pi-goal-list-loop-audit 0.34.13 → 0.34.15

package/extensions/goal-loop-core.ts

@@ -176,6 +176,8 @@ export interface Goal {
    * At 3 the goal pauses loudly — a broken auditor model must not spin a
    * silent retry-forever loop. Cleared on any real auditor run. */
   auditInfraStreak?: number;
+  /** v0.34.15: persisted error-brake rung — survives /reload so the 6-brake park can engage. */
+  errorBrakeStreak?: number;
   /** v0.28.26: the completion claim captured when an audit attempt is
    * quota-blocked. The quota retry re-runs the AUDITOR directly with this
    * stored claim instead of re-engaging the agent — re-engaging produced a

package/extensions/loops/goal.ts

@@ -411,6 +411,30 @@ function attemptAutoRecovery(ctx: ExtensionContext, where: string): boolean {
   return true;
 }
 
+/** v0.34.14: /reload rebind detector. The extension runs INSIDE pi, so
+ * process.pid IS pi's pid: an instance that boots and finds its OWN pid
+ * already in the owner file is a /reload rebuild of a live session, not a
+ * cold boot. Rebinds always resume active goals/loops — holding mid-work
+ * after an in-place rebuild is pure friction (user directive: keep going
+ * unless we must stop; "the list is not continuing" after /reload,
+ * hellhunter 2026-08-01). Cold boots (new pid) still honor autoresume=off.
+ * Sidecar, not the ledger: read-before-write must be atomic-ish and the
+ * ledger is append-only. */
+const SESSION_OWNER_FILE = "session-owner.json";
+function claimSessionOwnerAndDetectRebind(cwd: string): boolean {
+  try {
+    const p = path.join(piGlaDir(cwd), SESSION_OWNER_FILE);
+    let prevPid: number | null = null;
+    try {
+      prevPid = (JSON.parse(fs.readFileSync(p, "utf-8")) as { pid?: number }).pid ?? null;
+    } catch { /* absent or corrupt — first boot */ }
+    fs.writeFileSync(p, JSON.stringify({ pid: process.pid, at: new Date().toISOString() }));
+    return prevPid !== null && prevPid === process.pid;
+  } catch {
+    return false;
+  }
+}
+
 /** v0.34.13: consume the sidecar marker on session restore. Single-use,
  * freshness-bounded — a stale marker from an abandoned recovery must not
  * surprise-resume a later session. */
@@ -680,7 +704,7 @@ const ZOMBIE_RUN_ALERT_THROTTLE_MS = 10 * 60_000;
 // (sendMessage never threw; session reported idle) but started NO turn —
 // transcript frozen, tokens flat, 10+ minutes of refires into the void.
 // Same family as the post-compaction dropped trigger (v0.26.5), but the
-// pending-latch watchdog needs idle&&pending and pi reported no pending
+// the pending latch needs idle&&pending and pi reported no pending
 // here, and the zombie watchdog needs busy — this shape falls between both
 // chairs. Disarm signal = real activity (agent_end/tool_call) AFTER the
 // last send; a landed turn — even a lazy text-only one — disarms it.
@@ -825,7 +849,6 @@ const COMPACTION_GRACE_MS = 3 * 60_000;
 // budget now spans ~5.5m) and escalate the brake cooldown per consecutive
 // brake (1m, 2m, 4m, 8m, 16m cap). A successful turn resets both.
 const ERROR_RETRY_LADDER_MS = [5_000, 15_000, 45_000, 90_000, 180_000];
-let errorBrakeStreak = 0;
 const SEND_REARM_LEDGER_MILESTONES_MS = [2 * 60_000, 5 * 60_000, 10 * 60_000];
 // v0.28.29: escalation is TIME-based and ACTIVITY-gated. A busy session is
 // NORMAL — the user conversing, or one long subagent turn — and the old
@@ -1235,6 +1258,39 @@ function freshCtx(): ExtensionContext | null {
   }
 }
 
+// v0.34.15 (hegemon 2026-08-01): pi ACCEPTED the continuation — footer showed
+// "1 queued" — but the turn trigger was dead, so the message sat queued while
+// pi idled. The 0.34.11 watchdog gates on "pi reported NO pending" and the
+// stall ladder takes ~10 minutes; a send that lands queued-without-a-turn is
+// a CONFIRMED dead trigger (hegemon law), so probe once, ~45s after every
+// landed send, and go straight to auto-recovery. A consumed message (even an
+// instant-429 turn consumes it) or any real activity disarms the probe.
+function queueStuckProbeMs(): number {
+  return Number(process.env.GLLA_QUEUE_STUCK_MS ?? 45_000);
+}
+let queueStuckProbe: ReturnType<typeof setTimeout> | null = null;
+function armQueueStuckProbe(ctx: ExtensionContext, sentAt: number): void {
+  if (queueStuckProbe) clearTimeout(queueStuckProbe);
+  queueStuckProbe = setTimeout(() => {
+    queueStuckProbe = null;
+    try {
+      if (isForeignCtx(ctx)) return; // stale instance — the live one probes
+      if (!isSupervising()) return; // paused/completed meanwhile
+      if (lastContinuationSentAt !== sentAt) return; // a newer send armed its own probe
+      if (lastRealActivityAt > sentAt) return; // the turn started and worked
+      if (!ctx.isIdle()) return; // a turn is running — healthy
+      if (!ctx.hasPendingMessages()) return; // consumed — even an instant 429 consumes
+      appendLedger(ctx.cwd, "queue_stuck_detected", { waitedMs: Date.now() - sentAt });
+      if (!attemptAutoRecovery(ctx, "queue-stuck continuation")) {
+        const msg = `${goalNoun()}: the continuation is QUEUED but pi won't start a turn — the turn trigger is dead (re-sends only queue). Cure: /reload — the goal resumes itself after the rebuild (autoresume off? /glla resume).`;
+        ctx.ui.notify(msg, "warning");
+        notifyExternal(ctx, msg);
+      }
+    } catch { /* stale ctx — the live instance owns the probe now */ }
+  }, queueStuckProbeMs());
+  queueStuckProbe.unref?.();
+}
+
 function scheduleContinuation(ctx: ExtensionContext, force = false, delayMs?: number): void {
   abortedStandDown = false; // v0.29.5: any explicit schedule ends the stand-down
   if (!isActionableGoal()) return;
@@ -1291,6 +1347,7 @@ function sendContinuation(goalId: string): void {
     continuationRearmStreak = 0; continuationRearmSince = 0; // v0.28.5 (E3): a landed send clears the storm
     appendLedger(ctx.cwd, "goal_continuation_sent", { goalId });
     lastContinuationSentAt = Date.now();
+    armQueueStuckProbe(ctx, lastContinuationSentAt);
   } catch (err) {
     appendLedger(ctx.cwd, "goal_continuation_send_failed", { goalId, error: err instanceof Error ? err.message : String(err) });
     // v0.26.7: stale runtime = terminal (sends can never land); anything
@@ -2973,6 +3030,7 @@ function sendLoopTurn(): void {
     loopRearmStreak = 0; loopRearmSince = 0; // v0.28.5 (E3): a landed turn clears the storm
     appendLedger(ctx.cwd, "loop_turn_sent", { iteration: loop.iteration });
     lastContinuationSentAt = Date.now();
+    armQueueStuckProbe(ctx, lastContinuationSentAt);
   } catch (err) {
     // stale API — next agent_end reschedules (but if none comes, the
     // heartbeat's stall escalation stops the spin — v0.26.1).
@@ -3679,7 +3737,13 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       // logged as disapprovals.
       const auditorRan = result.output.trim().length > 0;
       // v0.28.5 (E2): a REAL auditor run clears the infra-error streak.
-      if (auditorRan && (state.goal.auditInfraStreak ?? 0) > 0) updateGoal({ auditInfraStreak: undefined }, ctx);
+      // v0.34.14: …but only a CLEAN one. A STALLED run returns the partial
+      // output it streamed before the abort — non-empty, so auditorRan is
+      // true — while result.error still marks it an infrastructure failure.
+      // Clearing the streak on those meant the 3-strike breaker at :3874
+      // NEVER engaged: pully 2026-08-01 looped 10-min stall cycles for 4h
+      // (the auditor hung on an ssh/sudo verification every attempt).
+      if (auditorRan && !result.error && (state.goal.auditInfraStreak ?? 0) > 0) updateGoal({ auditInfraStreak: undefined }, ctx);
       const history = state.goal.auditHistory ?? [];
       if (auditorRan) {
         // v0.25.4: strip think-block leakage (MiniMax-M3 `</think>`
@@ -3878,11 +3942,11 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
             auditHistory: history,
             auditInfraStreak: infraStreak,
             pauseKind: "error",
-            pauseReason: `auditor infrastructure failed ${infraStreak}× in a row — the auditor model is likely broken (last: ${result.error.slice(0, 120)})`,
+            pauseReason: `auditor infrastructure failed ${infraStreak}× in a row — the auditor model is likely broken OR a verification command is hanging (ssh/sudo/long test runs stall the stream) (last: ${result.error.slice(0, 120)})`,
             pauseSuggestedAction: "Fix the auditor model (/glla model=provider/id) or restart pi, then /goal resume. Your work was NOT judged.",
           }, ctx);
           appendLedger(ctx.cwd, "goal_paused", { reason: `auditor infra streak ${infraStreak}: ${result.error.slice(0, 120)}` });
-          ctx.ui.notify(`${goalNoun()} paused: auditor infrastructure failed ${infraStreak}× in a row. Fix the auditor model (/glla model=...), then /goal resume.`, "warning");
+          ctx.ui.notify(`${goalNoun()} paused: auditor infrastructure failed ${infraStreak}× in a row — model broken or a verification command hanging (ssh/sudo/long runs). Fix with /glla model=... or unblock the command, then /goal resume.`, "warning");
           notifyExternal(ctx, `${goalNoun()} paused: auditor infrastructure ${infraStreak}× — model likely broken.`);
           return {
             content: [{
@@ -6418,9 +6482,13 @@ export default function (pi: ExtensionAPI): void {
     // v0.34.13: an auto-recovery /reload carries its own resume consent —
     // the sidecar marker overrides autoresume=off for THIS restore only.
     const recoveryResume = consumeRecoveryResume(ctx.cwd);
+    // v0.34.14: a /reload rebind (same pi pid) ALWAYS resumes — the session
+    // is live mid-work; holding is the "list is not continuing" bug.
+    const rebindResume = claimSessionOwnerAndDetectRebind(ctx.cwd);
+    if (rebindResume) appendLedger(ctx.cwd, "rebind_resume", { pid: process.pid });
     if (isLoopActive()) {
       const l = state.loop!;
-      if (autoResume || recoveryResume) {
+      if (autoResume || recoveryResume || rebindResume) {
         ctx.ui.notify(
           `Resuming loop (iteration ${l.iteration}/${l.maxIterations > 0 ? l.maxIterations : "∞"}, best ${l.bestValue ?? "n/a"}, stall ${l.stallCount}/${l.plateauWindow}): ${l.target.slice(0, 60)}`,
           "info",
@@ -6441,7 +6509,7 @@ export default function (pi: ExtensionAPI): void {
       // "load it but not auto start it"). Interrupted goals hold like
       // everything else; autoresume=on (unattended rigs) still auto-resumes
       // them, and the marker is cleared only on that promised auto-resume.
-      if (autoResume || recoveryResume) {
+      if (autoResume || recoveryResume || rebindResume) {
         // v0.28.1 (S2): clear the stale-handle interrupt marker — this IS
         // the auto-resume the marker promised.
         if (wasInterrupted) updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx);
@@ -6697,12 +6765,22 @@ export default function (pi: ExtensionAPI): void {
         // 60-second provider hiccup waiting on a manual /goal resume.
         const detail = text.trim() ? ` (last: ${text.trim().replace(/\s+/g, " ").slice(0, 160)})` : "";
         const reason = `5 consecutive errors${detail}`;
+        // v0.34.15: the streak now lives ON THE GOAL so it survives the
+        // auto-recovery /reloads that used to zero the module counter —
+        // hegemon 2026-08-01: a hard-exhausted MiniMax plan churned 1-minute
+        // probes for an hour because every reload reset the ladder to rung 1
+        // and the 6-brake park (v0.29.9) could never engage.
+        const brakeStreak = state.goal!.errorBrakeStreak ?? 0;
+        // v0.34.15: a quota/rate-limit wall is NOT a flake — the card must
+        // say "resuming won't help; switch /model or wait out the window"
+        // (the raw 429 text was in `detail` but nobody parses JSON on a card).
+        const quotaWall = /rate.?limit|usage limit|quota|insufficient|credits/i.test(detail);
         // v0.29.1: brake-cycle CAP. The v0.28.25 ladder slows the thrash
         // (1m→16m) but never STOPS it — junk-runner/hellhunter/pully each
         // burned 4+ pause↔retry cycles against provider windows that last
         // hours. After 6 consecutive brakes: park. v0.29.9: the park keeps
         // probing at the top of each hour (clock-aligned window resets).
-        if (errorBrakeStreak >= 6) {
+        if (brakeStreak >= 6) {
           // v0.29.9: park — but keep probing at the top of each hour
           // (user: "simply adding an hourly retry … just to pick up work
           // faster assuming the retry expired"). Coding-plan rate-limit
@@ -6716,18 +6794,20 @@ export default function (pi: ExtensionAPI): void {
             status: "paused",
             pauseKind: "error",
             pauseReason: `${reason} — 6 error-brakes in a row; the provider has been erroring for an extended window`,
-            pauseSuggestedAction: "Probing at the top of each hour — rate-limit windows typically expire on clock-hour boundaries. /goal resume retries now.",
+            pauseSuggestedAction: quotaWall
+              ? "Provider quota/rate-limit wall — resuming won't help until the window resets. Hourly top-of-hour probes will pick work back up; switch /model to a different provider to continue immediately."
+              : "Probing at the top of each hour — rate-limit windows typically expire on clock-hour boundaries. /goal resume retries now.",
           }, ctx);
-          ctx.ui.notify(`${goalNoun()} parked: ${reason} — 6 brakes in a row. Hourly top-of-hour probes will pick work back up when the window opens; /goal resume retries now.`, "warning");
+          ctx.ui.notify(`${goalNoun()} parked: ${reason} — 6 brakes in a row. ${quotaWall ? "Quota/rate-limit wall — switching /model continues immediately; otherwise hourly" : "Hourly"} top-of-hour probes will pick work back up when the window opens.`, "warning");
           notifyExternal(ctx, `${goalNoun()} parked: provider erroring across 6 error-brake cycles — hourly top-of-hour probes scheduled.`);
-          appendLedger(ctx.cwd, "error_brake_capped", { streak: errorBrakeStreak, reason });
+          appendLedger(ctx.cwd, "error_brake_capped", { streak: brakeStreak, reason });
           const probeMs = msUntilNextHourBoundary(Date.now());
           scheduleQuotaRetry(ctx, probeMs / 1000, reason, () => {
             // Re-check: only probe if STILL parked by the error-brake cap —
             // a user pause/resume/cancel meanwhile is never stomped.
             if (state.goal && state.goal.status === "paused" && state.goal.pauseKind === "error"
               && (state.goal.pauseReason ?? "").includes("error-brakes in a row")) {
-              appendLedger(ctx.cwd, "hourly_rate_probe", { goalId: state.goal.id, streak: errorBrakeStreak });
+              appendLedger(ctx.cwd, "hourly_rate_probe", { goalId: state.goal.id, streak: state.goal.errorBrakeStreak ?? 0 });
               updateGoal({ status: "active" }, ctx);
               appendLedger(ctx.cwd, "goal_resumed", { via: "hourly-rate-probe" });
               ctx.ui.notify("Hourly probe: resuming (rate-limit windows typically expire at the top of the hour).", "info");
@@ -6738,17 +6818,19 @@ export default function (pi: ExtensionAPI): void {
         }
         // v0.28.25: the cooldown escalates per CONSECUTIVE brake — a fleet-wide
         // 403 window is not cleared by re-braking every 60 seconds.
-        const cooldownMs = 60_000 * 2 ** Math.min(errorBrakeStreak, 4);
+        const cooldownMs = 60_000 * 2 ** Math.min(brakeStreak, 4);
         const cooldownMin = Math.round(cooldownMs / 60_000);
-        errorBrakeStreak++;
         updateGoal({
           status: "paused",
           pauseKind: "wait",
           pauseResumeAt: new Date(Date.now() + cooldownMs).toISOString(),
           pauseReason: reason,
-          pauseSuggestedAction: `Transient provider flake? The goal auto-resumes once in ${cooldownMin}m if still paused for this reason — or /goal resume now.`,
+          errorBrakeStreak: brakeStreak + 1,
+          pauseSuggestedAction: quotaWall
+            ? `Provider quota/rate-limit wall — resuming won't help until the window resets. Switch /model to a different provider to continue now, or let the probe auto-resume in ${cooldownMin}m.`
+            : `Transient provider flake? The goal auto-resumes once in ${cooldownMin}m if still paused for this reason — or /goal resume now.`,
         }, ctx);
-        ctx.ui.notify(`Goal paused: ${reason}.`, "warning");
+        ctx.ui.notify(`Goal paused: ${reason}.${quotaWall ? " Quota/rate-limit wall — resuming won't help until the window resets; switch /model to continue now." : ""}`, "warning");
         notifyExternal(ctx, `Goal paused: ${reason}.`);
         appendLedger(ctx.cwd, "goal_paused", { reason });
         scheduleQuotaRetry(ctx, cooldownMs / 1000, reason, () => {
@@ -6799,7 +6881,8 @@ export default function (pi: ExtensionAPI): void {
     } else {
       consecutiveErrorIterations = 0;
       consecutiveAbortIterations = 0;
-      errorBrakeStreak = 0; // v0.28.25: a healthy turn clears the brake cooldown
+      // v0.28.25/v0.34.15: a healthy turn clears the (now persisted) brake streak
+      if ((state.goal?.errorBrakeStreak ?? 0) > 0) updateGoal({ errorBrakeStreak: undefined }, ctx);
     }
 
     // No wall-clock cap by design: a goal ends via completion, explicit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.34.13",
+  "version": "0.34.15",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. An isolated extension-less auditor re-verifies every completion with raw evidence; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "MIT",
   "author": "dracon",

package/schemas/goal.schema.json

@@ -53,6 +53,7 @@
     "interruptedAt": { "type": "string" },
     "interruptedReason": { "type": "string" },
     "auditInfraStreak": { "type": "number" },
+    "errorBrakeStreak": { "type": "number" },
     "pendingCompletion": { "type": "object" },
     "createdVia": { "type": "string" },
     "activePath": { "type": "string" },