pi-goal-list-loop-audit 0.35.12 → 0.35.13

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.35.13 — stale-API recovery loop fix (2026-08-20)
+
+### Stale-handle recovery correctness
+  Heartbeat recovery now validates the captured `ExtensionAPI` separately
+  from `ExtensionContext`. A context that still answers `isIdle()` cannot
+  revive an API that Pi has invalidated, so glla keeps the durable interruption
+  parked instead of repeatedly announcing recovery and retrying the same dead
+  continuation handle.
+
 ## 0.35.12 — npm 12 pack-report compatibility (2026-08-20)
 
 ### Keyed npm 12 dry-run reports

package/README.md

@@ -10,7 +10,7 @@ This is a detached process, not a nested session in the main pi process. `comple
 
 On Windows, npm installs the `pi.cmd` shim rather than a directly executable `pi` binary. The auditor launches it through an explicitly quoted `cmd.exe` boundary; POSIX keeps direct shell-less execution. Protocol snapshots also tolerate transient Windows file-locks without deleting the last valid snapshot first.
 
-**Current package version:** `v0.35.12` — use `/glla version` to see the installed version and the command for comparing it with the registry latest. This checkout may contain unreleased changes; the npm registry is authoritative for published versions.
+**Current package version:** `v0.35.13` — use `/glla version` to see the installed version and the command for comparing it with the registry latest. This checkout may contain unreleased changes; the npm registry is authoritative for published versions.
 
 ## Why this exists
 

package/docs/INDEX.md

@@ -17,7 +17,7 @@ For shipped docs, the relevant entry points are:
   task milestone gating; v0.35.8 added main-model preferred-primary
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
-  shapes; v0.35.12 supports npm 12's keyed pack reports.
+  shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
 - `../README.md` — what the plugin is, install, quickstart, and the
   architectural guarantee (drafting + confirm + detached auditor).
 - `../INSTALL.md` — manual install / symlink setup; the recommended

package/extensions/goal-heartbeat.ts

@@ -484,19 +484,12 @@ function heartbeatTick(): void {
     if (tryAbsorbHostSuccessor(knownCtx, "heartbeat-self-heal")) return;
     rememberCtx(knownCtx);
     // Reuse the same-session recovery gate as ordinary commands. It clears
-    // the durable interrupted marker and can resume unattended work; the
-    // fallback below preserves the old probe-only behavior if ownership is
-    // still ambiguous.
-    if (!flags.staleTerminalDone && !flags.extensionApiStale) return;
-    flags.staleTerminalDone = false;
-    flags.extensionApiStale = false;
-    flags.zombieStoodDown = false;
-    flags.sessionHandoffPending = false;
-    try {
-      knownCtx.ui.notify("glla: pi recovered after a stale-handle terminal — self-healing in-memory state (no /reload needed).", "info");
-    } catch {
-      /* the ledger is the durable record; notify is best-effort */
-    }
+    // the durable interrupted marker and rebinds the owner only after BOTH
+    // the context and the captured ExtensionAPI are healthy. If that gate
+    // refuses the contact, stay parked: clearing these flags here used to
+    // announce a false recovery and immediately retry against the same stale
+    // API every heartbeat tick.
+    if (flags.staleTerminalDone || flags.extensionApiStale) return;
   }
   const ctx = freshCtx();
   if (!ctx) return;

package/extensions/loops/goal-session.ts

@@ -1072,7 +1072,11 @@ function isCtxAlive(ctx: ExtensionContext | null | undefined): boolean {
  * (field: hegemon 2026-08-06 — one probe failure parked a live session for
  * 5 hours). */
 function probeExtensionApiStaleRaw(): boolean {
-  if (lastCtx && isCtxAlive(lastCtx)) return false;
+  // The ExtensionAPI and ExtensionContext can disagree briefly: a live
+  // context does NOT prove that the captured `pi` can still send. In
+  // particular, a stale send can latch the API while ctx.isIdle() continues
+  // to succeed. Always probe the API itself here or the heartbeat will
+  // repeatedly "recover" and immediately fail the next continuation send.
   if (!extensionApi) return false;
   try {
     extensionApi.getSessionName();
@@ -1083,13 +1087,10 @@ function probeExtensionApiStaleRaw(): boolean {
 }
 
 function probeExtensionApiStale(): boolean {
-  if (extensionApiStale) {
-    if (lastCtx && isCtxAlive(lastCtx)) {
-      extensionApiStale = false;
-      return false;
-    }
-    return true;
-  }
+  // A stale ExtensionAPI is terminal for this factory instance. A healthy
+  // context probe must not clear this latch: the next send would still use
+  // the same captured API and throw again.
+  if (extensionApiStale) return true;
   if (probeExtensionApiStaleRaw()) extensionApiStale = true;
   return extensionApiStale;
 }
@@ -1483,8 +1484,11 @@ function selfHealStaleSameSession(ctx: ExtensionContext): boolean {
   if (owner && owner.pid === process.pid && typeof owner.instanceId === "string" && owner.instanceId !== instanceId) {
     return false; // a successor module instance owns this cwd — never re-claim
   }
-  // The handle must actually be healthy NOW — the fresh probe on the live context.
-  if (!isCtxAlive(ctx)) return false;
+  // Both handles must actually be healthy NOW. A live ExtensionContext does
+  // not prove that the captured ExtensionAPI can send; Pi can leave ctx
+  // probes answering while the API has already latched stale. Reclaim only
+  // when the exact API used by continuation sends also passes its probe.
+  if (!isCtxAlive(ctx) || !extensionApi || probeExtensionApiStaleRaw()) return false;
   const was = extensionApiStale ? "extension_api_stale" : sessionHandoffPending ? "session_handoff_pending" : "stale_terminal_done";
   extensionApiStale = false;
   sessionHandoffPending = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.35.12",
+  "version": "0.35.13",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",