pi-goal-list-loop-audit 0.29.10 → 0.29.12

package/extensions/goal-loop-core.ts

@@ -1045,10 +1045,15 @@ export function shouldSuppressHeartbeatForRecentShip(args: {
 /** Best-effort "when did work last ship" for a repo: newest of the HEAD
  * commit time and the .pi-glla state file mtime. Null when unknown. */
 /** v0.26.7: pi's exact stale-runtime error signature — thrown by every
- * runtime-bound method after pi invalidates the extension on session
- * replacement (newSession/fork/switchSession/reload; compaction reaches
- * the same teardown in pi 0.82.x). See dist/core/extensions/loader.js
- * createExtensionRuntime().invalidate. */
+ * runtime-bound method after pi invalidates the extension. v0.29.12 source
+ * audit (pi 0.83.0 dist): the ONLY invalidate() caller is AgentSession
+ * .dispose(), reachable solely via session replacement (newSession/
+ * switchSession/fork/quit). COMPACTION NEVER DISPOSES — manual, auto, and
+ * overflow compaction all rebuild context in place. Field note 2026-07-30:
+ * 10 stale events in 4 days in endless-td, repeatedly ~3 min after
+ * compactions with NO new session file and zombie command handlers still
+ * answering — a replacement that disposed but never re-ran factories (or
+ * a same-file switchSession); the disposing path is unidentified pi-side. */
 export function isStaleApiError(err: unknown): boolean {
   return err instanceof Error && err.message.includes("stale after session replacement");
 }

package/extensions/goal-loop-display.ts

@@ -173,10 +173,11 @@ export function buildStatusText(state: State, audit?: AuditDisplayProgress | nul
     return `glla: ${paint(theme, pauseIsError(g) ? "error" : "warning", label)}${heldSuffix}`;
   }
   if (g.status === "active") {
-    // v0.28.1 (S1/S2): a stale-handle interrupt keeps the goal ACTIVE (the
-    // next fresh session auto-resumes it) — say so instead of looking healthy.
+    // v0.28.1 (S1/S2): a stale-handle interrupt keeps the goal ACTIVE.
+    // v0.29.11: the fresh session HOLDS it (hold-everything restore gate;
+    // autoresume=on resumes for you) — name the verb, don't promise auto.
     if (g.interruptedAt) {
-      return `glla: ${g.policy} ${paint(theme, "error", "⚠ interrupted — stale handle · auto-resumes on pi restart")}${heldSuffix}`;
+      return `glla: ${g.policy} ${paint(theme, "error", "⚠ interrupted — stale handle · /reload → /glla resume")}${heldSuffix}`;
     }
     // v0.24.7: list policy gets its own wording — a queue item is not a goal.
     // v0.28.11 (U10): goal policy joins it — "list 29" read as a command

package/extensions/loops/goal.ts

@@ -219,7 +219,7 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   if (extensionApiStale) return; // already terminal — don't re-spam
   extensionApiStale = true;
   appendLedger(ctx.cwd, "extension_api_stale", { where, kind: isLoopActive() ? "loop" : "goal" });
-  const guidance = "pi invalidated this session's extension handle (session replacement — compaction triggers it in pi 0.82.x). Sends can never land in this process. Restart pi (or reload extensions) — an active goal auto-resumes on the fresh session; loops need /loop start.";
+  const guidance = "pi invalidated this session's extension handle (session replacement — the session was disposed and this process's sends can never land). Run /reload — extensions rebuild IN PLACE, no pi restart needed — then /glla resume (autoresume=on resumes for you). Restart pi only if /reload itself fails.";
   if (isLoopActive()) {
     clearLoopTimer();
     state.loop = { ...state.loop!, active: false, stopReason: `extension api stale: ${guidance}` };
@@ -260,7 +260,7 @@ function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   if (!probeExtensionApiStale()) return false;
   appendLedger(ctx.cwd, "extension_api_stale", { where: `entry probe (${what})` });
   ctx.ui.notify(
-    `glla: this session's extension handle is stale (pi session replacement) — ${what} can't send continuations in this process. State is safe in .pi-glla/ — restart pi and the active goal auto-resumes.`,
+    `glla: this session's extension handle is stale (pi session replacement) — ${what} can't send continuations in this process. State is safe in .pi-glla/ — run /reload (extensions rebuild in place), then /glla resume. Restart pi only if /reload fails.`,
     "warning",
   );
   return true;
@@ -544,9 +544,9 @@ function escalateSendRearmStorm(ctx: ExtensionContext, kind: "continuation" | "l
   appendLedger(ctx.cwd, "send_rearm_escalated", { kind, afterMinutes: mins, silentMinutes: silent });
   if (kind === "loop" && isLoopActive()) {
     clearLoopTimer();
-    state.loop = { ...state.loop!, active: false, stopReason: `send-retry storm: ${mins}m of re-arms with no session activity for ${silent}m — the session is wedged. Restart pi, then /loop start again.` };
+    state.loop = { ...state.loop!, active: false, stopReason: `send-retry storm: ${mins}m of re-arms with no session activity for ${silent}m — the session is wedged. Restart pi, then /loop resume (the loop holds on restore).` };
     persistState(ctx);
-    ctx.ui.notify(`Loop stopped: send-retry storm (${mins}m, session silent ${silent}m). Restart pi and /loop start.`, "warning");
+    ctx.ui.notify(`Loop stopped: send-retry storm (${mins}m, session silent ${silent}m). Restart pi, then /loop resume (the loop holds on restore).`, "warning");
     notifyExternal(ctx, "Loop stopped: send-retry storm.");
     return;
   }
@@ -583,9 +583,9 @@ function escalateStallNow(ctx: ExtensionContext, threshold: number): boolean {
   appendLedger(ctx.cwd, "stall_escalated", { threshold, kind: isLoopActive() ? "loop" : "goal" });
   if (isLoopActive()) {
     clearLoopTimer();
-    state.loop = { ...state.loop!, active: false, stopReason: `stalled: ${threshold} continuation refires landed no turn — the session is not continuing (wedged message queue or stale API). Restart pi, then /loop start again.` };
+    state.loop = { ...state.loop!, active: false, stopReason: `stalled: ${threshold} continuation refires landed no turn — the session is not continuing (wedged message queue or stale API). Restart pi, then /loop resume (the loop holds on restore).` };
     persistState(ctx);
-    ctx.ui.notify(`Loop stopped: ${threshold} refires produced no turn — the continuation is not landing. Restart pi and /loop start.`, "warning");
+    ctx.ui.notify(`Loop stopped: ${threshold} refires produced no turn — the continuation is not landing. Restart pi, then /loop resume (the loop holds on restore).`, "warning");
     notifyExternal(ctx, "Loop stopped: stalled (continuation not landing).");
     return true;
   }
@@ -619,12 +619,16 @@ function heartbeatTick(): void {
   // machinery below stays quiet for 3 minutes while the replaced session
   // settles (latch watchdog, wedge alert, refire counting all resume after).
   if (Date.now() < compactionGraceUntil) return;
-  // v0.28.27: a stale (session-replaced) handle can never land a send —
-  // the terminal warning already fired once. ALL stall machinery stays
-  // quiet from here on: refiring into a dead process is misleading, and
-  // worse, the stall escalation would PAUSE the goal — silently cancelling
-  // the interruptedAt → auto-resume-on-restart promise the footer shows.
-  if (extensionApiStale) return;
+  // v0.29.11: PROBE the handle before the stall machinery runs — a
+  // session-replaced handle can never land a refire, so detect it on the
+  // first tick after replacement and go terminal immediately, instead of
+  // burning refires into the void until a send happens to throw (field:
+  // polis stall 3/5, endless-td stall 1/5 before the warning fired).
+  // v0.28.27: once terminal, ALL stall machinery stays quiet from here
+  // on: refiring into a dead process is misleading, and worse, the stall
+  // escalation would PAUSE the goal — silently cancelling the
+  // interruptedAt → hold-on-restart promise the footer shows.
+  if (probeExtensionApiStale()) { goStaleTerminal(ctx, "heartbeat probe"); return; }
   // v0.29.1: stranded-audit recovery. A goal left in "auditing" with NO
   // in-flight audit means the auditor's result never landed (wedged queue
   // ate the tool result; compaction/restart mid-audit). Field-observed in
@@ -4499,6 +4503,10 @@ async function cmdGllaWipe(ctx: ExtensionContext): Promise<void> {
  * genuinely differ per type (tweak/finish/next/decide/refine) stay typed.
  */
 async function cmdGllaResume(ctx: ExtensionContext): Promise<void> {
+  // v0.29.12: a zombie instance (handle dead after session replacement)
+  // used to answer "Nothing to resume" — the resume path must name the
+  // real recovery (/reload rebuilds extensions in place), not mislead.
+  if (warnIfStaleAtEntry(ctx, "/glla resume")) return;
   const g = state.goal;
   const goalResumable = g && g.status === "paused";
   const loopResumable = state.loop && !state.loop.active && state.loop.stopReason === HELD_ON_RESTORE;
@@ -5328,6 +5336,16 @@ export default function (pi: ExtensionAPI): void {
     ) {
       ctx.ui.notify("Auto-resume fired (event: session start). Continue working.", "info");
     }
+    // v0.29.11: loops stopped by the stale-handle terminal or the stall
+    // escalation told the user "restart pi, then /loop start" — but a
+    // fresh start discards iteration/best/history. Hold them on load like
+    // any restore-held loop: /loop resume continues from the saved state.
+    if (state.loop && !state.loop.active &&
+        (state.loop.stopReason?.startsWith("extension api stale") || state.loop.stopReason?.startsWith("stalled:") || state.loop.stopReason?.startsWith("send-retry storm:"))) {
+      appendLedger(ctx.cwd, "loop_held_for_resume", { was: (state.loop.stopReason ?? "").slice(0, 40) });
+      state.loop = { ...state.loop, stopReason: HELD_ON_RESTORE };
+      persistState(ctx);
+    }
     // v0.29.10: reseed live/held audit loops stuck on the degenerate
     // pre-discovery baseline-0 — best can never go below 0, so every
     // iteration stalls and the prompt cries REGRESSED on real progress

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.29.10",
+  "version": "0.29.12",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",