pi-goal-list-loop-audit 0.26.4 → 0.26.6

package/extensions/goal-loop-backoff.ts

@@ -90,6 +90,44 @@ export const MEASURE_TIMEOUT_MS = 10 * 60_000;
  * disapprove, never hang the completion gate forever. */
 export const AUDITOR_STALL_MS = 10 * 60_000;
 
+/** v0.26.5: pending-latch watchdog threshold. Field-observed failure: a
+ * continuation sent right at compaction was ACCEPTED by pi (sendMessage
+ * returned) but the turn trigger was dropped — pi's pending-message flag
+ * then stayed set forever. sessionIdle (= isIdle && !hasPendingMessages)
+ * never went true, so the heartbeat refire path AND the stall escalation
+ * were both suppressed: 22 minutes of total silence until a manual nudge.
+ * The wedge alert was blind too (22m < 30m threshold, and its "hung
+ * command" framing would be wrong anyway). This watchdog owns that
+ * shape: idle + pending + silent >= threshold = the latch is stuck. */
+export const PENDING_LATCH_STUCK_MS = 3 * 60_000;
+
+export interface PendingLatchInput {
+  /** A goal is active (autoContinue) or a loop is running. */
+  supervising: boolean;
+  /** ctx.isIdle() — the session is NOT mid-turn. */
+  idle: boolean;
+  /** ctx.hasPendingMessages() — pi believes a message is still queued. */
+  pending: boolean;
+  /** A continuation or loop timer is already scheduled. */
+  timerPending: boolean;
+  /** Milliseconds since the last observed agent activity. */
+  silentMs: number;
+  /** Threshold in ms; 0 disables the watchdog. */
+  thresholdMs: number;
+}
+
+/** Should the pending-latch watchdog count a stall right now? It never
+ * re-sends: the message is ALREADY queued pi-side, and the hegemon
+ * zombie proved re-sends don't unstick a dropped trigger (619 sends,
+ * zero turns). Count + notify + escalate to a loud stop instead. */
+export function shouldFirePendingLatchWatchdog(input: PendingLatchInput): boolean {
+  if (!input.supervising) return false;
+  if (!input.idle || !input.pending) return false;
+  if (input.timerPending) return false;
+  if (input.thresholdMs <= 0) return false;
+  return input.silentMs >= input.thresholdMs;
+}
+
 export interface WedgeInput {
   /** A goal is active (autoContinue) or a loop is running. */
   supervising: boolean;

package/extensions/goal-loop-core.ts

@@ -917,6 +917,8 @@ export function isAutoCommitPaused(cwd: string): boolean {
 /** Suppress the heartbeat when work shipped very recently — a session
  * that just committed is transitioning, not stalled. Pure; the tick
  * gathers the timestamps. */
+/** @deprecated v0.26.6: no longer called by the heartbeat (self-sustaining
+ * under ledger writes / auto-commit daemons). Kept for API compatibility. */
 export function shouldSuppressHeartbeatForRecentShip(args: {
   nowMs: number;
   lastShippedAtMs: number | null;
@@ -930,6 +932,10 @@ export function shouldSuppressHeartbeatForRecentShip(args: {
 /** Best-effort "when did work last ship" for a repo: newest of the HEAD
  * commit time and the .pi-glla state file mtime. Null when unknown. */
 export function lastShippedAtMs(cwd: string): number | null {
+  // v0.26.6: the .pi-glla/active.jsonl MTIME term was REMOVED — the
+  // heartbeat's own ledger writes refreshed it every 15s, which made the
+  // 0.25.0 ship-suppression self-sustaining (darklord: 9.1h / 2,184
+  // suppressed ticks). Only a real git commit counts as a ship now.
   let best: number | null = null;
   try {
     const out = execSync("git log -1 --format=%ct", { cwd, stdio: ["ignore", "pipe", "ignore"] })
@@ -940,12 +946,6 @@ export function lastShippedAtMs(cwd: string): number | null {
   } catch {
     /* not a git repo or no commits */
   }
-  try {
-    const mtime = fs.statSync(path.join(cwd, ".pi-glla", "active.jsonl")).mtimeMs;
-    if (best === null || mtime > best) best = mtime;
-  } catch {
-    /* no state file yet */
-  }
   return best;
 }
 

package/extensions/loops/goal.ts

@@ -38,7 +38,6 @@ import {
   classifyImpossibleReason,
   extractPendingTasks,
   isFullAuditObjective,
-  lastShippedAtMs,
   resolveEffectiveAggressiveSettings,
   appendAuditLog,
   computeListDepth,
@@ -52,7 +51,6 @@ import {
   crossRecommendMode,
   formatListDepth,
   shouldEscalateStall,
-  shouldSuppressHeartbeatForRecentShip,
   mergeSettings,
   parseListImport,
 
@@ -160,6 +158,8 @@ import {
   MEASURE_TIMEOUT_MS,
   WEDGE_ALERT_DEFAULT_MINUTES,
   shouldWedgeAlert,
+  PENDING_LATCH_STUCK_MS,
+  shouldFirePendingLatchWatchdog,
 } from "../goal-loop-backoff.js";
 
 // =================================================================
@@ -238,6 +238,10 @@ let heartbeatNudges = 0;
 // refire's own noteActivity, which is what made the hegemon zombie spin
 // self-sustaining (619 refires / 23.5h / zero turns).
 let consecutiveStalls = 0;
+// v0.26.6: precise replacement for the removed ship-recency suppression —
+// set while complete_goal's isolated audit runs, so the heartbeat never
+// refires into an in-flight completion.
+let completionAuditInFlight = false;
 let heartbeatTimer: NodeJS.Timeout | null = null;
 
 function noteActivity(real = false): void {
@@ -280,15 +284,74 @@ function startUITicker(): void {
   uiTicker.unref?.();
 }
 
+/** v0.26.5: shared loud-stop for both stall paths (refire streak and
+ * pending-latch streak). Returns true when it escalated. */
+function escalateStallNow(ctx: ExtensionContext, threshold: number): boolean {
+  if (!shouldEscalateStall(consecutiveStalls, threshold)) return false;
+  consecutiveStalls = 0;
+  appendLedger(ctx.cwd, "stall_escalated", { threshold, kind: isLoopActive() ? "loop" : "goal" });
+  if (isLoopActive()) {
+    clearLoopTimer();
+    state.loop = { ...state.loop!, active: false, stopReason: `stalled: ${threshold} continuation refires landed no turn — the session is not continuing (wedged message queue or stale API). Restart pi, then /loop start again.` };
+    persistState(ctx);
+    ctx.ui.notify(`Loop stopped: ${threshold} refires produced no turn — the continuation is not landing. Restart pi and /loop start.`, "warning");
+    notifyExternal(ctx, "Loop stopped: stalled (continuation not landing).");
+    return true;
+  }
+  if (state.goal && state.goal.status === "active") {
+    updateGoal({
+      status: "paused",
+      pauseReason: `stalled: ${threshold} continuation refires landed no turn`,
+      pauseSuggestedAction: "The continuation chain is broken in this process (wedged message queue or stale API). Restart pi, then /goal resume.",
+    }, ctx);
+    ctx.ui.notify(`Goal paused: ${threshold} refires produced no turn. Restart pi, then /goal resume.`, "warning");
+    notifyExternal(ctx, "Goal paused: stalled (continuation not landing).");
+    return true;
+  }
+  return true;
+}
+
 function heartbeatTick(): void {
   const ctx = freshCtx();
   if (!ctx) return;
-  let sessionIdle = false;
+  let idle = false;
+  let pending = false;
   try {
-    sessionIdle = ctx.isIdle() && !ctx.hasPendingMessages();
+    idle = ctx.isIdle();
+    pending = ctx.hasPendingMessages();
   } catch {
     return;
   }
+  const sessionIdle = idle && !pending;
+  // v0.26.5: pending-latch watchdog — a queued continuation whose turn
+  // trigger was dropped (field-observed post-compaction: continuation
+  // ACCEPTED at compact+0s, then 22 minutes of silence). The stuck latch
+  // keeps sessionIdle false, which suppresses the refire path AND the
+  // stall escalation below — without this branch the session is silent
+  // forever. We never re-send here (the message is already queued
+  // pi-side; hegemon proved re-sends don't unstick a dropped trigger) —
+  // count, notify, escalate to a loud stop.
+  const latchSilentMs = Date.now() - lastActivityAt;
+  if (
+    shouldFirePendingLatchWatchdog({
+      supervising: isSupervising(),
+      idle,
+      pending,
+      timerPending: continuationTimer !== null || loopTimer !== null,
+      silentMs: latchSilentMs,
+      thresholdMs: PENDING_LATCH_STUCK_MS,
+    })
+  ) {
+    consecutiveStalls++;
+    appendLedger(ctx.cwd, "pending_latch_stuck", { consecutiveStalls, silentMs: latchSilentMs });
+    noteActivity(); // re-arm the 3-minute cadence; never resets the stall streak
+    const stallEscalation = loadSettings(ctx.cwd).stallEscalationRefires ?? DEFAULT_STALL_ESCALATION_REFIRES;
+    if (escalateStallNow(ctx, stallEscalation)) return;
+    const msg = `Heartbeat: a queued continuation never started its turn for ${Math.round(latchSilentMs / 60_000)}m — pi's pending-message latch appears stuck (known post-compaction failure; stall ${consecutiveStalls}/${stallEscalation > 0 ? stallEscalation : "∞"}). If this repeats, restart pi.`;
+    ctx.ui.notify(msg, "warning");
+    notifyExternal(ctx, msg);
+    return;
+  }
   const fire = shouldHeartbeatRefire({
     supervising: isSupervising(),
     sessionIdle,
@@ -305,7 +368,9 @@ function heartbeatTick(): void {
   if (
     shouldWedgeAlert({
       supervising: isSupervising(),
-      sessionBusy: !sessionIdle,
+      // v0.26.5: !idle, not !sessionIdle — an idle session with a stuck
+      // pending latch is the watchdog's job above, not a "hung command".
+      sessionBusy: !idle,
       silentMs: Date.now() - lastActivityAt,
       msSinceLastAlert: Date.now() - lastWedgeAlertAt,
       thresholdMs: wedgeMinutes * 60_000,
@@ -318,18 +383,16 @@ function heartbeatTick(): void {
     notifyExternal(ctx, msg);
   }
   if (!fire) return;
-  // v0.25.0 (contract item 27): a session that SHIPPED in the last 5
-  // minutes (commit or ledger write) is transitioning, not stalled —
-  // suppress the refire so rapid iteration isn't interrupted.
-  if (
-    shouldSuppressHeartbeatForRecentShip({
-      nowMs: Date.now(),
-      lastShippedAtMs: lastShippedAtMs(ctx.cwd),
-    })
-  ) {
-    appendLedger(ctx.cwd, "heartbeat_suppressed", { reason: "recent ship (<5m)" });
-    return;
-  }
+  // v0.26.6: the 0.25.0 "recent ship (<5m)" suppression was REMOVED. It fed
+  // lastShippedAtMs, which read the state-file MTIME — and the heartbeat's
+  // own suppressed-tick ledger writes refreshed that mtime every 15s,
+  // making the suppression self-sustaining forever (field-observed in
+  // darklord: 2,184 suppressed ticks over 9.1h after a post-compaction
+  // send failure; the completed list item never closed). Under an
+  // auto-committing daemon the git-head term self-sustains too. The legit
+  // windows are already covered precisely — busy mid-turn, pending
+  // messages, scheduled timers — plus the audit-in-flight flag below.
+  if (completionAuditInFlight) return;
   noteActivity();
   consecutiveStalls++;
   appendLedger(ctx.cwd, "heartbeat_refire", { nudgesSoFar: heartbeatNudges, consecutiveStalls });
@@ -338,28 +401,7 @@ function heartbeatTick(): void {
   // this — they count turns, and a zombie runs none. Escalate to a loud,
   // actionable stop instead of spinning silently forever.
   const stallEscalation = loadSettings(ctx.cwd).stallEscalationRefires ?? DEFAULT_STALL_ESCALATION_REFIRES;
-  if (shouldEscalateStall(consecutiveStalls, stallEscalation)) {
-    consecutiveStalls = 0;
-    appendLedger(ctx.cwd, "stall_escalated", { threshold: stallEscalation, kind: isLoopActive() ? "loop" : "goal" });
-    if (isLoopActive()) {
-      clearLoopTimer();
-      state.loop = { ...state.loop!, active: false, stopReason: `stalled: ${stallEscalation} continuation refires landed no turn — the session is not continuing (wedged message queue or stale API). Restart pi, then /loop start again.` };
-      persistState(ctx);
-      ctx.ui.notify(`Loop stopped: ${stallEscalation} refires produced no turn — the continuation is not landing. Restart pi and /loop start.`, "warning");
-      notifyExternal(ctx, "Loop stopped: stalled (continuation not landing).");
-      return;
-    }
-    if (state.goal && state.goal.status === "active") {
-      updateGoal({
-        status: "paused",
-        pauseReason: `stalled: ${stallEscalation} continuation refires landed no turn`,
-        pauseSuggestedAction: "The continuation chain is broken in this process (wedged message queue or stale API). Restart pi, then /goal resume.",
-      }, ctx);
-      ctx.ui.notify(`Goal paused: ${stallEscalation} refires produced no turn. Restart pi, then /goal resume.`, "warning");
-      notifyExternal(ctx, "Goal paused: stalled (continuation not landing).");
-      return;
-    }
-  }
+  if (escalateStallNow(ctx, stallEscalation)) return;
   ctx.ui.notify(`Heartbeat: supervisor active but session stalled — re-firing continuation (stall ${consecutiveStalls}/${stallEscalation > 0 ? stallEscalation : "∞"}).`, "info");
   if (isLoopActive()) {
     scheduleLoopTick(ctx);
@@ -1852,13 +1894,20 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       // retry with backoff before we report "auditor infrastructure error
       // (retried once)". Neither attempt is a verdict on the work.
       const auditStartMs = Date.now();
-      const { result, retriedOnce } = await runWithInfraRetry(runAudit, {
-        onRetry: (err) => {
-          latestAuditProgress = { label: `infra error (${err.slice(0, 40)}) — retrying once`, lastEventAt: Date.now() };
-          refreshUI(ctx);
-          appendLedger(ctx.cwd, "audit_infra_retry", { goalId: state.goal?.id, error: err.slice(0, 200) });
-        },
-      });
+      completionAuditInFlight = true;
+      let result: Awaited<ReturnType<typeof runAudit>>;
+      let retriedOnce = false;
+      try {
+        ({ result, retriedOnce } = await runWithInfraRetry(runAudit, {
+          onRetry: (err) => {
+            latestAuditProgress = { label: `infra error (${err.slice(0, 40)}) — retrying once`, lastEventAt: Date.now() };
+            refreshUI(ctx);
+            appendLedger(ctx.cwd, "audit_infra_retry", { goalId: state.goal?.id, error: err.slice(0, 200) });
+          },
+        }));
+      } finally {
+        completionAuditInFlight = false;
+      }
       const auditDurationMs = Date.now() - auditStartMs;
       latestAuditProgress = null;
       // Audit history: record REAL verdicts only — a non-empty report is the

package/extensions/reviewer.ts

@@ -80,11 +80,13 @@ const CLASS_PATTERNS: Array<{ class: FindingClass; re: RegExp }> = [
  * the reviewer's own report/config vocabulary. Observed false positives
  * from the 0.26.2 completion: a test("…architectural…") name, the
  * INSTALL.md mode-matrix row, and ship-doc prose. */
-const SKIP_LINE = /^\s*(test|it|describe|assert|expect)\s*\(|^\s*(const|let|var|function|import|export|require)\b|\{\s*\.\.\.\s*\}|,\s*\.\.\.$|^\s*\||^\s*[{\[\]}]|^\s*['"]/;
+const SKIP_LINE = /^\s*(test|it|describe|assert|expect)\s*\(|^\s*(const|let|var|function|import|export|require)\b|\{\s*\.\.\.\s*\}|,\s*\.\.\.$|^\s*\||^\s*[{\[\]}]|^\s*['"]|^\s*ℹ/; // ℹ = test-runner/status noise ("ℹ todo 0" was enqueued as a /list item by the 0.26.2 reviewer)
 const REVIEWER_VOCAB = /architectural-class|bug-class|refactor-class|strategic-class|reviewer found|cascade step|\*\*Mode\*\*|problems\s*\/\s*\(?(improvements|architectural)/i;
 
 export function classifyFindingText(line: string): FindingClass | undefined {
-  const t = line.trim();
+  // Strip list markers here too (extractFindings already does, but direct
+  // callers/tests pass raw report lines like "- ℹ todo 0").
+  const t = line.trim().replace(/^[-*>\s\[\]x]+/, "");
   if (t.length < 8) return undefined;
   if (SKIP_LINE.test(t) || REVIEWER_VOCAB.test(t)) return undefined;
   for (const { class: cls, re } of CLASS_PATTERNS) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.26.4",
+  "version": "0.26.6",
   "description": "Goal. Loop. Audit. Done. — a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor — only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",