pi-antiloop 1.5.0 → 1.6.1

package/README.md

@@ -6,18 +6,19 @@
 
 # Antiloop — Loop Detection and Break for pi
 
-**Antiloop watches every assistant message, tool call and thinking block, and forces the model out of reasoning loops before they eat your context and your patience.** Four simultaneous detection strategies (text similarity, tool-call sequences, thinking content, structural openings) find loops that humans miss — and progressive intervention (warning → force break → abort) tells the model to take a different approach, without you having to babysit it.
+**Antiloop watches every assistant message, tool call and thinking block, and forces the model out of reasoning loops before they eat your context and your patience.** Six simultaneous detection strategies (text similarity, tool-call sequences, thinking content, structural openings, degenerate repetition, no-progress outcome runs) find loops that humans miss — and progressive intervention (warning → force break → abort) tells the model to take a different approach, without you having to babysit it.
 
 ---
 
 ## Features
 
-- **Four detection strategies** — text repetition (trigram Jaccard + Levenshtein), tool-call sequences (name + near-identical arguments + same outcome — result-aware, so retries that make progress don't false-positive), thinking blocks, and structural opening-phrase patterns
+- **Six detection strategies** — text repetition (trigram Jaccard + Levenshtein), tool-call sequences (name + near-identical arguments + same outcome — result-aware, so retries that make progress don't false-positive), thinking blocks, structural opening-phrase patterns, **degenerate repetition** (a single message/call stuck repeating one word hundreds of times — the `noguerol ×5145` meltdown — caught at `message_end` with no repeated peer needed, and degenerate bash commands blocked before they execute), and **no-progress outcome runs** (the NFS `test A…QQQ` class: dozens of near-identical re-runs of the same experiment, every one ending in the *same failing outcome* — args mutate so tool-loop can't see it; the repeated failure signature can)
+- **Stays alive in long sessions** — tracked messages carry a monotonic sequence number, so trimming the sliding window can never make the dedupe guard skip later messages (a bug that silently blinded antiloop after ~15 tracked messages)
 - **Task-stream recognition (batch work)** — when another extension (e.g. `punched` appending lines to pi.md, or `plan` adding tasks) makes the model call the *same* tool many times with *different* content, antiloop recognizes it as N distinct tasks of one type and stays silent — no warning, no force break. A genuine loop (the *same* call repeated verbatim) is still caught
-- **Progressive intervention** — `warning` reminds the model to vary its approach; `force break` injects explicit anti-loop instructions and modifies context; `abort` stops the run entirely
+- **Progressive intervention** — `warning` reminds the model to vary its approach; `force break` steers a real break message into the running agent before its next LLM call; `abort` stops the run entirely
 - **Configurable thresholds** — independent dials for similarity cutoff, warning/force-break/abort counts, detection window, and which strategies are on
 - **Sliding window** — only the last N messages are compared, so detection is O(N) in the window size, not in the full session
-- **Live footer indicator** — `🔄 antiloop(on|off)` in the footer, per spec, with the current level (`⚠️/🛑/🚨`) and consecutive count; an interactive TUI footer adds a keyboard toggle (`esc+a` by default, configurable/off) and preserves the built-in footer's pwd/branch/context/model info
+- **Live footer indicator** — `🔄 antiloop(on|off)` in the footer, per spec, with the current level (`⚠️/🛑/🚨`) and consecutive count; an interactive TUI footer adds a keyboard toggle (`esc+a` by default, configurable/off, honored only while idle) and preserves the built-in footer's pwd/branch/context/model info
 - **Detection log** — timestamped history with similarity scores, filterable through the native pi menu
 - **Self-test** — `/antiloop test` runs built-in cases to verify the similarity engine is calibrated
 - **User input softens detection** — each new user message decays the consecutive counter so a fresh prompt can resolve the loop without manual reset
@@ -98,10 +99,14 @@ Detection strategies:
   Text loops: ✅
   Tool loops: ✅
   Thinking loops: ✅
+  Degenerate: ✅
+  Outcome (no-progress): ✅
 
 Recent detections:
   [text] Text similarity 85% with message 3 (2m ago)
   [tool] repeated 3x: bash (5m ago)
+  [degenerate] bash command: degenerate repetition — "noguerol" ×5145 (5m ago)
+  [outcome] no progress: 9 near-identical bash attempts with the same failing outcome (5m ago)
 ```
 
 ### `/antiloop config`
@@ -123,6 +128,9 @@ Grouped interactive menu showing the current value in each option:
 - **🔧 call similarity** — `99 / 95 / 90 / 80%` — how identical tool-call *arguments* must be to count as the same call (default 95%: only near-identical repeats loop)
 - **🔁 call repeats** — `1 / 2 / 3` — how many times the same call must repeat before it flags (default 2)
 - **🧾 result similarity** — `95 / 80 / 60%` — how similar captured results must be to count as the *same outcome*; a repeated command that starts producing a different result is progress, not a loop (default 80%)
+- **🌀 degenerate run** — `8 / 16 / 24 / 48` — identical words in a row inside ONE message/call before it counts as stuck generation (default 16; the `noguerol ×5145` class)
+- **⛔ block degenerate bash** — on/off — refuse a degenerate bash command before it executes, feeding the reason back to the model (default on)
+- **📉 no-progress after** — `4 / 6 / 8 / 12` — same failing outcome repeated this many times (near-identical args) before flagging (default 8; the NFS `test A…QQQ` class)
 
 **📋 Task streams** — batch work (punched_log, plan_manager, …) is N tasks of one type, not a loop
 - **📋 task streams** — on/off — recognize that batch work and stay silent
@@ -133,6 +141,8 @@ Grouped interactive menu showing the current value in each option:
 - **📝 text** — on/off — detect repeated text messages
 - **🔧 tools** — on/off — detect repeated tool calls
 - **🧠 thinking** — on/off — detect repeated internal reasoning
+- **🌀 degenerate** — on/off — detect one message stuck repeating a single word/token (no repeated peer needed)
+- **📉 outcome** — on/off — detect many near-identical attempts all ending in the same failing outcome (no progress)
 
 **🧹 reset state** — clear all counters and history
 
@@ -160,13 +170,23 @@ batch no detections    → silent (exp silent — 98.9% args would match without
 loop still detected     → tool (exp tool — identical repeats are NOT a stream) ✅
 loop survives batch gate→ tool (exp tool — bash repeats are real) ✅
 stream needs ≥3 calls   → no stream (exp no stream at 2 calls) ✅
+degenerate first sight   → degenerate (bash command: "noguerol" ×402 …) ✅   ← v1.6: ONE meltdown message, no peer
+degenerate legit cmd      → ok (exp ok) ✅
+degenerate interleaved    → flag (noguerol ×150) (exp flag — freq/share clause) ✅
+degenerate glued token    → flag (noguerol ×300) (exp flag — perfect power) ✅
+degenerate turn weight    → degenerate 2, text 1 (exp 2, 1) ✅
+outcome fires on 9th      → outcome (9 near-identical bash attempts, same failing outcome) ✅   ← v1.6.1: NFS test-A…QQQ class
+outcome needs 8 prior     → silent (exp silent at 5 attempts) ✅
+outcome converging sweep  → silent (exp silent — outcomes differ = progress) ✅
+outcome diff failures     → silent (exp silent — error changed = progress) ✅
+outcome identical OKs     → silent (exp silent — success repeats ≠ loop) ✅
 ```
 
 ## How It Works
 
 ### Detection pipeline
 
-After every assistant `message_end` event, antiloop extracts the new content (text, thinking, tool calls — including their ids) and pushes it onto a sliding window of the last `detectionWindow + 5` messages. Detection itself runs at `turn_end`, once the tool results are known: results are fingerprinted and attached to the tracked calls, then the active detection strategies run against the window:
+After every assistant `message_end` event, antiloop extracts the new content (text, thinking, tool calls — including their ids) and pushes it onto a sliding window of the last `detectionWindow + 5` messages. Detection itself runs at `turn_end`, once the tool results are known: results are fingerprinted and attached to the tracked calls, then the active detection strategies run against the window. The one exception is the **degenerate** strategy: a single stuck message needs no peer and no tool result, so it is evaluated right at `message_end` — the only point before the message's own tool calls execute — and degenerate `bash` calls are also blocked at the `tool_call` hook.
 
 | Strategy | What it compares | Algorithm |
 |----------|------------------|-----------|
@@ -174,9 +194,11 @@ After every assistant `message_end` event, antiloop extracts the new content (te
 | Tool | Tool name + arguments (+ captured result) | Sequence match + near-identical args (≥ `toolSimilarityThreshold`, default 95%) *and* ≥ `minToolRepeatCount` prior recurrences. **Result veto:** if both runs captured a result and the outcomes differ, it's progress, not a loop |
 | Thinking | Internal reasoning/thinking blocks | Same as text |
 | Structural | First 10 words of each message | Opening-phrase similarity ≥ 90% across ≥ 3 messages |
+| Degenerate | One single message/call (no peer needed) | Run-length + frequency of identical words inside the payload: ≥ `degenerateMaxRun` (default 16) consecutive identical words, or one word ≥ `degenerateMaxFreq`× at ≥ `degenerateMaxShare` of all tokens; plus a perfect-power check for glued no-space tokens. Scanned at `message_end` — before the tool calls execute — and on every `bash` `tool_call` (blocking gate) |
+| Outcome | Single tool calls across the window, after the last user input | ≥ `outcomeMinRepeats` (default 8) PRIOR attempts with args ≥ `outcomeArgSimilarity` (0.85) similar AND the same *failing* outcome (failure signatures compared at ≥ `outcomeSigThreshold`, 0.7; identical OK results never count — they're the norm for batches). Catches mutated re-run loops the tool detector can't see (labels/permutations change every turn) |
 | Task stream | Same tool, many calls | When a tool appears ≥ `taskStreamMinCalls` times (default 3) in the window and *no two* calls are near-identical (`taskStreamTwinThreshold`, default 99%), the tool is an active batch: N different tasks of one type (e.g. `punched_log` appends, `plan_manager` task adds). Those calls are exempt from tool-loop detection, and text/thinking/structural patterns that only involve those batch messages are suppressed too. If even one call pair is a twin (the same task repeated), the tool is *not* a stream and detection proceeds normally |
 
-Each detected pair becomes a `LoopDetection { type, similarity, messageIndices, description }` and the consecutive counter increases.
+Each detected pair becomes a `LoopDetection { type, similarity, messageIndices, description }` and the consecutive counter increases (a degenerate turn counts `degenerateTurnWeight`, default 2 — warning on first sight).
 
 ### Intervention levels
 
@@ -184,11 +206,13 @@ Each detected pair becomes a `LoopDetection { type, similarity, messageIndices,
 |-------|---------|----------|
 | 0 (no loop) | — | Silent — passes the message through |
 | 1 (warning) | `consecutiveDetections >= warningThreshold` | Notifies the user (`⚠️`) — no message is injected into the conversation, so the model's generation is never interrupted by the warning itself |
-| 2 (force break) | `consecutiveDetections >= forceBreakThreshold` | Injects mandatory anti-loop instructions + appends a context message to the last assistant message |
-| 3 (abort) | `consecutiveDetections >= abortThreshold` | (Disabled by default) Surfaces an error asking the user for new instructions |
+| 2 (force break) | `consecutiveDetections >= forceBreakThreshold` | Steers a real break message into the running agent (`pi.sendUserMessage`, delivered right before its next LLM call) telling it to stop repeating and change approach |
+| 3 (abort) | `consecutiveDetections >= abortThreshold` | (Disabled by default) Stops the run outright via `ctx.abort()` |
 
 The level never de-escalates during an active loop; user input decays the consecutive counter naturally so a fresh prompt can break the cycle.
 
+**Degenerate turns are handled earlier than the ladder:** the meltdown is detected at `message_end` (the same moment the text/tool-call payload is complete, *before* pi preflights and executes its tools). A single degenerate turn already adds `degenerateTurnWeight` (2) consecutive points → warning on first sight; the second consecutive meltdown → force break steer; after the steer, further degenerate output counts against `ignoredSteerLimit` → hard stop. Degenerate `bash` calls are additionally refused by the `tool_call` gate (`blockDegenerateBash`) — the command never runs, and the block reason is fed back to the model as the tool error so it can still change approach.
+
 ### Similarity scoring
 
 ```
@@ -262,6 +286,92 @@ Tunables: `detectTaskStreams` (master switch), `taskStreamMinCalls` (batch
 size needed before recognition), `taskStreamTwinThreshold` (how similar args
 must be to count as *the same task* — lower it to treat near-duplicate
 entries as loops again).
+
+### Degenerate repetition: ONE message stuck on a word ≠ a reasoning loop
+
+All strategies above need at least two similar messages — they detect a model
+*repeating itself across turns*. There is a different, equally destructive
+failure mode they cannot see: the model's decoder **anchors on a token and
+stops producing new output**, repeating the same word hundreds of times
+*inside a single message or tool call*. Real case (session `2026-09-09T15-43`,
+/home/j — Qwen3.8-27B on llama.cpp): one 46 KB `bash` call whose SSH
+username wordlist repeated `noguerol` **5145 times** (a run of 5140 — 99% of
+the payload). Every cross-message detector stayed silent (nothing to compare
+against — it happened exactly once), and only a manual ESC stopped it.
+
+Antiloop v1.6 detects this **degenerate repetition** directly, on the first
+occurrence, with no peer message:
+
+- **Run-length** — a payload of ≥ `degenerateMinTokens` (50) normalized words
+  containing ≥ `degenerateMaxRun` (16) *consecutive identical* words is a
+  meltdown.
+- **Frequency share** — one word appearing ≥ `degenerateMaxFreq` (60) times
+  with ≥ `degenerateMaxShare` (40%) of all tokens catches interleaved
+  meltdowns (`A B A B A B…`) that have no long run.
+- **Perfect power** — a single giant token with no separators at all
+  (`noguerolnoguerol…`) is checked for periodicity.
+
+Tokenization uses runs of letters (unicode), so JSON stringification noise
+(escaped `\n` in stored tool args, punctuation, digits, code symbols) never
+fragments the repeated word — and legit payloads full of numbers or code
+symbols don't false-positive. 1-letter tokens are ignored as candidates
+(`{"a":1}` JSON keys can't trigger).
+
+Because the signal is conclusive, it acts **before the tools run**: the
+meltdown is caught at `message_end` (pi emits it once the assistant message is
+complete, before tool preflight), escalates immediately (one degenerate turn =
+`degenerateTurnWeight` = 2 consecutive points → warning on first sight, force
+steer on the second consecutive meltdown), and any degenerate `bash` command
+is **blocked in the `tool_call` hook** (`blockDegenerateBash`) — the 46 KB
+brute-force style command never executes. The block reason is returned to the
+model as the tool error, so the next LLM call can still change approach; only
+if it keeps melting does antiloop steer and then hard-stop the run.
+
+Legit commands are safe: real scripts never repeat one word 16+ times in a
+row inside a ≥ 50-token payload (verified against the actual sequential bash
+sweeps that motivated the tool-loop threshold). Only `bash` gets the blocking
+gate — writing a repetitive *file* (e.g. a user-requested padding fixture) is
+alerted and escalated, not refused.
+
+### No-progress outcome runs: mutated re-runs, same wall
+
+A subtler meltdown than the degenerate one: the model re-runs the SAME
+experiment over and over, mutating a cosmetic label or permutation each time
+so no call ever repeats verbatim — while the outcome stays the SAME FAILURE.
+Real case (same session, rows 95–249): ~90 ssh `exportfs`/`mount` tests,
+labels `test A` … `test QQQ`, targets alternating Javi/Compartido — every one
+ending `access denied` / `rc=32`, with fresh journalctl noise per attempt.
+The tool-loop detector is blind to it BY DESIGN (args mutate every turn:
+mean adjacent trigram similarity 0.93, but the label always changes, so the
+same call never recurs `minToolRepeatCount` times) and results only *veto*
+tool loops today — nothing used "same outcome repeated" as a positive signal.
+
+Antiloop v1.6.1's **outcome detector** closes exactly that gap, conservatively:
+
+- the LAST turn's single tool call must have a captured result that is a
+  FAILURE (fingerprints carry an error signature — `ok|fail|sig|…` — extracted
+  around the first failure marker over the FULL output, because a tool run can
+  fail with `isError=false`: the ssh pipeline exits 0 while `rc=32` lives
+  inside the text);
+- at least `outcomeMinRepeats` (default 8) PRIOR single-call turns (all after
+  the last real user message) must share BOTH args ≥ `outcomeArgSimilarity`
+  (0.85 — the same experiment reshuffled) AND the same failure signature
+  (digit-stripped signatures compared at `outcomeSigThreshold`, 0.7 — mount
+  targets that legitimately vary between attempts survive, journalctl noise
+  doesn't).
+
+Guarantees preserved: converging sweeps change outcome → silent; different
+failures = evolving diagnosis → silent; identical OKs (task-stream batches,
+file writes, idempotent verifications) never count as failures → silent;
+user-steered turns don't count → only the autonomous stretch is judged.
+Because the signal is proven no-progress, one such turn adds
+`degenerateTurnWeight` (2) points → warning on the crossing turn, force-break
+steer on the next, hard stop shortly after if the same wall persists. On the
+real session this fires at `test MM` (warn) → `NN` (steer) → `PP` (abort) —
+~50 wasted experiment turns cut.
+
+Tunables: `detectOutcomeLoops`, `outcomeMinRepeats` (lower = earlier cutoff),
+`outcomeArgSimilarity`, `outcomeSigThreshold`.
 ```
 
 ### Sliding window
@@ -282,6 +392,17 @@ Persisted as JSON at `~/.pi/agent/antiloop.json`:
   "toolSimilarityThreshold": 0.95,
   "minToolRepeatCount": 2,
   "resultSimilarityThreshold": 0.8,
+  "detectDegenerate": true,
+  "degenerateMinTokens": 50,
+  "degenerateMaxRun": 16,
+  "degenerateMaxFreq": 60,
+  "degenerateMaxShare": 0.4,
+  "degenerateTurnWeight": 2,
+  "blockDegenerateBash": true,
+  "detectOutcomeLoops": true,
+  "outcomeMinRepeats": 8,
+  "outcomeArgSimilarity": 0.85,
+  "outcomeSigThreshold": 0.7,
   "detectTaskStreams": true,
   "taskStreamMinCalls": 3,
   "taskStreamTwinThreshold": 0.99,
@@ -306,6 +427,17 @@ Persisted as JSON at `~/.pi/agent/antiloop.json`:
 | `toolSimilarityThreshold` | `0.95` | How close tool-call arguments must be (0.0–1.0) to count as the *same* call — see [tool loops](#how-it-works) |
 | `minToolRepeatCount` | `2` | Prior occurrences of a near-identical call set required before a tool loop is flagged (2 = same call seen 3×) |
 | `resultSimilarityThreshold` | `0.8` | Minimum similarity between captured result tails to still count as the *same outcome*; below this, a repeated command is treated as progress, not a loop |
+| `detectDegenerate` | `true` | Detect intra-message degenerate repetition — one message/call stuck repeating a single word (the `noguerol ×5145` class). Needs no repeated peer message; scanned at `message_end` and on every bash `tool_call` |
+| `degenerateMinTokens` | `50` | Minimum normalized tokens in a payload before it is scanned for degenerate repetition (shorter payloads aren't conclusive) |
+| `degenerateMaxRun` | `16` | Consecutive identical words inside one payload that flag it as degenerate |
+| `degenerateMaxFreq` | `60` | One word's total occurrences (with `degenerateMaxShare` of the payload) that flags interleaved meltdowns |
+| `degenerateMaxShare` | `0.4` | Frequency share (freq/total tokens) required together with `degenerateMaxFreq` |
+| `degenerateTurnWeight` | `2` | Consecutive-detection points added by one degenerate turn (2 = warning on first sight) |
+| `blockDegenerateBash` | `true` | Block a degenerate `bash` command in the `tool_call` hook before it executes; the reason is fed back to the model as the tool error |
+| `detectOutcomeLoops` | `true` | No-progress outcome runs: ≥ `outcomeMinRepeats` near-identical attempts (args ≥ `outcomeArgSimilarity`) all ending in the *same failing outcome* — the NFS `test A…QQQ` class |
+| `outcomeMinRepeats` | `8` | Prior same-failure attempts (inside the window, after the last user input) required before the outcome detector fires |
+| `outcomeArgSimilarity` | `0.85` | How similar args must be to count as the *same experiment reshuffled* (mutations of labels/permutations stay under it — distinct tasks don't) |
+| `outcomeSigThreshold` | `0.7` | Minimum similarity between digit-stripped failure signatures to count as the *same failure* |
 | `detectTaskStreams` | `true` | Recognize homogeneous batch work (same tool called with distinct content — e.g. punched/plan/obsidian extensions) and stay silent; see [task streams](#task-streams-n-tasks-of-one-type--a-loop) |
 | `taskStreamMinCalls` | `3` | Same-tool calls required inside the window before a task stream is recognized |
 | `taskStreamTwinThreshold` | `0.99` | Arguments this similar (or identical) count as *the same task* — a twin invalidates the stream and re-enables normal loop detection |
@@ -316,7 +448,7 @@ Persisted as JSON at `~/.pi/agent/antiloop.json`:
 | `maxHistoryEntries` | `100` | Max detection history entries |
 | `detectionWindow` | `10` | Number of recent messages to analyze |
 | `interactiveFooter` | `true` | TUI footer replaces the built-in one with an antiloop indicator + toggle shortcut (set `false` to keep the built-in footer and only the `setStatus` line) |
-| `toggleShortcut` | `esc+a` | Key sequence that toggles antiloop from the footer (`esc+a` or `off`). The input is never consumed, so typing is unaffected |
+| `toggleShortcut` | `esc+a` | Key sequence that toggles antiloop from the footer (`esc+a` or `off`). Honored only while pi is idle (ESC is also pi's interrupt key — typing `a` right after cancelling a stuck run must not silently switch antiloop off). The input is never consumed, so typing is unaffected |
 
 ## Best Practices
 
@@ -326,7 +458,9 @@ Persisted as JSON at `~/.pi/agent/antiloop.json`:
 4. **Per-strategy toggles** — if the model's reasoning legitimately repeats (e.g. it's working through a checklist), disable `thinking` detection and leave text/tool on.
 5. **Watch the log** — `/antiloop log` shows what's actually triggering. If you see false positives, raise `similarityThreshold` instead of disabling the strategy entirely.
 6. **Let user input clear state** — each user message decays the consecutive counter by 2, so a fresh prompt naturally resets without `/antiloop reset`.
-7. **`/antiloop test`** — runs the real detection engine (text + tool-call regression cases) to verify calibration after any change.
+7. **Degenerate detector needs no tuning for most setups** — a run of ≥ 16 identical words (or one word ≥ 40% of a ≥ 50-token payload) inside a single message is conclusive stuck generation; the 46 KB `noguerol ×5145` SSH-wordlist meltdown is caught on first sight (warning), its bash never executes (`blockDegenerateBash`), and a second consecutive meltdown gets the force-break steer. If a model legitimately writes repetitive payloads, raise `degenerateMaxRun` / `degenerateMaxFreq` via `/antiloop config` — don't disable the detector.
+8. **Outcome detector catches mutated re-run loops** — a model that re-issues the same experiment with cosmetic changes (labels, permutations) while every attempt fails identically gets a warning after `outcomeMinRepeats` (8) same-failure attempts, a steer on the next, and a hard stop shortly after. Converging sweeps, evolving failures and repeated successes stay silent by design. Lower `outcomeMinRepeats` if you want earlier cutoffs.
+9. **`/antiloop test`** — runs the real detection engine (text + tool-call + task-stream + degenerate + outcome regression cases) to verify calibration after any change.
 
 ## Architecture
 
@@ -351,10 +485,10 @@ Modular extension with zero external dependencies (only pi's bundled `@earendil-
 
 - **Levenshtein + trigram Jaccard** hybrid — small texts use edit distance, large texts use n-gram overlap (each is O(N) in text length)
 - **Sliding window** — only the last `detectionWindow` messages participate, capping memory at O(W × message_size)
-- **Early bail** — short messages and empty tool calls skip similarity computation entirely
+- **Early bail** — short messages and empty tool calls skip similarity computation entirely; the degenerate scan is a single linear tokenization pass
 - **TUI integration** — uses `ctx.ui.select` for the config menu and the log viewer; `ctx.ui.notify` for state notifications; `ctx.ui.setStatus` + a custom `ctx.ui.setFooter` component for the persistent footer indicator, live level info, and the `esc+a` keyboard toggle (`ctx.ui.onTerminalInput`, never consumes input)
-- **Hooks** — `message_end` (track messages + tool call ids), `turn_end` (attach result fingerprints, detect, and intervene: steer the force break / abort the run), `input` (decay on real user messages only), `session_start` (load config + install footer + reset), `session_shutdown` (restore built-in footer)
-- **Intervention runs on the turn loop, not on user prompts** — escalation is decided at `turn_end`, the break is steered into the running agent before its next LLM call, and the guaranteed hard stop aborts the run (`ctx.abort`, fire-and-forget — never awaited, so the hook can't deadlock). No custom-role messages are injected into the conversation at any level (steering a real user message + aborting are the only levers; custom-role injections were removed because a model can stall on an unexpected injected message)
+- **Hooks** — `message_end` (track messages + tool call ids with a monotonic sequence so the sliding-window trim can never collide turn indices, and pre-handle degenerate meltdowns — the message is complete but its tools haven't executed yet), `tool_call` (block degenerate `bash` commands before they run), `turn_end` (attach result fingerprints with failure signatures, detect — including no-progress outcome runs — and intervene: steer the force break / abort the run), `input` (decay on real user messages only), `session_start` (load config + install footer + reset), `session_shutdown` (restore built-in footer)
+- **Intervention runs on the turn loop, not on user prompts** — escalation is decided at `turn_end` (and at `message_end` for the self-contained degenerate signal), the break is steered into the running agent before its next LLM call, and the guaranteed hard stop aborts the run (`ctx.abort`, fire-and-forget — never awaited, so the hook can't deadlock). No custom-role messages are injected into the conversation at any level (steering a real user message + aborting are the only levers; custom-role injections were removed because a model can stall on an unexpected injected message)
 
 ## License
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-antiloop",
-  "version": "1.5.0",
-  "description": "Antiloop: detect reasoning loops and force a break (warn \u2192 force \u2192 abort) across text, tool, thinking, and structural patterns. The force break is delivered mid-run: a real break message is steered into the running agent right before its next LLM call, and if the model ignores it and keeps repeating verbatim, antiloop aborts the run \u2014 an autonomous tool loop always terminates. Tool-loop detection is result-aware: only near-identical repeated calls with the same outcome count, so sequential bash operations and retries that make progress don't false-positive. Task-stream recognition: when an extension (punched, plan, \u2026) makes the model call the SAME tool many times with DIFFERENT content \u2014 N distinct tasks of one type, e.g. appending lines or adding plan tasks \u2014 antiloop stays silent.",
+  "version": "1.6.1",
+  "description": "Antiloop: detect reasoning loops and force a break (warn → force → abort) across text, tool, thinking, structural, degenerate-repetition, and no-progress outcome patterns. Degenerate (one message stuck repeating a word hundreds of times — noguerol ×5145) is caught at message_end and its bash blocked before executing. No-progress (the NFS test-A…QQQ class: ~90 mutated re-runs of the same experiment, every one failing identically) fires when the same failing outcome repeats ≥ outcomeMinRepeats times with near-identical args. Fixes antiloop going blind mid-session: tracked messages use a monotonic sequence so the trim of the sliding window can never collide turn indices. The force break is delivered mid-run (steer before the next LLM call) and if the model ignores it antiloop aborts the run — an autonomous tool loop always terminates. Result-aware tool-loop detection keeps sequential bash and converging sweeps quiet; task-stream recognition keeps punched/plan batch work quiet.",
   "keywords": [
     "pi-package",
     "antiloop",

package/src/commands.ts

@@ -58,9 +58,11 @@ async function showStatus(ctx: ExtensionCommandContext, rt: Runtime): Promise<vo
 		`  similarity: ${(rt.config.similarityThreshold * 100).toFixed(0)}%  window: ${rt.config.detectionWindow}`,
 		`  tool sim: ${(rt.config.toolSimilarityThreshold * 100).toFixed(0)}%  tool repeat: ${rt.config.minToolRepeatCount}+ prior`,
 		`  result sim: ${(rt.config.resultSimilarityThreshold * 100).toFixed(0)}%  (same cmd + diff outcome = no loop)`,
+		`  degenerate: run ≥ ${rt.config.degenerateMaxRun} same word · freq ≥ ${rt.config.degenerateMaxFreq} @ ${(rt.config.degenerateMaxShare * 100).toFixed(0)}% (≥ ${rt.config.degenerateMinTokens} tokens) · weight ${rt.config.degenerateTurnWeight} · block bash ${yn(rt.config.blockDegenerateBash)}`,
+		`  outcome: same failing result ≥ ${rt.config.outcomeMinRepeats} attempts (args ≥ ${(rt.config.outcomeArgSimilarity * 100).toFixed(0)}% sim, sig ≥ ${(rt.config.outcomeSigThreshold * 100).toFixed(0)}%)`,
 		`  task streams: ${yn(rt.config.detectTaskStreams)} (min ${rt.config.taskStreamMinCalls} calls, twins ≥ ${(rt.config.taskStreamTwinThreshold * 100).toFixed(0)}%)`,
 		"",
-		`detectors: text ${yn(rt.config.detectTextLoops)} · tool ${yn(rt.config.detectToolLoops)} · think ${yn(rt.config.detectThinkingLoops)}`,
+		`detectors: text ${yn(rt.config.detectTextLoops)} · tool ${yn(rt.config.detectToolLoops)} · think ${yn(rt.config.detectThinkingLoops)} · degenerate ${yn(rt.config.detectDegenerate)} · outcome ${yn(rt.config.detectOutcomeLoops)}`,
 		`footer: interactive ${yn(rt.config.interactiveFooter)} · toggle: ${rt.config.toggleShortcut}`,
 	];
 	if (rt.state.activeTaskStreams.length) {
@@ -91,6 +93,11 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 		{ value: "toolSim" as const, label: `🔧 call similarity: ${(c.toolSimilarityThreshold * 100).toFixed(0)}%`, description: "how identical tool calls must be to count as the same call" },
 		{ value: "toolRepeat" as const, label: `🔁 call repeats: ${c.minToolRepeatCount}+`, description: "how many times the same call must repeat before it flags" },
 		{ value: "resultSim" as const, label: `🧾 result similarity: ${(c.resultSimilarityThreshold * 100).toFixed(0)}%`, description: "same command + different result = progress, not a loop" },
+		// ── 🌀 Degenerate (intra-message meltdown) ───────────────────────
+		{ value: "degRun" as const, label: `🌀 degenerate run: ≥ ${c.degenerateMaxRun}`, description: "identical words in a row inside ONE message/call before it counts as stuck generation (noguerol ×5145 class)" },
+		{ value: "degBlock" as const, label: `⛔ block degenerate bash: ${yn(c.blockDegenerateBash)}`, description: "stop a degenerate command before it executes (default on)" },
+		// ── 📉 Outcome (no-progress) ────────────────────────────────
+		{ value: "outcomeMin" as const, label: `📉 no-progress after: ${c.outcomeMinRepeats}`, description: "same failing outcome repeated this many times (mutated args ≥ 85% similar) before flagging — the NFS test-A…QQQ class" },
 		// ── 📋 Task streams ─────────────────────────────────────────
 		{ value: "streams" as const, label: `📋 task streams: ${yn(c.detectTaskStreams)}`, description: "batch work (punched_log / plan_manager / …) is not a loop" },
 		{ value: "streamMin" as const, label: `📋 stream min calls: ${c.taskStreamMinCalls}`, description: "calls of the same tool before a batch is recognized" },
@@ -99,6 +106,8 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 		{ value: "text" as const, label: `📝 text: ${yn(c.detectTextLoops)}`, description: "detect repeated text messages" },
 		{ value: "tool" as const, label: `🔧 tools: ${yn(c.detectToolLoops)}`, description: "detect repeated tool calls" },
 		{ value: "think" as const, label: `🧠 thinking: ${yn(c.detectThinkingLoops)}`, description: "detect repeated internal reasoning" },
+		{ value: "deg" as const, label: `🌀 degenerate: ${yn(c.detectDegenerate)}`, description: "detect ONE message stuck repeating a single word/token (no repeated peer needed)" },
+		{ value: "outcome" as const, label: `📉 outcome: ${yn(c.detectOutcomeLoops)}`, description: "detect many near-identical attempts all ending in the SAME failing outcome (no progress)" },
 		// ── 🧹 ──────────────────────────────────────────────────────
 		{ value: "reset" as const, label: "🧹 reset state", description: "clear counters and history" },
 	]);
@@ -208,6 +217,29 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 			if (v !== undefined) { c.resultSimilarityThreshold = v; saveConfig(c); ctx.ui.notify(`result similarity: ${(v * 100).toFixed(0)}%`, "info"); }
 			break;
 		}
+		case "degRun": {
+			const v = await selectFrom(ctx, "🌀 degenerate run (identical words in a row inside one payload)", [
+				{ value: 8, label: "⚡ 8 (sensitive)" },
+				{ value: 16, label: "🎯 16 (default)" },
+				{ value: 24, label: "24" },
+				{ value: 48, label: "🐢 48 (relaxed)" },
+			]);
+			if (v !== undefined) { c.degenerateMaxRun = v; saveConfig(c); ctx.ui.notify(`degenerate run: ≥ ${v}`, "info"); }
+			break;
+		}
+		case "degBlock":
+			c.blockDegenerateBash = !c.blockDegenerateBash; saveConfig(c);
+			ctx.ui.notify(`block degenerate bash: ${yn(c.blockDegenerateBash)}`, "info"); break;
+		case "outcomeMin": {
+			const v = await selectFrom(ctx, "📉 no-progress threshold (same failing outcome, near-identical args)", [
+				{ value: 4, label: "⚡ 4 (sensitive — long experiment series get cut early)" },
+				{ value: 6, label: "6" },
+				{ value: 8, label: "🎯 8 (default)" },
+				{ value: 12, label: "🐢 12 (relaxed)" },
+			]);
+			if (v !== undefined) { c.outcomeMinRepeats = v; saveConfig(c); ctx.ui.notify(`no-progress after: ${v}`, "info"); }
+			break;
+		}
 		case "streams":
 			c.detectTaskStreams = !c.detectTaskStreams; saveConfig(c);
 			ctx.ui.notify(`task streams: ${yn(c.detectTaskStreams)}`, "info"); break;
@@ -248,6 +280,12 @@ async function showConfigMenu(ctx: ExtensionCommandContext, rt: Runtime): Promis
 		case "think":
 			c.detectThinkingLoops = !c.detectThinkingLoops; saveConfig(c);
 			ctx.ui.notify(`thinking: ${yn(c.detectThinkingLoops)}`, "info"); break;
+		case "deg":
+			c.detectDegenerate = !c.detectDegenerate; saveConfig(c);
+			ctx.ui.notify(`degenerate: ${yn(c.detectDegenerate)}`, "info"); break;
+		case "outcome":
+			c.detectOutcomeLoops = !c.detectOutcomeLoops; saveConfig(c);
+			ctx.ui.notify(`outcome: ${yn(c.detectOutcomeLoops)}`, "info"); break;
 		case "reset":
 			resetState(rt.state);
 			ctx.ui.notify("🧹 state reset", "info");
@@ -280,6 +318,7 @@ export function resetState(state: AntiloopState): void {
 	state.lastDetectedTurnIndex = -1;
 	state.steerDelivered = false;
 	state.ignoredSteerCount = 0;
+	state.turnSeq = 0;
 }
 
 async function runSelfTest(ctx: ExtensionCommandContext): Promise<void> {

package/src/config.ts

@@ -17,6 +17,17 @@ export const DEFAULT_CONFIG: AntiloopConfig = {
 	toolSimilarityThreshold: 0.95,
 	minToolRepeatCount: 2,
 	resultSimilarityThreshold: 0.8,
+	detectDegenerate: true,
+	degenerateMinTokens: 50,
+	degenerateMaxRun: 16,
+	degenerateMaxFreq: 60,
+	degenerateMaxShare: 0.4,
+	degenerateTurnWeight: 2,
+	blockDegenerateBash: true,
+	detectOutcomeLoops: true,
+	outcomeMinRepeats: 8,
+	outcomeArgSimilarity: 0.85,
+	outcomeSigThreshold: 0.7,
 	detectTaskStreams: true,
 	taskStreamMinCalls: 3,
 	taskStreamTwinThreshold: 0.99,

package/src/detect.ts

@@ -34,6 +34,166 @@ function opening(text: string, n = 10): string {
 	return normalizeText(text.split(/\s+/).slice(0, n).join(" "));
 }
 
+// ---------------------------------------------------------------------------
+// Intra-message degenerate repetition (v1.6).
+//
+// The "noguerol ×5145" class (verified against a real session — /home/j
+// 2026-09-09T15-43: ONE 46 KB bash call whose SSH username list repeats a
+// single word 5145 times, a run of 5140 — 99% of the payload). A model whose
+// decoder anchors on a token stops producing NEW output: it repeats the same
+// word hundreds of times INSIDE one message or tool call. The cross-message
+// detectors (text / tool / thinking / structural) all need >= 2 similar
+// messages and cannot see this — the meltdown happened exactly once, inside a
+// single call, and antiloop stayed silent until the user ESC'd.
+//
+// This detector is self-contained: it flags the FIRST such payload, no peer
+// message required, and it is cheap enough to run at message_end (before the
+// tool calls execute) and on every bash tool_call (blocking gate).
+// ---------------------------------------------------------------------------
+
+/** Longest run / top frequency of ONE repeated word inside a payload. */
+export interface DegenerateInfo {
+	token: string;
+	freq: number;
+	maxRun: number;
+	total: number;
+}
+
+export interface DegenerateHit extends DegenerateInfo {
+	where: string;
+}
+
+/** Ignore 1-letter tokens as candidates (JSON keys like {"a":1} must not flag). */
+const MIN_TOKEN_LEN = 2;
+
+/**
+ * Detect pathological single-word repetition in a payload (assistant text or a
+ * JSON.stringify'd tool-call argument). Returns the repeated word with its
+ * count, longest consecutive run and payload size, or undefined when the
+ * payload is normal.
+ *
+ * Tokenization: runs of unicode letters, lowercased. Stored tool args are
+ * JSON-escaped (real newlines arrived as the two characters `\n`), so escaped
+ * whitespace is normalized back to a separator first — a word list written
+ * across lines must still tokenize word by word. Digits/punctuation/code
+ * symbols split tokens instead of polluting them.
+ *
+ * Signals (both are conclusive for generation quality):
+ *   - a run of >= degenerateMaxRun consecutive identical words, or
+ *   - one word occurring >= degenerateMaxFreq times with >= degenerateMaxShare
+ *     of all tokens (catches interleaved "A B A B" meltdowns with no run).
+ * A payload must have >= degenerateMinTokens tokens to be scanned.
+ */
+export function findDegenerateRepetition(
+	text: string,
+	config: AntiloopConfig,
+): DegenerateInfo | undefined {
+	let s = String(text).replace(/\\+[nrt]/g, " ").toLowerCase();
+	const raw = s.match(/[\p{L}]+/gu);
+	if (!raw) return undefined;
+	const total = raw.length;
+
+	let maxRun = 0;
+	let runToken = "";
+	let prev = "";
+	let run = 0;
+	const freq = new Map<string, number>();
+	for (const t of raw) {
+		if (t.length < MIN_TOKEN_LEN) {
+			run = 0;
+			prev = "";
+			continue;
+		}
+		freq.set(t, (freq.get(t) ?? 0) + 1);
+		if (t === prev) run++;
+		else {
+			run = 1;
+			prev = t;
+		}
+		if (run > maxRun) {
+			maxRun = run;
+			runToken = t;
+		}
+	}
+	let topToken = "";
+	let topFreq = 0;
+	for (const [t, c] of freq) {
+		if (c > topFreq) {
+			topFreq = c;
+			topToken = t;
+		}
+	}
+	if (total >= config.degenerateMinTokens) {
+		if (maxRun >= config.degenerateMaxRun) {
+			return { token: runToken, freq: freq.get(runToken) ?? topFreq, maxRun, total };
+		}
+		if (topFreq >= config.degenerateMaxFreq && topFreq / total >= config.degenerateMaxShare) {
+			return { token: topToken, freq: topFreq, maxRun, total };
+		}
+	}
+
+	// No-space meltdown: one giant periodic token ("noguerolnoguerol…" with all
+	// separators stripped) is a perfect power of a short motif. Independent of
+	// the token-count gate: a single 1200+ char token has no word runs at all.
+	if (raw.length <= 2) {
+		const single = raw.join("");
+		const len = single.length;
+		if (len >= 1200) {
+			for (let p = 3; p <= 200 && p * 12 <= len; p++) {
+				if (len % p) continue;
+				const motif = single.slice(0, p);
+				let ok = true;
+				for (let i = p; i < len; i += p) {
+					if (!single.startsWith(motif, i)) {
+						ok = false;
+						break;
+					}
+				}
+				if (ok) {
+					const repeats = len / p;
+					if (repeats >= 12) {
+						return { token: motif.slice(0, 40), freq: repeats, maxRun: repeats, total: repeats };
+					}
+				}
+			}
+		}
+	}
+	return undefined;
+}
+
+/** Scan one assistant message (text + each tool-call argument) for a meltdown. */
+export function scanMessageDegenerate(
+	content: string,
+	toolCalls: TrackedToolCall[] | undefined,
+	config: AntiloopConfig,
+): DegenerateHit | undefined {
+	if (!config.detectDegenerate) return undefined;
+	if (content && content.length) {
+		const d = findDegenerateRepetition(content, config);
+		if (d) return { ...d, where: "message text" };
+	}
+	for (const tc of toolCalls ?? []) {
+		if (!tc.args) continue;
+		const d = findDegenerateRepetition(tc.args, config);
+		if (d) return { ...d, where: tc.name === "bash" ? "bash command" : `args(${tc.name})` };
+	}
+	return undefined;
+}
+
+export function degenerateDescription(hit: DegenerateHit): string {
+	const share = hit.total ? Math.round((hit.freq / hit.total) * 100) : 100;
+	return `${hit.where}: degenerate repetition — "${hit.token}" ×${hit.freq} (${share}% of ${hit.total} tokens, longest run ${hit.maxRun})`;
+}
+
+/** Consecutive-detection weight of a detection turn. The strong
+ * self-contained signals (degenerate meltdown, proven no-progress outcome run)
+ * add degenerateTurnWeight (default 2) points so the FIRST one already reaches
+ * the warning level and escalation is fast on repeat. */
+export function detectionTurnWeight(detections: LoopDetection[], config: AntiloopConfig): number {
+	const strong = detections.some((d) => d.type === "degenerate" || d.type === "outcome");
+	return strong ? Math.max(1, config.degenerateTurnWeight) : 1;
+}
+
 function similarity(a: string, b: string): number {
 	if (a.length < MIN_CONTENT_LENGTH || b.length < MIN_CONTENT_LENGTH) return 0;
 	if (a === b) return 1;
@@ -74,7 +234,18 @@ export function resultFingerprint(
 	}
 	const norm = normalizeText(text);
 	if (!norm.length) return undefined;
-	return `${isError ? "err" : "ok"}|${norm.slice(-400)}`;
+	// A tool run can FAIL while isError stays false (the NFS mount errors: the
+	// ssh pipeline exits 0 after grep/echo, rc=32 lives inside the output). The
+	// tail-only fingerprint would cut the failure markers away AND the tail is
+	// noisy (journalctl timestamps differ per attempt), so for failures we keep
+	// a SHORT ERROR SIGNATURE around the first failure marker — it repeats
+	// verbatim across attempts of the same failure and makes same-outcome
+	// comparisons robust. Formats: "err|…" / "ok|fail|sig|…|tail" / "ok|…".
+	const failed = FAIL_MARKERS.test(norm);
+	if (!failed) return `${isError ? "err" : "ok"}|${norm.slice(-400)}`;
+	const at = norm.search(FAIL_MARKERS);
+	const sig = norm.slice(Math.max(0, at - 60), at + 160);
+	return `${isError ? "err" : "ok"}|fail|${sig}|${norm.slice(-400)}`;
 }
 
 /** Same outcome = identical fingerprint, or high similarity of the tails. */
@@ -89,6 +260,44 @@ function sameOutcome(a: string, b: string, threshold: number): boolean {
 	return s >= threshold && s > 0;
 }
 
+// Failure markers on a NORMALIZED fingerprint tail (lowercased, punctuation
+// stripped — "rc=32" arrives as "rc32"). A conservative "this attempt failed"
+// test: rc ≠ 0, denials, missing files, refusals, syntax crashes… Generic
+// words like "error"/"failed" are intentionally NOT markers (legit outputs
+// like "0 failed, 12 passed" must not count as failures).
+const FAIL_MARKERS =
+	/\b(denied|no such file|not found|cannot|unable|refused|syntax error|timed out|timeout|exception|traceback|fatal|core dumped|rc\s*[1-9]\d*)\b/i;
+
+/** True when a captured result fingerprint represents a FAILED attempt.
+ * Used by the no-progress outcome detector so only repeated FAILURES (not
+ * repeated identical successes, which are the norm for task-stream batches
+ * like "logged" or file writes) count as a stuck loop. */
+export function isFailResult(fp: string | undefined): boolean {
+	if (!fp) return false;
+	if (fp.startsWith("err|") || fp.startsWith("ok|fail|")) return true;
+	return FAIL_MARKERS.test(fp);
+}
+
+/** The short error signature embedded in a failure fingerprint
+ * ("ok|fail|SIG|tail"), if present. */
+function failSig(fp: string): string | undefined {
+	const m = /^(?:err|ok)\|fail\|(.*?)\|/.exec(fp);
+	return m ? m[1] : undefined;
+}
+
+/** Same-FAILURE comparison for the outcome detector. Prefers the embedded error
+ * signatures (they repeat across attempts of the same failure) with digits
+ * stripped — timestamps, PIDs and rc values are noise; the target words that
+ * legitimately vary between attempts (Javi vs Compartido) survive but the
+ * threshold is looser than the veto threshold on purpose. Falls back to the
+ * full fingerprints when no signature is present. */
+function sameFailure(a: string, b: string, threshold: number): boolean {
+	const sa = failSig(a);
+	const sb = failSig(b);
+	if (sa && sb) return sameOutcome(sa.replace(/\d+/g, ""), sb.replace(/\d+/g, ""), threshold);
+	return sameOutcome(a, b, threshold);
+}
+
 function toolCallsSimilar(
 	c1: TrackedToolCall[],
 	c2: TrackedToolCall[],
@@ -177,11 +386,28 @@ export function detectTaskStreams(
 export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopDetection[] {
 	const out: LoopDetection[] = [];
 	const msgs = state.recentMessages;
-	if (msgs.length < 2) return out;
+	if (msgs.length < 1) return out;
 	const start = Math.max(0, msgs.length - config.detectionWindow);
 	const win = msgs.slice(start);
 	const now = Date.now();
 
+	// Intra-message degenerate repetition fires on a SINGLE pathological message
+	// (no peer needed) and is independent of the task-stream batch gate: a
+	// meltdown is a meltdown even mid-batch.
+	if (config.detectDegenerate) {
+		const last = win[win.length - 1];
+		const hit = scanMessageDegenerate(last.content, last.toolCalls, config);
+		if (hit) {
+			out.push({
+				type: "degenerate",
+				similarity: 1,
+				messageIndices: [msgs.length - 1],
+				description: degenerateDescription(hit),
+				timestamp: now,
+			});
+		}
+	}
+
 	// Task-stream gate: if the window is a homogeneous batch (same extension
 	// tool called with DISTINCT content ≥ taskStreamMinCalls times), that tool
 	// is exempt from tool-loop detection, and text/thinking/structural
@@ -264,6 +490,68 @@ export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopD
 		}
 	}
 
+	// -------------------------------------------------------------------
+	// No-progress outcome runs (v1.6.1).
+	//
+	// The NFS-test session (/home/j 2026-09-09, rows 95–249): ~90 mutated
+	// re-runs of the SAME experiment (sshpass+sudo+exportfs+mount, labels
+	// "test A"…"test QQQ"), every one failing identically (rc=32 / access
+	// denied). The tool-loop detector is blind to it BY DESIGN: args mutate
+	// every turn (mean adjacent trigram similarity 0.93, but the label always
+	// changes) so the same call never recurs >= minToolRepeatCount times, and
+	// identical results only VETO tool loops — nothing uses "same outcome
+	// repeated" as a positive signal. A human sees it instantly: many attempts,
+	// same wall, zero progress.
+	//
+	// Signal: the LAST turn's single tool call has a captured result, and at
+	// least outcomeMinRepeats PRIOR single-call turns (after the last real user
+	// message — an autonomous stretch, not user-steered iteration) share BOTH
+	// args >= outcomeArgSimilarity (the same experiment reshuffled) AND the same
+	// outcome (>= resultSimilarityThreshold). Legit work is untouched: distinct
+	// operations fail with distinct output; converging sweeps change outcome;
+	// batch/stream messages are excluded; a success interspersed resets the
+	// class. similarity 0.99 => after a force break, further same-outcome turns
+	// count as "ignoring the break" (isVerbatimRepeat) and escalate to the hard
+	// stop, exactly like verbatim tool loops.
+	// -------------------------------------------------------------------
+	if (config.detectOutcomeLoops) {
+		const last = win[win.length - 1];
+		const lastCalls = last.toolCalls;
+		const afterUser = state.lastUserMessageTime;
+		if (lastCalls && lastCalls.length === 1) {
+			const lc = lastCalls[0];
+			// Failure gate: only repeated FAILURES prove no progress. Task-stream
+			// batches (punched_log appends, obsidian/file writes) legitimately
+			// produce the SAME OK outcome every call — they must never count. And
+			// batch messages must NOT be skipped here: a "bash ×N stream" with
+			// identical failures is exactly the no-progress loop to catch.
+			if (lc.result && isFailResult(lc.result)) {
+				let matches = 0;
+				for (let i = 0; i < win.length - 1; i++) {
+					const m = win[i];
+					if (m.timestamp <= afterUser) continue; // user-steered turns don't count
+					const prev = m.toolCalls;
+					if (!prev || prev.length !== 1) continue;
+					const pc = prev[0];
+					if (pc.name !== lc.name || !pc.result) continue;
+					if (!sameFailure(lc.result, pc.result, config.outcomeSigThreshold)) continue;
+					if (!argsTwin(lc.args, pc.args, config.outcomeArgSimilarity)) continue;
+					matches++;
+				}
+				if (matches >= config.outcomeMinRepeats) {
+					out.push({
+						type: "outcome",
+						similarity: 0.99,
+						messageIndices: [msgs.length - 1],
+						description:
+							`no progress: ${matches + 1} near-identical ${lc.name} attempts (args ≥ ${(config.outcomeArgSimilarity * 100).toFixed(0)}% similar) with the same failing outcome — “${lc.result.slice(0, 90)}”`,
+						timestamp: now,
+					});
+				}
+			}
+		}
+	}
+
 	if (config.detectThinkingLoops) {
 		const last = win[win.length - 1];
 		if (last.thinking && last.thinking.length > 50) {
@@ -297,11 +585,13 @@ export function nextLevel(consecutiveDetections: number, config: AntiloopConfig)
 }
 
 /** True when detections prove the model repeated a message/tool call essentially
- * verbatim (≥98% text similarity or an identical tool-loop). Weaker signals
- * (thinking echoes, structural repeated openings at 90%) do NOT count — a model
- * that only *thinks* in circles but varies its actual output is still making an
- * attempt and must not be hard-stopped. Used post-force-break: only verbatim
- * repeats prove the model ignored the break instruction. */
+ * verbatim (≥98% text similarity or an identical tool-loop), OR produced a
+ * degenerate meltdown, OR kept re-running the same experiment with the same
+ * failing outcome (no-progress, sim 0.99). Weaker signals (thinking echoes,
+ * structural repeated openings at 90%) do NOT count — a model that only *thinks*
+ * in circles but varies its actual output is still making an attempt and must
+ * not be hard-stopped. Used post-force-break: only verbatim repeats and proven
+ * no-progress repeats show the model ignored the break instruction. */
 export function isVerbatimRepeat(detections: LoopDetection[]): boolean {
 	return detections.some((d) => d.type !== "thinking" && d.similarity >= 0.98);
 }
@@ -383,11 +673,14 @@ export function runSelfTest(): string[] {
 		detectTextLoops: true, notifyOnDetection: true, maxHistoryEntries: 100,
 		detectionWindow: 10, interactiveFooter: true, toggleShortcut: "esc+a",
 		detectTaskStreams: true, taskStreamMinCalls: 3, taskStreamTwinThreshold: 0.99,
+		detectDegenerate: true, degenerateMinTokens: 50, degenerateMaxRun: 16,
+		degenerateMaxFreq: 60, degenerateMaxShare: 0.4, degenerateTurnWeight: 2, blockDegenerateBash: true,
+		detectOutcomeLoops: true, outcomeMinRepeats: 8, outcomeArgSimilarity: 0.85, outcomeSigThreshold: 0.7,
 	};
 	const asState = (recentMessages: TrackedMessage[]): AntiloopState =>
 		({ recentMessages, detections: [], activeTaskStreams: [], currentLevel: 0,
 			consecutiveDetections: 0, inForcedBreak: false, totalDetections: 0,
-			lastUserMessageTime: 0, lastDetectedTurnIndex: -1,
+			lastUserMessageTime: 0, lastDetectedTurnIndex: -1, turnSeq: 0,
 			steerDelivered: false, ignoredSteerCount: 0 });
 	const NARR = "Now I will append the next decision entry to the project memory document so we keep the context.";
 
@@ -443,5 +736,141 @@ export function runSelfTest(): string[] {
 	out.push(`thinking-only 1.00        → ${isVerbatimRepeat(dl("thinking", 1)) ? "yes" : "no"} (exp no — output varies) ${!isVerbatimRepeat(dl("thinking", 1)) ? "✅" : "❌"}`);
 	out.push(`structural 0.90           → ${isVerbatimRepeat(dl("structural", 0.9)) ? "yes" : "no"} (exp no) ${!isVerbatimRepeat(dl("structural", 0.9)) ? "✅" : "❌"}`);
 
+	// --- v1.6: intra-message degenerate repetition (single-message meltdown) ---
+	// Regression: the real session /home/j 2026-09-09T15-43 — ONE 46 KB bash call
+	// whose username list repeats "noguerol" 5145 times (run of 5140). Every
+	// cross-message detector needs a peer message and stayed silent; the
+	// degenerate scan must fire on the FIRST such message, alone in the window.
+	const argJson = (cmd: string) => JSON.stringify({ command: cmd }); // stored args form
+	const meltdownCmd =
+		`echo "=== brute usernames with petete pw ==="; for u in noguerol noguerol@ j javi javi@ root petete ${`noguerol `.repeat(400)}; do :; done`;
+	const meltMsg = mk("", [{ name: "bash", args: argJson(meltdownCmd) }]);
+	const mDet = detectLoops(asState([meltMsg]), tcfg);
+	const mHit = mDet.find((d) => d.type === "degenerate");
+	out.push(`degenerate first sight   → ${mHit ? `degenerate (${mHit.description})` : "no"} (exp degenerate — was the miss) ${mHit ? "✅" : "❌"}`);
+
+	// Legit payloads must NOT flag: short commands are under minTokens, real
+	// scripts never repeat one word 16× in a row.
+	const leg1 = findDegenerateRepetition(sweepRun1, tcfg);
+	const leg2 = findDegenerateRepetition("for i in 1 2 3; do echo step $i; done", tcfg);
+	const leg3 = findDegenerateRepetition(
+		"set -euo pipefail; mkdir -p build tmp dist logs data assets src test docs lib bin etc usr var opt srv && " +
+			"cp -r config.yaml README.md LICENSE package.json tsconfig.json src lib test docs assets && " +
+			"chmod +x scripts/deploy.sh scripts/backup.sh scripts/monitor.sh && " +
+			"./scripts/deploy.sh --env production --region eu-west-1 --tag v1.2.3 --dry-run false > deploy.log 2>&1 || echo deploy failed",
+		tcfg,
+	);
+	out.push(`degenerate legit cmd      → ${leg1 || leg2 || leg3 ? "flag" : "ok"} (exp ok) ${!leg1 && !leg2 && !leg3 ? "✅" : "❌"}`);
+
+	// Interleaved meltdown ("A B A B…") has no long run — caught via freq/share.
+	const inter = findDegenerateRepetition("noguerol petete ".repeat(150), tcfg);
+	out.push(`degenerate interleaved    → ${inter ? `flag (${inter.token} ×${inter.freq})` : "no"} (exp flag — freq/share clause) ${inter ? "✅" : "❌"}`);
+
+	// Word list written ACROSS lines: separators are the literal "\n" escapes
+	// inside the stored JSON args — must still tokenize word by word.
+	const acrossLines = argJson("for u in " + "noguerol\n".repeat(120) + "done");
+	const linesHit = findDegenerateRepetition(acrossLines, tcfg);
+	out.push(`degenerate across \n      → ${linesHit ? `flag (${linesHit.token} ×${linesHit.freq})` : "no"} (exp flag — escaped newlines) ${linesHit ? "✅" : "❌"}`);
+
+	// No-space giant token ("noguerol" glued) — perfect-power clause.
+	const glued = findDegenerateRepetition("noguerol".repeat(300), tcfg);
+	out.push(`degenerate glued token    → ${glued ? `flag (${glued.token} ×${glued.freq})` : "no"} (exp flag — perfect power) ${glued ? "✅" : "❌"}`);
+
+	// Turn weight: one degenerate turn = 2 consecutive points (warning on first
+	// sight), normal turns stay at 1.
+	const wDeg = detectionTurnWeight(mDet, tcfg);
+	const wTxt = detectionTurnWeight(dl("text", 0.8), tcfg);
+	out.push(`degenerate turn weight    → degenerate ${wDeg}, text ${wTxt} (exp 2, 1) ${wDeg === 2 && wTxt === 1 ? "✅" : "❌"}`);
+
+	// --- v1.6.1: no-progress outcome runs (mutated re-runs, same outcome) ---
+	// Regression: the NFS session — ~90 mutated re-runs of the SAME experiment
+	// (ssh exportfs/mount, labels test A…test QQQ, targets alternating Javi /
+	// Compartido), every one failing rc=32. Args mutate each turn (same call
+	// never recurs → tool-loop silent) and journalctl noise varies per attempt,
+	// but the FAILURE SIGNATURE repeats: that IS the loop. Fires on the 9th
+	// attempt (8 prior same-failure matches ≥ outcomeMinRepeats).
+	const nfsCmd = (label: string, target: string) =>
+		argJson(
+			`sshpass -p X ssh -o ConnectTimeout=10 noguerol@petete 'cd /tmp && echo X | sudo -S bash -c "echo --- test ${label}: rootdir=/volume2, absolute paths, fsid=0 and 1, mount /${target} ---; ` +
+			`cat > /etc/exports << EOF\n/volume2/NAS-8TB-Javi *(rw,sync,no_subtree_check,fsid=0)\nEOF\nexportfs -ra\nsystemctl restart nfs-server\n` +
+			`mount -t nfs4 -o vers=4.2 127.0.0.1:/${target} /tmp/nfstest 2>&1; echo rc=\$?; journalctl -u nfs-mountd | tail -4"' 2>&1`,
+		);
+	const nfsFailFor = (target: string, sec: number) =>
+		resultFingerprint(
+			[
+				{
+					type: "text",
+					text:
+						`--- mount /${target} --- | mount.nfs4: access denied by server while mounting 127.0.0.1:/${target} rc=32 | ` +
+						`Sep 09 18:${sec} petete systemd[1]: Started nfs-mountd.service (PID ${1000 + sec})`,
+				},
+			],
+			false,
+		)!;
+	const nfsOk = resultFingerprint([{ type: "text", text: "rc=0 | TARGET SOURCE FSTYPE | /tmp/nfstest 127.0.0.1:/  nfs4  rw,relatime" }], false)!;
+	const targets = ["NAS-8TB-Javi", "NAS-8TB-Compartido"];
+	const nfsMsgs = [..."ABCDEFGHI"].map((l, idx) =>
+		mk("", [{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: nfsFailFor(targets[idx % 2], 100 + idx) }]),
+	);
+	const nfsDet = detectLoops(asState(nfsMsgs), tcfg);
+	const nfsHit = nfsDet.find((d) => d.type === "outcome");
+	out.push(`outcome fires on 9th      → ${nfsHit ? `outcome (${nfsHit.description.slice(0, 100)}…)` : nfsDet.map((d) => d.type).join(",") || "no"} (exp outcome — mixed targets) ${nfsHit ? "✅" : "❌"}`);
+	out.push(`outcome weight            → ${detectionTurnWeight(nfsDet, tcfg)} (exp 2) ${detectionTurnWeight(nfsDet, tcfg) === 2 ? "✅" : "❌"}`);
+	out.push(`outcome post-steer = ignored→ ${isVerbatimRepeat(nfsDet) ? "yes" : "no"} (exp yes — same failing outcome after the break) ${isVerbatimRepeat(nfsDet) ? "✅" : "❌"}`);
+
+	// Below the repeat count: 5 identical-failure attempts → still trying, silent.
+	const fewMsgs = [..."ABCDE"].map((l, idx) =>
+		mk("", [{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: nfsFailFor(targets[idx % 2], 100 + idx) }]),
+	);
+	const fewDet = detectLoops(asState(fewMsgs), tcfg);
+	out.push(`outcome needs 8 prior     → ${fewDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent at 5 attempts) ${!fewDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+
+	// Converging sweep (v1.1 guarantee): similar args but the outcome CHANGES
+	// (progress!) — must stay silent even with many attempts.
+	const progMsgs = [..."ABCDEFGHIJ"].map((l, idx) =>
+		mk("", [
+			{
+				name: "bash",
+				args: nfsCmd(l, targets[idx % 2]),
+				result:
+					idx === 9
+						? nfsOk
+						: resultFingerprint(
+								[{ type: "text", text: `attempt ${idx}: failed with rc=${idx + 30} reason=${idx % 3}` }],
+								true,
+						  )!,
+			},
+		]),
+	);
+	const progDet = detectLoops(asState(progMsgs), tcfg);
+	out.push(`outcome converging sweep  → ${progDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — outcomes differ = progress) ${!progDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+
+	// Different FAILURE kinds with similar args (denied vs timeout vs no-such-file)
+	// = evolving diagnosis, not the same wall — silent too.
+	const diffFailMsgs = [..."ABCDEFGHIJ"].map((l, idx) => {
+		const reasons = ["access denied by server", "timed out after 90 seconds", "No such file or directory"];
+		const r = reasons[idx % 3];
+		return mk("", [
+			{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: resultFingerprint([{ type: "text", text: `mount failed: ${r} rc=32` }], false)! },
+		]);
+	});
+	const diffFailDet = detectLoops(asState(diffFailMsgs), tcfg);
+	out.push(`outcome diff failures     → ${diffFailDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — error changed = progress) ${!diffFailDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+
+	// Task-stream coexistence: a punched_log batch with identical tool results
+	// must NOT count toward the outcome run (identical OK = normal batch).
+	const batchFail = resultFingerprint([{ type: "text", text: "logged" }], false)!;
+	const batchOutMsgs = [1, 2, 3, 4, 5, 6, 7, 8, 9].map((n) => mk(NARR, [{ name: "punched_log", args: noteArgs(String(n)), result: batchFail }]));
+	const batchOutDet = detectLoops(asState(batchOutMsgs), tcfg);
+	out.push(`outcome batch excluded    → ${batchOutDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — identical OKs are batch norm) ${!batchOutDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+
+	// Failure gate: 9 near-identical attempts that all SUCCEED identically (e.g.
+	// re-verifying a working setup, or a file-write batch) must stay silent —
+	// only repeated FAILURES prove no progress.
+	const okMsgs = [..."ABCDEFGHI"].map((l, idx) => mk("", [{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: nfsOk }]));
+	const okDet = detectLoops(asState(okMsgs), tcfg);
+	out.push(`outcome identical OKs     → ${okDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — success repeats ≠ loop) ${!okDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+	out.push(`isFailResult gate         → err| → ${isFailResult("err|boom") ? "fail" : "ok"}, rc32 → ${isFailResult("ok|rc32 denied") ? "fail" : "ok"}, rc0/ok → ${isFailResult("ok|rc 0 12 passed") ? "fail" : "ok"} (exp fail, fail, ok) ${isFailResult("err|boom") && isFailResult("ok|rc32 denied") && !isFailResult("ok|rc 0 12 passed") ? "✅" : "❌"}`);
+
 	return out;
 }

package/src/index.ts

@@ -1,6 +1,6 @@
 /**
  * antiloop — detect reasoning loops and intervene.
- * Hooks: message_end, input, turn_end, session_start, session_shutdown.
+ * Hooks: message_end, tool_call, input, turn_end, session_start, session_shutdown.
  * Commands: /antiloop [enable|disable|status|config|log|reset|test]
  *
  * Intervention model (v1.5):
@@ -15,9 +15,19 @@
  *     (≥98% similar / identical tool loop) ignoredSteerLimit times, antiloop
  *     hard-stops the run (ctx.abort).
  *   abort   (level 3, opt-in via abortThreshold) — stops the run outright.
+ *
+ * v1.6 adds the intra-message degenerate detector: a model whose decoder
+ * anchors on a token repeats it hundreds of times INSIDE one message / tool
+ * call (the real 46 KB bash "noguerol ×5145" meltdown). That needs no peer
+ * message, so it is caught at message_end — BEFORE the tool calls execute —
+ * and degenerate bash commands are additionally blocked in the tool_call
+ * hook (blockDegenerateBash). One degenerate turn counts degenerateTurnWeight
+ * (2) consecutive points: warning on first sight, force-break steer on the
+ * second consecutive meltdown, hard stop shortly after if it keeps repeating.
  */
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { isToolCallEventType } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
 import { loadConfig, saveConfig } from "./config.ts";
 import type { AntiloopState, LoopDetection, Runtime, TrackedToolCall } from "./types.ts";
@@ -38,6 +48,7 @@ function newState(): AntiloopState {
 		lastDetectedTurnIndex: -1,
 		steerDelivered: false,
 		ignoredSteerCount: 0,
+		turnSeq: 0,
 	};
 }
 
@@ -163,6 +174,14 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 					? undefined
 					: ctx.ui.onTerminalInput?.((data: string) => {
 							if (config.toggleShortcut === "off") return undefined;
+							// Only honor the toggle while idle. ESC is also pi's interrupt key:
+							// an 'a' typed right after cancelling a stuck run is almost always
+							// normal typing, not a toggle — arming while the agent runs caused
+							// accidental silent toggles to OFF mid-session.
+							if (!ctx.isIdle()) {
+								pendingEsc = false;
+								return undefined;
+							}
 							if (data === "\x1b") {
 								pendingEsc = true;
 								return undefined;
@@ -227,7 +246,7 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		});
 	}
 
-	pi.on("message_end", async (event) => {
+	pi.on("message_end", async (event, ctx) => {
 		if (!config.enabled) return;
 		const msg = event.message;
 		if (msg.role !== "assistant") return;
@@ -255,12 +274,79 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 				thinking: thinking || undefined,
 				toolCalls: toolCalls.length ? toolCalls : undefined,
 				timestamp: Date.now(),
-				turnIndex: state.recentMessages.length,
+				// Monotonic: the array is trimmed below (detectionWindow + 5), so
+				// recentMessages.length would repeat after the first trim and the
+				// turn_end dedupe guard (turnIndex === lastDetectedTurnIndex) would
+				// skip every later message — antiloop going blind mid-session.
+				turnIndex: state.turnSeq++,
 			});
 		}
 		if (state.recentMessages.length > config.detectionWindow + 5) {
 			state.recentMessages = state.recentMessages.slice(-(config.detectionWindow + 5));
 		}
+
+		// v1.6 — degenerate meltdowns are handled HERE, at message_end, because
+		// turn_end only fires after tool execution (too late to stop the 46 KB
+		// "noguerol ×5000" bash from running) and an aborted generation may never
+		// reach turn_end at all. The signal is self-contained (one pathological
+		// payload, no peer message) so the full escalation ladder runs right now;
+		// the turn-guard makes the later turn_end pass skip this message and no
+		// detection is double-counted.
+		if (!config.detectDegenerate) return;
+		const { scanMessageDegenerate, degenerateDescription, nextLevel, isVerbatimRepeat } = await import("./detect.ts");
+		const hit = scanMessageDegenerate(content, toolCalls, config);
+		if (!hit) return;
+		const tracked = state.recentMessages[state.recentMessages.length - 1];
+		if (tracked) state.lastDetectedTurnIndex = tracked.turnIndex;
+		const prevLevel = state.currentLevel;
+		state.consecutiveDetections += Math.max(1, config.degenerateTurnWeight);
+		state.totalDetections++;
+		const det: LoopDetection = {
+			type: "degenerate",
+			similarity: 1,
+			messageIndices: [state.recentMessages.length - 1],
+			description: degenerateDescription(hit),
+			timestamp: Date.now(),
+		};
+		state.detections.push(det);
+		if (state.detections.length > config.maxHistoryEntries) {
+			state.detections = state.detections.slice(-config.maxHistoryEntries);
+		}
+		applyLevel(nextLevel(state.consecutiveDetections, config));
+		const level = state.currentLevel;
+
+		if (level === 1 && prevLevel < 1) {
+			// Warning: informational only (never injects — a warning must not stall).
+			if (config.notifyOnDetection) {
+				ctx.ui.notify(`antiloop: warning — ${det.description}`, "warning");
+			}
+		} else if (level === 2) {
+			if (!state.steerDelivered) {
+				// Steer the break message before the next LLM call. The degenerate bash
+				// itself is blocked by the tool_call gate, so the model sees the block
+				// reason + the steer together and can still change approach.
+				if (ctx.signal !== undefined) {
+					deliverForceBreak(ctx, [det]);
+				} else if (prevLevel < 2 && config.notifyOnDetection) {
+					ctx.ui.notify(`antiloop: force break — ${det.description}`, "error");
+				}
+			} else if (isVerbatimRepeat([det])) {
+				// The model produced degenerate output AGAIN after the break message:
+				// count it; once the ignore limit is hit the run is cut for good.
+				state.ignoredSteerCount++;
+				if (state.ignoredSteerCount >= config.ignoredSteerLimit) {
+					hardStop(
+						ctx,
+						`antiloop: abort — degenerate output repeated ${state.ignoredSteerCount}× after the force break — run stopped; provide new instructions`,
+					);
+				}
+			}
+		} else if (level === 3) {
+			// abortThreshold configured and reached: stop the run BEFORE the degenerate
+			// tool calls can execute (ctx.abort kills the pending tool batch).
+			hardStop(ctx, `antiloop: abort — ${det.description} — run stopped; provide new instructions`);
+		}
+		updateStatus(ctx);
 	});
 
 	pi.on("input", async (event) => {
@@ -283,9 +369,30 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		return { action: "continue" };
 	});
 
+	/**
+	 * v1.6 — degenerate bash gate. A meltdown message whose command repeats one
+	 * word hundreds of times (the 46 KB "noguerol ×5145" SSH-wordlist brute
+	 * force) must NEVER execute: it is pure context burn at best, and a real
+	 * brute-force / destructive repetition at worst. message_end already
+	 * escalated it; here we block the actual call before it runs. The block
+	 * reason is fed back to the model as the tool error, so the next LLM call
+	 * sees why the command was refused and can change approach.
+	 */
+	pi.on("tool_call", async (event, ctx) => {
+		if (!config.enabled || !config.detectDegenerate || !config.blockDegenerateBash) return;
+		if (!isToolCallEventType("bash", event)) return;
+		const { findDegenerateRepetition, degenerateDescription } = await import("./detect.ts");
+		const hit = findDegenerateRepetition(event.input.command ?? "", config);
+		if (!hit) return;
+		return {
+			block: true,
+			reason: `[antiloop] blocked: ${degenerateDescription({ ...hit, where: "bash command" })} — this is stuck generation, not a real command. Do NOT retry it: stop and take one small, concrete step instead.`,
+		};
+	});
+
 	pi.on("turn_end", async (event, ctx) => {
 		if (!config.enabled) return;
-		const { detectLoops, detectTaskStreams, isVerbatimRepeat, nextLevel, resultFingerprint } = await import("./detect.ts");
+		const { detectLoops, detectTaskStreams, detectionTurnWeight, isVerbatimRepeat, nextLevel, resultFingerprint } = await import("./detect.ts");
 
 		const last = state.recentMessages[state.recentMessages.length - 1];
 		if (!last || last.turnIndex === state.lastDetectedTurnIndex) {
@@ -329,7 +436,9 @@ export default function antiloopExtension(pi: ExtensionAPI) {
 		}
 
 		// ---- detection: escalate ------------------------------------------
-		state.consecutiveDetections++;
+		// Degenerate turns count degenerateTurnWeight (default 2) points so a
+		// single intra-message meltdown already reaches the warning level.
+		state.consecutiveDetections += detectionTurnWeight(detections, config);
 		state.totalDetections++;
 		state.detections.push(...detections);
 		if (state.detections.length > config.maxHistoryEntries) {

package/src/types.ts

@@ -16,6 +16,46 @@ export interface AntiloopConfig {
 	 * its output (even while still similar) gets room to escape on its own.
 	 */
 	ignoredSteerLimit: number;
+	/**
+	 * Intra-message degenerate repetition (the "noguerol \u00d75145" meltdown class): a model
+	 * stuck emitting the same token hundreds of times INSIDE one message / tool call.
+	 * Unlike the other detectors it needs no peer message: one pathological payload is
+	 * already conclusive. Fires on the first occurrence; each degenerate turn is weighted
+	 * (degenerateTurnWeight, default 2) so a single meltdown reaches the warning level.
+	 */
+	detectDegenerate: boolean;
+	/** Minimum normalized tokens in a payload before it is scanned (shorter = not conclusive). */
+	degenerateMinTokens: number;
+	/** Longest run of ONE identical word that flags a payload as degenerate. */
+	degenerateMaxRun: number;
+	/** Total occurrences of one word (anywhere, interleaved) that flags when combined with share. */
+	degenerateMaxFreq: number;
+	/** Word frequency share (freq/total) needed together with degenerateMaxFreq. */
+	degenerateMaxShare: number;
+	/** How many consecutive-detection points ONE degenerate turn adds (2 = warn on first sight). */
+	degenerateTurnWeight: number;
+	/** Block a bash tool call whose command shows degenerate repetition BEFORE it executes. */
+	blockDegenerateBash: boolean;
+	/**
+	 * No-progress outcome runs (v1.6.1): a model that keeps re-running the SAME
+	 * experiment with cosmetic mutations (labels/permutations) while the outcome
+	 * stays the SAME FAILURE — the real NFS session where ~90 near-identical
+	 * ssh exportfs/mount tests (test A … test QQQ) all failed rc=32. The
+	 * tool-loop detector can't see it: args mutate every turn so the same call
+	 * never recurs (labels differ), and results only VETO tool loops today.
+	 * Signal: >= outcomeMinRepeats PRIOR attempts inside the window whose args
+	 * are >= outcomeArgSimilarity similar AND whose captured result is the same
+	 * outcome (>= resultSimilarityThreshold), all after the last real user input.
+	 */
+	detectOutcomeLoops: boolean;
+	outcomeMinRepeats: number;
+	outcomeArgSimilarity: number;
+	/** Same-FAILURE gate for the outcome detector: minimum similarity between the
+	 * digit-stripped error signatures of two failing attempts to count as the
+	 * SAME failure. Looser than the veto threshold on purpose: the signature
+	 * repeats across attempts of the same wall even when legitimately varying
+	 * words (mount targets) sit inside it. */
+	outcomeSigThreshold: number;
 	/**
 	 * How close tool-call arguments must be (0..1) to count as the SAME call.
 	 * High by default: long bash commands share scaffolding (env setup, flags,
@@ -66,7 +106,7 @@ export interface AntiloopConfig {
 	toggleShortcut: string;
 }
 
-export type LoopKind = "text" | "tool" | "thinking" | "structural";
+export type LoopKind = "text" | "tool" | "thinking" | "structural" | "degenerate" | "outcome";
 
 export interface LoopDetection {
 	type: LoopKind;
@@ -94,6 +134,10 @@ export interface TrackedMessage {
 	thinking?: string;
 	toolCalls?: TrackedToolCall[];
 	timestamp: number;
+	/** Monotonic push sequence (state.turnSeq++), NOT the window index: the
+	 * recent-messages array is trimmed to detectionWindow+5, so an array-length
+	 * based index would collide after trimming and make the turn_end dedupe
+	 * guard skip every later message (antiloop going blind mid-session). */
 	turnIndex: number;
 }
 
@@ -116,6 +160,10 @@ export interface AntiloopState {
 	lastUserMessageTime: number;
 	/** turnIndex of the last tracked message detection already ran on. */
 	lastDetectedTurnIndex: number;
+	/** Monotonic sequence for the next tracked message's turnIndex (see
+	 * TrackedMessage.turnIndex). Persists across trims; reset on /reset and at
+	 * session start. */
+	turnSeq: number;
 	/** True once the force-break user message was steered into the current episode.
 	 * One steer per episode: repeated steering would spam the conversation. Cleared
 	 * when the episode decays (currentLevel back to 0) or on real user input. */