pi-antiloop 1.5.1 → 1.7.0

package/src/detect.ts

@@ -34,6 +34,278 @@ function opening(text: string, n = 10): string {
 	return normalizeText(text.split(/\s+/).slice(0, n).join(" "));
 }
 
+// ---------------------------------------------------------------------------
+// Intra-message degenerate repetition (v1.6).
+//
+// The "noguerol ×5145" class (verified against a real session — /home/j
+// 2026-09-09T15-43: ONE 46 KB bash call whose SSH username list repeats a
+// single word 5145 times, a run of 5140 — 99% of the payload). A model whose
+// decoder anchors on a token stops producing NEW output: it repeats the same
+// word hundreds of times INSIDE one message or tool call. The cross-message
+// detectors (text / tool / thinking / structural) all need >= 2 similar
+// messages and cannot see this — the meltdown happened exactly once, inside a
+// single call, and antiloop stayed silent until the user ESC'd.
+//
+// This detector is self-contained: it flags the FIRST such payload, no peer
+// message required, and it is cheap enough to run at message_end (before the
+// tool calls execute) and on every bash tool_call (blocking gate).
+// ---------------------------------------------------------------------------
+
+/** Longest run / top frequency of ONE repeated word inside a payload. */
+export interface DegenerateInfo {
+	token: string;
+	freq: number;
+	maxRun: number;
+	total: number;
+}
+
+export interface DegenerateHit extends DegenerateInfo {
+	where: string;
+}
+
+/** Ignore 1-letter tokens as candidates (JSON keys like {"a":1} must not flag). */
+const MIN_TOKEN_LEN = 2;
+
+/**
+ * Detect pathological single-word repetition in a payload (assistant text or a
+ * JSON.stringify'd tool-call argument). Returns the repeated word with its
+ * count, longest consecutive run and payload size, or undefined when the
+ * payload is normal.
+ *
+ * Tokenization: runs of unicode letters, lowercased. Stored tool args are
+ * JSON-escaped (real newlines arrived as the two characters `\n`), so escaped
+ * whitespace is normalized back to a separator first — a word list written
+ * across lines must still tokenize word by word. Digits/punctuation/code
+ * symbols split tokens instead of polluting them.
+ *
+ * Signals (both are conclusive for generation quality):
+ *   - a run of >= degenerateMaxRun consecutive identical words, or
+ *   - one word occurring >= degenerateMaxFreq times with >= degenerateMaxShare
+ *     of all tokens (catches interleaved "A B A B" meltdowns with no run).
+ * A payload must have >= degenerateMinTokens tokens to be scanned.
+ */
+export function findDegenerateRepetition(
+	text: string,
+	config: AntiloopConfig,
+): DegenerateInfo | undefined {
+	let s = String(text).replace(/\\+[nrt]/g, " ").toLowerCase();
+	const raw = s.match(/[\p{L}]+/gu);
+	if (!raw) return undefined;
+	const total = raw.length;
+
+	let maxRun = 0;
+	let runToken = "";
+	let prev = "";
+	let run = 0;
+	const freq = new Map<string, number>();
+	for (const t of raw) {
+		if (t.length < MIN_TOKEN_LEN) {
+			run = 0;
+			prev = "";
+			continue;
+		}
+		freq.set(t, (freq.get(t) ?? 0) + 1);
+		if (t === prev) run++;
+		else {
+			run = 1;
+			prev = t;
+		}
+		if (run > maxRun) {
+			maxRun = run;
+			runToken = t;
+		}
+	}
+	let topToken = "";
+	let topFreq = 0;
+	for (const [t, c] of freq) {
+		if (c > topFreq) {
+			topFreq = c;
+			topToken = t;
+		}
+	}
+	if (total >= config.degenerateMinTokens) {
+		if (maxRun >= config.degenerateMaxRun) {
+			return { token: runToken, freq: freq.get(runToken) ?? topFreq, maxRun, total };
+		}
+		if (topFreq >= config.degenerateMaxFreq && topFreq / total >= config.degenerateMaxShare) {
+			return { token: topToken, freq: topFreq, maxRun, total };
+		}
+	}
+
+	// No-space meltdown: one giant periodic token ("noguerolnoguerol…" with all
+	// separators stripped) is a perfect power of a short motif. Independent of
+	// the token-count gate: a single 1200+ char token has no word runs at all.
+	if (raw.length <= 2) {
+		const single = raw.join("");
+		const len = single.length;
+		if (len >= 1200) {
+			for (let p = 3; p <= 200 && p * 12 <= len; p++) {
+				if (len % p) continue;
+				const motif = single.slice(0, p);
+				let ok = true;
+				for (let i = p; i < len; i += p) {
+					if (!single.startsWith(motif, i)) {
+						ok = false;
+						break;
+					}
+				}
+				if (ok) {
+					const repeats = len / p;
+					if (repeats >= 12) {
+						return { token: motif.slice(0, 40), freq: repeats, maxRun: repeats, total: repeats };
+					}
+				}
+			}
+		}
+	}
+	return undefined;
+}
+
+/** Scan one assistant message (text + each tool-call argument) for a meltdown. */
+export function scanMessageDegenerate(
+	content: string,
+	toolCalls: TrackedToolCall[] | undefined,
+	config: AntiloopConfig,
+): DegenerateHit | undefined {
+	if (!config.detectDegenerate) return undefined;
+	if (content && content.length) {
+		const d = findDegenerateRepetition(content, config);
+		if (d) return { ...d, where: "message text" };
+	}
+	for (const tc of toolCalls ?? []) {
+		if (!tc.args) continue;
+		const d = findDegenerateRepetition(tc.args, config);
+		if (d) return { ...d, where: tc.name === "bash" ? "bash command" : `args(${tc.name})` };
+	}
+	return undefined;
+}
+
+export function degenerateDescription(hit: DegenerateHit): string {
+	const share = hit.total ? Math.round((hit.freq / hit.total) * 100) : 100;
+	return `${hit.where}: degenerate repetition — "${hit.token}" ×${hit.freq} (${share}% of ${hit.total} tokens, longest run ${hit.maxRun})`;
+}
+
+// ---------------------------------------------------------------------------
+// Intra-message BLOCK repetition (v1.7).
+//
+// The "narration loop" class (verified against a real coding session: ONE
+// assistant message replaying ~5 near-verbatim cycles of "Let me start by
+// checking the environment and the current state of the repository… / I'll run
+// several independent checks in parallel. / Let me begin the S0 development…").
+// Every pre-existing detector stayed silent: text/tool/thinking/structural all
+// compare ACROSS messages (the model produced one message, no peer), and the
+// degenerate detector only watches ONE word repeated hundreds of times, not a
+// whole sentence/paragraph replayed. The signal here is phrase-level: a sliding
+// window of blockNgram-word n-grams over the normalized payload; if almost ALL
+// of those n-grams recur and the most frequent one recurs ≥ blockMinRepeats
+// times, the generation is replaying itself instead of advancing.
+//
+// Deliberately conservative: only a payload where ≥ blockRepeatShare (default
+// 85%) of 5-gram positions repeat qualifies. Ordinary prose — even long,
+// structured docs — sits far below (README/pi.md paragraphs: ≤ 0.11), while
+// 3+ replays of a narration block reach 0.98–1.0. Repeat-linked code/log lines
+// that share a template are NOT flagged because their n-grams carry the varying
+// digits and differ.
+// ---------------------------------------------------------------------------
+
+/** Recursive n-gram coverage of one payload. */
+export interface BlockRepeatInfo {
+	/** Recurring n-gram positions / total n-gram positions (0..1). */
+	ratio: number;
+	/** Occurrences of the MOST repeated n-gram. */
+	repeats: number;
+	/** Total normalized words in the payload. */
+	tokens: number;
+	/** The n used (words per window). */
+	ngram: number;
+	/** The most repeated n-gram, for the description. */
+	sample: string;
+}
+
+export interface BlockRepeatHit extends BlockRepeatInfo {
+	where: string;
+}
+
+/**
+ * Detect phrase/block-level self-repetition inside ONE payload. Returns the
+ * coverage ratio with the most repeated n-gram, or undefined for normal text.
+ *
+ * Reads the payload as a stream of lowercase alphanumeric words (code symbols
+ * and punctuation are separators, so stored-JSON escaping cannot glue tokens).
+ * Coverage counts an n-gram position as repeated when the SAME n-word sequence
+ * (digits included, so templated lines with varying numbers do not count)
+ * occurs somewhere else in the payload.
+ */
+export function findRepetitiveBlock(text: string, config: AntiloopConfig): BlockRepeatInfo | undefined {
+	const words = String(text).toLowerCase().match(/[\p{L}\p{N}]+/gu);
+	if (!words) return undefined;
+	const total = words.length;
+	if (total < config.blockMinTokens) return undefined;
+	const n = Math.max(2, config.blockNgram);
+	const minRepeats = Math.max(2, config.blockMinRepeats);
+	if (total < n * minRepeats) return undefined;
+
+	const counts = new Map<string, number>();
+	const grams: string[] = [];
+	for (let i = 0; i + n <= total; i++) {
+		const g = words.slice(i, i + n).join(" ");
+		grams.push(g);
+		counts.set(g, (counts.get(g) ?? 0) + 1);
+	}
+	if (!grams.length) return undefined;
+
+	let covered = 0;
+	let topKey = "";
+	let top = 0;
+	for (const g of grams) {
+		const c = counts.get(g)!;
+		if (c > top) {
+			top = c;
+			topKey = g;
+		}
+		if (c >= 2) covered++;
+	}
+	// At least one n-word phrase must recur blockMinRepeats times (a single
+	// echo is a restatement, not a replay) and the recurrence must dominate.
+	if (top < minRepeats) return undefined;
+	const ratio = covered / grams.length;
+	if (ratio < config.blockRepeatShare) return undefined;
+	return { ratio, repeats: top, tokens: total, ngram: n, sample: topKey };
+}
+
+/** Scan one assistant message (text + each tool-call argument) for a replay. */
+export function scanMessageBlock(
+	content: string,
+	toolCalls: TrackedToolCall[] | undefined,
+	config: AntiloopConfig,
+): BlockRepeatHit | undefined {
+	if (!config.detectBlockRepeats) return undefined;
+	if (content && content.length) {
+		const b = findRepetitiveBlock(content, config);
+		if (b) return { ...b, where: "message text" };
+	}
+	for (const tc of toolCalls ?? []) {
+		if (!tc.args) continue;
+		const b = findRepetitiveBlock(tc.args, config);
+		if (b) return { ...b, where: tc.name === "bash" ? "bash command" : `args(${tc.name})` };
+	}
+	return undefined;
+}
+
+export function blockRepeatDescription(hit: BlockRepeatHit): string {
+	const pct = Math.round(hit.ratio * 100);
+	return `${hit.where}: block repetition — ${pct}% of ${hit.tokens} tokens replay repeated ${hit.ngram}-word phrases ("${hit.sample}" ×${hit.repeats})`;
+}
+
+/** Consecutive-detection weight of a detection turn. The strong
+ * self-contained signals (degenerate meltdown, proven no-progress outcome run)
+ * add degenerateTurnWeight (default 2) points so the FIRST one already reaches
+ * the warning level and escalation is fast on repeat. */
+export function detectionTurnWeight(detections: LoopDetection[], config: AntiloopConfig): number {
+	const strong = detections.some((d) => d.type === "degenerate" || d.type === "block" || d.type === "outcome");
+	return strong ? Math.max(1, config.degenerateTurnWeight) : 1;
+}
+
 function similarity(a: string, b: string): number {
 	if (a.length < MIN_CONTENT_LENGTH || b.length < MIN_CONTENT_LENGTH) return 0;
 	if (a === b) return 1;
@@ -74,7 +346,18 @@ export function resultFingerprint(
 	}
 	const norm = normalizeText(text);
 	if (!norm.length) return undefined;
-	return `${isError ? "err" : "ok"}|${norm.slice(-400)}`;
+	// A tool run can FAIL while isError stays false (the NFS mount errors: the
+	// ssh pipeline exits 0 after grep/echo, rc=32 lives inside the output). The
+	// tail-only fingerprint would cut the failure markers away AND the tail is
+	// noisy (journalctl timestamps differ per attempt), so for failures we keep
+	// a SHORT ERROR SIGNATURE around the first failure marker — it repeats
+	// verbatim across attempts of the same failure and makes same-outcome
+	// comparisons robust. Formats: "err|…" / "ok|fail|sig|…|tail" / "ok|…".
+	const failed = FAIL_MARKERS.test(norm);
+	if (!failed) return `${isError ? "err" : "ok"}|${norm.slice(-400)}`;
+	const at = norm.search(FAIL_MARKERS);
+	const sig = norm.slice(Math.max(0, at - 60), at + 160);
+	return `${isError ? "err" : "ok"}|fail|${sig}|${norm.slice(-400)}`;
 }
 
 /** Same outcome = identical fingerprint, or high similarity of the tails. */
@@ -89,6 +372,44 @@ function sameOutcome(a: string, b: string, threshold: number): boolean {
 	return s >= threshold && s > 0;
 }
 
+// Failure markers on a NORMALIZED fingerprint tail (lowercased, punctuation
+// stripped — "rc=32" arrives as "rc32"). A conservative "this attempt failed"
+// test: rc ≠ 0, denials, missing files, refusals, syntax crashes… Generic
+// words like "error"/"failed" are intentionally NOT markers (legit outputs
+// like "0 failed, 12 passed" must not count as failures).
+const FAIL_MARKERS =
+	/\b(denied|no such file|not found|cannot|unable|refused|syntax error|timed out|timeout|exception|traceback|fatal|core dumped|rc\s*[1-9]\d*)\b/i;
+
+/** True when a captured result fingerprint represents a FAILED attempt.
+ * Used by the no-progress outcome detector so only repeated FAILURES (not
+ * repeated identical successes, which are the norm for task-stream batches
+ * like "logged" or file writes) count as a stuck loop. */
+export function isFailResult(fp: string | undefined): boolean {
+	if (!fp) return false;
+	if (fp.startsWith("err|") || fp.startsWith("ok|fail|")) return true;
+	return FAIL_MARKERS.test(fp);
+}
+
+/** The short error signature embedded in a failure fingerprint
+ * ("ok|fail|SIG|tail"), if present. */
+function failSig(fp: string): string | undefined {
+	const m = /^(?:err|ok)\|fail\|(.*?)\|/.exec(fp);
+	return m ? m[1] : undefined;
+}
+
+/** Same-FAILURE comparison for the outcome detector. Prefers the embedded error
+ * signatures (they repeat across attempts of the same failure) with digits
+ * stripped — timestamps, PIDs and rc values are noise; the target words that
+ * legitimately vary between attempts (Javi vs Compartido) survive but the
+ * threshold is looser than the veto threshold on purpose. Falls back to the
+ * full fingerprints when no signature is present. */
+function sameFailure(a: string, b: string, threshold: number): boolean {
+	const sa = failSig(a);
+	const sb = failSig(b);
+	if (sa && sb) return sameOutcome(sa.replace(/\d+/g, ""), sb.replace(/\d+/g, ""), threshold);
+	return sameOutcome(a, b, threshold);
+}
+
 function toolCallsSimilar(
 	c1: TrackedToolCall[],
 	c2: TrackedToolCall[],
@@ -177,11 +498,45 @@ export function detectTaskStreams(
 export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopDetection[] {
 	const out: LoopDetection[] = [];
 	const msgs = state.recentMessages;
-	if (msgs.length < 2) return out;
+	if (msgs.length < 1) return out;
 	const start = Math.max(0, msgs.length - config.detectionWindow);
 	const win = msgs.slice(start);
 	const now = Date.now();
 
+	// Intra-message repetition fires on a SINGLE pathological message (no peer
+	// needed) and is independent of the task-stream batch gate: a meltdown is a
+	// meltdown even mid-batch. Two flavors: degenerate (one word ×hundreds) and
+	// block (whole sentences/phrases replayed — the narration-loop class).
+	if (config.detectDegenerate) {
+		const last = win[win.length - 1];
+		const hit = scanMessageDegenerate(last.content, last.toolCalls, config);
+		if (hit) {
+			out.push({
+				type: "degenerate",
+				similarity: 1,
+				messageIndices: [msgs.length - 1],
+				description: degenerateDescription(hit),
+				timestamp: now,
+			});
+		}
+	}
+
+	if (config.detectBlockRepeats) {
+		const last = win[win.length - 1];
+		const hit = scanMessageBlock(last.content, last.toolCalls, config);
+		if (hit) {
+			out.push({
+				type: "block",
+				// 0.99 => isVerbatimRepeat(): after a force break, a replayed block
+				// is the model ignoring the break and escalates to the hard stop.
+				similarity: 0.99,
+				messageIndices: [msgs.length - 1],
+				description: blockRepeatDescription(hit),
+				timestamp: now,
+			});
+		}
+	}
+
 	// Task-stream gate: if the window is a homogeneous batch (same extension
 	// tool called with DISTINCT content ≥ taskStreamMinCalls times), that tool
 	// is exempt from tool-loop detection, and text/thinking/structural
@@ -264,6 +619,68 @@ export function detectLoops(state: AntiloopState, config: AntiloopConfig): LoopD
 		}
 	}
 
+	// -------------------------------------------------------------------
+	// No-progress outcome runs (v1.6.1).
+	//
+	// The NFS-test session (/home/j 2026-09-09, rows 95–249): ~90 mutated
+	// re-runs of the SAME experiment (sshpass+sudo+exportfs+mount, labels
+	// "test A"…"test QQQ"), every one failing identically (rc=32 / access
+	// denied). The tool-loop detector is blind to it BY DESIGN: args mutate
+	// every turn (mean adjacent trigram similarity 0.93, but the label always
+	// changes) so the same call never recurs >= minToolRepeatCount times, and
+	// identical results only VETO tool loops — nothing uses "same outcome
+	// repeated" as a positive signal. A human sees it instantly: many attempts,
+	// same wall, zero progress.
+	//
+	// Signal: the LAST turn's single tool call has a captured result, and at
+	// least outcomeMinRepeats PRIOR single-call turns (after the last real user
+	// message — an autonomous stretch, not user-steered iteration) share BOTH
+	// args >= outcomeArgSimilarity (the same experiment reshuffled) AND the same
+	// outcome (>= resultSimilarityThreshold). Legit work is untouched: distinct
+	// operations fail with distinct output; converging sweeps change outcome;
+	// batch/stream messages are excluded; a success interspersed resets the
+	// class. similarity 0.99 => after a force break, further same-outcome turns
+	// count as "ignoring the break" (isVerbatimRepeat) and escalate to the hard
+	// stop, exactly like verbatim tool loops.
+	// -------------------------------------------------------------------
+	if (config.detectOutcomeLoops) {
+		const last = win[win.length - 1];
+		const lastCalls = last.toolCalls;
+		const afterUser = state.lastUserMessageTime;
+		if (lastCalls && lastCalls.length === 1) {
+			const lc = lastCalls[0];
+			// Failure gate: only repeated FAILURES prove no progress. Task-stream
+			// batches (punched_log appends, obsidian/file writes) legitimately
+			// produce the SAME OK outcome every call — they must never count. And
+			// batch messages must NOT be skipped here: a "bash ×N stream" with
+			// identical failures is exactly the no-progress loop to catch.
+			if (lc.result && isFailResult(lc.result)) {
+				let matches = 0;
+				for (let i = 0; i < win.length - 1; i++) {
+					const m = win[i];
+					if (m.timestamp <= afterUser) continue; // user-steered turns don't count
+					const prev = m.toolCalls;
+					if (!prev || prev.length !== 1) continue;
+					const pc = prev[0];
+					if (pc.name !== lc.name || !pc.result) continue;
+					if (!sameFailure(lc.result, pc.result, config.outcomeSigThreshold)) continue;
+					if (!argsTwin(lc.args, pc.args, config.outcomeArgSimilarity)) continue;
+					matches++;
+				}
+				if (matches >= config.outcomeMinRepeats) {
+					out.push({
+						type: "outcome",
+						similarity: 0.99,
+						messageIndices: [msgs.length - 1],
+						description:
+							`no progress: ${matches + 1} near-identical ${lc.name} attempts (args ≥ ${(config.outcomeArgSimilarity * 100).toFixed(0)}% similar) with the same failing outcome — “${lc.result.slice(0, 90)}”`,
+						timestamp: now,
+					});
+				}
+			}
+		}
+	}
+
 	if (config.detectThinkingLoops) {
 		const last = win[win.length - 1];
 		if (last.thinking && last.thinking.length > 50) {
@@ -297,11 +714,13 @@ export function nextLevel(consecutiveDetections: number, config: AntiloopConfig)
 }
 
 /** True when detections prove the model repeated a message/tool call essentially
- * verbatim (≥98% text similarity or an identical tool-loop). Weaker signals
- * (thinking echoes, structural repeated openings at 90%) do NOT count — a model
- * that only *thinks* in circles but varies its actual output is still making an
- * attempt and must not be hard-stopped. Used post-force-break: only verbatim
- * repeats prove the model ignored the break instruction. */
+ * verbatim (≥98% text similarity or an identical tool-loop), OR produced a
+ * degenerate meltdown, OR kept re-running the same experiment with the same
+ * failing outcome (no-progress, sim 0.99). Weaker signals (thinking echoes,
+ * structural repeated openings at 90%) do NOT count — a model that only *thinks*
+ * in circles but varies its actual output is still making an attempt and must
+ * not be hard-stopped. Used post-force-break: only verbatim repeats and proven
+ * no-progress repeats show the model ignored the break instruction. */
 export function isVerbatimRepeat(detections: LoopDetection[]): boolean {
 	return detections.some((d) => d.type !== "thinking" && d.similarity >= 0.98);
 }
@@ -383,11 +802,15 @@ export function runSelfTest(): string[] {
 		detectTextLoops: true, notifyOnDetection: true, maxHistoryEntries: 100,
 		detectionWindow: 10, interactiveFooter: true, toggleShortcut: "esc+a",
 		detectTaskStreams: true, taskStreamMinCalls: 3, taskStreamTwinThreshold: 0.99,
+		detectDegenerate: true, degenerateMinTokens: 50, degenerateMaxRun: 16,
+		degenerateMaxFreq: 60, degenerateMaxShare: 0.4, degenerateTurnWeight: 2, blockDegenerateBash: true,
+		detectBlockRepeats: true, blockMinTokens: 120, blockNgram: 5, blockMinRepeats: 3, blockRepeatShare: 0.85,
+		detectOutcomeLoops: true, outcomeMinRepeats: 8, outcomeArgSimilarity: 0.85, outcomeSigThreshold: 0.7,
 	};
 	const asState = (recentMessages: TrackedMessage[]): AntiloopState =>
 		({ recentMessages, detections: [], activeTaskStreams: [], currentLevel: 0,
 			consecutiveDetections: 0, inForcedBreak: false, totalDetections: 0,
-			lastUserMessageTime: 0, lastDetectedTurnIndex: -1,
+			lastUserMessageTime: 0, lastDetectedTurnIndex: -1, turnSeq: 0,
 			steerDelivered: false, ignoredSteerCount: 0 });
 	const NARR = "Now I will append the next decision entry to the project memory document so we keep the context.";
 
@@ -443,5 +866,191 @@ export function runSelfTest(): string[] {
 	out.push(`thinking-only 1.00        → ${isVerbatimRepeat(dl("thinking", 1)) ? "yes" : "no"} (exp no — output varies) ${!isVerbatimRepeat(dl("thinking", 1)) ? "✅" : "❌"}`);
 	out.push(`structural 0.90           → ${isVerbatimRepeat(dl("structural", 0.9)) ? "yes" : "no"} (exp no) ${!isVerbatimRepeat(dl("structural", 0.9)) ? "✅" : "❌"}`);
 
+	// --- v1.6: intra-message degenerate repetition (single-message meltdown) ---
+	// Regression: the real session /home/j 2026-09-09T15-43 — ONE 46 KB bash call
+	// whose username list repeats "noguerol" 5145 times (run of 5140). Every
+	// cross-message detector needs a peer message and stayed silent; the
+	// degenerate scan must fire on the FIRST such message, alone in the window.
+	const argJson = (cmd: string) => JSON.stringify({ command: cmd }); // stored args form
+	const meltdownCmd =
+		`echo "=== brute usernames with petete pw ==="; for u in noguerol noguerol@ j javi javi@ root petete ${`noguerol `.repeat(400)}; do :; done`;
+	const meltMsg = mk("", [{ name: "bash", args: argJson(meltdownCmd) }]);
+	const mDet = detectLoops(asState([meltMsg]), tcfg);
+	const mHit = mDet.find((d) => d.type === "degenerate");
+	out.push(`degenerate first sight   → ${mHit ? `degenerate (${mHit.description})` : "no"} (exp degenerate — was the miss) ${mHit ? "✅" : "❌"}`);
+
+	// Legit payloads must NOT flag: short commands are under minTokens, real
+	// scripts never repeat one word 16× in a row.
+	const leg1 = findDegenerateRepetition(sweepRun1, tcfg);
+	const leg2 = findDegenerateRepetition("for i in 1 2 3; do echo step $i; done", tcfg);
+	const leg3 = findDegenerateRepetition(
+		"set -euo pipefail; mkdir -p build tmp dist logs data assets src test docs lib bin etc usr var opt srv && " +
+			"cp -r config.yaml README.md LICENSE package.json tsconfig.json src lib test docs assets && " +
+			"chmod +x scripts/deploy.sh scripts/backup.sh scripts/monitor.sh && " +
+			"./scripts/deploy.sh --env production --region eu-west-1 --tag v1.2.3 --dry-run false > deploy.log 2>&1 || echo deploy failed",
+		tcfg,
+	);
+	out.push(`degenerate legit cmd      → ${leg1 || leg2 || leg3 ? "flag" : "ok"} (exp ok) ${!leg1 && !leg2 && !leg3 ? "✅" : "❌"}`);
+
+	// Interleaved meltdown ("A B A B…") has no long run — caught via freq/share.
+	const inter = findDegenerateRepetition("noguerol petete ".repeat(150), tcfg);
+	out.push(`degenerate interleaved    → ${inter ? `flag (${inter.token} ×${inter.freq})` : "no"} (exp flag — freq/share clause) ${inter ? "✅" : "❌"}`);
+
+	// Word list written ACROSS lines: separators are the literal "\n" escapes
+	// inside the stored JSON args — must still tokenize word by word.
+	const acrossLines = argJson("for u in " + "noguerol\n".repeat(120) + "done");
+	const linesHit = findDegenerateRepetition(acrossLines, tcfg);
+	out.push(`degenerate across \n      → ${linesHit ? `flag (${linesHit.token} ×${linesHit.freq})` : "no"} (exp flag — escaped newlines) ${linesHit ? "✅" : "❌"}`);
+
+	// No-space giant token ("noguerol" glued) — perfect-power clause.
+	const glued = findDegenerateRepetition("noguerol".repeat(300), tcfg);
+	out.push(`degenerate glued token    → ${glued ? `flag (${glued.token} ×${glued.freq})` : "no"} (exp flag — perfect power) ${glued ? "✅" : "❌"}`);
+
+	// Turn weight: one degenerate turn = 2 consecutive points (warning on first
+	// sight), normal turns stay at 1.
+	const wDeg = detectionTurnWeight(mDet, tcfg);
+	const wTxt = detectionTurnWeight(dl("text", 0.8), tcfg);
+	out.push(`degenerate turn weight    → degenerate ${wDeg}, text ${wTxt} (exp 2, 1) ${wDeg === 2 && wTxt === 1 ? "✅" : "❌"}`);
+
+	// --- v1.7: intra-message BLOCK repetition (narration loops) ---
+	// Regression: a real coding session where ONE assistant message replayed the
+	// same ~5 sentences in a loop ("Let me start by checking the environment…" /
+	// "I'll run several independent checks in parallel." / "Let me begin the S0
+	// development…"). Cross-message text/tool/thinking detectors need a peer and
+	// stayed silent; the degenerate scan only watches a single word. The block
+	// detector must fire on the message itself.
+	const NARRV = [
+		"Let me start by checking the environment and the current state of the repository, then set up a plan for the S0 slice and begin building.",
+		"I'll run several independent checks in parallel.",
+		"Let me begin the S0 development. First, reconnaissance of the environment and current repo state.",
+		"Let me check what's available in the environment (node, package managers, network, postgres) and the current repo state, then set up the S0 plan and start building the monorepo scaffold.",
+		"I'll run a batch of independent environment checks first.",
+	];
+	const cycles = (k: number): string => {
+		let s = "";
+		for (let i = 0; i < k; i++) for (const v of NARRV) s += v + "\n\n";
+		return s;
+	};
+	const s0Det = detectLoops(asState([mk(cycles(5))]), tcfg);
+	const s0Hit = s0Det.find((d) => d.type === "block");
+	out.push(`block S0 narration loop  → ${s0Hit ? `block (${s0Hit.description})` : "no"} (exp block — was the miss) ${s0Hit ? "✅" : "❌"}`);
+	out.push(`block turn weight        → ${detectionTurnWeight(s0Det, tcfg)} (exp 2 — warn on first sight) ${detectionTurnWeight(s0Det, tcfg) === 2 ? "✅" : "❌"}`);
+	out.push(`block post-steer = ignored→ ${isVerbatimRepeat(s0Det) ? "yes" : "no"} (exp yes — replayed block after the break) ${isVerbatimRepeat(s0Det) ? "✅" : "❌"}`);
+
+	// 3 replay cycles still flag; a single restatement (2 cycles, top-gram ×2)
+	// does not — one echo is a summary, not stuck generation.
+	const c3 = findRepetitiveBlock(cycles(3), tcfg);
+	const c2 = findRepetitiveBlock(cycles(2), tcfg);
+	out.push(`block 3 cycles / 2 cycles→ ${c3 ? `flag (${Math.round(c3.ratio * 100)}%)` : "no"} / ${c2 ? "flag" : "no"} (exp flag / no — needs ≥3 repeats) ${c3 && !c2 ? "✅" : "❌"}`);
+
+	// Ordinary prose and templated (but evolving) payloads must stay silent:
+	// long docs score ≤ 0.11 coverage; templated logs/code carry varying digits
+	// so their 5-grams differ.
+	const prose =
+		"The extension watches every assistant message and tool call to decide whether the model is making progress. " +
+		"It stores a short window of recent turns, fingerprints tool results and compares them with earlier attempts. " +
+		"When a pattern repeats it escalates from a quiet warning to a forced change of approach and finally aborts. " +
+		"Configuration lives in a small json file next to the agent directory and every threshold can be tuned at runtime. " +
+		"The default values were chosen against real sessions so ordinary work never triggers a false positive. " +
+		"Detectors are independent: disabling one leaves the others active and the footer keeps the user informed. " +
+		"A clean turn cools the counter down so a recovered model is given room to finish the task. " +
+		"Everything is written in plain typescript with no runtime dependencies beyond the host package. " +
+		"New strategies should be measured against the recorded payloads before they are enabled by default. " +
+		"The goal is simple: catch a stuck model early and keep the context useful for the real work.";
+	const logLines = [...Array(30)].map((_, i) => `2026-09-24T10:${String(i).padStart(2, "0")}:00Z INFO worker ${i} processed job ${1000 + i} in ${i * 3}ms status ok`).join("\n");
+	const proseHit = findRepetitiveBlock(prose, tcfg);
+	const logHit = findRepetitiveBlock(logLines, tcfg);
+	out.push(`block legit prose/logs   → ${proseHit || logHit ? "flag" : "ok"} (exp ok) ${!proseHit && !logHit ? "✅" : "❌"}`);
+
+	// --- v1.6.1: no-progress outcome runs (mutated re-runs, same outcome) ---
+	// Regression: the NFS session — ~90 mutated re-runs of the SAME experiment
+	// (ssh exportfs/mount, labels test A…test QQQ, targets alternating Javi /
+	// Compartido), every one failing rc=32. Args mutate each turn (same call
+	// never recurs → tool-loop silent) and journalctl noise varies per attempt,
+	// but the FAILURE SIGNATURE repeats: that IS the loop. Fires on the 9th
+	// attempt (8 prior same-failure matches ≥ outcomeMinRepeats).
+	const nfsCmd = (label: string, target: string) =>
+		argJson(
+			`sshpass -p X ssh -o ConnectTimeout=10 noguerol@petete 'cd /tmp && echo X | sudo -S bash -c "echo --- test ${label}: rootdir=/volume2, absolute paths, fsid=0 and 1, mount /${target} ---; ` +
+			`cat > /etc/exports << EOF\n/volume2/NAS-8TB-Javi *(rw,sync,no_subtree_check,fsid=0)\nEOF\nexportfs -ra\nsystemctl restart nfs-server\n` +
+			`mount -t nfs4 -o vers=4.2 127.0.0.1:/${target} /tmp/nfstest 2>&1; echo rc=\$?; journalctl -u nfs-mountd | tail -4"' 2>&1`,
+		);
+	const nfsFailFor = (target: string, sec: number) =>
+		resultFingerprint(
+			[
+				{
+					type: "text",
+					text:
+						`--- mount /${target} --- | mount.nfs4: access denied by server while mounting 127.0.0.1:/${target} rc=32 | ` +
+						`Sep 09 18:${sec} petete systemd[1]: Started nfs-mountd.service (PID ${1000 + sec})`,
+				},
+			],
+			false,
+		)!;
+	const nfsOk = resultFingerprint([{ type: "text", text: "rc=0 | TARGET SOURCE FSTYPE | /tmp/nfstest 127.0.0.1:/  nfs4  rw,relatime" }], false)!;
+	const targets = ["NAS-8TB-Javi", "NAS-8TB-Compartido"];
+	const nfsMsgs = [..."ABCDEFGHI"].map((l, idx) =>
+		mk("", [{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: nfsFailFor(targets[idx % 2], 100 + idx) }]),
+	);
+	const nfsDet = detectLoops(asState(nfsMsgs), tcfg);
+	const nfsHit = nfsDet.find((d) => d.type === "outcome");
+	out.push(`outcome fires on 9th      → ${nfsHit ? `outcome (${nfsHit.description.slice(0, 100)}…)` : nfsDet.map((d) => d.type).join(",") || "no"} (exp outcome — mixed targets) ${nfsHit ? "✅" : "❌"}`);
+	out.push(`outcome weight            → ${detectionTurnWeight(nfsDet, tcfg)} (exp 2) ${detectionTurnWeight(nfsDet, tcfg) === 2 ? "✅" : "❌"}`);
+	out.push(`outcome post-steer = ignored→ ${isVerbatimRepeat(nfsDet) ? "yes" : "no"} (exp yes — same failing outcome after the break) ${isVerbatimRepeat(nfsDet) ? "✅" : "❌"}`);
+
+	// Below the repeat count: 5 identical-failure attempts → still trying, silent.
+	const fewMsgs = [..."ABCDE"].map((l, idx) =>
+		mk("", [{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: nfsFailFor(targets[idx % 2], 100 + idx) }]),
+	);
+	const fewDet = detectLoops(asState(fewMsgs), tcfg);
+	out.push(`outcome needs 8 prior     → ${fewDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent at 5 attempts) ${!fewDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+
+	// Converging sweep (v1.1 guarantee): similar args but the outcome CHANGES
+	// (progress!) — must stay silent even with many attempts.
+	const progMsgs = [..."ABCDEFGHIJ"].map((l, idx) =>
+		mk("", [
+			{
+				name: "bash",
+				args: nfsCmd(l, targets[idx % 2]),
+				result:
+					idx === 9
+						? nfsOk
+						: resultFingerprint(
+								[{ type: "text", text: `attempt ${idx}: failed with rc=${idx + 30} reason=${idx % 3}` }],
+								true,
+						  )!,
+			},
+		]),
+	);
+	const progDet = detectLoops(asState(progMsgs), tcfg);
+	out.push(`outcome converging sweep  → ${progDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — outcomes differ = progress) ${!progDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+
+	// Different FAILURE kinds with similar args (denied vs timeout vs no-such-file)
+	// = evolving diagnosis, not the same wall — silent too.
+	const diffFailMsgs = [..."ABCDEFGHIJ"].map((l, idx) => {
+		const reasons = ["access denied by server", "timed out after 90 seconds", "No such file or directory"];
+		const r = reasons[idx % 3];
+		return mk("", [
+			{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: resultFingerprint([{ type: "text", text: `mount failed: ${r} rc=32` }], false)! },
+		]);
+	});
+	const diffFailDet = detectLoops(asState(diffFailMsgs), tcfg);
+	out.push(`outcome diff failures     → ${diffFailDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — error changed = progress) ${!diffFailDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+
+	// Task-stream coexistence: a punched_log batch with identical tool results
+	// must NOT count toward the outcome run (identical OK = normal batch).
+	const batchFail = resultFingerprint([{ type: "text", text: "logged" }], false)!;
+	const batchOutMsgs = [1, 2, 3, 4, 5, 6, 7, 8, 9].map((n) => mk(NARR, [{ name: "punched_log", args: noteArgs(String(n)), result: batchFail }]));
+	const batchOutDet = detectLoops(asState(batchOutMsgs), tcfg);
+	out.push(`outcome batch excluded    → ${batchOutDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — identical OKs are batch norm) ${!batchOutDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+
+	// Failure gate: 9 near-identical attempts that all SUCCEED identically (e.g.
+	// re-verifying a working setup, or a file-write batch) must stay silent —
+	// only repeated FAILURES prove no progress.
+	const okMsgs = [..."ABCDEFGHI"].map((l, idx) => mk("", [{ name: "bash", args: nfsCmd(l, targets[idx % 2]), result: nfsOk }]));
+	const okDet = detectLoops(asState(okMsgs), tcfg);
+	out.push(`outcome identical OKs     → ${okDet.some((d) => d.type === "outcome") ? "outcome" : "silent"} (exp silent — success repeats ≠ loop) ${!okDet.some((d) => d.type === "outcome") ? "✅" : "❌"}`);
+	out.push(`isFailResult gate         → err| → ${isFailResult("err|boom") ? "fail" : "ok"}, rc32 → ${isFailResult("ok|rc32 denied") ? "fail" : "ok"}, rc0/ok → ${isFailResult("ok|rc 0 12 passed") ? "fail" : "ok"} (exp fail, fail, ok) ${isFailResult("err|boom") && isFailResult("ok|rc32 denied") && !isFailResult("ok|rc 0 12 passed") ? "✅" : "❌"}`);
+
 	return out;
 }