pi-goal-list-loop-audit 0.34.49 → 0.34.57

package/README.md

@@ -248,33 +248,47 @@ Activity is otherwise intentionally honest:
 | `QUEUED` | A continuation is waiting to start; no work is fabricated. |
 | `IDLE` | The durable item remains active, but no recent work is observed. |
 | `auditor …` | A detached, extension-less verifier is queued, running, quiet, or waiting for its verdict. |
-| `QUOTA WALL` | The provider rejected the request for a quota/plan window; saved work is waiting for a durable probe. |
-
-Quota walls deliberately do **not** get more blind request retries. A bare
-429/rate-limit response is treated as a transient throttle; explicit plan,
-usage, billing, reset, and provider-code language is classified more strongly.
-For example, MiniMax's `Token Plan rate limit reached … (2062)` asks for an
-upgrade or pay-as-you-go billing and is not the same thing as a per-minute
-throttle. Output/context-token stops are handled separately and never become a
-quota wall. pi's request-local retry counter is bounded; glla owns the longer
-recovery window: generic throttles use `15m → 30m → 1h → 2h → 4h → 5h`; a
-plan wall with no reset hint starts at `1h → 2h → 4h → 5h`. Automatic probes
-stop after 24h.
-A provider hint is honored when it is within the five-hour probe budget; a
-week-long hint is shown and held for manual action instead of scheduling a
-hidden week-long timer. With global `autoResume=on`, pending probes survive a
-session reload. After the safety horizon, `/list resume`, `/goal resume`, or
-`/loop resume` explicitly starts a fresh bounded window. For continuous work,
-configure ordered **Main model backups** in `/glla` using a model from a
-different provider or billing/quota pool — another model on the same exhausted
-plan is not a real fallback.
-
-Classification is conservative: explicit 429/rate-limit/plan-limit/token-plan
-signals are quota walls; ordinary `503 temporarily unavailable`, `403
-forbidden`, auth failures, and ambiguous provider prose are not relabeled as
-quota. Credit/billing exhaustion gets a manual-action hold. The raw provider
-message remains in the ledger/durable state for diagnosis, while the card
-shows the classified reason and recovery action.
+| `QUOTA WALL` | The provider rejected the request for a quota/plan window (by its own wording); saved work is waiting for a durable probe. |
+
+## Provider failures: one retry envelope, bounded (v0.34.51)
+
+Error text is **not trusted** to pick a retry policy: we only know that an
+error came, and provider messages vary. Every main-model failure — quota,
+rate limit, billing/credits, auth, transient, or unclassifiable — rides the
+same durable recovery envelope `15m → 30m → 1h → 2h → 4h → 5h` (probe cap
+5h, automatic window 24h, then an explicit `/goal resume`/`/list resume`/
+`/loop resume` starts a fresh window). The only failures that do not auto-retry
+are the ones identified by *positive evidence* as futile: context/output-token
+limits and user aborts (`non-recoverable`), plus auditor watchdog timeouts
+(a hanging verification command will hang again — the stored claim waits for
+an explicit resume).
+A provider hint (`retry_after`/`reset_at`) is honored when it fits the
+five-hour probe budget; a week-long hint is shown and held instead of
+scheduling a hidden week-long timer. With global `autoResume=on`, pending
+probes survive a session reload. For continuous work, configure ordered
+**Main model backups** in `/glla` using a model from a different provider or
+billing/quota pool — another model on the same exhausted plan is not a real
+fallback.
+
+**Quota walls engage fast** (v0.34.57): a surfaced long-lived failure
+(quota / billing / auth) records a 30-minute knowledge window; a send-rearm
+storm inside that window escalates into the recovery envelope after **3
+minutes** of failed sends instead of the generic 15 — a wedge right after a
+quota wall is almost always the same wall. Transient (5xx/stream/network)
+failures never record the signal and keep the fast error ladder. The
+envelope is armed by configuration: an empty `mainModelFallbacks` list means
+"park and probe the same model" rather than switching pools — the
+never-switch posture is a first-class policy, not an accident.
+
+Classification still exists, but it only *labels*: the card and badge show
+what the provider said (quota wall, billing, rate limit) so the reason is
+diagnosable, and `QUOTA WALL` is only shown when the provider's own words say
+quota — ambiguous prose is never relabeled. The raw provider message stays in
+the ledger/durable state; the card shows the classified reason and recovery
+action. Detached-auditor failures get the same treatment: any infrastructure
+error on a stored completion claim pauses the goal with a durable bounded
+one-shot retry (`auditor retry: …`), and only the plan's 24h horizon stops
+automatic probes.
 
 The quota-specific card hides raw provider JSON while preserving it in durable
 state and the ledger:
@@ -337,6 +351,16 @@ warning says no replacement arrived, restart pi normally and let the saved
 mux dependency. The legacy `autoReloadOnStale` and `autoRecovery` fields remain
 only as deprecated settings-file compatibility fields; they are ignored.
 
+**A stale handle never mutates** (v0.34.51–v0.34.54): every `/list` mutation
+(add/remove/next/clear/cancel) and the bare `/glla` settings surface probe at
+entry and refuse with the standard recovery message on a stale extension
+context — a session that cannot announce or run its writes must not make them.
+Mutating `/glla` actions (wipe/cancel/reviewer/postaudit/tooloverride) leave a
+`settings_mutation_refused_stale` ledger trail; read-only surfaces (`/list
+show`, `/goal status`) stay usable with the warning. Once the replacement
+`session_start` arrives, both surfaces render cleanly with no stale residue
+(the lifecycle-recovery harness proves the two-phase contract).
+
 **User aborts mean STOP** (v0.29.4): Esc-aborting a turn stands the chain
 down with a named notify (`/goal resume` to continue) — it does NOT count
 toward stall warnings, does NOT auto re-fire, and the stand-down survives

package/docs/DESIGN.md

@@ -197,6 +197,63 @@ architectural decisions that changed the SHAPE of the system:
   cycle. Manual model selection cancels it; goal/list/loop cancellation clears
   its timer and durable state.
 
+## Addendum v0.34.48–v0.34.56 (lifecycle/recovery hardening — the stale-handle era)
+
+Between the v0.34.31 recovery envelope and the v0.34.57 quota fast-engagement, the
+recovery story hardened around the **stale extension handle** — the field-observed
+shape (hegemon/polis 2026-07-26+) where pi invalidates the extension API on session
+replacement without delivering a successor `session_start`:
+
+- **Honest stale entry everywhere** (v0.34.51/52): `warnIfStaleAtEntry` probes at
+  entry (since v0.28.1), but the probe's return value used to be discarded by the
+  mutation paths. Now every `/list` mutation (add/remove/next/clear/cancel) and the
+  bare `/glla` settings surface refuse on a stale handle with the standard recovery
+  message — a session that cannot announce or run its writes must not make them.
+  Mutating `/glla` actions (wipe/cancel/reviewer/postaudit/tooloverride) refuse with
+  a `settings_mutation_refused_stale` ledger trail; read-only surfaces stay usable
+  with the warning. This is the plugin side of the missing-replacement contract: fail
+  closed, never guess, never pretend success.
+- **Settings routing clarity** (v0.34.53): `/list settings` is a verb, handled
+  explicitly BEFORE the natural-language dump fallthrough — a ledgered redirect to
+  `/glla`, never a drafting seed. `/list add settings …` remains the only way an item
+  literally named "settings" enters the queue.
+- **Lifecycle-recovery harness** (v0.34.54): a behavioral suite proves the two-phase
+  contract — stale handle: `/list show` warns and does not pretend, settings refuse
+  wholesale; fresh `session_start`: both render cleanly with no stale residue.
+- **Command-registration collision model** (v0.34.55): pi's `resolveRegisteredCommands`
+  flattens extensions in load order and suffixes EVERY registration of a duplicated
+  command name (`name:1`, `name:2`, …) — the bare name becomes owned by nobody and
+  dispatch stops routing it while a collision exists. The model is read from the
+  installed pi core (hermetic, never modified) and auto-records the routing table to
+  `audit/command-registration-routing.md`, making collisions reproducible and
+  diagnosable without touching pi.
+- **Unmatched telemetry stays unmatched** (v0.34.56): tool starts/ends without a
+  counterpart are represented as explicitly unmatched facts, never falsely paired —
+  the report surface stays truthful (the AuditProgress/AuditorProgress dual-interface
+  rule: display evidence-gates on `unmatchedStarts + unmatchedEnds > 0`).
+- **Uniform retry envelope, no text-trust** (v0.34.51): error text is not trusted to
+  pick a retry policy. Quota, billing, auth, transient, and unknown failures all ride
+  ONE bounded durable envelope `15m → 30m → 1h → 2h → 4h → 5h` (cap 5h, automatic
+  window 24h); classification only labels the display. The billing-hold special case
+  is removed (`main_model_billing_hold` is legacy). Positive-evidence futile classes
+  (context/output-token limits, user aborts) plus auditor watchdog timeouts never
+  auto-retry; provider hints are honored only within the 5h probe budget.
+
+## Addendum v0.34.57 (quota walls engage recovery fast)
+
+- **Knowledge-window escalation**: a surfaced long-lived failure (quota /
+  billing / auth) records a 30-minute knowledge window. A send-rearm storm
+  inside that window escalates into the recovery envelope after 3 minutes of
+  failed sends (plus the unchanged 5-minute activity silence gate) instead of
+  the generic 15 minutes — a wedge right after a quota wall is almost always
+  the same wall, and blind re-sends into it are pure waste.
+- **Transient failures stay fast**: 5xx/stream/network failures are
+  short-lived by definition and never record the knowledge signal; they keep
+  the 5s→3m error ladder and the pi-core retry budget.
+- **Armed by configuration**: the envelope is inert without
+  `mainModelFallbacks` (rotation) — an empty list means "park and probe the
+  same model" instead of switching pools.
+
 ## Addendum v0.4.0 (completion)
 
 - **Auditor compaction enabled** (flaw #3 — the last open one). Safety:

package/docs/RELEASING.md

@@ -17,6 +17,12 @@ the repository.
 
 ## Release checklist
 
+Accumulated changes since the last release live under an `## Unreleased`
+section at the top of `CHANGELOG.md` (with the in-repo milestone labels such
+as `### 0.34.51`); the release commit renames that section to the released
+version. Do not invent version headers for work that was never tagged —
+untagged work stays under `Unreleased` until the release commit.
+
 ```bash
 npm version <major.minor.patch> --no-git-tag-version
 npm run release:check

package/extensions/goal-loop-auditor-process.ts

@@ -39,7 +39,15 @@ export interface AuditorProgress {
   currentTool?: string;
   currentToolArgs?: string;
   currentToolStartedAt?: number;
+  /** v0.34.56: the toolCallId of the open start (undefined when the start
+   * event carried none — the missing-toolCallId shape). */
+  currentToolId?: string;
   toolCalls: Array<{ name: string; argsPrefix: string; finishedAt: number }>;
+  /** v0.34.56: explicitly unmatched tool starts/ends — see
+   * applyToolExecutionEvent (goal-loop-auditor.ts) and the worker's mirror
+   * in scripts/goal-auditor-worker.mjs. Never dropped, never falsely paired. */
+  unmatchedToolStarts: Array<{ name: string; argsPrefix: string; startedAt: number; toolCallId?: string }>;
+  unmatchedToolEnds: Array<{ toolCallId?: string; toolName?: string; at: number }>;
 }
 
 export type AuditorModel = string | { provider: string; id: string };
@@ -129,6 +137,10 @@ interface AuditorProgressFile {
   currentTool?: string;
   currentToolArgs?: string;
   currentToolStartedAt?: number;
+  /** v0.34.56: explicitly unmatched tool telemetry facts (see
+   * applyToolExecutionEvent in goal-loop-auditor.ts). */
+  unmatchedToolStarts?: AuditorProgress["unmatchedToolStarts"];
+  unmatchedToolEnds?: AuditorProgress["unmatchedToolEnds"];
 }
 
 export interface AuditorProcessRuntime {
@@ -224,9 +236,13 @@ function asProgress(file: AuditorProgressFile, startedAt: number): AuditorProgre
     ...(file.lastActivityAt !== undefined ? { lastActivityAt: file.lastActivityAt } : {}),
     recentOutput: file.recentOutput,
     toolCalls: file.toolCalls,
+    unmatchedToolStarts: file.unmatchedToolStarts ?? [],
+    unmatchedToolEnds: file.unmatchedToolEnds ?? [],
     ...(file.currentTool ? { currentTool: file.currentTool } : {}),
     ...(file.currentToolArgs ? { currentToolArgs: file.currentToolArgs } : {}),
     ...(file.currentToolStartedAt ? { currentToolStartedAt: file.currentToolStartedAt } : {}),
+    ...(file.unmatchedToolStarts ? { unmatchedToolStarts: file.unmatchedToolStarts } : {}),
+    ...(file.unmatchedToolEnds ? { unmatchedToolEnds: file.unmatchedToolEnds } : {}),
   };
 }
 
@@ -355,17 +371,19 @@ export async function runDetachedGoalCompletionAuditor(args: {
           if (parsed.approved && args.goal.verificationContract?.trim()) {
             const shield = checkRegressionShield(output, args.goal.verificationContract);
             if (!shield.passed) {
-              const why = !shield.hasEvidenceBlock ? "report has no <evidence> block" : `report's evidence does not address: ${shield.missingItems.join("; ")}`;
+              // The auditor's semantic verdict was approval; the separate
+              // regression shield blocked acceptance because the report did
+              // not cite every contract item. Keep that outcome distinct from
+              // both a work disapproval and infrastructure failure.
               return {
-                approved: false, disapproved: true, output, model, thinkingLevel,
-                error: `regression_shield: approved but ${why}`,
+                approved: true, disapproved: false, output, model, thinkingLevel,
                 regressionShieldPassed: false, regressionShieldMissing: shield.missingItems,
               };
             }
-            args.onProgress?.({ phase: "complete", elapsedMs: now() - startedAt, recentOutput: output.split("\n").filter(Boolean).slice(-8), toolCalls: result.toolCalls });
+            args.onProgress?.({ phase: "complete", elapsedMs: now() - startedAt, recentOutput: output.split("\n").filter(Boolean).slice(-8), toolCalls: result.toolCalls, unmatchedToolStarts: [], unmatchedToolEnds: [] });
             return { approved: true, disapproved: false, output, model, thinkingLevel, regressionShieldPassed: true };
           }
-          args.onProgress?.({ phase: "complete", elapsedMs: now() - startedAt, recentOutput: output.split("\n").filter(Boolean).slice(-8), toolCalls: result.toolCalls });
+          args.onProgress?.({ phase: "complete", elapsedMs: now() - startedAt, recentOutput: output.split("\n").filter(Boolean).slice(-8), toolCalls: result.toolCalls, unmatchedToolStarts: [], unmatchedToolEnds: [] });
           return { approved: parsed.approved, disapproved: parsed.disapproved, impossible: parsed.impossible, impossibleReason: parsed.impossibleReason, output, model, thinkingLevel };
         } catch (error) {
           if ((error as NodeJS.ErrnoException).code !== "ENOENT") return infra(model, thinkingLevel, `invalid auditor result: ${error instanceof Error ? error.message : String(error)}`);

package/extensions/goal-loop-auditor.ts

@@ -67,8 +67,80 @@ export interface AuditProgress {
   currentTool?: string;
   currentToolArgs?: string;
   currentToolStartedAt?: number;
+  /** v0.34.56: the toolCallId of the open start (undefined when the start
+   * event carried none — the missing-toolCallId shape). */
+  currentToolId?: string;
   // Tool-call history for regression_shield:
   toolCalls: Array<{ name: string; argsPrefix: string; finishedAt: number }>;
+  /** v0.34.56: tool_execution_start events whose end never arrived (the
+   * start was replaced by a later start with a different/absent id). These
+   * are EXPLICIT unmatched facts — never silently re-paired with a wrong
+   * end. */
+  unmatchedToolStarts: Array<{ name: string; argsPrefix: string; startedAt: number; toolCallId?: string }>;
+  /** v0.34.56: tool_execution_end events that provably do not close the
+   * open start (wrong/absent id, or no open start at all). Represented
+   * explicitly instead of being dropped or falsely paired. */
+  unmatchedToolEnds: Array<{ toolCallId?: string; toolName?: string; at: number }>;
+}
+
+export type AuditorToolExecutionEvent =
+  | { type: "tool_execution_start"; toolCallId?: string; toolName: string; args?: unknown }
+  | { type: "tool_execution_end"; toolCallId?: string; toolName?: string };
+
+/** v0.34.56: tool-execution pairing, extracted pure so the telemetry is
+ * regression-testable. Truth rules:
+ *
+ * - A start while a start is open with a different (or absent) id means the
+ *   open start never received its end — record it in unmatchedToolStarts as
+ *   an explicitly unmatched fact, then adopt the new start.
+ * - An end pairs ONLY when: both sides carry the SAME id, or both sides are
+ *   anonymous (the id-less serial stream — the only pairing an id-less
+ *   stream can support).
+ * - An end with a different id than the open start, an id'd end against an
+ *   anonymous start, an anonymous end against an id'd start, or an end with
+ *   no open start at all: recorded in unmatchedToolEnds. NEVER paired with
+ *   the wrong start, NEVER silently dropped.
+ */
+export function applyToolExecutionEvent(
+  telemetry: AuditProgress,
+  event: AuditorToolExecutionEvent,
+  now: number,
+): AuditProgress {
+  if (event.type === "tool_execution_start") {
+    const sameId = event.toolCallId !== undefined && event.toolCallId === telemetry.currentToolId;
+    if (telemetry.currentTool !== undefined && !sameId) {
+      telemetry.unmatchedToolStarts.push({
+        name: telemetry.currentTool,
+        argsPrefix: telemetry.currentToolArgs ?? "",
+        startedAt: telemetry.currentToolStartedAt ?? now,
+        toolCallId: telemetry.currentToolId,
+      });
+    }
+    telemetry.currentTool = event.toolName;
+    telemetry.currentToolArgs = typeof event.args === "object" && event.args !== null
+      ? JSON.stringify(event.args).slice(0, 120)
+      : String(event.args ?? "").slice(0, 120);
+    telemetry.currentToolStartedAt = now;
+    telemetry.currentToolId = event.toolCallId;
+    return telemetry;
+  }
+  const open = telemetry.currentTool;
+  if (open !== undefined) {
+    const idMatches = event.toolCallId !== undefined && telemetry.currentToolId !== undefined && event.toolCallId === telemetry.currentToolId;
+    const bothAnonymous = event.toolCallId === undefined && telemetry.currentToolId === undefined;
+    if (idMatches || bothAnonymous) {
+      telemetry.toolCalls.push({ name: open, argsPrefix: telemetry.currentToolArgs ?? "", finishedAt: now });
+      telemetry.currentTool = undefined;
+      telemetry.currentToolArgs = undefined;
+      telemetry.currentToolStartedAt = undefined;
+      telemetry.currentToolId = undefined;
+      return telemetry;
+    }
+    // The end provably does not close the open start — the start stays open
+    // (it has not ended) and the end is recorded as an unmatched fact.
+  }
+  telemetry.unmatchedToolEnds.push({ toolCallId: event.toolCallId, toolName: event.toolName, at: now });
+  return telemetry;
 }
 
 export type AuditorProgressCallback = (progress: AuditProgress) => void;
@@ -223,6 +295,8 @@ export async function runGoalCompletionAuditor(args: {
     return { approved: false, disapproved: false, output: "", model: "(unset)", thinkingLevel, error: "no model (session model also unset)" };
   }
   const toolCalls: AuditProgress["toolCalls"] = [];
+  const unmatchedToolStarts: AuditProgress["unmatchedToolStarts"] = [];
+  const unmatchedToolEnds: AuditProgress["unmatchedToolEnds"] = [];
 
   try {
     const startedAt = Date.now();
@@ -231,6 +305,8 @@ export async function runGoalCompletionAuditor(args: {
       phase: "running",
       elapsedMs: 0,
       toolCalls,
+      unmatchedToolStarts,
+      unmatchedToolEnds,
     };
     function emitProgress(): void {
       progress.elapsedMs = Date.now() - startedAt;
@@ -291,26 +367,24 @@ export async function runGoalCompletionAuditor(args: {
         if (typeof msg === "string") streamError = msg.slice(0, 300);
       }
       if (event.type === "tool_execution_start") {
-        progress.currentTool = event.toolName;
-        progress.currentToolArgs = typeof event.args === "object" && event.args !== null
-          ? JSON.stringify(event.args).slice(0, 120)
-          : String(event.args ?? "").slice(0, 120);
-        progress.currentToolStartedAt = Date.now();
+        // v0.34.56: pairing lives in the pure applyToolExecutionEvent — the
+        // telemetry regression test drives it directly.
+        applyToolExecutionEvent(progress, {
+          type: "tool_execution_start",
+          toolCallId: (anyEvent.toolCallId as string | undefined) ?? undefined,
+          toolName: event.toolName,
+          args: anyEvent.args,
+        }, Date.now());
         progress.phase = "tool_executing";
         emitProgress();
         return;
       }
       if (event.type === "tool_execution_end") {
-        if (progress.currentTool) {
-          toolCalls.push({
-            name: progress.currentTool,
-            argsPrefix: progress.currentToolArgs ?? "",
-            finishedAt: Date.now(),
-          });
-        }
-        progress.currentTool = undefined;
-        progress.currentToolArgs = undefined;
-        progress.currentToolStartedAt = undefined;
+        applyToolExecutionEvent(progress, {
+          type: "tool_execution_end",
+          toolCallId: (anyEvent.toolCallId as string | undefined) ?? undefined,
+          toolName: anyEvent.toolName as string | undefined,
+        }, Date.now());
         progress.phase = "running";
         emitProgress();
         return;
@@ -429,16 +503,15 @@ export async function runGoalCompletionAuditor(args: {
     if (approved && args.goal.verificationContract?.trim()) {
       const shield = checkRegressionShield(output, args.goal.verificationContract);
       if (!shield.passed) {
-        const why = !shield.hasEvidenceBlock
-          ? "report has no <evidence> block"
-          : `report's evidence does not address: ${shield.missingItems.join("; ")}`;
+        // Keep the auditor's semantic approval distinct from the
+        // orchestrator-side shield block. This is neither a disapproval of
+        // the work nor an infrastructure failure.
         return {
-          approved: false,
-          disapproved: true,
+          approved: true,
+          disapproved: false,
           output,
           model: modelLabel(model),
           thinkingLevel,
-          error: `regression_shield: approved but ${why}`,
           regressionShieldPassed: false,
           regressionShieldMissing: shield.missingItems,
         };

package/extensions/goal-loop-core.ts

@@ -35,6 +35,26 @@ export type Status =
 
 export type Policy = "goal" | "list"; // v0.3.0: "loop".
 
+/** User-facing controls whose command root follows the active goal policy. */
+export type ModeCommand = "pause" | "tweak" | "resume";
+
+/** Return the command root for a supervised work surface. */
+export function workCommandRoot(mode: Policy | "loop" | undefined): "/goal" | "/list" | "/loop" {
+  if (mode === "list") return "/list";
+  if (mode === "loop") return "/loop";
+  return "/goal";
+}
+
+/** Build a mode-correct pause/tweak/resume command for a goal or list item. */
+export function modeCommand(mode: Policy | undefined, command: ModeCommand): string {
+  return `${workCommandRoot(mode)} ${command}`;
+}
+
+/** Build a command for a goal, list item, or metric loop. */
+export function workCommand(mode: Policy | "loop" | undefined, command: string): string {
+  return `${workCommandRoot(mode)} ${command}`;
+}
+
 export interface Task {
   id: string;
   title: string;
@@ -114,6 +134,26 @@ export interface AuditVerdict {
   regressionShieldMissing?: string[];
 }
 
+/** The display classification for one stored auditor result. Keep semantic
+ * verdicts separate from operational failures: a shield-blocked approval is
+ * not a disapproval, and an infrastructure error is not a verdict at all. */
+export type AuditVerdictLabel =
+  | "approved"
+  | "disapproved"
+  | "impossible"
+  | "shield-blocked"
+  | "infrastructure failure"
+  | "no verdict";
+
+export function auditVerdictLabel(v: Pick<AuditVerdict, "approved" | "disapproved" | "impossible" | "error" | "regressionShieldPassed">): AuditVerdictLabel {
+  if (v.approved && v.regressionShieldPassed === false) return "shield-blocked";
+  if (v.approved) return "approved";
+  if (v.impossible) return "impossible";
+  if (v.disapproved) return "disapproved";
+  if (v.error) return "infrastructure failure";
+  return "no verdict";
+}
+
 /**
  * Sum token usage across assistant messages, counting each message once.
  * `agent_end` events may include already-seen history, so callers pass a
@@ -307,6 +347,45 @@ export function listMutationBlocked(draftingTarget: string | null): boolean {
 export const LIST_DRAFTING_BLOCK_MESSAGE =
   "LIST DRAFTING IN PROGRESS — do not add items one by one. Decompose the request into an items[] array and call propose_goal_draft ONCE: the user confirms the whole batch in a single dialog. list_add / list_activate work again after the drafting session ends.";
 
+/**
+ * v0.34.51: /list subcommands that persist or activate work — refused on a
+ * stale extension handle by cmdList's entry probe. Read-only verbs (show,
+ * depth, status) stay available so the user can still inspect the queue
+ * while the lifecycle replacement is pending. The natural-language dump
+ * fallthrough is always mutating and is gated separately at the call site.
+ */
+export const LIST_MUTATING_SUBCOMMANDS = new Set([
+  "audit",
+  "tweak",
+  "pause",
+  "resume",
+  "add",
+  "import",
+  "clear",
+  "cancel",
+  "next",
+  "remove",
+  "rm",
+]);
+
+/**
+ * v0.34.52: /glla verbs that open a settings surface or persist config —
+ * refused on a stale extension handle by cmdSettings' entry probe, mirroring
+ * the /list gate. Bare /glla (verb "ui") is the settings entry itself: every
+ * table choice writes state. wipe/reset/cancel/resume/reviewer/postaudit/
+ * tooloverride mutate directly. Read-only surfaces (status, log, stats,
+ * audits) and the unknown-action notice stay available for inspection.
+ */
+export const SETTINGS_MUTATING_ACTIONS = new Set([
+  "wipe",
+  "reset",
+  "cancel",
+  "resume",
+  "reviewer",
+  "postaudit",
+  "tooloverride",
+]);
+
 /**
  * Route natural-language text handed to `/list` with no subcommand verb
  * (v0.18.0). The user typed a dump — "fix x, do y, write docs" — not a
@@ -725,7 +804,7 @@ export function renderGoalMarkdown(goal: Goal): string {
     lines.push("## Audit history");
     lines.push("");
     for (const v of goal.auditHistory) {
-      lines.push(`- ${v.at} — ${v.approved ? "approved" : v.impossible ? "impossible" : "disapproved"} — \`${v.model}\``);
+      lines.push(`- ${v.at} — ${auditVerdictLabel(v)} — \`${v.model}\``);
     }
     lines.push("");
   }
@@ -899,15 +978,27 @@ export function draftContractItemCount(normalized: string): number {
  * module so tests exercise THIS function, not a copy (the pre-0.23.7 test
  * re-implemented it and silently went stale).
  */
-export function extractVerificationContract(raw: string): { objective: string; verificationContract: string } {
+export function extractVerificationContract(raw: string): { objective: string; verificationContract: string; explicitClear: boolean } {
   // Line-based first: a marker at line start begins the contract block.
   const lines = raw.split("\n");
   let mode: "obj" | "verify" = "obj";
   const objParts: string[] = [];
   const verifyParts: string[] = [];
+  // v0.34.51: a BARE contract marker ("Done when:" with nothing after it) is
+  // an explicit CLEAR signal — the caller wipes the stored contract instead
+  // of preserving or replacing it. The bare marker line is consumed, never
+  // kept as contract text; later lines after a bare marker still belong to
+  // the contract block.
+  let explicitClear = false;
+  const MARKER_START = /^\s*(?:done when|verified when|verify|verification|done)\b[^:]*:/i;
   for (const line of lines) {
-    if (line.match(/^\s*(?:done when|verified when|verify|verification|done)\b[^:]*:/i)) {
+    const m = line.match(MARKER_START);
+    if (m) {
       mode = "verify";
+      if (!line.slice(m[0].length).trim()) {
+        explicitClear = true;
+        continue;
+      }
     }
     if (mode === "obj") objParts.push(line);
     else verifyParts.push(line);
@@ -923,9 +1014,16 @@ export function extractVerificationContract(raw: string): { objective: string; v
     if (m) {
       objective = (m[1] ?? "").trim().replace(/[.;]\s*$/, "");
       verificationContract = (m[2] ?? "").trim();
+    } else if (!explicitClear) {
+      // Trailing bare marker mid-line: "Do x. Done when:" — explicit clear.
+      const empty = raw.match(/^(.*?)\s+(?:done when|verified when|verify|verification)\b[^:]*:\s*$/is);
+      if (empty) {
+        objective = (empty[1] ?? "").trim().replace(/[.;]\s*$/, "");
+        explicitClear = true;
+      }
     }
   }
-  return { objective, verificationContract };
+  return { objective, verificationContract, explicitClear };
 }
 
 /**
@@ -1440,7 +1538,8 @@ export function formatGoalAuditHistory(goal: { id: string; auditHistory?: Array<
   if (history.length === 0) return "(no audits on this goal yet)";
   return history
     .map((v) => {
-      const glyph = v.approved ? (v.regressionShieldPassed === false ? "🛡" : "✔") : v.impossible ? "⛔" : v.disapproved ? "✖" : "⚠";
+      const verdict = auditVerdictLabel(v);
+      const glyph = verdict === "approved" ? "✔" : verdict === "shield-blocked" ? "🛡" : verdict === "impossible" ? "⛔" : verdict === "disapproved" ? "✖" : "⚠";
       const day = String(v.at ?? "").slice(5, 16).replace("T", " ");
       const elapsed = v.durationMs ? ` · ${Math.round(v.durationMs / 60000)}m` : "";
       const firstLine = (String(v.report ?? "").split("\n").find((l: string) => l.trim()) ?? "").trim().slice(0, 80);