package metadata, README/AGENTS instructions, plugin id and RPC id are now `open-goal` (was `opencode-goal`). The npm package name stays `@cleocode/goal`; the goal-format schema ids (`opencode-goal/provenance/v1`, `opencode-goal/handoff/v1`) are unchanged on purpose so existing evidence still verifies. Install identity matching still accepts the old git spec and plugin id, so upgrading replaces the old entry instead of running both. GitHub redirects the old repo URL; new links use `kryptobaseddev/open-goal`.
+- **Fixed — an unknown `budget` key no longer fails open (D9).** The parser recognised only `turns`, `wall`, `tokens` and `cost_usd` and silently dropped anything else, so a contract written with `max_turns`/`max_tokens`/`max_cost_usd` ran with no budget at all and every "raise the budget" amendment was a no-op. Unknown keys are now a validation error naming the allowed keys, and a non-mapping `budget` is an error too.
+- **Fixed — the turn backstop is no longer reported as an exhausted budget (D9).** A run with no `budget.turns` still stops at the 200-turn backstop, but it now stops with its own `backstop_limited` status, decision kind and ledger event, and every surface (banner, action-required line, quick actions, post-goal summary) names the real remedy: set `budget.turns`. Previously the status said `budget_limited` while the header said "no budget set", which cost one live goal five owner round-trips.
+
 ## 0.9.2 — 2026-10-17
 
 - **First installable release through Trusted Publishing (OIDC).** `release.yml` rebuilt the Node bundle first and then published `@cleocode/goal@0.9.2` with a signed provenance statement. `0.9.0` was a manual publish whose registry package metadata was not readable/installable; `0.9.1` was tagged but its committed bundle was stale and the workflow refused it. **No engine behaviour changed.**

package/README.md

@@ -1,8 +1,10 @@
-# opencode-goal
+# open-goal (CLEO Goal plugin)
 
 Persistent, host-verified goal mode for [OpenCode 2](https://opencode.ai). Describe what you want, let the bundled **write-goal** interview turn it into a structured contract, and the plugin keeps the session working until the host — not the model — proves every criterion.
 
-> **Status: released (`v0.5.0`).** Engine, verification and TUI are built and tested end to end against OpenCode 2.0.22 with a scripted model, and each release is proven from its own installed git tag. CLEO integrates as an optional first-class citizen (`/goal cleo`). See [docs/HANDOFF.md](docs/HANDOFF.md).
+> **Status: released (`0.9.4` on npm as `@cleocode/goal`).** Engine, verification and TUI are built and tested end to end against OpenCode 2.0.22 with a scripted model, and each release is proven from its own installed tag. CLEO integrates as an optional first-class citizen (`/goal cleo`). See [docs/HANDOFF.md](docs/HANDOFF.md).
+>
+> **Name:** this project is **open-goal** (repo `kryptobaseddev/open-goal`). It was called `opencode-goal` until 2026-10; the GitHub repo redirects the old URL, and the agent mailbox is **`open-goal-lead@macbook`**. Use `open-goal` in new code, docs, mail and instructions — not `opencode-goal`.
 
 ## Why another goal plugin
 
@@ -36,10 +38,10 @@ Or install it for every project through OpenCode itself (this writes the user-gl
 ```bash
 opencode plugin add "@cleocode/goal@<version>"
 opencode reload
-opencode plugin list        # opencode-goal should be listed
+opencode plugin list        # open-goal should be listed
 ```
 
-Pin a version. A git tag still works as a spec: `github:kryptobaseddev/opencode-goal#v<version>`.
+Pin a version. A git tag still works as a spec: `github:kryptobaseddev/open-goal#v<version>`.
 
 ### The `cleo-goal` bin
 
@@ -128,7 +130,7 @@ While a goal runs the model cannot edit the contract, files under `.opencode/goa
 Use the object form in your OpenCode config to change defaults:
 
 ```jsonc
-{ "plugins": [{ "package": "github:kryptobaseddev/opencode-goal#v0.5.0", "options": { "stallTurns": 4, "cooldownMs": 3000 } }] }
+{ "plugins": [{ "package": "github:kryptobaseddev/open-goal#v0.5.0", "options": { "stallTurns": 4, "cooldownMs": 3000 } }] }
 ```
 
 `backstopTurns` (200, only when the contract has no turn budget) · `cooldownMs` (1500) · `stallTurns` (3) · `recoveryAt` (2) · `blockerRepeats` (3) · `maxPromptFailures` (3) · `verifierAgent` ("goal-verifier") · `verifierTimeoutMs` (240000) · `liveChecks` (true) · `launchApprovalMs` (600000).

package/dist/cli.js

@@ -6910,7 +6910,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 // package.json
 var package_default = {
   name: "@cleocode/goal",
-  version: "0.9.2",
+  version: "0.9.4",
   description: "CLEO Goal: persistent, host-verified goal mode for OpenCode 2 (and any harness through cleo-goal tick), with a structured goal contract and a live TUI.",
   type: "module",
   license: "MIT",
@@ -6966,9 +6966,9 @@ var package_default = {
   ],
   repository: {
     type: "git",
-    url: "git+https://github.com/kryptobaseddev/opencode-goal.git"
+    url: "git+https://github.com/kryptobaseddev/open-goal.git"
   },
-  homepage: "https://github.com/kryptobaseddev/opencode-goal#readme",
+  homepage: "https://github.com/kryptobaseddev/open-goal#readme",
   keywords: [
     "opencode",
     "opencode-plugin",
@@ -6986,7 +6986,7 @@ var package_default = {
     yaml: "2.8.1"
   },
   bugs: {
-    url: "https://github.com/kryptobaseddev/opencode-goal/issues"
+    url: "https://github.com/kryptobaseddev/open-goal/issues"
   }
 };
 
@@ -6996,7 +6996,7 @@ import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 var INSTALL_SCHEMA_VERSION = 1;
 var PACKAGE_NAME = "@cleocode/goal";
-var IDENTITIES = [PACKAGE_NAME, "github:kryptobaseddev/opencode-goal", "opencode-goal"];
+var IDENTITIES = [PACKAGE_NAME, "github:kryptobaseddev/open-goal", "github:kryptobaseddev/opencode-goal", "open-goal", "opencode-goal"];
 var PROJECT_CONFIG = join(".opencode", "opencode.json");
 
 class InstallError extends Error {
@@ -7408,7 +7408,17 @@ function parseContract(text, options = {}) {
   }
   if (hasCycle(plan))
     err("plan", "step dependencies form a cycle");
+  const BUDGET_KEYS = ["turns", "wall", "tokens", "cost_usd"];
+  if (raw.budget !== undefined && !isRecord(raw.budget))
+    err("budget", `budget must be a mapping with ${BUDGET_KEYS.join(", ")}`);
   const budgetRaw = isRecord(raw.budget) ? raw.budget : {};
+  for (const key of Object.keys(budgetRaw)) {
+    if (BUDGET_KEYS.includes(key))
+      continue;
+    if (options.tolerateUnknownBudgetKeys)
+      continue;
+    err(`budget.${key}`, `unknown key; allowed: ${BUDGET_KEYS.join(", ")}`);
+  }
   const budget = {};
   if (budgetRaw.turns !== undefined) {
     const turns = Number(budgetRaw.turns);
@@ -7718,15 +7728,11 @@ function git(cwd, args) {
   return { ok: result.status === 0, out: result.stdout ?? "" };
 }
 var isRepo = (cwd) => git(cwd, ["rev-parse", "--is-inside-work-tree"]).out.trim() === "true";
-function worktreeSignature(cwd) {
-  return git(cwd, ["worktree", "list", "--porcelain"]).out.split(`
-`).map((line) => line.trim()).filter(Boolean).join(`
-`);
-}
-function fingerprint(cwd) {
-  if (!isRepo(cwd))
-    return;
-  const head = git(cwd, ["rev-parse", "HEAD"]).out;
+var topLevel = (cwd) => {
+  const r = git(cwd, ["rev-parse", "--show-toplevel"]);
+  return r.ok ? r.out.trim() : undefined;
+};
+function treeState(cwd) {
   const diff = git(cwd, ["diff", "HEAD", "--no-color", "--", ".", GOAL_STATE]).out;
   const untracked = git(cwd, ["ls-files", "--others", "--exclude-standard", "--", ".", GOAL_STATE]).out;
   const contents = untracked.split(`
@@ -7738,8 +7744,31 @@ function fingerprint(cwd) {
       return file;
     }
   });
-  return createHash2("sha256").update(head).update(diff).update(contents.join(`
-`)).update(worktreeSignature(cwd)).digest("hex").slice(0, 20);
+  return createHash2("sha256").update(diff).update(contents.join(`
+`)).digest("hex").slice(0, 20);
+}
+function worktreeSignature(cwd) {
+  const self = topLevel(cwd) ?? cwd;
+  const blocks = git(cwd, ["worktree", "list", "--porcelain"]).out.split(/\n\s*\n/).map((b) => b.trim()).filter(Boolean);
+  return blocks.map((block) => {
+    const lines = block.split(`
+`).map((line) => line.trim()).filter(Boolean);
+    const path = lines.find((line) => line.startsWith("worktree "))?.slice("worktree ".length);
+    if (!path)
+      return block;
+    if (path === self)
+      return block;
+    return `${block}
+${treeState(path)}`;
+  }).join(`
+
+`);
+}
+function fingerprint(cwd) {
+  if (!isRepo(cwd))
+    return;
+  const head = git(cwd, ["rev-parse", "HEAD"]).out;
+  return createHash2("sha256").update(head).update(treeState(cwd)).update(worktreeSignature(cwd)).digest("hex").slice(0, 20);
 }
 function changedSince(cwd, base) {
   if (!isRepo(cwd))
@@ -8118,7 +8147,9 @@ function decide(state, signals, limits) {
   if (signals.budgetRatio >= 1 || signals.backstop) {
     if (!state.wrapup)
       return { kind: "admit", tail: "wrapup" };
-    return { kind: "stop", status: "budget_limited", code: "budget", reason: signals.backstop ? `backstop of ${limits.backstopTurns} turns reached` : "budget used" };
+    if (signals.backstop)
+      return { kind: "stop", status: "backstop_limited", code: "backstop", reason: `backstop of ${limits.backstopTurns} turns reached; no contract budget set — set budget.turns to control the run` };
+    return { kind: "stop", status: "budget_limited", code: "budget", reason: "budget used" };
   }
   if (state.counters.noProgress >= limits.stallTurns) {
     if (signals.activeStalled && signals.onStall === "continue")

package/dist/tui.js

@@ -16,7 +16,7 @@ import { createStore, reconcile } from "solid-js/store";
 var anyObject = { type: "object", additionalProperties: true };
 var targetObject = { type: "object", properties: { key: { type: "string", minLength: 1, maxLength: 256 }, lock: { type: "string", minLength: 64, maxLength: 64 }, runId: { type: "string", minLength: 1, maxLength: 128 }, sessionID: { type: "string", minLength: 1, maxLength: 256 } }, required: ["key", "lock"], additionalProperties: false };
 var GoalRpc = {
-  id: "opencode-goal",
+  id: "open-goal",
   methods: {
     provenance: {
       input: { type: "object", properties: { sessionID: { type: "string", minLength: 1, maxLength: 256 } }, additionalProperties: false },
@@ -68,7 +68,7 @@ var GoalRpc = {
         properties: {
           sessionID: { type: "string" },
           slug: { type: "string" },
-          kind: { type: "string", enum: ["needs_review", "paused-after-verdict", "blocked", "budget_limited", "amend-proposed", "supersede-ack", "complete", "start-picker", "owner-operation"] },
+          kind: { type: "string", enum: ["needs_review", "paused-after-verdict", "blocked", "budget_limited", "backstop_limited", "amend-proposed", "supersede-ack", "complete", "start-picker", "owner-operation"] },
           title: { type: "string" },
           message: { type: "string" },
           question: { type: "string" },
@@ -107,6 +107,7 @@ var STATUS = {
   blocked: { icon: "\u26D4", label: "blocked", tone: "error" },
   needs_review: { icon: "\u2691", label: "needs review", tone: "warning" },
   budget_limited: { icon: "\u2298", label: "budget used", tone: "warning" },
+  backstop_limited: { icon: "\u23F1", label: "turn backstop", tone: "warning" },
   complete: { icon: "\u2713", label: "complete", tone: "success" },
   failed: { icon: "\u2717", label: "failed", tone: "error" },
   aborted: { icon: "\u25A0", label: "aborted", tone: "muted" },
@@ -185,6 +186,8 @@ function bannerText(view) {
       return { text: `\u25CE ${st.icon} Goal needs review \u2014 ${view.reason ?? ""} \xB7 /goal approve <id> or ${RESUME}`, tone: "warning" };
     case "budget_limited":
       return { text: `\u25CE ${st.icon} Goal stopped at its budget \u2014 raise budget in goal.yaml and /goal start, or /goal abort`, tone: "warning" };
+    case "backstop_limited":
+      return { text: `\u25CE ${st.icon} Goal stopped at the turn backstop \u2014 no budget was set \xB7 set budget.turns in goal.yaml and amend, or /goal abort`, tone: "warning" };
     default:
       return;
   }
@@ -256,6 +259,7 @@ var STATUS2 = {
   blocked: { icon: "\u26D4", label: "blocked", tone: "error" },
   needs_review: { icon: "\u2691", label: "needs review", tone: "warning" },
   budget_limited: { icon: "\u2298", label: "budget used", tone: "warning" },
+  backstop_limited: { icon: "\u23F1", label: "turn backstop", tone: "warning" },
   complete: { icon: "\u2713", label: "complete", tone: "success" },
   failed: { icon: "\u2717", label: "failed", tone: "error" },
   aborted: { icon: "\u25A0", label: "aborted", tone: "muted" },
@@ -325,7 +329,7 @@ function cardAffordanceTab(view, now, width = 40) {
   const truncated = new Set(cardCompactLines(view, now, width).filter((l) => l.tab && l.text.includes("\u2026")).map((l) => l.tab));
   return order.find((t) => truncated.has(t));
 }
-var humanKinds = new Set(["verdict", "approve", "reject", "amend-proposed", "amended", "blocked", "complete", "summary", "flag", "attached", "paused", "resumed", "aborted", "budget_limited", "superseded-by", "approve ", "reject "]);
+var humanKinds = new Set(["verdict", "approve", "reject", "amend-proposed", "amended", "blocked", "complete", "summary", "flag", "attached", "paused", "resumed", "aborted", "budget_limited", "backstop_limited", "superseded-by", "approve ", "reject "]);
 function quickActRows(view) {
   const rows = [];
   if (["running", "waiting", "verifying"].includes(view.status)) {
@@ -344,6 +348,8 @@ function quickActRows(view) {
     rows.push({ label: "Verify now", description: "run the host checks + verifier immediately", act: "verify" });
   } else if (view.status === "budget_limited") {
     rows.push({ label: "Abort the goal", description: "stop at the budget", act: "abort" });
+  } else if (view.status === "backstop_limited") {
+    rows.push({ label: "Abort the goal", description: "stop at the turn backstop", act: "abort" });
   } else if (isTerminalStatus(view.status)) {
     rows.push({ label: "Archive the goal", description: "demote to goals-archive/ (history intact)", act: "archive" });
     rows.push({ label: "Start the next goal", description: "open the write-goal interview", act: "start-next" });
@@ -371,6 +377,9 @@ function decisionRows(view) {
     } else if (view.status === "budget_limited") {
       rows.push({ label: "Raise budget and amend", description: "Describe the budget change in the Composer; review the agent's staged diff" });
       rows.push({ label: "Abort the goal", description: "stop at the budget", act: "abort" });
+    } else if (view.status === "backstop_limited") {
+      rows.push({ label: "Set budget.turns and amend", description: "The run had no budget; name a turn limit in the Composer and review the staged diff" });
+      rows.push({ label: "Abort the goal", description: "stop at the turn backstop", act: "abort" });
     }
   }
   if (view.status === "paused")
@@ -596,7 +605,7 @@ function pointerSelect(control, event, rowHeight) {
 var SIDEBAR_WIDTH = 40;
 var PANEL_NAME = "goal-dashboard";
 var tui_default = {
-  id: "opencode-goal",
+  id: "open-goal",
   async setup(context) {
     const rpc = context.client.rpc(GoalRpc);
     const [views, setViews] = createStore({});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/goal",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "CLEO Goal: persistent, host-verified goal mode for OpenCode 2 (and any harness through cleo-goal tick), with a structured goal contract and a live TUI.",
   "type": "module",
   "license": "MIT",
@@ -56,9 +56,9 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/kryptobaseddev/opencode-goal.git"
+    "url": "git+https://github.com/kryptobaseddev/open-goal.git"
   },
-  "homepage": "https://github.com/kryptobaseddev/opencode-goal#readme",
+  "homepage": "https://github.com/kryptobaseddev/open-goal#readme",
   "keywords": [
     "opencode",
     "opencode-plugin",
@@ -76,6 +76,6 @@
     "yaml": "2.8.1"
   },
   "bugs": {
-    "url": "https://github.com/kryptobaseddev/opencode-goal/issues"
+    "url": "https://github.com/kryptobaseddev/open-goal/issues"
   }
 }

package/skills/write-goal/SKILL.md

@@ -51,7 +51,7 @@ Map the decisions as a tree. Each round, ask the **frontier** — every decision
 Log every question and answer to `decisions.jsonl` (one JSON object per line: `{"t","q","options","a","by":"owner"|"assumed"}`). Anything you decide without asking becomes an `assumptions` entry with a rationale and `reversible` — never a silent default.
 
 ### 4 · Draft `goal.yaml`
-Start from `assets/goal.template.yaml` (or the shape below). Then validate: call `goal_validate({slug})` when the opencode-goal plugin is present and fix every error; otherwise self-check against the rules below. Repeat until clean.
+Start from `assets/goal.template.yaml` (or the shape below). Then validate: call `goal_validate({slug})` when the open-goal plugin is present and fix every error; otherwise self-check against the rules below. Repeat until clean.
 
 ### 5 · Review
 Show the owner the contract compactly: outcome, a table of criteria (id · statement · check), invariants, protected paths, non-goals, budget. Ask: **Approve** (Recommended) / Revise criteria / Revise scope / Save as draft.
@@ -181,7 +181,7 @@ stop:
 
 Check kinds: `command` (`run`, `expect: {exit | stdout_contains | stdout_regex}`, `timeout` s, `runs`, `live`) · `file` (`path`, `exists`) · `contains` (`path`, `text`|`regex`) · `absent` (`pattern`, `paths`) · `diff` (`paths` unchanged since start) · `verifier` (`ask`: judged by a read-only verifier that must quote files) · `human` (`ask`: owner sign-off).
 
-Optional blocks: `why`, `scope {in, out}`, `constraints`, `budget {turns, wall: "3h", tokens: "3M", cost_usd}`, `autonomy {questions: defer|allow, on_user_message: steer|pause, on_interrupt: pause|resume-on-message}`, `verification {mode: host|host+verifier|strict, max_rejections}` (default `host+verifier`, 3).
+Optional blocks: `why`, `scope {in, out}`, `constraints`, `budget {turns, wall: "3h", tokens: "3M", cost_usd}`, `autonomy {questions: defer|allow, on_user_message: steer|pause, on_interrupt: pause|resume-on-message}`, `verification {mode: host|host+verifier|strict, max_rejections}` (default `host+verifier`, 3). The budget keys are exactly `turns`, `wall`, `tokens` and `cost_usd`; any other key (`max_turns`, `max_tokens`, …) is a validation error, and a contract with no `turns` is still capped by a 200-turn backstop (reported as `backstop_limited`, not as an exhausted budget).
 
 Rules the validator enforces: `schema: goal/v1`; `id` equals the directory; `intent.verbatim`, `outcome`, ≥1 `non_goals` and ≥1 essential criterion are required; ids are `C1…`, `I1…`, `S1…`, `A1…` and unique; every criterion has a check of a known kind with its required fields; invariants are host-checkable; plan references exist and have no cycles; budgets parse. Warnings: an outcome that reads as an activity ("keep improving…"), vague words without a number ("fast", "robust", "clean"), no host-checkable essential criterion. **Quote any value containing `: `** with single quotes. Keep every `command` check on a **single line**: YAML folded scalars (`>-`) fold equally-indented lines but keep literal newlines before more-indented ones, so a loop body written on its own line becomes a separate shell command at verify time. Rehearse each command check exactly as stored (extract it from the parsed YAML, run it through the login shell) before claiming.
 

package/skills/write-goal/references/goal-schema.md

@@ -20,7 +20,7 @@ The plugin's parser (`src/contract/parse.ts` in opencode-goal) is the source of
 | `protect` | no | globs the worker may not edit; enforced before edits and re-checked at verification |
 | `assumptions` | no | ids `A1…`; `status` assumed (default) / confirmed / vetoed |
 | `plan` | no | ids `S1…`; `proves` must reference criteria; `depends_on` must reference steps; no cycles |
-| `budget` | no | `turns` (int), `wall` ("90m", "3h", "1h30m"), `tokens` (400k, "3M"; spend across the run), `cost_usd` |
+| `budget` | no | `turns` (int), `wall` ("90m", "3h", "1h30m"), `tokens` (400k, "3M"; spend across the run), `cost_usd`. Exactly these keys: any other key is an error, never a silent drop. With no `turns`, the run is capped by a 200-turn backstop that reports `backstop_limited`. |
 | `stop.when`, `stop.escalate_when` | no | shown to the worker; escalation means `goal_block` |
 | `autonomy` | no | `questions` defer (default) / allow · `on_user_message` steer (default) / pause · `on_interrupt` pause (default) / resume-on-message · `amend`: owner-set policy, a list of change classes the agent may apply to its own contract without asking — `timeout` (a check's timeout only), `budget`, `plan` (plan steps and assumptions), `recover` (adopt an in-policy out-of-band disk edit). Default `[]` = owner reviews every change. Criteria statements/checks, protect, scope, verification, stop rules and the policy itself are never agent-applicable. |
 | `verification` | no | `mode` host / host+verifier (default) / strict · `max_rejections` 1-10 (default 3) · `read`: extra folders or files outside the project the verifier may READ (plain paths, relative to the project root; never writable; everything else outside the project stays denied) |
@@ -48,6 +48,6 @@ The plugin's parser (`src/contract/parse.ts` in opencode-goal) is the source of
 
 ## Validator messages
 
-Errors: wrong schema · bad or mismatched id · missing title / intent.verbatim / outcome · no non-goals · no criteria · no essential criterion · criterion id not `C<n>` · missing statement · missing or unknown check kind · missing kind fields (run, path, pattern, paths, ask, text|regex) · invalid regex · non-positive timeout · invariant with a non-host kind · duplicate ids · plan id not `S<n>` · unknown `proves`/`depends_on` · dependency cycle · bad budget values · bad autonomy / verification values · invalid YAML (with a hint for unquoted `: `).
+Errors: wrong schema · bad or mismatched id · missing title / intent.verbatim / outcome · no non-goals · no criteria · no essential criterion · criterion id not `C<n>` · missing statement · missing or unknown check kind · missing kind fields (run, path, pattern, paths, ask, text|regex) · invalid regex · non-positive timeout · invariant with a non-host kind · duplicate ids · plan id not `S<n>` · unknown `proves`/`depends_on` · dependency cycle · bad budget values or unknown budget keys · bad autonomy / verification values · invalid YAML (with a hint for unquoted `: `).
 
 Warnings: title over 80 chars · outcome reads as an activity · vague words without a number (outcome and statements) · no host-checkable essential criterion.

package/src/cli/install.ts

@@ -9,7 +9,7 @@ import { isAbsolute, join, relative, resolve, sep } from "node:path"
 export const INSTALL_SCHEMA_VERSION = 1
 export const PACKAGE_NAME = "@cleocode/goal"
 /** Specs that name this plugin, whatever the version: the npm package and the git repo it was installed from before npm. */
-const IDENTITIES = [PACKAGE_NAME, "github:kryptobaseddev/opencode-goal", "opencode-goal"]
+const IDENTITIES = [PACKAGE_NAME, "github:kryptobaseddev/open-goal", "github:kryptobaseddev/opencode-goal", "open-goal", "opencode-goal"]
 export const PROJECT_CONFIG = join(".opencode", "opencode.json")
 
 type Options = Record<string, unknown>

package/src/contract/parse.ts

@@ -204,7 +204,7 @@ type YamlParse = (text: string) => unknown
 const bunYaml = (globalThis as { Bun?: { YAML?: { parse: YamlParse } } }).Bun?.YAML
 const parseYaml: YamlParse = (text) => (bunYaml ? bunYaml.parse(text) : parseYamlPortable(text))
 
-export function parseContract(text: string, options: { slug?: string } = {}): ParseResult {
+export function parseContract(text: string, options: { slug?: string; tolerateUnknownBudgetKeys?: boolean } = {}): ParseResult {
   const issues: Issue[] = []
   const lock = lockOf(text)
   let raw: unknown
@@ -280,7 +280,22 @@ export function parseContract(text: string, options: { slug?: string } = {}): Pa
   }
   if (hasCycle(plan)) err("plan", "step dependencies form a cycle")
 
+  // D9: the budget block had the same fail-open shape as D6 — an unknown key
+  // such as `max_turns` was silently dropped, leaving no budget at all and a
+  // mysterious 200-turn backstop. Every key is now either recognised or named
+  // in an error.
+  const BUDGET_KEYS = ["turns", "wall", "tokens", "cost_usd"] as const
+  if (raw.budget !== undefined && !isRecord(raw.budget)) err("budget", `budget must be a mapping with ${BUDGET_KEYS.join(", ")}`)
   const budgetRaw = isRecord(raw.budget) ? raw.budget : {}
+  for (const key of Object.keys(budgetRaw)) {
+    if ((BUDGET_KEYS as readonly string[]).includes(key)) continue
+    // The default is a hard error (D9: a typo must not silently remove the
+    // budget). The repair path opts in to tolerating metadata keys so a
+    // contract locked under an older, laxer validator can still be read and
+    // amended forward instead of bricking its run.
+    if (options.tolerateUnknownBudgetKeys) continue
+    err(`budget.${key}`, `unknown key; allowed: ${BUDGET_KEYS.join(", ")}`)
+  }
   const budget: Budget = {}
   if (budgetRaw.turns !== undefined) {
     const turns = Number(budgetRaw.turns)

package/src/engine/decisions.ts

@@ -1,7 +1,7 @@
 import type { EngineMessage } from "../server/messages"
 import { OwnerReviewStore, type ReviewChoice, type ReviewRequest } from "./owner-reviews"
 
-export type DecisionKind = "needs_review" | "paused-after-verdict" | "blocked" | "budget_limited" | "amend-proposed" | "supersede-ack" | "complete" | "start-picker" | "owner-operation"
+export type DecisionKind = "needs_review" | "paused-after-verdict" | "blocked" | "budget_limited" | "backstop_limited" | "amend-proposed" | "supersede-ack" | "complete" | "start-picker" | "owner-operation"
 export type DecisionTarget = { slug: string; runId?: string; sessionID?: string; lock: string; status: string }
 export type DecisionRequest = ReviewRequest & {
   kind: DecisionKind

package/src/engine/loop.ts

@@ -57,7 +57,7 @@ export type LoopAction =
   | { kind: "verify" }
   | { kind: "admit"; tail: TailKind }
   | { kind: "schedule"; tail: TailKind; delayMs: number; waiting?: { reason: string } }
-  | { kind: "stop"; status: Status; code: "blocked" | "stalled" | "budget" | "wrapup"; reason: string }
+  | { kind: "stop"; status: Status; code: "blocked" | "stalled" | "budget" | "backstop" | "wrapup"; reason: string }
 
 /**
  * The one decision. Ordering mirrors the adapter exactly:
@@ -78,7 +78,12 @@ export function decide(state: RunState, signals: LoopSignals, limits: LoopLimits
   if (signals.budgetRatio >= 1 || signals.backstop) {
     // One wrap-up turn is admitted before the run stops for the owner.
     if (!state.wrapup) return { kind: "admit", tail: "wrapup" }
-    return { kind: "stop", status: "budget_limited", code: "budget", reason: signals.backstop ? `backstop of ${limits.backstopTurns} turns reached` : "budget used" }
+    // D9: a backstop stop is NOT an exhausted budget. It means no contract
+    // budget was set at all, so it gets its own status and a reason that names
+    // the remedy instead of pretending the owner's budget ran out.
+    if (signals.backstop)
+      return { kind: "stop", status: "backstop_limited", code: "backstop", reason: `backstop of ${limits.backstopTurns} turns reached; no contract budget set — set budget.turns to control the run` }
+    return { kind: "stop", status: "budget_limited", code: "budget", reason: "budget used" }
   }
   if (state.counters.noProgress >= limits.stallTurns) {
     // Owner-set policy: a genuinely stalled-but-active run may continue with a

package/src/engine/state.ts

@@ -11,6 +11,7 @@ export type Status =
   | "blocked"
   | "needs_review"
   | "budget_limited"
+  | "backstop_limited"
   | "complete"
   | "failed"
   | "aborted"
@@ -140,7 +141,7 @@ export function ownerCan(state: RunState, action: OwnerAction): string | undefin
     case "pause":
       return isActive(state.status) ? undefined : `goal is ${state.status}`
     case "resume":
-      return ["paused", "blocked", "needs_review", "budget_limited"].includes(state.status) ? undefined : `goal is ${state.status}; only a stopped goal can resume`
+      return ["paused", "blocked", "needs_review", "budget_limited", "backstop_limited"].includes(state.status) ? undefined : `goal is ${state.status}; only a stopped goal can resume`
     case "abort":
       return isTerminal(state.status) ? `goal is already ${state.status}` : undefined
     case "verify":

package/src/rpc.ts

@@ -9,7 +9,7 @@ export type { LaunchView } from "./engine/launches"
 const targetObject = { type: "object", properties: { key: { type: "string", minLength: 1, maxLength: 256 }, lock: { type: "string", minLength: 64, maxLength: 64 }, runId: { type: "string", minLength: 1, maxLength: 128 }, sessionID: { type: "string", minLength: 1, maxLength: 256 } }, required: ["key", "lock"], additionalProperties: false } as const
 
 export const GoalRpc = {
-  id: "opencode-goal",
+  id: "open-goal",
   methods: {
     provenance: {
       input: { type: "object", properties: { sessionID: { type: "string", minLength: 1, maxLength: 256 } }, additionalProperties: false },
@@ -61,7 +61,7 @@ export const GoalRpc = {
         properties: {
           sessionID: { type: "string" },
           slug: { type: "string" },
-          kind: { type: "string", enum: ["needs_review", "paused-after-verdict", "blocked", "budget_limited", "amend-proposed", "supersede-ack", "complete", "start-picker", "owner-operation"] },
+          kind: { type: "string", enum: ["needs_review", "paused-after-verdict", "blocked", "budget_limited", "backstop_limited", "amend-proposed", "supersede-ack", "complete", "start-picker", "owner-operation"] },
           title: { type: "string" },
           message: { type: "string" },
           question: { type: "string" },

package/src/server/app.ts

@@ -365,6 +365,18 @@ export class GoalApp {
     return value
   }
 
+  /** T163/D9 repair: a generation locked under an older, laxer validator can
+   *  become unreadable when the validator tightens (for example a free-text
+   *  `budget.rationale` key). The strict parser stays the default; this helper
+   *  is used only to form the "prior" side of a repair amendment so the owner
+   *  can stage a valid generation instead of hand-editing goal.yaml. It
+   *  tolerates unknown `budget.*` keys and nothing else. */
+  private priorContract(text: string, slug: string): Contract | undefined {
+    const strict = parseContract(text, { slug })
+    if (strict.contract) return strict.contract
+    return parseContract(text, { slug, tolerateUnknownBudgetKeys: true }).contract
+  }
+
   private contractOf(state: RunState): Contract | undefined {
     const cached = this.loaded.get(state.slug)
     if (cached && cached.lock === state.lock) return cached.contract
@@ -399,7 +411,10 @@ export class GoalApp {
    * — never infer it from the presence of a pending proposal. */
   private divergenceOf(state: RunState): { diskLock: string; diskText: string } | undefined {
     const disk = this.store.readContract(state.slug)
-    if (!disk?.contract || disk.lock === state.lock) return undefined
+    // Differing bytes are a divergence even when the disk copy does not parse:
+    // recovery must at least be reachable so it can name an invalid edit
+    // instead of reporting "nothing to recover" while staging refuses.
+    if (!disk || disk.lock === state.lock) return undefined
     return { diskLock: disk.lock, diskText: disk.text }
   }
 
@@ -572,7 +587,9 @@ export class GoalApp {
           ? { actionRequired: `blocked on ${state.blocker?.key ?? "owner decision"}: ${state.blocker?.reason ?? state.reason ?? ""}${state.blocker?.needs ? ` — needs ${state.blocker.needs}` : ""}` }
           : state.status === "budget_limited"
             ? { actionRequired: `budget used: raise the budget and amend, or abort (${state.reason ?? ""})` }
-            : {}),
+            : state.status === "backstop_limited"
+              ? { actionRequired: `turn backstop: no contract budget set — set budget.turns and amend, or abort (${state.reason ?? ""})` }
+              : {}),
       amendments: state.amendments.filter((a) => a.status === "proposed").length,
       flags: state.flags.length,
       updatedAt: state.updatedAt,
@@ -586,7 +603,7 @@ export class GoalApp {
 
   /**
    * T045: the post-goal summary, emitted on every complete / needs_review /
-   * budget_limited transition. Built from data the run already has, shown to
+   * budget_limited / backstop_limited transition. Built from data the run already has, shown to
    * the owner (rpc event → TUI dialog) and the agent (one-line transcript
    * notice), and persisted under evidence/ with a ledger event.
    */
@@ -1188,18 +1205,25 @@ export class GoalApp {
       // fresh diff there is not execution or transfer of the old consent.
       if (state.sessionID !== sessionID && this.factsOf(state.sessionID).busy && state.status !== "paused") throw new Error("The selected goal is executing elsewhere; pause it before proposing an amendment")
       const disk = this.store.readContract(state.slug)
-      if (!disk?.contract || disk.lock !== state.lock) throw new Error("Disk contract differs from the locked goal; resolve the existing edit before staging")
+      if (!disk) throw new Error("No goal.yaml on disk for the selected goal")
+      if (disk.lock !== state.lock) throw new Error("Disk contract differs from the locked goal; resolve the existing edit before staging")
+      // D9 repair: when the lock still matches but the current validator now
+      // rejects a metadata key, the locked generation is unreadable. Read it
+      // leniently so the owner can stage a valid repair generation instead of
+      // hitting a wall where propose refuses and recover says nothing differs.
+      const prior = disk.contract ?? this.priorContract(disk.text, state.slug)
+      if (!prior) throw new Error(`The locked contract is invalid and cannot be read for repair:\n${formatIssues(disk.issues)}`)
       const next = parseContract(input.yaml, { slug: state.slug })
       if (!next.contract) throw new Error(`Invalid amendment; current contract unchanged:\n${formatIssues(next.issues)}`)
       if (next.lock === state.lock) throw new Error("Nothing changed; no amendment staged")
-      const diff = amendmentDiff(disk.contract, next.contract)
+      const diff = amendmentDiff(prior, next.contract)
       // Owner-set autonomy: inside the launched policy the agent applies the
       // change itself (journalled, owner-revertible). Anything outside it,
       // including the policy itself, is routed to the owner below.
-      const policy = disk.contract.autonomy.amend
-      const change = classifyChange(disk.contract, next.contract)
+      const policy = prior.autonomy.amend
+      const change = classifyChange(prior, next.contract)
       const allowed = policyAllows(policy, change)
-      if (allowed.ok) return { applied: this.applyByPolicy(sessionID, state, disk.contract, next.contract, next.lock, input.yaml, input.rationale, change.classes, false) }
+      if (allowed.ok) return { applied: this.applyByPolicy(sessionID, state, prior, next.contract, next.lock, input.yaml, input.rationale, change.classes, false) }
       const outsidePolicy = policy.length ? allowed.reasons : []
       // A proposal is not permission to mutate the oracle. Stop the target
       // under its OLD contract while the exact diff is being reviewed.
@@ -1572,18 +1596,28 @@ export class GoalApp {
       const state = this.runs.get(request.targetSessionID)
       const disk = this.store.readContract(request.slug)
       const next = parseContract(request.nextText, { slug: request.slug })
-      if (!state || state.runId !== request.runId || state.lock !== request.lock || isTerminal(state.status) || !disk?.contract || disk.lock !== request.lock || !next.contract || next.lock !== request.nextLock) {
+      // A lock match is what binds the review to this generation; the disk
+      // contract may still be unreadable under a tightened validator when the
+      // reviewed change repairs it (D9 repair path).
+      if (!state || state.runId !== request.runId || state.lock !== request.lock || isTerminal(state.status) || !disk || disk.lock !== request.lock || !next.contract || next.lock !== request.nextLock) {
         this.amendmentReviews.update(request.id, { status: "failed", result: "Target/run/contract changed since review; no amendment applied." })
         this.store.ledger(request.slug, { type: "amendment-resolution-failed", decisionId: request.id, reason: "review binding changed" })
         this.noticeM(request.sessionID, M.amendmentChanged())
         return
       }
+      const prior = disk.contract ?? this.priorContract(disk.text, request.slug)
+      if (!prior) {
+        this.amendmentReviews.update(request.id, { status: "failed", result: "The locked contract is invalid and cannot be read; no amendment applied." })
+        this.store.ledger(request.slug, { type: "amendment-resolution-failed", decisionId: request.id, reason: "locked contract unreadable" })
+        this.noticeM(request.sessionID, M.amendmentChanged())
+        return
+      }
       const reserved = this.amendmentReviews.reserve(request.id)
       if (!reserved) return
       const acceptedAt = Date.now()
       const stopped = structuredClone(state)
       setStatus(stopped, "paused", "owner accepted amendment; resume when ready")
-      const result = amendedState(stopped, disk.contract, next.contract, request.nextLock, `owner accepted decision ${request.id}`, acceptedAt)
+      const result = amendedState(stopped, prior, next.contract, request.nextLock, `owner accepted decision ${request.id}`, acceptedAt)
       const approved = this.amendmentReviews.writeAhead(request.id, { state: result, acceptedAt })
       try {
         const applied = this.store.commitAmendment(approved)
@@ -2557,6 +2591,13 @@ export class GoalApp {
             await this.transcript(state.sessionID, `◎ budget used (${contract.title}). The owner decides: raise the budget in goal.yaml and amend, or abort. Do not start new work.`)
             await this.summarize(state, contract)
             return this.persist(state)
+          case "backstop":
+            setStatus(state, "backstop_limited", action.reason)
+            this.store.ledger(state.slug, { type: "backstop_limited", turns: state.turn, backstopTurns: this.options.backstopTurns })
+            this.decide(state.sessionID, state.slug, "backstop_limited", M.backstopStopped(contract.title, this.options.backstopTurns))
+            await this.transcript(state.sessionID, `◎ turn backstop reached (${contract.title}): no contract budget was set. The owner decides: set budget.turns in goal.yaml and amend, or abort. Do not start new work.`)
+            await this.summarize(state, contract)
+            return this.persist(state)
           case "stalled":
             this.store.ledger(state.slug, { type: "stall", turns: stallTurns, activity: active, reason: stallReason, policy: contract.autonomy.on_stall })
             setStatus(state, "paused", action.reason)
@@ -3078,6 +3119,7 @@ export class GoalApp {
           return { ok: true, message: `Goal paused: ${state.title} — /goal resume · /goal abort` }
         case "resume": {
           if (state.status === "budget_limited") return { ok: false, message: "The goal used its budget. Raise budget in goal.yaml and start a new run, or abort it." }
+          if (state.status === "backstop_limited") return { ok: false, message: "The goal stopped at the turn backstop because no budget was set. Set budget.turns in goal.yaml and amend it, or abort it." }
           // T091: a resume is idempotent — an already-running run journals no
           // second receipt and is not admitted twice.
           if (state.status === "running" && !state.wait) return { ok: true, message: `Goal already running: ${state.title} — /goal status · /goal pause` }
@@ -3169,7 +3211,7 @@ export class GoalApp {
   private async provenance(sessionID?: string): Promise<RuntimeProvenance> {
     const listed: any = await this.ctx.plugin.list({ location: { directory: this.root } } as any)
     const entries = Array.isArray(listed) ? listed : listed?.data ?? []
-    const entry = entries.find((p: any) => p.id === "opencode-goal")
+    const entry = entries.find((p: any) => p.id === "open-goal" || p.id === "opencode-goal")
     const source = entry?.source ?? { type: "unknown" }
     const state = sessionID ? this.runs.get(sessionID) : undefined
     const result: RuntimeProvenance = {
@@ -3570,6 +3612,16 @@ export class GoalApp {
         const divergent = liveGoal && this.divergenceOf(liveGoal)
         if (liveGoal && divergent)
           return { ok: false, actionExecuted: false, target: this.targetOf(liveGoal), message: `${this.divergenceRefusal(liveGoal, divergent)} No ${action} was executed.` }
+        // T163/D9 repair: the locked bytes themselves may fail the CURRENT
+        // validator even though the disk was never edited (a generation locked
+        // by an older, laxer parser). That is not a read-only draft and not a
+        // divergence; name the invalid key and the one supported fix.
+        if (liveGoal) {
+          const disk = this.store.readContract(liveGoal.slug)
+          if (disk && disk.lock === liveGoal.lock && !disk.contract)
+            return { ok: false, actionExecuted: false, target: this.targetOf(liveGoal),
+              message: `The locked contract of "${liveGoal.slug}" is invalid under this plugin version, so no ${action} can run:\n${formatIssues(disk.issues)}\nThe disk bytes ARE the locked generation (SHA256 ${liveGoal.lock.slice(0, 12)}…), so there is nothing to recover. Fix only the named key(s) and stage a validated replacement with goal_propose_amendment {"slug":"${liveGoal.slug}","expectedLock":"${liveGoal.lock}","yaml":"<full corrected goal.yaml>"}; the owner reviews and accepts it, which re-locks the run. No hand-edit and no ${action} was executed.` }
+        }
         return { ok: false, message: "This selected goal is read-only (draft, archived or invalid); review/launch a valid draft instead." }
       }
       const state = [...this.runs.values()].find((s) => s.slug === selected.slug && s.runId === selected.runId) ?? this.store.readRun(selected.slug)

package/src/server/help.ts

@@ -7,7 +7,7 @@ export type HelpFacts = { version: string }
 
 export function goalHelp({ version }: HelpFacts): string {
   return [
-    `# opencode-goal ${version} — the goal loop, for agents and owners`,
+    `# open-goal ${version} — the goal loop, for agents and owners`,
     "",
     "## Commands (owner)",
     "- `/goal new <what you want done>` — the write-goal interview (skill attached; similar-goal probe runs first)",

package/src/server/index.ts

@@ -7,7 +7,7 @@ import { GoalApp } from "./app"
 const instances = new Map<string, GoalApp>()
 
 export default {
-  id: "opencode-goal",
+  id: "open-goal",
   async setup(ctx: Plugin.Context) {
     const key = ctx.location.directory
     const previous = instances.get(key)

package/src/server/messages.ts

@@ -112,6 +112,14 @@ export const M = {
       abort,
       archive,
     ], "question"),
+  // D9: a turn backstop is not an exhausted budget. Say what actually happened
+  // and name the one key that turns it into an owner-set limit.
+  backstopStopped: (title: string, turns: number) =>
+    msg("goal.backstop.stopped", "warning", `Goal stopped at the ${turns}-turn backstop: ${title}. No contract budget was set, so the run had no limit to raise. Set budget.turns in goal.yaml and amend, or abort.`, [
+      { label: "Set budget.turns (amend)", run: "reply in the Composer with `budget: {turns: <n>}`; the agent stages a reviewed amendment" },
+      abort,
+      archive,
+    ], "question"),
   blocked: (key: string, reason: string, needs?: string) =>
     msg("goal.blocked", "warning", `Goal blocked on ${key}: ${reason}${needs ? ` — it needs: ${needs}` : " — only the owner can resolve this"}.`, [
       { label: "Resolve, then resume", run: "/goal resume", act: "resume" },

package/src/summary/build.ts

@@ -78,9 +78,9 @@ export function provenanceSplit(criteria: SummaryCriterion[]): string | undefine
  *  dialog — the full report (criteria, non-goals, findings) stays in `text`. */
 export function buildDigest(s: Omit<PostGoalSummary, "digest" | "text">): string {
   const lines: string[] = []
-  const icon = s.status === "complete" ? "✓" : s.status === "failed" ? "✗" : s.status === "budget_limited" ? "⊘" : "⚑"
+  const icon = s.status === "complete" ? "✓" : s.status === "failed" ? "✗" : s.status === "budget_limited" ? "⊘" : s.status === "backstop_limited" ? "⏱" : "⚑"
   const proven = s.criteria.filter((c) => c.status === "pass").length
-  const terminal = new Set(["complete", "failed", "aborted", "needs_review", "budget_limited"])
+  const terminal = new Set(["complete", "failed", "aborted", "needs_review", "budget_limited", "backstop_limited"])
   const stopped = terminal.has(s.status) ? "loop stopped" : "loop running"
   lines.push(`${icon} ${s.status.replace(/_/g, " ")} · ${proven}/${s.criteria.length} proven · ${s.turns} turn${s.turns === 1 ? "" : "s"} · ${stopped}`)
   lines.push(s.completed)
@@ -124,6 +124,7 @@ export function findingsFromLedger(events: Array<Record<string, unknown>>): Summ
     else if (e.type === "amended") out.push({ kind: "amended", text: `contract amended (generation ${e.generation ?? "?"}): ${e.summary ?? ""}`, at })
     else if (e.type === "amend-proposed") out.push({ kind: "amend-proposed", text: `amendment proposed: ${e.summary ?? ""}`, at })
     else if (e.type === "budget_limited") out.push({ kind: "budget_limited", text: "the run hit its budget", at })
+    else if (e.type === "backstop_limited") out.push({ kind: "backstop_limited", text: `the run hit the ${e.backstopTurns ?? "turn"} backstop because no budget was set`, at })
   }
   return out
 }
@@ -162,6 +163,8 @@ export function buildPostGoalSummary(input: SummaryInput): PostGoalSummary {
     followUps.push("Resolve the review: /goal approve <C#> (final) or /goal reject <C#> <why>, then /goal verify.")
   } else if (state.status === "budget_limited") {
     followUps.push("Raise the budget in goal.yaml and start a new run, or wrap up: /goal archive after aborting.")
+  } else if (state.status === "backstop_limited") {
+    followUps.push("No budget was set, so the run stopped at the turn backstop. Set budget.turns in goal.yaml and amend it, or wrap up: /goal archive after aborting.")
   }
   if (scopeAudit.length) followUps.push("Break the discussed-but-unproven items out into a follow-up goal so they stop riding on this one.")
   followUps.push("Decompose long-running work with CLEO" + (input.cleo ? " (this project is already linked; keep tasks completing with evidence)." : ": this project has no .cleo workspace — installing it gives goals a task board that outlives any single run (the link stays optional and CLI-only)."))
@@ -223,6 +226,9 @@ export function buildPostGoalSummary(input: SummaryInput): PostGoalSummary {
   } else if (state.status === "budget_limited") {
     nextSteps.push("Raise the budget in goal.yaml, then start a new run")
     nextSteps.push("Or wrap up — /goal archive")
+  } else if (state.status === "backstop_limited") {
+    nextSteps.push("Set budget.turns in goal.yaml, then amend the run")
+    nextSteps.push("Or wrap up — /goal archive")
   } else {
     nextSteps.push("Inspect the goal — /goal status")
     nextSteps.push("Start a goal yourself — /goal new <what you want done>")

package/src/tui/dashboard.ts

@@ -22,6 +22,7 @@ const STATUS: Record<string, { icon: string; label: string; tone: Tone }> = {
   blocked: { icon: "⛔", label: "blocked", tone: "error" },
   needs_review: { icon: "⚑", label: "needs review", tone: "warning" },
   budget_limited: { icon: "⊘", label: "budget used", tone: "warning" },
+  backstop_limited: { icon: "⏱", label: "turn backstop", tone: "warning" },
   complete: { icon: "✓", label: "complete", tone: "success" },
   failed: { icon: "✗", label: "failed", tone: "error" },
   aborted: { icon: "■", label: "aborted", tone: "muted" },
@@ -155,7 +156,7 @@ export function cardAffordanceTab(view: GoalView, now: number, width = 40): Dash
   return order.find((t) => truncated.has(t))
 }
 
-const humanKinds = new Set(["verdict", "approve", "reject", "amend-proposed", "amended", "blocked", "complete", "summary", "flag", "attached", "paused", "resumed", "aborted", "budget_limited", "superseded-by", "approve ", "reject "])
+const humanKinds = new Set(["verdict", "approve", "reject", "amend-proposed", "amended", "blocked", "complete", "summary", "flag", "attached", "paused", "resumed", "aborted", "budget_limited", "backstop_limited", "superseded-by", "approve ", "reject "])
 
 /** (T074 sign-off fix) Quick acts: owner actions that ALWAYS make sense for
  *  the goal's current state — the Decisions tab is interactive even when no
@@ -178,6 +179,8 @@ export function quickActRows(view: GoalView): ActionRow[] {
     rows.push({ label: "Verify now", description: "run the host checks + verifier immediately", act: "verify" })
   } else if (view.status === "budget_limited") {
     rows.push({ label: "Abort the goal", description: "stop at the budget", act: "abort" })
+  } else if (view.status === "backstop_limited") {
+    rows.push({ label: "Abort the goal", description: "stop at the turn backstop", act: "abort" })
   } else if (isTerminalStatus(view.status)) {
     rows.push({ label: "Archive the goal", description: "demote to goals-archive/ (history intact)", act: "archive" })
     rows.push({ label: "Start the next goal", description: "open the write-goal interview", act: "start-next" })
@@ -211,6 +214,9 @@ export function decisionRows(view: GoalView): ActionRow[] {
     } else if (view.status === "budget_limited") {
       rows.push({ label: "Raise budget and amend", description: "Describe the budget change in the Composer; review the agent's staged diff" })
       rows.push({ label: "Abort the goal", description: "stop at the budget", act: "abort" })
+    } else if (view.status === "backstop_limited") {
+      rows.push({ label: "Set budget.turns and amend", description: "The run had no budget; name a turn limit in the Composer and review the staged diff" })
+      rows.push({ label: "Abort the goal", description: "stop at the turn backstop", act: "abort" })
     }
   }
   if (view.status === "paused") rows.push({ label: "Resume the goal", description: view.reason ?? "", act: "resume" })

package/src/tui/format.ts

@@ -17,6 +17,7 @@ export const STATUS: Record<string, { icon: string; label: string; tone: Tone }>
   blocked: { icon: "⛔", label: "blocked", tone: "error" },
   needs_review: { icon: "⚑", label: "needs review", tone: "warning" },
   budget_limited: { icon: "⊘", label: "budget used", tone: "warning" },
+  backstop_limited: { icon: "⏱", label: "turn backstop", tone: "warning" },
   complete: { icon: "✓", label: "complete", tone: "success" },
   failed: { icon: "✗", label: "failed", tone: "error" },
   aborted: { icon: "■", label: "aborted", tone: "muted" },
@@ -108,6 +109,8 @@ export function bannerText(view: GoalView): { text: string; tone: Tone } | undef
       return { text: `◎ ${st.icon} Goal needs review — ${view.reason ?? ""} · /goal approve <id> or ${RESUME}`, tone: "warning" }
     case "budget_limited":
       return { text: `◎ ${st.icon} Goal stopped at its budget — raise budget in goal.yaml and /goal start, or /goal abort`, tone: "warning" }
+    case "backstop_limited":
+      return { text: `◎ ${st.icon} Goal stopped at the turn backstop — no budget was set · set budget.turns in goal.yaml and amend, or /goal abort`, tone: "warning" }
     default:
       return undefined
   }

package/src/tui/index.tsx

@@ -20,7 +20,7 @@ const SIDEBAR_WIDTH = 40
 const PANEL_NAME = "goal-dashboard"
 
 export default {
-  id: "opencode-goal",
+  id: "open-goal",
   async setup(context: Context) {
     const rpc = context.client.rpc(GoalRpc as any) as any
     const [views, setViews] = createStore<Record<string, GoalView | null>>({})

package/src/util/git.ts

@@ -27,22 +27,9 @@ export const headCommit = (cwd: string): string | undefined => {
   return r.ok ? r.out.trim() : undefined
 }
 
-/** T116: linked worktrees live under the project but their commits are invisible
- * to the root worktree's diff, so the last goal run recorded changed:false and
- * tripped the stall auto-pause three times. `git worktree list --porcelain`
- * names every worktree's HEAD and branch; a commit in any of them changes it. */
-export function worktreeSignature(cwd: string): string {
-  return git(cwd, ["worktree", "list", "--porcelain"])
-    .out.split("\n")
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .join("\n")
-}
-
-/** Hash of HEAD + staged/unstaged diff + untracked file list + linked-worktree HEADs, excluding goal state. */
-export function fingerprint(cwd: string): string | undefined {
-  if (!isRepo(cwd)) return undefined
-  const head = git(cwd, ["rev-parse", "HEAD"]).out
+/** Hash of one worktree's staged/unstaged diff plus untracked file sizes and
+ *  mtimes, excluding goal state. Same rule the root worktree has always used. */
+function treeState(cwd: string): string {
   const diff = git(cwd, ["diff", "HEAD", "--no-color", "--", ".", GOAL_STATE]).out
   const untracked = git(cwd, ["ls-files", "--others", "--exclude-standard", "--", ".", GOAL_STATE]).out
   const contents = untracked
@@ -57,7 +44,35 @@ export function fingerprint(cwd: string): string | undefined {
         return file
       }
     })
-  return createHash("sha256").update(head).update(diff).update(contents.join("\n")).update(worktreeSignature(cwd)).digest("hex").slice(0, 20)
+  return createHash("sha256").update(diff).update(contents.join("\n")).digest("hex").slice(0, 20)
+}
+
+/** T116: linked worktrees live under the project but their work is invisible to
+ *  the root worktree's diff, so a run recorded changed:false and tripped the
+ *  stall auto-pause. `git worktree list --porcelain` names every worktree; the
+ *  signature now carries HEAD/branch AND the dirty state of each linked
+ *  worktree, so uncommitted work counts as progress too, not only commits.
+ *  The cwd worktree is skipped because `fingerprint` hashes it separately. */
+export function worktreeSignature(cwd: string): string {
+  const self = topLevel(cwd) ?? cwd
+  const blocks = git(cwd, ["worktree", "list", "--porcelain"]).out.split(/\n\s*\n/).map((b) => b.trim()).filter(Boolean)
+  return blocks
+    .map((block) => {
+      const lines = block.split("\n").map((line) => line.trim()).filter(Boolean)
+      const path = lines.find((line) => line.startsWith("worktree "))?.slice("worktree ".length)
+      if (!path) return block
+      if (path === self) return block
+      return `${block}\n${treeState(path)}`
+    })
+    .join("\n\n")
+}
+
+/** Hash of HEAD + staged/unstaged diff + untracked file list + every linked
+ *  worktree's HEAD and dirty state, excluding goal state. */
+export function fingerprint(cwd: string): string | undefined {
+  if (!isRepo(cwd)) return undefined
+  const head = git(cwd, ["rev-parse", "HEAD"]).out
+  return createHash("sha256").update(head).update(treeState(cwd)).update(worktreeSignature(cwd)).digest("hex").slice(0, 20)
 }
 
 /** T109: a bounded, host-computed git history digest. The verifier child has only