pi-goal-list-loop-audit 0.31.9 → 0.32.1

package/extensions/goal-loop-auditor.ts

@@ -338,6 +338,9 @@ export async function runGoalCompletionAuditor(args: {
     } finally {
       clearInterval(stallTimer);
       unsub();
+      // v0.32.0: dispose the auditor session — each complete_goal leaked one
+      // session's subscriptions/stream resources for the parent's lifetime.
+      (session as any).dispose?.();
     }
 
     if (stalled) {

package/extensions/goal-settings.ts

@@ -188,6 +188,8 @@ export function loadGlobalSettings(): Settings {
 /** Every provenance-tracked key (the /glla headless display + UI). */
 export const SETTINGS_KEYS: Array<keyof Settings> = [
   "auditorModel",
+  "auditorModelFallback",
+  "auditorSameSessionSwap",
   "auditorThinkingLevel",
   "notifyCmd",
   "tokenLimit",

package/extensions/loops/goal.ts

@@ -223,6 +223,14 @@ let extensionApi: ExtensionAPI | null = null;
 // throws FOREVER in this process — retrying for hours is the hegemon
 // failure shape. Detect the stale signature once and go terminally loud.
 let extensionApiStale = false;
+// v0.32.0: CRITICAL — goStaleTerminal must gate on its OWN flag, not
+// extensionApiStale: probeExtensionApiStale() sets extensionApiStale on
+// detection, so the heartbeat's `probe → goStaleTerminal` sequence always
+// found the flag already true and returned silently — orphan-stale recovery
+// (ledger, loop stop, interruptedAt, warn, AUTO-RELOAD SELF-HEAL) was dead
+// code since v0.29.11. Field proof: hegemon sat stale for days and the
+// wezterm self-heal never fired.
+let staleTerminalDone = false;
 
 /** v0.26.7: a stale api is terminal for this process — go loudly with
  * restart guidance instead of retrying sends that can never land.
@@ -292,16 +300,24 @@ function absorbStaleIfSuperseded(ctx: ExtensionContext): boolean {
     extensionApiStale = true; // silence the send paths WITHOUT the terminal theatre
     clearLoopTimer();
     if (continuationTimer) { clearTimeout(continuationTimer); continuationTimer = null; }
+    // v0.32.0: the superseded module's heartbeat + UI ticker were IMMORTAL
+    // (clearInterval appeared nowhere) — N /reloads = N×2 zombie tickers.
+    if (heartbeatTimer) { clearInterval(heartbeatTimer); heartbeatTimer = null; }
+    if (uiTicker) { clearInterval(uiTicker); uiTicker = null; }
     return true;
   }
   return false;
 }
 
 function goStaleTerminal(ctx: ExtensionContext, where: string): void {
-  if (extensionApiStale) return; // already terminal — don't re-spam
+  if (staleTerminalDone) return; // already terminal — don't re-spam
+  staleTerminalDone = true;
   extensionApiStale = true;
   appendLedger(ctx.cwd, "extension_api_stale", { where, kind: isLoopActive() ? "loop" : "goal" });
   const guidance = "pi invalidated this session's extension handle (session replacement — the session was disposed and this process's sends can never land). Run /reload — extensions rebuild IN PLACE, no pi restart needed — then /glla resume (autoresume=on resumes for you). Restart pi only if /reload itself fails.";
+  // v0.32.0: kill the continuation re-arm too — otherwise an orphaned goal
+  // keeps spinning a flat 50ms retry below every watchdog.
+  if (continuationTimer) { clearTimeout(continuationTimer); continuationTimer = null; continuationScheduledFor = null; }
   if (isLoopActive()) {
     clearLoopTimer();
     state.loop = { ...state.loop!, active: false, stopReason: `extension api stale: ${guidance}` };
@@ -400,6 +416,12 @@ function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   // v0.30.0: a successor may already own this session (e.g. /reload
   // re-imported the modules) — the user's command belongs to the fresh
   // instance; say so softly instead of demanding a reload.
+  // v0.32.0: the rebind window means a fresh instance is COMING, not here —
+  // the old message claimed "handled there" while nothing owned the session.
+  if (Date.now() < sessionReplacementUntil) {
+    ctx.ui.notify(`glla: this session is rebinding after /reload — ${what} will be handled by the refreshed instance; retry in a moment if it doesn't.`, "info");
+    return true;
+  }
   if (absorbStaleIfSuperseded(ctx)) {
     ctx.ui.notify(`glla: a refreshed instance owns this session — ${what} is handled there; nothing to do.`, "info");
     return true;
@@ -579,6 +601,8 @@ let carryoverResolved = true;
 // set while complete_goal's isolated audit runs, so the heartbeat never
 // refires into an in-flight completion.
 let completionAuditInFlight = false;
+// v0.32.0: consecutive stored-claim quota retries (capped at 5, then hold).
+let quotaRetryStreak = 0;
 let heartbeatTimer: NodeJS.Timeout | null = null;
 
 const ZOMBIE_RUN_SILENT_MS = 20 * 60_000;
@@ -644,6 +668,16 @@ let loopRearmStreak = 0;
 // whose turn trigger was still dead — pausing a resumable goal 4 minutes
 // after the compact instead of giving pi room to recover.
 let compactionGraceUntil = 0;
+// v0.32.1 (pi-goal-x's lesson — "recover from compacts smarter"): a compact
+// leaves a RESUME DEBT, not just two fixed-offset settle probes that can both
+// lose (field: hellhunter 4-min dangle 2026-07-31; polis stall same day).
+// postCompactResumeOwed discharges only when a real turn starts (agent_start);
+// every heartbeat tick past grace retries it. postCompactResyncPending arms a
+// deterministic [POST-COMPACTION RESYNC] block on the next continuation/loop
+// message (pi-goal-x's #5) so the compacted agent re-anchors on artifact
+// state instead of lost chat history.
+let postCompactResumeOwed = false;
+let postCompactResyncPending = false;
 const COMPACTION_GRACE_MS = 3 * 60_000;
 // v0.28.25: provider-error retry cadence. Field-observed in dracon-utilities
 // (kimi, 19-session fleet on one provider account): a "concurrent request
@@ -803,6 +837,24 @@ function heartbeatTick(): void {
     if (!absorbStaleIfSuperseded(ctx)) goStaleTerminal(ctx, "heartbeat probe");
     return;
   }
+  // v0.32.1: post-compaction resume debt — retry on every heartbeat tick
+  // past grace until a turn actually starts. Fixed-offset settles alone
+  // can both lose (pi busy at 2s AND at grace+2s = a dangling chain).
+  if (postCompactResumeOwed && isSupervising() && !abortedStandDown) {
+    try {
+      if (ctx.isIdle() && !ctx.hasPendingMessages() && continuationTimer === null && loopTimer === null) {
+        if (isLoopActive()) {
+          appendLedger(ctx.cwd, "compaction_resume_owed_refire", { kind: "loop" });
+          scheduleLoopTick(ctx);
+        } else if (isActionableGoal()) {
+          appendLedger(ctx.cwd, "compaction_resume_owed_refire", { kind: "goal" });
+          scheduleContinuation(ctx, true);
+        } else {
+          postCompactResumeOwed = false; // nothing to resume — discharge
+        }
+      }
+    } catch { /* next tick */ }
+  }
   // v0.29.16: zombie-run watchdog. pi reports BUSY (a run is "active") but
   // zero stream events for 20 min = the provider stream hung silently —
   // queued continuations can't land, and every other watchdog stays quiet
@@ -1005,6 +1057,9 @@ function sendContinuation(goalId: string): void {
   if (!isActionableGoal()) return;
   const ctx = freshCtx();
   if (!ctx) {
+    // v0.32.0: a stale handle must not spin a flat 50ms re-arm below every
+    // watchdog — the heartbeat's terminal path does the theatre; we just stop.
+    if (probeExtensionApiStale()) return;
     // No live ctx — retry shortly; the next session event will refresh it.
     continuationScheduledFor = goalId;
     continuationTimer = setTimeout(() => sendContinuation(goalId), BACKOFF_IDLE_RETRY_MS);
@@ -1021,11 +1076,13 @@ function sendContinuation(goalId: string): void {
   }
   if (!extensionApi || extensionApiStale) return;
   try {
+    const resync = postCompactResyncPending ? buildPostCompactResync() : "";
     extensionApi.sendMessage({
       customType: GOAL_EVENT_ENTRY,
-      content: continuationPrompt(state.goal!),
+      content: resync + continuationPrompt(state.goal!),
       display: false,
     }, { triggerTurn: true, deliverAs: "followUp" });
+    if (resync) postCompactResyncPending = false; // consumed only by a landed send
     continuationRearmStreak = 0; continuationRearmSince = 0; // v0.28.5 (E3): a landed send clears the storm
     appendLedger(ctx.cwd, "goal_continuation_sent", { goalId });
   } catch (err) {
@@ -1078,6 +1135,25 @@ function sendLengthContinue(ctx: ExtensionContext, consecutive: number): void {
   }
 }
 
+/** v0.32.1: deterministic post-compaction re-anchor (pi-goal-x's #5) —
+ * prepended to the first continuation/loop message after a compact. */
+function buildPostCompactResync(): string {
+  const lines: string[] = [
+    "[POST-COMPACTION RESYNC] The transcript was just compacted. Trust the artifacts on disk and .pi-glla/ state — NOT your memory of the prior chat. Re-read files before editing them.",
+  ];
+  if (state.goal) {
+    lines.push(`Goal ${state.goal.id} — status ${state.goal.status}`);
+    lines.push(`Objective: ${state.goal.objective.slice(0, 200)}`);
+    const next = findNextPendingTask(state.goal.taskList?.tasks ?? []);
+    if (next) lines.push(`Next pending task: \`${next.id}\` — ${next.title}`);
+    const lastAudit = state.goal.auditHistory?.[state.goal.auditHistory.length - 1];
+    if (lastAudit) lines.push(`Last audit: ${lastAudit.approved ? "APPROVED" : lastAudit.impossible ? "IMPOSSIBLE" : "disapproved"} (${lastAudit.at})`);
+  } else if (state.loop?.active) {
+    lines.push(`Loop: ${state.loop.target.slice(0, 160)} — iteration ${state.loop.iteration}`);
+  }
+  return lines.join("\n") + "\n\n";
+}
+
 function continuationPrompt(goal: Goal): string {
   // Read the .md file as the template, then substitute {{tokens}}.
   // For v0.1.0 we inline-substitute so we don't need fs at runtime.
@@ -1251,7 +1327,9 @@ async function fanOutListAuditFindings(ctx: ExtensionContext): Promise<void> {
   // Dedupe against the live queue (a re-run must not double-queue a finding
   // that's already waiting) — match on the finding text's first 60 chars.
   const queuedText = listQueue().map((i) => i.objective).join("\n");
-  const fresh = open.filter((f) => !queuedText.includes(f.text.slice(0, 60)));
+  // v0.32.0: cap one fan-out — a runaway findings file must not enqueue
+  // hundreds of items on a single Confirm.
+  const fresh = open.filter((f) => !queuedText.includes(f.text.slice(0, 60))).slice(0, 50);
   const alreadyQueued = open.length - fresh.length;
   const decideNote =
     decisions.length > 0
@@ -1440,6 +1518,14 @@ async function retryStoredCompletionAudit(ctx: ExtensionContext, origin: "quota-
       pauseSuggestedAction: `Quota auto-retry in ${retryMin}m — or /goal resume to retry now`,
     }, liveCtx);
     appendLedger(liveCtx.cwd, "goal_paused", { reason: `auditor quota: retry in ${quota.retryAfterSec}s (stored-claim retry)` });
+    // v0.32.0: terminal cap — a permanently dead auditor key must not spawn
+    // one auditor per hour forever. 5 consecutive quota retries → hold.
+    quotaRetryStreak++;
+    if (quotaRetryStreak >= 5) {
+      appendLedger(liveCtx.cwd, "quota_retry_capped", { streak: quotaRetryStreak });
+      liveCtx.ui.notify(`Auditor quota retry gave up after ${quotaRetryStreak} consecutive attempts — the claim stays stored; /goal resume retries by hand.`, "warning");
+      return;
+    }
     liveCtx.ui.notify(`Auditor still quota-limited — next auto-retry in ${retryMin}m (your completion claim is stored; no action needed).`, "warning");
     scheduleQuotaRetry(liveCtx, quota.retryAfterSec, result.error, () => {
       if (state.goal && state.goal.status === "paused" && (state.goal.pauseReason ?? "").startsWith("auditor quota:") && state.goal.pendingCompletion) {
@@ -1452,6 +1538,7 @@ async function retryStoredCompletionAudit(ctx: ExtensionContext, origin: "quota-
   // Any other outcome — disapproved, impossible, non-quota infra — belongs
   // to the agent: resume and let the continuation drive the next step. The
   // verdict is durable in auditHistory + /goal status.
+  quotaRetryStreak = 0;
   updateGoal({
     status: "active",
     auditHistory: history,
@@ -2579,11 +2666,13 @@ function sendLoopTurn(): void {
   // instruction (metricless loops; metric loops already vary via values).
   const variantNote = metricless ? continueVariant(loop.iteration) : "";
   try {
+    const loopResync = postCompactResyncPending ? buildPostCompactResync() : "";
     extensionApi.sendMessage({
       customType: GOAL_EVENT_ENTRY,
-      content: loopPrompt(loop, regressionNote, strategyNote, boundsNote, interventionNote, variantNote),
+      content: loopResync + loopPrompt(loop, regressionNote, strategyNote, boundsNote, interventionNote, variantNote),
       display: false,
     }, { triggerTurn: true, deliverAs: "followUp" });
+    if (loopResync) postCompactResyncPending = false; // consumed only by a landed send
     // v0.26.1: the send path is ledgered — the hegemon zombie spun 619
     // refires with zero visibility into whether sends were landing.
     loopRearmStreak = 0; loopRearmSince = 0; // v0.28.5 (E3): a landed turn clears the storm
@@ -4265,35 +4354,45 @@ function resolveAuditorModel(ctx: ExtensionContext, ref?: string, fallbackRef?:
     return matches[0] ? { model: matches[0] } : { reason: "no available model matching" };
   };
   const isSession = (m: any) => sessionModel && m.provider === sessionModel.provider && m.id === sessionModel.id;
-  const pins = [ref, fallbackRef].map((r) => r?.trim()).filter((r): r is string => !!r);
+  // v0.32.0: per-pin source labels — when the primary is unset, pins[0] IS
+  // the fallback and the old i===0→"setting" map mislabeled it.
+  const pins: Array<{ pin: string; src: "setting" | "fallback-pin" }> = [];
+  if (ref?.trim()) pins.push({ pin: ref.trim(), src: "setting" });
+  if (fallbackRef?.trim()) pins.push({ pin: fallbackRef.trim(), src: "fallback-pin" });
   for (let i = 0; i < pins.length; i++) {
-    const pin = pins[i]!;
+    const { pin } = pins[i]!;
     const r = tryRef(pin);
     if (!r.model) {
       // Unavailable pin → cascade: next pin, then the session model (LOUD).
       appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pin, reason: r.reason });
-      ctx.ui.notify(`Auditor model "${pin}" is unavailable (${r.reason}) — ${i + 1 < pins.length ? "trying the fallback pin" : "falling back to the session model"}. Fix via /glla → Auditor model.`, "warning");
+      // v0.32.0: the last pin no longer pre-announces the session fallback —
+      // the post-loop block does that (it notified twice before).
+      ctx.ui.notify(`Auditor model "${pin}" is unavailable (${r.reason})${i + 1 < pins.length ? " — trying the fallback pin" : ""}. Fix via /glla → Auditor model.`, "warning");
       continue;
     }
     if (sameSessionSwap && isSession(r.model) && i + 1 < pins.length) {
       // The pin IS the session model — the verifier would be the executor's
       // own model; auto-swap down the chain (the user's move).
-      appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: pins[i + 1] });
-      ctx.ui.notify(`Session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — auditor auto-swapped to ${pins[i + 1]} so the verifier differs.`, "info");
+      appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: pins[i + 1]!.pin });
+      ctx.ui.notify(`Session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — auditor auto-swapped to ${pins[i + 1]!.pin} so the verifier differs.`, "info");
       continue;
     }
-    if (sameSessionSwap && isSession(r.model) && !fallbackRef?.trim()) {
+    // v0.32.0: the nudge must fire when the LAST pin stands on the session
+    // model — the old `!fallbackRef` guard went SILENT when the fallback pin
+    // itself resolved to the session model (verifier == executor, and hop 0's
+    // notify had just claimed "auto-swapped so the verifier differs" — false).
+    if (sameSessionSwap && isSession(r.model) && i + 1 >= pins.length) {
       // Last resort reached and it IS the session model, with no fallback
       // ever pinned — the model stands (the session IS the last resort);
       // one loud nudge so the user can wire the swap.
       appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: null });
       ctx.ui.notify(`The session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — pin a different /glla → Auditor fallback model so the verifier can differ.`, "warning");
     }
-    return { model: r.model, via: i === 0 ? "setting" : "fallback-pin" };
+    return { model: r.model, via: pins[i]!.src };
   }
   if (sessionModel) {
     if (pins.length > 0) {
-      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pins.join(" → "), reason: "all pins exhausted" });
+      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pins.map((p) => p.pin).join(" → "), reason: "all pins exhausted" });
       ctx.ui.notify("All pinned auditor models are unavailable — falling back to the session model. Fix via /glla → Auditor model.", "warning");
       return { model: sessionModel, via: "session-fallback" };
     }
@@ -5660,6 +5759,11 @@ export default function (pi: ExtensionAPI): void {
     continuationRearmStreak = 0; continuationRearmSince = 0;
     loopRearmStreak = 0; loopRearmSince = 0;
     compactionGraceUntil = Date.now() + COMPACTION_GRACE_MS;
+    // v0.32.1: arm the resume debt + the resync block (the settle probes
+    // below stay as the fast path; the heartbeat now retries the debt on
+    // EVERY post-grace tick until agent_start discharges it).
+    postCompactResumeOwed = true;
+    postCompactResyncPending = true;
     const settle = setTimeout(() => {
       const c = freshCtx();
       if (!c) return;
@@ -6303,6 +6407,9 @@ export default function (pi: ExtensionAPI): void {
   });
   pi.on("agent_start", () => {
     lastStreamActivityAt = Date.now();
+    // v0.32.1: a real turn started — the post-compaction resume debt is
+    // discharged (the heartbeat stops retrying it).
+    postCompactResumeOwed = false;
   });
   pi.on("turn_start", () => {
     lastStreamActivityAt = Date.now();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.31.9",
+  "version": "0.32.1",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",