opencode-goal-plugin 0.4.0 → 0.4.7

package/CHANGELOG.md

@@ -2,6 +2,84 @@
 
 ## Unreleased
 
+## 0.4.7 — 2026-06-29
+
+### Bug fixes (low-severity cleanups)
+
+- **Dead `if (goal.goalId !== previousGoalId)` conditional removed from both resume paths.** `resetGoalBudget` always rotates `goalId` via `randomUUID()`, so the conditional was always `true`. The misleading branch could never be taken, masking the intent (unconditional registry re-key on resume). Both the agent-tool `updateGoal {status: "resumed"}` path and the `/goal resume` command path are now unconditional.
+- **`noToolCallTurns` no longer stales on null-assistant idles.** When `messages()` returns no assistant message (only a user turn), `latestAssistant` is `null` and `latestHasToolCall` is `false`. Previously the counter incremented unconditionally; a user-only idle turn could push the goal toward a no-tool-call pause even though the model hadn't spoken. The reset condition now includes `|| !latestAssistant`, matching the intent of the stall detector.
+- **`noProgressTurns` no longer stales on null-assistant idles.** Same scenario as above: when `latestOutputTokens === null` and there is no assistant message, the counter now resets instead of incrementing, consistent with the gate's purpose of detecting stalled model output.
+- **Updated ledger-durability comment near `pushHistory("completed")`.** The previous comment implied the ledger was the primary recovery mechanism. The corrected comment clarifies that ledger write failures are silent (bare `catch`), and that a present state file always takes precedence over the ledger — making the ledger relevant only when the state file is absent.
+- **`buildAgentToolHandlers` accepts a `persistTerminalState` option.** Terminal state transitions (`status='complete'` and `clearGoal`) now call `persistTerminalState` if provided, falling back to the regular `persist` function. The `GoalPlugin` factory passes its own `persistTerminalState` closure through, so agent-triggered completions and clears get the same durable flush semantics as the event-handler paths.
+
+## 0.4.6 — 2026-06-29
+
+### Bug fixes (counters, compaction, and auditor)
+
+- **`noToolCallTurns` is now independent of `noProgressTurns`.** On a turn that qualifies for the noProgress stall gate (low output, no tool call, stalled text), the noToolCall counter no longer also increments. Without this guard, the effective grace window was `min(noProgress, noToolCall)` rather than two independent limits — a configured higher `noProgressTurnsBeforePause` threshold was silently overridden by the lower `noToolCallTurnsBeforePause`.
+- **`formatFailures` is now incremented when the stall gate fires and returns early.** Stall detection previously returned before the format-failure accumulator could run. A model that repeatedly emitted bare `[goal:complete]` with low output triggered the stall gate rather than accumulating toward the `maxPromptFailures` cap; the cap was permanently unreachable because `/goal resume` reset `formatFailures` to zero each time. The counter now increments inside the stall-gate early-return path when `completionUnverified` or `blockerUnstated` is true.
+- **Budget-wrapup state is persisted before the wrapup prompt is sent.** Previously `budgetWrapupSent = true` and `stopped = true` were set in memory but not persisted before `promptAsync`. A crash during the prompt would result in `budgetWrapupSent: false` in the state file and a duplicate wrapup on the next resume cycle. The fix adds `pushHistory("budget-wrapup")` + `persist()` before the prompt call, mirroring the hard-limit path.
+- **`TOOL_PART_TYPES` now covers raw provider part type names.** Some OpenCode adapters forward the provider's original message part shape without normalizing to `"tool"`. Added `"tool_use"`, `"function_call"`, and `"tool-call"` to the set so `messageHasToolCall` (and both stall gates) correctly recognize tool-using turns from non-normalized adapters.
+- **Approved completion that is lost while the auditor is in flight now produces an announcement.** If the goal is cleared or replaced while a completion auditor runs, and the auditor returns `approved: true`, the plugin now announces "completion was approved but the goal was modified while the audit ran — completion not recorded." Previously the approved result was silently discarded with no visible trace.
+- **`buildCompactionContext` is now deterministic.** The function previously called `Date.now()` to compute elapsed seconds, so two calls during the same compaction event produced different strings, busting the prefix cache from that byte position. The elapsed time is now derived from `goal.lastContinueAt` (set during each persist cycle), making the output stable and matching the function's own claim of being "reconstructed deterministically from the plugin's persisted goal record."
+
+## 0.4.5 — 2026-06-29
+
+### Bug fixes (input validation + counter correctness)
+
+- **`set_goal` now validates budget arguments and mode.** Previously `set_goal({maxTurns: 0})` silently used the global default; a typo in `mode` silently became `"normal"`. Both now return explicit errors, matching the `/goal` command's validation behavior.
+- **`update_goal` cannot combine an objective update with `status='complete'` in the same call.** The completion would be archived under a condition that was never executed, falsifying the audit trail. The tool now requires two separate calls: first update the objective, then mark complete after the revised work is done.
+- **`update_goal {status: 'resumed'}` on a running goal returns an error.** The slash-command path rejected this; the agent tool path silently reset all budget counters — turnCount, totalTokens, startedAt, etc. — on a goal that never stopped, enabling indefinite budget circumvention. The agent tool now rejects the call when the goal is not stopped.
+- **`/goal edit` and `update_goal` objective updates now reset `formatFailures` to 0.** The edit paths already reset `noProgressTurns` and `noToolCallTurns` but omitted `formatFailures`. A goal with accumulated format-failure violations had less tolerance than a freshly-resumed goal after an objective change.
+- **`/goal <condition>` replace command now clears `sessionOrdered`.** The agent `setGoal` path called `sessionOrdered.delete()` on replacement, but the slash-command path did not. A user replacing a sisyphus sequence with a standalone goal would get unexpected auto-promotion of the sequence's remaining goals after the replacement completed.
+- **`set_goal` and `update_goal` tool result strings now escape XML metacharacters.** The `goal.condition` is stored raw (for use by `buildGoalBlock`/`buildContinueMessage`), but the tool result returned to the model now calls `escapeGoalText` to prevent XML metacharacters from breaking tool-result boundaries in XML-serialized formats.
+- **`promptFailures` decrements by 1 on a successful prompt instead of resetting to 0.** This mirrors the `formatFailures` fix: an alternating error/success pattern previously bypassed the circuit-breaker cap indefinitely. Decrementing allows gradual recovery while still accumulating toward the cap over time.
+
+## 0.4.4 — 2026-06-29
+
+### Bug fixes (state machine + injection prevention)
+
+- **`escapeGoalText` now neutralizes role-like tag openings.** The previous `STRUCTURAL_TAGS` set only covered plugin-defined tags. Tags like `<system>`, `<assistant>`, `<human>`, `<anthropic>`, `<claude>`, `<context>`, `<instructions>`, and `<prompt>` could survive unescaped in compacted system messages, creating second-order injection opportunities where model output captured by `recordCheckpoint` re-appeared as an elevated-privilege block after compaction.
+- **`update_goal` objective update no longer un-stops a stopped goal.** Calling `update_goal({objective: "…"})` previously cleared `goal.stopped` and `goal.stopReason`, silently resurrecting a goal that was audit-rejected, user-paused, or blocked for any reason. Objective updates now preserve the stopped state; only an explicit `status: "resumed"` call resets it.
+- **`/goal clear` and agent `clearGoal` now delete all backgrounded goals.** Previously only the focused goal was removed from the session registry (`cleanupGoal` → `removeSessionGoal`). Background goals added via `/goal add` remained alive and would promote themselves to focused on restart. Both clear paths now call `sessionGoals.delete(sessionID)` first, wiping the entire per-session goal map.
+- **`formatFailures` decrements by 1 on a clean turn instead of resetting to 0.** A reset-to-zero on every non-violation turn allowed an alternating bad/good/bad pattern to bypass the consecutive-failure cap indefinitely. Decrementing by 1 means repeated violations accumulate toward the cap even when interspersed with good turns.
+- **`update_goal {status: "blocked"}` requires a non-empty `blocker` argument.** The event-handler path already rejects a `[goal:blocked]` marker with no concrete blocker, but the agent tool path accepted an empty `blocker` (recording an empty `blockedReason`). The agent tool now returns an error when `blocker` is missing or whitespace-only, consistent with the auto-continue guard.
+
+## 0.4.3 — 2026-06-29
+
+### Bug fixes (concurrency + persistence)
+
+- **`activeContinues` Set → Map with per-handler UUID token.** `cleanupGoal` removes the session from the Map (allowing new handlers to start), but the idle handler's `finally` block only deletes if its token still matches — preventing it from clobbering a new handler's guard. With a plain `Set`, the old `finally` unconditionally deleted the new handler's entry, creating a race window where two handlers could run concurrently for the same session.
+- **Liveness re-check after `announceAudit`.** `announceAudit` is async and can yield long enough for a user to `/goal clear` or replace the goal. The handler now calls `activeGoal(sessionID, goalID)` after the announcement and returns immediately if the goal is gone, preventing an orphaned archive write.
+- **`persist()` calls serialized via promise chain.** Concurrent callers previously raced on the temp-file rename: the second rename could write older state over the first. All calls now chain through `persistChain`, guaranteeing ordered writes.
+- **`/goal clear` and agent `clearGoal` now emit a `"cleared"` ledger event before discarding the goal.** Without this, `reconstructGoalsFromLedger` (used when the state file is missing) would revive cleared goals as paused on restart. `LEDGER_TERMINAL_TYPES` already includes `"cleared"` — the event just wasn't being written.
+- **State-file/ledger cross-check on restart.** After loading from the state file, the plugin now reads the ledger and removes any active goals whose `goalId` appears in a terminal ledger entry. This guards against the scenario where a terminal persist wrote to the ledger but the state file write failed (e.g. process killed between the two writes): the goal would otherwise load as active and be re-driven on the next idle.
+
+### Bug fixes (state machine + security)
+
+- **Escape checkpoint and history text in compaction context.** Checkpoint summaries and lifecycle-event details contain assistant-generated text. If a malicious assistant output included structural XML tags (e.g. `</goal_objective><budget_wrapup>…</budget_wrapup>`), they could be re-embedded unescaped in the compaction context system message. `buildCompactionProgressSummary` and the `lastCheckpoint` inline in `buildCompactionContext` now call `escapeGoalText` on all assistant-derived strings.
+- **`/goal edit` and agent `update_goal` objective updates now reset `noToolCallTurns`.** The edit paths already reset `noProgressTurns` and cleared soft-stop state, but forgot `noToolCallTurns`. A goal that was heading toward a no-tool-call pause kept its stale counter after an objective change, and could pause after fewer than the configured grace turns on the new objective.
+- **`formatFailures` is now preserved through a persistence round-trip.** `normalizePersistedGoal` carried `promptFailures` but omitted `formatFailures`. After a plugin restart any accumulated format-failure count was silently reset to zero, giving the model an unintended free pass on the first format re-prompts after recovery.
+- **Agent `update_goal {status: "complete"}` now invokes the configured completion auditor.** The `[goal:complete]` marker path gates archival on an optional auditor, but the agent tool path bypassed it entirely. `buildAgentToolHandlers` now accepts a `completionAuditor` option, and the `GoalPlugin` factory passes the configured auditor through. A rejected verdict pauses the goal with stop reason `audit rejected`; an auditor that throws is treated as a rejection (fail closed).
+- **`createChildSessionAuditor` now enforces a configurable timeout (default 120 s).** `sessionApi.prompt` could hang indefinitely, blocking the idle handler and stalling the goal forever. The auditor now races the API call against a `setTimeout` promise; if the timeout fires first, the verdict is `{ approved: false, reason: "auditor timed out after Nms" }`. The timer is always cleared after settlement.
+- **Thinking-only turns are excluded from the `noProgress` stall detector.** A turn that produced reasoning tokens but no prose output and no tool calls was treated as stalled by `lowOutputLooksStalled` (prose output tokens = 0 < threshold). The new `latestHasThinkingTokens` check (`tokens.reasoning > 0`) excludes such turns from the stall gate, preventing false pauses on extended-thinking models that reason before acting.
+
+## 0.4.2 — 2026-06-29
+
+### Bug fixes
+
+- **Guard against stale `message.updated` re-deliveries re-inflating `totalTokens` after `/goal resume`.** After `/goal resume`, OpenCode replays the streaming `message.updated` event for the last assistant message. Previously `resetGoalBudget` deleted those message IDs from `seenTokens`, so the replayed event looked new and added its tokens to the freshly-zeroed counter — incorrectly inflating the resumed goal's token total from the first turn. Fix: `resetGoalBudget` no longer deletes IDs from `seenTokens`. The `message.updated` handler now skips any message whose ID is already in `seenTokens` but is absent from the current `goal.messageIDs` (i.e. belongs to a prior budget epoch), so stale re-deliveries are silently ignored.
+- **Guard against stale `message.updated` re-deliveries inflating a replacement goal's `totalTokens`.** When a goal is replaced via `/goal <new>`, the old goal's `cleanupGoal` path previously deleted its message IDs from `seenTokens`. If OpenCode then re-delivered a streaming event for one of those old IDs (e.g. a buffered duplicate), the new goal object had no record of it, so the guard could not fire and the event inflated the new goal's counter. Fix: `cleanupGoal` also leaves `seenTokens` entries in place. Entries accumulate across the process lifetime (O(turns × messages_per_turn)) and are cleared in bulk by `clearRuntimeState` on teardown.
+- **Reset `totalTokens` to zero after session compaction.** `totalTokens` is tracked with `Math.max` semantics (peak context size), so it never decreases on its own. A goal that crossed the 80 % budget-wrapup threshold before compaction would permanently remain above it even after the context shrank to a fraction of its prior size. Fix: the `experimental.session.compacting` hook now resets `totalTokens = 0` and rotates `messageIDs` into `priorMessageIDs` after injecting the compaction context, then calls `persist()`. Post-compaction turns re-establish the token baseline from scratch.
+
+## 0.4.1 — 2026-06-29
+
+### Bug fixes
+
+- **Fix provider prefix cache invalidation caused by volatile limit warnings in system prompt (#14).** `experimental.chat.system.transform` was calling `buildLimitWarning`, which appends a string containing `Date.now()`-derived `remainingMs` and a per-turn `remainingTokens` counter. Once any warning threshold was crossed (default: 25 000 tokens remaining, ≤ 3 turns left, ≤ 60 s left), the system prompt changed on every provider request — including tool-call sub-requests mid-turn — invalidating the prefix cache from byte 0 each time. On a 200 k-context thinking model consuming 20–30 k reasoning tokens/turn, this triggered O(turns × tool_calls × context_size) cache misses instead of O(1), causing the ~$12/8 min cost spike reported in issue #13. Fix: `buildLimitWarning` is removed from `system.transform`; the system prompt is now byte-stable for the full lifetime of a goal. Limit warnings continue to reach the model on every continuation turn via `buildContinueMessage`, which already included them.
+- **Cap consecutive format-validation re-prompts (#15).** A model that repeatedly omitted `[goal:evidence]` on a `[goal:complete]` marker, or omitted a concrete blocker on `[goal:blocked]`, was re-prompted indefinitely: the existing `promptFailures` counter only incremented on network/protocol errors. Added a separate `formatFailures` counter that increments on each `completionUnverified` or `blockerUnstated` re-prompt and resets on a valid response. After `maxPromptFailures` consecutive format failures the goal pauses with stop reason `format validation failures` and a descriptive status message; `/goal resume` retries.
+- **Exclude tool-calling turns from the noProgress stall detector (#16).** `lowOutputLooksStalled` could fire on a reasoning-heavy model doing a pure tool call (small prose output, reasoning tokens only): `latestText` is empty and `latestOutputTokens` is below the 50-token threshold, matching the stall condition. Added `!latestHasToolCall` to `lowOutputLooksStalled` so a turn that invoked any tool is never counted as stalled regardless of prose output. `latestHasToolCall` is now hoisted above both the `noProgress` and `noToolCall` blocks so both gates share the same computation.
+
 ## 0.4.0 — 2026-06-21
 
 - **Expose agent-facing goal tools (`get_goal`, `get_goal_history`, `set_goal`, `update_goal`, `clear_goal`)** when the host provides `@opencode-ai/plugin` (a new *optional* peer dependency, loaded via a cached dynamic import so the zero-runtime-dependency posture is preserved). `set_goal` is constrained by its description to explicit user requests (so the agent does not set goals on its own); it accepts optional `maxTurns` / `maxTokens` / `maxDurationMs` overrides plus `successCriteria` / `constraints` / `mode`. `update_goal` supports objective edits and `complete` / `blocked` / `paused` / `resumed` transitions (with `evidence` / `blocker`). Tools create, replace, and clear goals through the **multi-goal registry** (the same `buildGoalState` → `registerSessionGoal` → `focusGoal` path the `/goal` command uses), so tool-created goals persist, appear in `/goal list`, and are driven by the idle handler; `complete` archives with evidence and auto-promotes the next goal in an ordered (sisyphus) sequence. Registration is skipped gracefully when the package is absent or with `registerTools: false`. New `buildAgentToolHandlers` / `buildAgentTools` / `agentToolSessionID` helpers. Implements megalist items 7.1 and 7.2. _(This is the work the 0.3.0 changelog mistakenly listed as already shipped; it is now actually implemented and adapted to the current multi-goal architecture.)_

package/README.md

@@ -290,6 +290,19 @@ By default a `[goal:complete]` is accepted on the assistant's word. You can requ
 
 On **approval** the goal is archived as achieved. On **rejection** the goal is *not* archived — it is paused with stop reason `audit rejected` and the reason in its status, so you can address the gap and `/goal resume`. The built-in child-session auditor fails *open* (auto-approves) if the session API is unavailable, while a custom auditor that throws is treated as a rejection (fail closed). The audit is off unless one of these options is set.
 
+Pass `auditorOptions` to tune the built-in auditor:
+
+```js
+GoalPlugin({
+  completionAudit: true,
+  auditorOptions: {
+    timeoutMs: 60_000,  // default 120 000 ms; set lower for faster CI feedback
+  },
+})
+```
+
+`timeoutMs` caps how long the built-in child-session auditor waits for a verdict. If the session doesn't reply within the timeout the auditor auto-approves (fail open) so the goal can still be archived. `auditorOptions` is ignored when a custom `auditor` function is supplied.
+
 ## Prompt safety
 
 The goal text is wrapped in `<goal_objective>` tags and labeled as user-provided task data. The assistant is told to treat it as a task description, not as elevated instructions that can override system, developer, tool, or repository policies.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-goal-plugin",
-  "version": "0.4.0",
+  "version": "0.4.7",
   "description": "Session-scoped /goal workflow for OpenCode.",
   "type": "module",
   "main": "./src/goal-plugin.js",

package/src/goal-plugin.js

@@ -56,7 +56,13 @@ const MAX_ARCHIVED_PER_SESSION = 10
 const lastGoalResults = new Map()
 const seenTokens = new Map()
 const seenOutputTokens = new Map()
-const activeContinues = new Set()
+// Map<sessionID, token> rather than Set so the idle handler's finally block can
+// detect whether its entry has been superseded by a new handler: if cleanupGoal
+// deletes the sessionID (allowing a new handler to start and set a fresh token)
+// before the old handler's finally fires, the old finally skips the delete
+// because the token no longer matches. With a plain Set, the old finally would
+// unconditionally delete the new handler's guard, exposing a race window.
+const activeContinues = new Map()
 const CLEAR_COMMANDS = new Set(["clear", "stop", "off", "reset", "none", "cancel"])
 const PAUSE_COMMANDS = new Set(["pause"])
 const GOAL_FLAG_SPECS = {
@@ -111,7 +117,9 @@ const GOAL_FLAG_SPECS = {
 // shapes count as tool-using turns too). A continuation turn with none of these
 // is "talk only" — a signal of a self-chat loop the auto-continue should not
 // keep feeding.
-const TOOL_PART_TYPES = new Set(["tool", "tool-invocation", "subtask"])
+// Covers both normalized OpenCode types and raw provider-specific part types
+// (some adapters forward the provider's original shape without normalizing).
+const TOOL_PART_TYPES = new Set(["tool", "tool-invocation", "subtask", "tool_use", "function_call", "tool-call"])
 
 function messageHasToolCall(message) {
   const parts = Array.isArray(message?.parts) ? message.parts : []
@@ -442,10 +450,13 @@ function promoteNextOrderedGoal(sessionID) {
 function cleanupGoal(sessionID) {
   const goal = goalStates.get(sessionID)
   if (goal) {
-    for (const messageID of goal.messageIDs) {
-      seenTokens.delete(messageID)
-      seenOutputTokens.delete(messageID)
-    }
+    // seenTokens entries for this goal's message IDs are intentionally NOT deleted
+    // here. resetGoalBudget also leaves them in place. The message.updated handler
+    // uses the presence of an ID in seenTokens combined with its absence from the
+    // current goal.messageIDs to detect and skip stale re-deliveries — deleting
+    // entries here would break that guard for post-replacement stale events.
+    // Entries are cleared in bulk by clearRuntimeState on plugin teardown; the
+    // per-process accumulation is small (O(turns × messages_per_turn)).
     removeSessionGoal(sessionID, goal.goalId)
   }
   goalStates.delete(sessionID)
@@ -505,10 +516,11 @@ function rememberGoalResult(sessionID, goal, state, reason = "", evidence = "")
 }
 
 function resetGoalBudget(goal) {
-  for (const messageID of goal.messageIDs) {
-    seenTokens.delete(messageID)
-    seenOutputTokens.delete(messageID)
-  }
+  // Do NOT delete old message IDs from seenTokens here. The message.updated
+  // handler guards against stale re-deliveries by checking whether the message ID
+  // is in seenTokens but NOT in the current goal.messageIDs — keeping the entries
+  // alive is what makes that check reliable. cleanupGoal removes them when the
+  // goal is fully discarded, so seenTokens entries are bounded to active goals.
   goal.goalId = randomUUID()
   goal.startedAt = Date.now()
   goal.turnCount = 0
@@ -520,6 +532,7 @@ function resetGoalBudget(goal) {
   goal.budgetWrapupSent = false
   goal.messageIDs = new Set()
   goal.promptFailures = 0
+  goal.formatFailures = 0
   goal.lastAssistantMessageID = ""
   goal.history = [...(goal.history || [])].slice(-MAX_HISTORY_ENTRIES)
 }
@@ -764,6 +777,7 @@ function normalizePersistedGoal(rawGoal) {
     stopped: rawGoal.stopped === true,
     stopReason: typeof rawGoal.stopReason === "string" ? rawGoal.stopReason : "",
     promptFailures: toNonNegativeInteger(rawGoal.promptFailures),
+    formatFailures: toNonNegativeInteger(rawGoal.formatFailures),
     messageIDs: Array.isArray(rawGoal.messageIDs)
       ? rawGoal.messageIDs.filter((messageID) => typeof messageID === "string" && messageID)
       : [],
@@ -924,6 +938,38 @@ async function applyParsedStateFile(raw, client) {
   return "loaded"
 }
 
+// After applyParsedStateFile loads goals into goalStates, check the ledger for
+// terminal events. If a goal has a "completed" or "cleared" entry in the ledger
+// but still appears active in the state file (because the state write failed
+// after the terminal ledger write), remove it so it is not re-driven.
+async function reconcileLoadedStateWithLedger(persistenceOptions, client) {
+  const entries = await readLedgerEntries(persistenceOptions.ledgerFilePath)
+  if (!entries.length) return
+
+  const terminalGoalIds = new Set()
+  for (const entry of entries) {
+    if (LEDGER_TERMINAL_TYPES.has(entry.type) && typeof entry.goalId === "string" && entry.goalId) {
+      terminalGoalIds.add(entry.goalId)
+    }
+  }
+  if (!terminalGoalIds.size) return
+
+  let removed = 0
+  for (const [sessionID, goal] of goalStates.entries()) {
+    if (terminalGoalIds.has(goal.goalId)) {
+      removeSessionGoal(sessionID, goal.goalId)
+      goalStates.delete(sessionID)
+      removed++
+    }
+  }
+  if (removed > 0) {
+    await logPluginError(
+      client,
+      `Ledger cross-check: removed ${removed} goal(s) whose terminal state was recorded in the ledger but not yet reflected in the state file (likely a failed terminal persist).`,
+    )
+  }
+}
+
 async function loadPersistedState(persistenceOptions, client) {
   if (!persistenceOptions.persistState) return "disabled"
 
@@ -954,7 +1000,15 @@ async function loadPersistedState(persistenceOptions, client) {
       continue
     }
 
-    if (status === "loaded") return primary ? "loaded" : "migrated"
+    if (status === "loaded") {
+      // Cross-check: the ledger is written before the state file for terminal
+      // events (completed, cleared). If the terminal persist succeeded in the
+      // ledger but the state file write failed (e.g. process killed between the
+      // two writes), the reloaded state may still have the goal as active. Remove
+      // any loaded active goals whose goalId has a terminal ledger entry.
+      await reconcileLoadedStateWithLedger(persistenceOptions, client)
+      return primary ? "loaded" : "migrated"
+    }
     // status === "invalid": preserve a present-but-corrupt primary; for a
     // fallback, keep trying the next candidate.
     if (primary) return "invalid"
@@ -1178,6 +1232,17 @@ const STRUCTURAL_TAGS = [
   "next_step",
   "completion_audit",
   "evidence_required",
+  // Role-like names that model providers treat as elevated context (second-order
+  // injection: a goal could guide the model to emit these in output captured by
+  // recordCheckpoint, then re-injected via compaction or buildGoalBlock).
+  "system",
+  "instructions",
+  "human",
+  "assistant",
+  "anthropic",
+  "claude",
+  "context",
+  "prompt",
 ]
 const STRUCTURAL_OPEN_TAG_RE = new RegExp(`<(${STRUCTURAL_TAGS.join("|")})\\b`, "gi")
 
@@ -1320,14 +1385,17 @@ function buildCompactionProgressSummary(goal, { maxCheckpoints = 3, maxEvents =
   if (checkpoints.length) {
     lines.push("Recent checkpoints (oldest first):")
     for (const checkpoint of checkpoints) {
-      lines.push(`- ${summarizeText(checkpoint.summary, 200)}`)
+      // Escape: checkpoint summaries contain assistant-generated text; an
+      // adversarial model output could inject structural tags into this string,
+      // which would be re-embedded in the compaction context system message.
+      lines.push(`- ${escapeGoalText(summarizeText(checkpoint.summary, 200))}`)
     }
   }
   const events = Array.isArray(goal.history) ? goal.history.slice(-maxEvents) : []
   if (events.length) {
     lines.push("Recent lifecycle events (oldest first):")
     for (const event of events) {
-      lines.push(`- ${event.type}: ${summarizeText(event.detail, 160)}`)
+      lines.push(`- ${event.type}: ${escapeGoalText(summarizeText(event.detail, 160))}`)
     }
   }
   return lines
@@ -1338,14 +1406,19 @@ function buildCompactionContext(goal) {
   // this, a compaction can drop the goal objective and budget state from the
   // working context, so the assistant loses the thread mid-run even though the
   // plugin still re-injects via system.transform afterward.
-  const elapsedSeconds = Math.round((Date.now() - goal.startedAt) / 1000)
+  // Use goal.lastContinueAt (set on each persist cycle) rather than Date.now()
+  // so buildCompactionContext is deterministic. If OpenCode calls the compacting
+  // hook more than once, each invocation produces the same elapsedSeconds and
+  // therefore the same string — preserving the prefix cache from this point on.
+  const snapshotAt = goal.lastContinueAt || goal.startedAt || 0
+  const elapsedSeconds = Math.round((snapshotAt - goal.startedAt) / 1000)
   return [
     "An OpenCode goal is active for this session. Preserve it across compaction.",
     "The summary below is reconstructed deterministically from the plugin's persisted goal record, not from chat memory.",
     buildGoalBlock(goal),
     `Goal status: ${goal.stopped ? goal.stopReason || "stopped" : "active"}.`,
     `Auto-continues used: ${goal.turnCount}/${goal.options.maxTurns}. Context tokens: ${goal.totalTokens}/${goal.options.maxTokens}. Elapsed: ${elapsedSeconds}s.`,
-    goal.lastCheckpoint ? `Latest checkpoint: ${goal.lastCheckpoint.summary}` : null,
+    goal.lastCheckpoint ? `Latest checkpoint: ${escapeGoalText(goal.lastCheckpoint.summary)}` : null,
     ...buildCompactionProgressSummary(goal),
     "After compaction, continue from the next concrete unfinished step while the goal is active. Verify the result against the goal objective before ending; output [goal:complete] (preceded by a [goal:evidence] line) only when fully satisfied, or [goal:blocked] (preceded by a concrete blocker) only if user input is required.",
   ]
@@ -1583,6 +1656,7 @@ function buildGoalState(sessionID, condition, options, meta = {}, lastStatus = "
     stopped: false,
     stopReason: "",
     promptFailures: 0,
+    formatFailures: 0,
     messageIDs: new Set(),
     history: [],
     checkpoints: [],
@@ -1599,7 +1673,11 @@ const AGENT_UPDATE_STATUSES = new Set(["complete", "blocked", "paused", "resumed
 // result. Goal creation/replacement routes through the multi-goal registry
 // (buildGoalState + registerSessionGoal + focusGoal) exactly like the command
 // path, so tool-created goals persist and are driven by the idle handler.
-function buildAgentToolHandlers({ defaultGoalOptions, persist }) {
+function buildAgentToolHandlers({ defaultGoalOptions, persist, persistTerminalState = null, completionAuditor = null }) {
+  // Use persistTerminalState (which logs on failure) for terminal operations when
+  // available; fall back to plain persist for callers that don't wire it up (e.g.
+  // tests using buildAgentToolHandlers directly).
+  const persistFinal = persistTerminalState || persist
   async function getGoal(sessionID) {
     const goal = goalStates.get(sessionID)
     if (goal) return formatStatus(goal)
@@ -1636,6 +1714,17 @@ function buildAgentToolHandlers({ defaultGoalOptions, persist }) {
     const objective = typeof args.objective === "string" ? args.objective.trim() : ""
     if (!objective) return "No objective provided. Pass a non-empty `objective`."
 
+    // Validate budget args before normalizing: normalizeOptions silently substitutes
+    // defaults for non-positive values, giving no feedback to the caller.
+    if (Number.isFinite(args.maxTurns) && args.maxTurns <= 0)
+      return `Invalid maxTurns: ${args.maxTurns} — must be a positive integer.`
+    if (Number.isFinite(args.maxTokens) && args.maxTokens <= 0)
+      return `Invalid maxTokens: ${args.maxTokens} — must be a positive integer.`
+    if (Number.isFinite(args.maxDurationMs) && args.maxDurationMs <= 0)
+      return `Invalid maxDurationMs: ${args.maxDurationMs} — must be a positive number.`
+    if (args.mode !== undefined && !GOAL_MODES.has(String(args.mode).toLowerCase()))
+      return `Invalid mode: ${args.mode} (expected ${[...GOAL_MODES].join(" or ")}).`
+
     const options = normalizeOptions({
       ...defaultGoalOptions,
       ...(Number.isFinite(args.maxTurns) ? { maxTurns: args.maxTurns } : {}),
@@ -1662,25 +1751,48 @@ function buildAgentToolHandlers({ defaultGoalOptions, persist }) {
     registerSessionGoal(goal)
     focusGoal(sessionID, goal)
     await persist()
-    return `New active goal: ${goal.condition}`
+    // Escape in the tool result only: goal.condition is stored raw so callers
+    // that build XML (buildGoalBlock, buildContinueMessage) can apply escaping
+    // themselves. Escaping here prevents XML metacharacters in user-supplied
+    // objectives from breaking tool-result boundaries in XML-serialized formats.
+    return `New active goal: ${escapeGoalText(goal.condition)}`
   }
 
   async function updateGoal(sessionID, args = {}) {
     const goal = goalStates.get(sessionID)
     if (!goal) return "No active goal to update. Use set_goal first."
 
+    // Reject the combination of an objective update with status='complete': the
+    // completion would be archived under a condition that was never executed,
+    // falsifying the audit trail. Require two separate calls.
+    if (
+      typeof args.objective === "string" &&
+      args.objective.trim() &&
+      String(args.status || "").trim().toLowerCase() === "complete"
+    ) {
+      return (
+        "Cannot combine an objective update with status='complete'. " +
+        "Use two separate calls: first update the objective (which revises the goal), " +
+        "then mark it complete after completing the revised work."
+      )
+    }
+
     const messages = []
 
     if (typeof args.objective === "string" && args.objective.trim()) {
       goal.condition = args.objective.trim()
-      goal.stopped = false
-      goal.stopReason = ""
+      // Deliberately NOT clearing goal.stopped or goal.stopReason: updating the
+      // objective does not un-stop a goal. Use status='resumed' to explicitly
+      // restart a stopped goal; silently un-stopping would resurrect audit-rejected
+      // or user-paused goals without the user's knowledge.
       goal.blockedReason = ""
       goal.budgetWrapupSent = false
       goal.noProgressTurns = 0
+      goal.noToolCallTurns = 0
+      goal.formatFailures = 0
       goal.lastStatus = "Goal objective updated."
       pushHistory(goal, "edited", `Objective updated to: ${summarizeText(goal.condition, 400)}`)
-      messages.push(`Objective updated: ${goal.condition}`)
+      messages.push(`Objective updated: ${escapeGoalText(goal.condition)}`)
     }
 
     if (args.status !== undefined) {
@@ -1690,6 +1802,27 @@ function buildAgentToolHandlers({ defaultGoalOptions, persist }) {
       }
       if (status === "complete") {
         const evidence = typeof args.evidence === "string" ? args.evidence.trim() : ""
+        // If a completion auditor is configured, run it before archiving so the
+        // agent tool path has the same integrity gate as the [goal:complete] marker
+        // path. Without this, an autonomous agent could bypass the auditor by
+        // calling update_goal({status:"complete"}) instead of using the marker.
+        if (completionAuditor) {
+          let verdict
+          try {
+            verdict = await completionAuditor({ goal, sessionID, latestText: evidence })
+          } catch (error) {
+            verdict = { approved: false, reason: "auditor error" }
+          }
+          if (!verdict || verdict.approved !== true) {
+            const reason = (verdict && verdict.reason) || "completion not substantiated"
+            goal.stopped = true
+            goal.stopReason = "audit rejected"
+            goal.lastStatus = `Completion audit rejected: ${summarizeText(reason, 200)}. Address it, then run /goal resume.`
+            pushHistory(goal, "audit-rejected", `Agent tool completion audit rejected: ${summarizeText(reason, 300)}`)
+            await persist()
+            return `Completion audit rejected: ${summarizeText(reason, 200)}. Goal paused; use /goal resume after addressing the issue.`
+          }
+        }
         goal.lastStatus = "Goal completed."
         pushHistory(
           goal,
@@ -1700,15 +1833,18 @@ function buildAgentToolHandlers({ defaultGoalOptions, persist }) {
         cleanupGoal(sessionID)
         // Advance an ordered (sisyphus) sequence just like the marker path does.
         if (sessionOrdered.has(sessionID)) promoteNextOrderedGoal(sessionID)
-        await persist()
+        await persistFinal("completion")
         return "Goal marked complete and archived."
       }
       if (status === "blocked") {
-        goal.blockedReason = typeof args.blocker === "string" ? args.blocker.trim() : ""
+        const blockerText = typeof args.blocker === "string" ? args.blocker.trim() : ""
+        if (!blockerText)
+          return "status 'blocked' requires a non-empty 'blocker' argument describing what is needed."
+        goal.blockedReason = blockerText
         goal.stopped = true
         goal.stopReason = "blocked"
         goal.lastStatus = "Assistant reported blocked."
-        pushHistory(goal, "blocked", goal.blockedReason || "Marked blocked via agent tool.")
+        pushHistory(goal, "blocked", goal.blockedReason)
         messages.push("Goal marked blocked.")
       } else if (status === "paused") {
         goal.stopped = true
@@ -1717,15 +1853,15 @@ function buildAgentToolHandlers({ defaultGoalOptions, persist }) {
         pushHistory(goal, "paused", "Paused via agent tool.")
         messages.push("Goal paused.")
       } else if (status === "resumed") {
+        if (!goal.stopped)
+          return "Goal is already running. Pause or stop it first if you want to reset the budget window."
         const previousGoalId = goal.goalId
         resetGoalBudget(goal)
-        // resetGoalBudget rotates goalId; re-key the registry so the goal stays
-        // findable by its new id (the focused pointer holds the same object).
-        if (goal.goalId !== previousGoalId) {
-          removeSessionGoal(sessionID, previousGoalId)
-          registerSessionGoal(goal)
-          focusGoal(sessionID, goal)
-        }
+        // resetGoalBudget always rotates goalId via randomUUID; unconditionally
+        // re-key the registry so the goal stays findable by its new id.
+        removeSessionGoal(sessionID, previousGoalId)
+        registerSessionGoal(goal)
+        focusGoal(sessionID, goal)
         goal.stopped = false
         goal.stopReason = ""
         goal.blockedReason = ""
@@ -1743,11 +1879,17 @@ function buildAgentToolHandlers({ defaultGoalOptions, persist }) {
   }
 
   async function clearGoal(sessionID) {
-    // Mirror `/goal clear`: drop the ordered flag and the focused goal + result.
+    // Mirror `/goal clear`: drop the ordered flag, ALL backgrounded goals, and the
+    // focused goal + result. Without sessionGoals.delete, background goals added via
+    // `/goal add` survive clear and resurrect as the focused goal on restart.
+    // Record the clear in the ledger before cleanupGoal removes the goal object.
+    const goalBeforeClear = goalStates.get(sessionID)
+    if (goalBeforeClear) pushHistory(goalBeforeClear, "cleared", "Cleared via agent tool.")
     sessionOrdered.delete(sessionID)
+    sessionGoals.delete(sessionID)
     cleanupGoal(sessionID)
     lastGoalResults.delete(sessionID)
-    await persist()
+    await persistFinal("clear")
     return "Goal cleared."
   }
 
@@ -1923,9 +2065,9 @@ function extractAuditVerdictText(response) {
 // so a missing/broken auditor pipeline never blocks legitimate completions.
 // NOTE: the exact child-session SDK shape should be confirmed against a live
 // OpenCode; the orchestration around it is what the tests cover.
-function createChildSessionAuditor(client, { agent = "build" } = {}) {
+function createChildSessionAuditor(client, { agent = "build", timeoutMs = 120_000 } = {}) {
   return async ({ goal, sessionID, latestText }) => {
-    try {
+    const run = async () => {
       const sessionApi = client?.session
       if (!sessionApi?.create || !sessionApi?.prompt) {
         return { approved: true, reason: "child-session API unavailable; auto-approved" }
@@ -1946,8 +2088,23 @@ function createChildSessionAuditor(client, { agent = "build" } = {}) {
         verdictText = getText(findLatestAssistantMessage(messages?.data)?.parts)
       }
       return parseAuditVerdict(verdictText)
+    }
+
+    let timerID
+    const timeout = new Promise((resolve) => {
+      timerID = setTimeout(
+        () => resolve({ approved: false, reason: `auditor timed out after ${timeoutMs}ms` }),
+        timeoutMs,
+      )
+    })
+
+    try {
+      const result = await Promise.race([run(), timeout])
+      return result
     } catch (error) {
       return { approved: true, reason: `auditor error (auto-approved): ${error?.message || error}` }
+    } finally {
+      clearTimeout(timerID)
     }
   }
 }
@@ -1959,7 +2116,14 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
     cwd: pluginOptions.cwd,
   })
   const { commandName, registerCommand } = normalizeCommandOptions(pluginOptions)
-  const persist = async () => persistState(persistenceOptions, client)
+  // Serialize all persist() calls through a promise chain so concurrent callers
+  // never race on the temp-file rename. persistState returns a boolean and never
+  // rejects, so the chain cannot stall on a thrown error.
+  let persistChain = Promise.resolve(true)
+  const persist = () => {
+    persistChain = persistChain.then(() => persistState(persistenceOptions, client))
+    return persistChain
+  }
 
   // Fail-closed (item 2.5): when persisting a terminal state (complete/blocked)
   // fails, surface it loudly. The terminal event is already in the append-only
@@ -2021,7 +2185,7 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
     await persist()
   }
 
-  const agentToolHandlers = buildAgentToolHandlers({ defaultGoalOptions, persist })
+  const agentToolHandlers = buildAgentToolHandlers({ defaultGoalOptions, persist, persistTerminalState, completionAuditor })
 
   const hooks = {
     "command.execute.before": async (input, output) => {
@@ -2074,7 +2238,16 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
       }
 
       if (CLEAR_COMMANDS.has(args)) {
+        // Record the clear in the ledger before cleanupGoal removes the goal
+        // object, so reconstructFromLedger can identify cleared goals and skip
+        // them rather than reconstructing them after a missing state file.
+        // sessionGoals.delete clears ALL backgrounded goals so they do not
+        // resurrect as the focused goal on restart (cleanupGoal only removes the
+        // focused one; background goals from `/goal add` would survive otherwise).
+        const goalBeforeClear = goalStates.get(sessionID)
+        if (goalBeforeClear) pushHistory(goalBeforeClear, "cleared", "User cleared the goal.")
         sessionOrdered.delete(sessionID)
+        sessionGoals.delete(sessionID)
         cleanupGoal(sessionID)
         lastGoalResults.delete(sessionID)
         await persist()
@@ -2110,14 +2283,11 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
 
         const previousGoalId = goal.goalId
         resetGoalBudget(goal)
-        // resetGoalBudget rotates goalId; re-key the multi-goal registry to the
-        // new id so a later clear/replace removes the goal instead of leaking a
-        // stale entry (the focused pointer holds the same object reference).
-        if (goal.goalId !== previousGoalId) {
-          removeSessionGoal(sessionID, previousGoalId)
-          registerSessionGoal(goal)
-          focusGoal(sessionID, goal)
-        }
+        // resetGoalBudget always rotates goalId via randomUUID; unconditionally
+        // re-key the registry so a later clear/replace removes the right entry.
+        removeSessionGoal(sessionID, previousGoalId)
+        registerSessionGoal(goal)
+        focusGoal(sessionID, goal)
         goal.stopped = false
         goal.stopReason = ""
         goal.blockedReason = ""
@@ -2154,6 +2324,8 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
         goal.blockedReason = ""
         goal.budgetWrapupSent = false
         goal.noProgressTurns = 0
+        goal.noToolCallTurns = 0
+        goal.formatFailures = 0
         goal.lastStatus = "Goal objective updated."
         pushHistory(goal, "edited", `Objective updated to: ${summarizeText(newObjective, 400)}`)
         await persist()
@@ -2356,7 +2528,10 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
 
       // Replace the focused goal (cleanupGoal discards it); backgrounded goals
       // for this session are preserved. Use `/goal add` to keep the current
-      // goal and add another.
+      // goal and add another. Clear any ordered-sequence flag so the new
+      // standalone goal does not trigger sisyphus auto-promotion of old sequence
+      // goals that may still be in the registry (matches the agent setGoal path).
+      sessionOrdered.delete(sessionID)
       cleanupGoal(sessionID)
       lastGoalResults.delete(sessionID)
       registerSessionGoal(goal)
@@ -2396,6 +2571,14 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
         const currentMessageID = messageID(message)
         if (!currentMessageID) return
 
+        // Skip stale re-deliveries from a prior budget window or a replaced goal.
+        // resetGoalBudget and cleanupGoal both leave seenTokens entries in place
+        // so this guard can fire: if an ID is already recorded in seenTokens but
+        // is absent from the current goal.messageIDs, it belongs to a previous
+        // budget epoch or a different goal that was replaced, and the event must
+        // not re-inflate totalTokens.
+        if (seenTokens.has(currentMessageID) && !goal.messageIDs.has(currentMessageID)) return
+
         let changed = false
         const currentOutputTokens = outputTokensForMessage(message)
         const previousOutputTokens = seenOutputTokens.get(currentMessageID) || 0
@@ -2436,7 +2619,8 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
       if (!goal || goal.stopped || activeContinues.has(sessionID)) return
       const goalID = goal.goalId
 
-      activeContinues.add(sessionID)
+      const continueToken = randomUUID()
+      activeContinues.set(sessionID, continueToken)
       try {
         const messages = await client.session.messages({
           path: { id: sessionID },
@@ -2492,6 +2676,11 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
               sessionID,
               `Auditing goal completion: verifying "${summarizeText(activeGoalAfterMessages.condition, 120)}" is satisfied before archiving.`,
             )
+            // Re-check liveness: announceAudit is async and can yield long enough
+            // for the user to /goal clear or replace the goal. If it's gone,
+            // bail out without archiving — archiving a cleared goal would resurrect
+            // it in memory and potentially in the persisted state.
+            if (!activeGoal(sessionID, goalID)) return
             // Optional independent auditor (item 2.2): an approved verdict
             // archives; a rejected verdict restores (pauses) the goal instead.
             if (completionAuditor) {
@@ -2503,7 +2692,18 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
                 verdict = { approved: false, reason: "auditor error" }
               }
               const auditedGoal = activeGoal(sessionID, goalID)
-              if (!auditedGoal) return
+              if (!auditedGoal) {
+                // The goal was cleared or replaced while the auditor was running.
+                // If the verdict was approved, surface the loss so the user knows
+                // the completion was verified but not recorded — they can re-engage.
+                if (verdict && verdict.approved === true) {
+                  await announceAudit(
+                    sessionID,
+                    "Audit result: completion was approved but the goal was modified while the audit ran — completion not recorded.",
+                  )
+                }
+                return
+              }
               if (!verdict || verdict.approved !== true) {
                 const reason = (verdict && verdict.reason) || "completion not substantiated"
                 auditedGoal.stopped = true
@@ -2523,8 +2723,10 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
               )
             }
             activeGoalAfterMessages.lastStatus = "Goal completed."
-            // pushHistory writes the terminal event to the durable ledger first,
-            // so the completion survives even if the state write below fails.
+            // pushHistory attempts to append the terminal event to the ledger before
+            // the state write below. Note: ledger write failures are silent (bare
+            // catch in emitLedgerEvent), and the ledger only enables recovery when
+            // the state file is absent — a stale state file always takes precedence.
             pushHistory(
               activeGoalAfterMessages,
               "completed",
@@ -2600,18 +2802,48 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
           return
         }
 
+        // Hoist tool-call check so both the noProgress and noToolCall gates can
+        // use it. A tool call is evidence of real work even when prose output
+        // is tiny (e.g. a thinking model that calls a tool with < 50 output
+        // tokens), so it resets noProgressTurns the same way the noToolCall
+        // gate already resets noToolCallTurns.
+        const latestHasToolCall = messageHasToolCall(latestAssistant)
+        // A turn that produced only reasoning tokens (no prose, no tool calls)
+        // is an extended-thinking pass, not a stall. latestOutputTokens counts
+        // prose output only; reasoning tokens are tracked separately. Without
+        // this guard a pure-thinking turn matches lowOutputTurn (output=0 < threshold)
+        // and latestText is empty, so it would false-positively look stalled.
+        const latestHasThinkingTokens =
+          toNonNegativeInteger(messageTokens(latestAssistant).reasoning) > 0
+
         const lowOutputTurn =
           activeGoalAfterMessages.turnCount > 0 &&
           latestOutputTokens !== null &&
           latestOutputTokens < activeGoalAfterMessages.options.noProgressTokenThreshold
+        // A turn that used a tool is never stalled even with low output tokens:
+        // reasoning-heavy models often produce small prose output while doing
+        // real work via tool calls. Excluding tool-call turns prevents false
+        // noProgress pauses on thinking models.
         const lowOutputLooksStalled =
-          lowOutputTurn && (assistantRepeated || !latestText || !assistantChanged)
+          lowOutputTurn &&
+          !latestHasToolCall &&
+          !latestHasThinkingTokens &&
+          (assistantRepeated || !latestText || !assistantChanged)
         if (lowOutputLooksStalled) {
           activeGoalAfterMessages.noProgressTurns += 1
           if (
             activeGoalAfterMessages.noProgressTurns >=
             activeGoalAfterMessages.options.noProgressTurnsBeforePause
           ) {
+            // Accumulate format-validation failures even when the stall gate fires
+            // first and returns early, so the formatFailures cap remains reachable
+            // for low-output unverified completions. Without this, a model that
+            // repeatedly emits bare [goal:complete] with low output tokens causes
+            // the stall gate to fire before formatFailures can accumulate, and
+            // /goal resume resets it to zero, making the cap permanently unreachable.
+            if (completionUnverified || blockerUnstated) {
+              activeGoalAfterMessages.formatFailures += 1
+            }
             activeGoalAfterMessages.stopped = true
             activeGoalAfterMessages.stopReason = "no progress"
             activeGoalAfterMessages.lastStatus = `Goal auto-continue paused after ${activeGoalAfterMessages.noProgressTurns} low-progress turn(s); the latest turn produced ${latestOutputTokens} output token(s). Run /${commandName} resume to continue.`
@@ -2630,7 +2862,7 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
             "warning",
             `Observed a low-progress turn below ${activeGoalAfterMessages.options.noProgressTokenThreshold} output tokens; grace count ${activeGoalAfterMessages.noProgressTurns}/${activeGoalAfterMessages.options.noProgressTurnsBeforePause}.`,
           )
-        } else if (latestOutputTokens !== null || assistantChanged) {
+        } else if (latestOutputTokens !== null || assistantChanged || !latestAssistant) {
           activeGoalAfterMessages.noProgressTurns = 0
         }
 
@@ -2640,10 +2872,14 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
         // configured grace window. Complements the low-output check above:
         // a turn can be high-output yet still make no real progress because it
         // never touched a tool.
-        const latestHasToolCall = messageHasToolCall(latestAssistant)
+        // Guard on !lowOutputLooksStalled: if the noProgress gate already fired
+        // for this turn, the noToolCall counter must NOT also increment. Without
+        // this guard, the effective grace window is min(noProgress, noToolCall)
+        // rather than two independent limits — the user's higher noProgress
+        // threshold gets silently overridden by the lower noToolCall threshold.
         const noToolCallContinuation =
           activeGoalAfterMessages.turnCount > 0 && Boolean(latestAssistant) && !latestHasToolCall
-        if (noToolCallContinuation) {
+        if (noToolCallContinuation && !lowOutputLooksStalled) {
           activeGoalAfterMessages.noToolCallTurns += 1
           if (
             activeGoalAfterMessages.noToolCallTurns >=
@@ -2667,7 +2903,7 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
             "warning",
             `Observed a continuation turn with no tool calls; grace count ${activeGoalAfterMessages.noToolCallTurns}/${activeGoalAfterMessages.options.noToolCallTurnsBeforePause}.`,
           )
-        } else if (latestHasToolCall) {
+        } else if (latestHasToolCall || !latestAssistant) {
           activeGoalAfterMessages.noToolCallTurns = 0
         }
 
@@ -2688,20 +2924,53 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
           activeGoalBeforePrompt.stopped = true
           activeGoalBeforePrompt.stopReason = "budget wrap-up requested"
           activeGoalBeforePrompt.lastStatus = "Budget threshold reached; requested final handoff."
+          // Persist before sending the wrapup prompt so that a crash during
+          // promptAsync doesn't cause a duplicate wrapup on resume. This mirrors
+          // the hard-limit path which also persists before its promptAsync call.
+          pushHistory(activeGoalBeforePrompt, "budget-wrapup", "Budget threshold reached; sending final handoff prompt.")
+          await persist()
         }
 
         activeGoalBeforePrompt.turnCount += 1
         activeGoalBeforePrompt.lastContinueAt = Date.now()
         if (!budgetWrapup) {
           if (completionUnverified) {
+            activeGoalBeforePrompt.formatFailures += 1
             activeGoalBeforePrompt.lastStatus = `Rejected an unverified [goal:complete] (no [goal:evidence]); re-prompting for evidence on turn ${activeGoalBeforePrompt.turnCount}.`
           } else if (blockerUnstated) {
+            activeGoalBeforePrompt.formatFailures += 1
             activeGoalBeforePrompt.lastStatus = `Rejected a [goal:blocked] with no concrete blocker; re-prompting on turn ${activeGoalBeforePrompt.turnCount}.`
           } else {
+            // Decrement rather than reset: an alternating bad/good/bad pattern
+            // should not indefinitely bypass the consecutive-failure cap. A model
+            // that produces one clean turn for every violation keeps formatFailures
+            // pinned near 1, which still accumulates toward the cap over time.
+            activeGoalBeforePrompt.formatFailures = Math.max(
+              0,
+              activeGoalBeforePrompt.formatFailures - 1,
+            )
             activeGoalBeforePrompt.lastStatus = latestText
               ? `Continuing after assistant turn ${activeGoalBeforePrompt.turnCount}.`
               : `Continuing after idle event ${activeGoalBeforePrompt.turnCount}.`
           }
+
+          // Pause after too many consecutive format-validation failures. Unlike
+          // promptFailures (which counts network/protocol errors), this counts turns
+          // where the model signalled completion or a blocker but omitted the required
+          // evidence or concrete-blocker line. The same maxPromptFailures cap applies;
+          // resume resets the counter via resetGoalBudget.
+          if (activeGoalBeforePrompt.formatFailures >= activeGoalBeforePrompt.options.maxPromptFailures) {
+            activeGoalBeforePrompt.stopped = true
+            activeGoalBeforePrompt.stopReason = "format validation failures"
+            activeGoalBeforePrompt.lastStatus = `Paused after ${activeGoalBeforePrompt.formatFailures} consecutive format-validation failure(s) (missing [goal:evidence] or concrete blocker). Run /${commandName} resume to retry.`
+            pushHistory(
+              activeGoalBeforePrompt,
+              "paused",
+              `Paused after ${activeGoalBeforePrompt.formatFailures} consecutive format-validation failure(s).`,
+            )
+            await persist()
+            return
+          }
         }
 
         const response = await client.session.promptAsync({
@@ -2736,7 +3005,10 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
         } else {
           const activeGoalAfterPrompt = currentGoal(sessionID, goalID)
           if (activeGoalAfterPrompt) {
-            activeGoalAfterPrompt.promptFailures = 0
+            // Decrement rather than reset: an alternating error/success pattern
+            // should still accumulate toward the circuit-breaker cap over time,
+            // matching the formatFailures approach for the same reason.
+            activeGoalAfterPrompt.promptFailures = Math.max(0, activeGoalAfterPrompt.promptFailures - 1)
             pushHistory(
               activeGoalAfterPrompt,
               budgetWrapup ? "budget-wrapup" : "auto-continue",
@@ -2763,7 +3035,10 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
         }
         await logPluginError(client, "Auto-continue failed", error)
       } finally {
-        activeContinues.delete(sessionID)
+        // Only delete our own entry. If cleanupGoal already removed it (because
+        // the goal completed) and a new handler has since set a fresh token,
+        // we must not clobber the new handler's guard.
+        if (activeContinues.get(sessionID) === continueToken) activeContinues.delete(sessionID)
       }
     },
 
@@ -2776,13 +3051,21 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
       const systemBlocks = Array.isArray(output.system) ? [...output.system] : []
       if (systemBlocks.some(systemBlockContainsGoal)) return
 
+      // Only static content here — volatile fields (limit warnings, turn counters,
+      // token counts, wall-clock values) must not appear in the system prompt.
+      // system.transform fires on every provider request including tool-call
+      // sub-requests; any per-turn drift in the system prompt invalidates the
+      // provider-side prefix cache from byte 0, turning O(1) cache hits into
+      // O(N*turns) full-context misses. Limit warnings are already delivered
+      // on every continuation turn via buildContinueMessage (buildLimitWarning
+      // and <progress_budget>), which is sufficient — the model doesn't need
+      // them in the system prompt mid-turn.
       const goalBlock = [
         buildGoalBlock(goal),
         "Keep working until the goal is fully satisfied.",
         "When fully satisfied, put a `[goal:evidence]` line summarizing what you verified immediately before `[goal:complete]`. A `[goal:complete]` without evidence is rejected.",
         "If user input is required, explain the concrete blocker in the line immediately before `[goal:blocked]`. A `[goal:blocked]` without a concrete blocker is rejected.",
-        buildLimitWarning(goal),
-      ].filter(Boolean).join("\n")
+      ].join("\n")
 
       if (systemBlocks.length === 0) {
         output.system = [goalBlock]
@@ -2808,6 +3091,18 @@ export const GoalPlugin = async ({ client }, pluginOptions = {}) => {
       } else {
         output.context = [context]
       }
+      // Reset the token high-water mark so the remaining budget reflects the
+      // compacted context size, not the pre-compaction peak. Without this,
+      // Math.max semantics mean totalTokens never decreases: a goal that crossed
+      // the 80% wrapup threshold before compaction would permanently stay above it
+      // even after the context shrinks to a fraction of its prior size.
+      // Move current message IDs to priorMessageIDs so the message.updated guard
+      // ignores stale events for pre-compaction messages.
+      if (!goal.priorMessageIDs) goal.priorMessageIDs = new Set()
+      for (const id of goal.messageIDs) goal.priorMessageIDs.add(id)
+      goal.messageIDs = new Set()
+      goal.totalTokens = 0
+      await persist()
     },
 
     "experimental.compaction.autocontinue": async (input, output) => {