pi-goal-list-loop-audit 0.34.9 → 0.34.11

package/README.md

@@ -25,6 +25,7 @@ Most pi goal extensions — `pi-goal`, `pi-goal-x`, `pi-loop-mode`, `ralphi`, `t
 Install:
 ```bash
 pi install npm:pi-goal-list-loop-audit
+pi install npm:@juicesharp/rpiv-ask-user-question   # effectively required — see Recommended companions
 ```
 
 Five top-level commands — `/goal`, `/list`, `/loop`, `/glla`, `/review`:
@@ -138,6 +139,39 @@ dry, not "done"), `max=` iterations, or the arbitrary bounds `time=<hours>` /
 `propose_loop_refine` to sharpen the target or swap the measure — you confirm,
 the orchestrator test-runs and re-baselines, and both eras stay in history.
 
+## Recommended companions
+
+glla is the goal plane — it drives, verifies, and notifies. It does not
+try to be the whole rig. Four plugins round it out. The first is
+**effectively required** — glla's drafting interviews, DECIDE findings,
+and confirm dialogs are built around structured questions (it degrades
+to plain-text prompts without it, but that is the fallback path, not the
+product). The other three are optional; glla works without them:
+
+- **`@juicesharp/rpiv-ask-user-question`** — **install this one.**
+  Structured questions with multi-select and markdown previews: the
+  /goal drafting interview, DECIDE findings, and every confirm dialog
+  render through it. Without it you get prose fallbacks — functional,
+  but not the intended UX.
+- **`@tintinweb/pi-subagents`** — the `Agent` tool: parallel Explore /
+  Plan / general-purpose subagents. glla's prompts teach fan-out with ROI
+  (parallelize real work, never ceremony spawning) and brief discipline,
+  and big audit collects genuinely assume this exists. glla's subagent
+  guarantees (the main session owns the goal; workers can't clobber it)
+  are plugin-agnostic, but this is the provider we test against.
+- **`@juicesharp/rpiv-advisor`** — a second opinion the executor model
+  can request mid-flight: the whole conversation branch is forwarded to a
+  stronger reviewer model, which answers with a plan, a correction, or a
+  stop signal. Drive the session with a cheap/fast model and buy strong
+  judgment per call. Role clarity: the advisor is *advisory*, never
+  verification — glla's isolated auditor remains the only completion
+  gate.
+- **`@pi-unipi/notify`** — push beyond the desktop: Telegram, Gotify,
+  ntfy, with per-event routing. glla's built-in pushes cover the local
+  desktop case and fire only where there is something to DO; add this
+  for away-from-desk alerts — route it to critical events only, or every
+  glla pause/verdict pings twice.
+
 ## Which loop? (the decision rule)
 
 **`/goal`** — one thing, judged *semantically*. Research, features, docs,
@@ -312,39 +346,6 @@ stuck backoff caps at 5 minutes then pauses, measure commands get a 10m
 hard timeout, and the auditor aborts after 10m with zero session activity
 (infrastructure error, never a verdict).
 
-## Recommended companions
-
-glla is the goal plane — it drives, verifies, and notifies. It does not
-try to be the whole rig. Four plugins round it out. The first is
-**effectively required** — glla's drafting interviews, DECIDE findings,
-and confirm dialogs are built around structured questions (it degrades
-to plain-text prompts without it, but that is the fallback path, not the
-product). The other three are optional; glla works without them:
-
-- **`@juicesharp/rpiv-ask-user-question`** — **install this one.**
-  Structured questions with multi-select and markdown previews: the
-  /goal drafting interview, DECIDE findings, and every confirm dialog
-  render through it. Without it you get prose fallbacks — functional,
-  but not the intended UX.
-- **`@tintinweb/pi-subagents`** — the `Agent` tool: parallel Explore /
-  Plan / general-purpose subagents. glla's prompts teach fan-out with ROI
-  (parallelize real work, never ceremony spawning) and brief discipline,
-  and big audit collects genuinely assume this exists. glla's subagent
-  guarantees (the main session owns the goal; workers can't clobber it)
-  are plugin-agnostic, but this is the provider we test against.
-- **`@juicesharp/rpiv-advisor`** — a second opinion the executor model
-  can request mid-flight: the whole conversation branch is forwarded to a
-  stronger reviewer model, which answers with a plan, a correction, or a
-  stop signal. Drive the session with a cheap/fast model and buy strong
-  judgment per call. Role clarity: the advisor is *advisory*, never
-  verification — glla's isolated auditor remains the only completion
-  gate.
-- **`@pi-unipi/notify`** — push beyond the desktop: Telegram, Gotify,
-  ntfy, with per-event routing. glla's built-in pushes cover the local
-  desktop case and fire only where there is something to DO; add this
-  for away-from-desk alerts — route it to critical events only, or every
-  glla pause/verdict pings twice.
-
 ## Compatibility (what goes well, what conflicts)
 
 **The Two-Driver Rule**: any plugin that drives agent turns on `agent_end`

package/extensions/loops/goal.ts

@@ -630,15 +630,30 @@ let heartbeatTimer: NodeJS.Timeout | null = null;
 
 const ZOMBIE_RUN_SILENT_MS = 20 * 60_000;
 const ZOMBIE_RUN_ALERT_THROTTLE_MS = 10 * 60_000;
+// v0.34.11: unanswered-continuation watchdog. Hellhunter 2026-08-01: at a
+// list-transition completion boundary pi ACCEPTED every continuation
+// (sendMessage never threw; session reported idle) but started NO turn —
+// transcript frozen, tokens flat, 10+ minutes of refires into the void.
+// Same family as the post-compaction dropped trigger (v0.26.5), but the
+// pending-latch watchdog needs idle&&pending and pi reported no pending
+// here, and the zombie watchdog needs busy — this shape falls between both
+// chairs. Disarm signal = real activity (agent_end/tool_call) AFTER the
+// last send; a landed turn — even a lazy text-only one — disarms it.
+const CONTINUATION_UNANSWERED_MS = 150_000;
+const CONTINUATION_UNANSWERED_THROTTLE_MS = 300_000;
 // v0.29.19: dead-turn caps (agent_end exemption path). 6 consecutive
 // provider-error turns = a real outage, not bad luck — stop honestly.
 // 3 consecutive user aborts = the user means it (user aborts mean STOP).
 const LOOP_MAX_CONSECUTIVE_ERRORS = 6;
 const LOOP_MAX_CONSECUTIVE_ABORTS = 3;
 
+let lastRealActivityAt = 0;
+let lastContinuationSentAt = 0;
+let lastUnansweredAlertAt = 0;
+
 function noteActivity(real = false): void {
   lastActivityAt = Date.now();
-  if (real) consecutiveStalls = 0;
+  if (real) { consecutiveStalls = 0; lastRealActivityAt = lastActivityAt; }
 }
 
 function isSupervising(): boolean {
@@ -932,6 +947,25 @@ function heartbeatTick(): void {
     notifyExternal(ctx, `glla: zombie run suspected (${Math.round(streamSilentMs / 60000)} min busy-silent) — press Esc to abort.`);
     return;
   }
+  // v0.34.11: unanswered-continuation watchdog — pi took the send but no
+  // turn started (no agent_end, no tool call, no stream). Re-sends don't
+  // unstick a dropped trigger (hegemon law) — this alert's job is to say
+  // the cure LOUDLY at ~2.5 min instead of leaving a silent 20-30 min gap
+  // before the zombie/wedge alerts. Does NOT return: the heartbeat refire
+  // below keeps sending underneath in case pi unsticks by itself.
+  if (
+    isSupervising() &&
+    lastContinuationSentAt > 0 &&
+    lastRealActivityAt < lastContinuationSentAt &&
+    Date.now() - lastContinuationSentAt >= CONTINUATION_UNANSWERED_MS &&
+    Date.now() - lastUnansweredAlertAt >= CONTINUATION_UNANSWERED_THROTTLE_MS
+  ) {
+    lastUnansweredAlertAt = Date.now();
+    appendLedger(ctx.cwd, "continuation_unanswered", { silentMs: Date.now() - lastContinuationSentAt });
+    const msg = `glla: pi accepted the continuation ${Math.round((Date.now() - lastContinuationSentAt) / 60_000)}m ago but NO turn has started — no tool calls, no tokens, transcript frozen (the turn trigger is wedged; same pi failure family as the post-compaction blackhole). Re-sends don't unstick it. Cure: /reload — autoresume re-fires the ${isLoopActive() ? "loop" : "goal/list item"} automatically.`;
+    ctx.ui.notify(msg, "warning");
+    notifyExternal(ctx, msg);
+  }
   // v0.29.1: stranded-audit recovery. A goal left in "auditing" with NO
   // in-flight audit means the auditor's result never landed (wedged queue
   // ate the tool result; compaction/restart mid-audit). Field-observed in
@@ -1164,6 +1198,7 @@ function sendContinuation(goalId: string): void {
     if (resync) postCompactResyncPending = false; // consumed only by a landed send
     continuationRearmStreak = 0; continuationRearmSince = 0; // v0.28.5 (E3): a landed send clears the storm
     appendLedger(ctx.cwd, "goal_continuation_sent", { goalId });
+    lastContinuationSentAt = Date.now();
   } catch (err) {
     appendLedger(ctx.cwd, "goal_continuation_send_failed", { goalId, error: err instanceof Error ? err.message : String(err) });
     // v0.26.7: stale runtime = terminal (sends can never land); anything
@@ -2845,6 +2880,7 @@ function sendLoopTurn(): void {
     // refires with zero visibility into whether sends were landing.
     loopRearmStreak = 0; loopRearmSince = 0; // v0.28.5 (E3): a landed turn clears the storm
     appendLedger(ctx.cwd, "loop_turn_sent", { iteration: loop.iteration });
+    lastContinuationSentAt = Date.now();
   } catch (err) {
     // stale API — next agent_end reschedules (but if none comes, the
     // heartbeat's stall escalation stops the spin — v0.26.1).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.34.9",
+  "version": "0.34.11",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. An isolated extension-less auditor re-verifies every completion with raw evidence; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "MIT",
   "author": "dracon",