pi-goal-list-loop-audit 0.35.13 → 0.35.32

package/extensions/loops/goal-activation.ts

@@ -54,6 +54,7 @@ import {
   extractPendingTasks,
   isFullAuditObjective,
   resolveEffectiveAggressiveSettings,
+  supervisorPaused,
   appendAuditLog,
   computeListDepth,
   formatAuditLog,
@@ -258,6 +259,7 @@ import {
 import { consumeRecoveryResume } from "../goal-recovery.js"; // decomposition step 3 (v0.34.111)
 import {
   createGoalHeartbeat,
+  releaseZombieAbortKey,
   endSubagentHangProbe,
   markSubagentHangProgress,
   startHeartbeat,
@@ -339,6 +341,9 @@ import {
   PENDING_LATCH_STUCK_MS,
   shouldFirePendingLatchWatchdog,
   AUDITOR_WALL_TIMEOUT_MS,
+  ZOMBIE_RETRY_DELAY_MS,
+  zombieRetryDecision,
+  type ZombieRetryStreak,
 } from "../goal-loop-backoff.js";
 
 import {
@@ -351,6 +356,7 @@ import {
   cmdSettings,
   createGoalCommands,
   enqueueItems,
+  hydrateListQueueFromDisk,
   maybeDecisionPopup,
   probeAutoNotify,
   recentlyCompletedObjectives,
@@ -411,12 +417,137 @@ export function enqueueFaultRepairTask(ctx: ExtensionContext, objective: string,
   appendLedger(ctx.cwd, "faulty_objective_repair_promoted", { goalId: repair.id, targetId: target?.id, position: 1, source: target?.source ?? "unknown" });
 }
 
-/** v0.35.x: terminate one confirmed zero-stream host turn and park the
- * owning goal/list item before asking pi to abort. This is deliberately an
- * activation-owned operation: it can clear the durable continuation sidecar,
- * stand down re-arms, and validate the current generation before touching the
- * host. A later /goal or /list resume explicitly clears the stand-down and
- * starts a new attempt; no callback here schedules a blind retry. */
+/** v0.35.17 — bounded automatic retry after a confirmed zero-stream abort.
+ *
+ * Field evidence (note.md Next §1, screenshot 20260821_152311): turns
+ * dispatched by ACCEPTING a Confirm dialog hang with zero provider stream
+ * activity often enough that users repeatedly return to "Goal paused after
+ * 30m ... action needed - this won't fix itself" sessions. The watchdog's
+ * abort is correct (it stops the token bleed); what was missing is the
+ * self-heal half. This adds ONE bounded automatic re-dispatch per silent
+ * streak, mirroring main-model recovery's timer pattern:
+ *
+ *   - exactly ONE automatic retry per zero-stream STREAK: a retried turn
+ *     that actually streams advances lastStreamActivityAt past the previous
+ *     abort's observation point, so any LATER independent hang starts a
+ *     fresh streak and earns its own single retry;
+ *   - a SECOND consecutive silence (retry hung too, or the original turn
+ *     never streamed again) parks permanently — no retry storm;
+ *   - `/glla pause` freezes the retry like every other automatic
+ *     side-effect: the parked claim stays durable for manual resume;
+ *   - manual /goal resume · /loop resume remain available at all times.
+ *
+ * The streak counter is process-memory by design: if the session restarts
+ * inside the retry window the park stands and manual resume applies — an
+ * honest degradation, not a phantom promise.
+ */
+const ZOMBIE_PAUSE_REASON = "automatic zero-stream abort — no provider activity was observed";
+
+// Streak state is process-memory by design (see the block comment above
+// scheduleZombieAutoRetry): a session restart inside the retry window leaves
+// the park standing for manual resume — an honest degradation.
+let zombieRetryStreak: ZombieRetryStreak = { key: "", count: 0, lastAbortStreamAt: 0 };
+let zombieRetryTimer: NodeJS.Timeout | null = null;
+
+/** Arm the one-shot automatic re-dispatch after a successful zombie abort.
+ * Returns true when a retry was scheduled (the caller adjusts its user-facing
+ * copy accordingly). */
+function scheduleZombieAutoRetry(
+  ctx: ExtensionContext,
+  generation: number,
+  goalId: string | undefined,
+  observedStreamAt: number,
+  silentMinutes: number,
+): boolean {
+  const key = goalId ?? "loop";
+  const { retry, streak } = zombieRetryDecision(observedStreamAt, key, zombieRetryStreak);
+  zombieRetryStreak = streak;
+  appendLedger(ctx.cwd, retry ? "zombie_auto_retry_scheduled" : "zombie_auto_retry_refused_streak", {
+    goalId,
+    streakCount: streak.count,
+    delayMs: zombieRetryDelayOverride ?? ZOMBIE_RETRY_DELAY_MS,
+  });
+  if (!retry) return false;
+  if (zombieRetryTimer) {
+    clearTimeout(zombieRetryTimer);
+    zombieRetryTimer = null;
+  }
+  // scheduleSessionTimeout carries the generation/stale/zombie fences — an
+  // old session's callback can never re-arm work after stale/shutdown/reload.
+  zombieRetryTimer = scheduleSessionTimeout(() => {
+    zombieRetryTimer = null;
+    // v0.35.15 semantics: a frozen supervisor keeps everything automatic off.
+    // The parked claim stays durable; /glla resume then /goal resume apply.
+    if (supervisorPaused(state)) return;
+    const fresh = freshCtxForGeneration(generation);
+    if (!fresh) return;
+    const goal = state.goal;
+    if (goalId !== undefined || goal) {
+      if (!goal || goal.status !== "paused" || goal.id !== goalId) return;
+      if (goal.pauseReason !== ZOMBIE_PAUSE_REASON) return; // superseded pause — not ours to clear
+      const freshLimit = loadSettings(fresh.cwd).tokenLimit ?? DEFAULT_TOKEN_LIMIT;
+      const usage = goal.usage ? { tokensUsed: goal.usage.tokensUsed, tokensLimit: freshLimit } : undefined;
+      abortedStandDown = false;
+      setContinuationDispatchStoodDownRef(false);
+      updateGoal({
+        status: "active",
+        pauseKind: undefined,
+        pauseReason: undefined,
+        pauseSuggestedAction: undefined,
+        ...(usage ? { usage } : {}),
+      }, fresh);
+      appendLedger(fresh.cwd, "zombie_auto_retry_dispatched", { goalId: goal.id, policy: goal.policy });
+      releaseZombieAbortKey();
+      try {
+        fresh.ui.notify(`Automatic retry starting — the earlier ${goal.policy === "list" ? "list item" : "goal"} turn was aborted after ${silentMinutes}m of zero stream activity. One bounded retry is dispatched now; if it hangs again the ${goal.policy === "list" ? "item" : "goal"} stays paused for ${activeGoalSurfaceCommand("resume")}.`, "info");
+      } catch { /* best-effort */ }
+      scheduleContinuation(fresh, true);
+      return;
+    }
+    // Loop owner: revive the preserved iteration and tick once.
+    const loop = state.loop;
+    if (!loop || !loop.stopReason?.includes("zero-stream abort")) return;
+    abortedStandDown = false;
+    setContinuationDispatchStoodDownRef(false);
+    loop.active = true;
+    loop.stopReason = undefined;
+    persistState(fresh);
+    appendLedger(fresh.cwd, "zombie_auto_retry_dispatched", { kind: "loop", iteration: loop.iteration });
+    releaseZombieAbortKey();
+    try {
+      fresh.ui.notify(`Automatic retry starting — the loop was stopped after a zero-stream abort. One bounded retry ticks now; if it hangs again it stays stopped for /loop resume.`, "info");
+    } catch { /* best-effort */ }
+    scheduleLoopTick(fresh);
+  }, zombieRetryDelayOverride ?? ZOMBIE_RETRY_DELAY_MS);
+  return true;
+}
+
+/** Test-only: reset the module-global retry streak/timer state. */
+export function __testOnlyResetZombieAutoRetry(): void {
+  if (zombieRetryTimer) {
+    clearTimeout(zombieRetryTimer);
+    zombieRetryTimer = null;
+  }
+  zombieRetryStreak = { key: "", count: 0, lastAbortStreamAt: 0 };
+}
+
+let zombieRetryDelayOverride: number | null = null;
+
+/** Test-only: shrink the automatic-retry delay (null restores the 90s
+ * production default). Never called by production code. */
+export function __testOnlySetZombieRetryDelay(ms: number | null): void {
+  zombieRetryDelayOverride = ms;
+}
+
+/** v0.35.x (amended v0.35.17): terminate one confirmed zero-stream host turn
+ * and park the owning goal/list item before asking pi to abort. This is
+ * deliberately an activation-owned operation: it can clear the durable
+ * continuation sidecar, stand down re-arms, and validate the current
+ * generation before touching the host. A later /goal or /list resume
+ * explicitly clears the stand-down and starts a new attempt — and since
+ * v0.35.17, the FIRST silence of a streak additionally arms ONE bounded
+ * automatic retry (scheduleZombieAutoRetry below); only a second consecutive
+ * zero-stream abort leaves the park purely manual. */
 export function abortZombieRun(
   ctx: ExtensionContext,
   generation: number,
@@ -441,7 +572,7 @@ export function abortZombieRun(
   setContinuationDispatchStoodDownRef(true);
   abortedStandDown = true;
   const silentMinutes = Math.max(1, Math.round((Date.now() - observedStreamAt) / 60_000));
-  const reason = "automatic zero-stream abort — no provider activity was observed";
+  const reason = ZOMBIE_PAUSE_REASON;
   if (goal) {
     const noun = goal.policy === "list" ? "list item" : "goal";
     updateGoal({
@@ -473,7 +604,15 @@ export function abortZombieRun(
   });
   const resume = goal ? activeGoalSurfaceCommand("resume") : "/loop resume";
   const cancel = goal ? activeGoalSurfaceCommand("cancel") : "/loop stop";
-  const message = `${goal ? goal.policy === "list" ? "List item" : "Goal" : "Loop"} paused after ${silentMinutes}m with zero stream activity; the zombie turn was aborted and queued retries were stopped. Work is saved. ${resume} retries it, or ${cancel} discards/stops it.`;
+  // v0.35.17: ONE bounded automatic retry per zero-stream streak — the park
+  // becomes a 90-second waystation instead of a dead end for the first
+  // silence. A refused streak (second consecutive hang) keeps the manual copy.
+  const retryScheduled = scheduleZombieAutoRetry(current, generation, goal?.id, observedStreamAt, silentMinutes);
+  const message = `${goal ? goal.policy === "list" ? "List item" : "Goal" : "Loop"} paused after ${silentMinutes}m with zero stream activity; the zombie turn was aborted and queued retries were stopped. Work is saved. ${
+    retryScheduled
+      ? `An automatic retry starts in ~90s; ${resume} retries immediately instead.`
+      : `${resume} retries it, or ${cancel} discards/stops it.`
+  }`;
   current.ui.notify(message, abortError ? "warning" : "info");
   notifyExternal(current, message);
   return true;
@@ -520,18 +659,20 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
   });
   const settingsHandler = (args: string, ctx: ExtensionContext) => { rememberCtx(ctx); return cmdSettings(args, ctx); };
   pi.registerCommand("glla", {
-    description: "Open the settings UI for goals, loops, lists, and the auditor. `/glla version` shows the installed package version; `/glla cancel` cancels the active objective; `/glla wipe` Confirm-gatedly clears all live state while preserving history.",
+    description: "Open the settings UI for goals, loops, lists, and the auditor. `/glla version` shows the installed package version; `/glla pause` freezes the supervisor's automatic machinery (re-arms/recovery/auto-resume/dispatch) without touching active work; `/glla cancel` cancels the active objective; `/glla wipe` Confirm-gatedly clears all live state while preserving history.",
     getArgumentCompletions: completions([
       // Operational verbs only. Settings and section navigation belong in
       // the bare `/glla` table, so they do not compete with action completion.
       ["version", "show the installed package version and registry check"],
       ["status", "show goal, list, loop, and pending decisions"],
       ["log", "show the recent event trail"],
-      ["resume", "resume the paused or held live thing"],
+      ["resume", "resume the paused or held live thing; also unfreezes a /glla pause"],
+      ["pause", "freeze ALL supervisor automation (re-arms/recovery/dispatch) — active work keeps running"],
       ["cancel", "cancel the active objective (list item + queue)"],
       ["wipe", "Confirm-gated idempotent reset of all live goal/list/loop state"],
       ["stats", "show per-project ledger rollups"],
       ["audits", "browse the audit log"],
+      ["agents", "show tracked subagents; --tail <id> reads a child transcript"],
       ["switchlog", "show the model-switch trail (model_switch / forbidden_model_switch)"],
       ["tooloverride", "configure agent-tool visibility"],
     ]),
@@ -889,6 +1030,9 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       });
     }
     extensionApi = pi;
+    // Session-scoped resources are reset only after this context has passed
+    // the host-admission gate; child factories never touch host state.
+    resetLengthContinue();
     sessionHandoffPending = false;
     // Reset terminal ownership before rememberCtx: this is the only event
     // allowed to bind a context after a stale/shutdown handoff.
@@ -936,6 +1080,18 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       }
     }
     replaceState(readState(ctx.cwd));
+    // v0.35.21 (list-invisible-until-restart): the durable queue is the
+    // UNION of the persisted state and the per-item .queue.json sidecars
+    // (v0.34.60 disk-first writes). readState replays only the state
+    // ledger, so a plugin re-init / stale-handle window that reset RAM to
+    // defaults used to leave the sidebar queue blank — active item only,
+    // no "N waiting · up next" line — until a full restart re-ran the
+    // disk merge on some other path. Converge memory to the union at EVERY
+    // lifecycle restore so the rendered surface is truthful immediately.
+    const hydratedFromDisk = hydrateListQueueFromDisk(ctx);
+    if (hydratedFromDisk > 0) {
+      ctx.ui.notify(`glla: restored ${hydratedFromDisk} queued list item(s) from durable sidecars.`, "info");
+    }
     // v0.35.x: a fresh session_start is the coalesced recovery boundary for
     // a silent host death. Consume the one-shot arm after durable state is
     // reloaded so the marker is cleared in the new context, and let the
@@ -1066,11 +1222,13 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     const rebindResume = ownerClaim.rebind;
     if (rebindResume) appendLedger(ctx.cwd, "rebind_resume", { pid: process.pid });
     const explicitRecovery = handoffResume || recoveryResume || rebindResume;
-    // A successor after a non-quit shutdown is lifecycle consent for a held
-    // loop even when the old inactive loop did not qualify for a handoff
-    // marker. Keep this loop-specific; standalone goals retain their normal
-    // cold-start hold policy.
-    const loopSuccessorResume = explicitRecovery || nonQuitShutdownResume;
+    // v0.35.23 (note.md Next #2): a non-quit shutdown successor no longer
+    // consents to loop auto-resume by itself — a crash restart IS a cold
+    // load, and cold loads hold for an explicit decision. The SAME-PROCESS
+    // successor case stays consented: pi replaced its session without dying
+    // (the /reload family), so the held work is mid-flight continuity, not
+    // a cold start. Different-pid successors hold like any cold load.
+    const sameProcessSuccessorResume = nonQuitShutdownResume && ownerClaim.previousPid === process.pid;
     const heldLoopSuccessorResume = !!state.loop
       && !state.loop.active
       && isLifecycleHeldLoopReason(state.loop.stopReason)
@@ -1120,7 +1278,15 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // autoResume keys are ignored. Once running, the chain auto-continues
     // forever unless a super-stuck brake (stall escalation / stale-api /
     // latch) stops it loudly.
-    const autoResumeSetting = resolveEffectiveAggressiveSettings(loadGlobalSettings()).autoResume;
+    // v0.35.23 (note.md Next #2): auto-resume consent is now the RAW global
+    // setting, not the aggressive-mode coercion. resolveEffectiveAggressive
+    // Settings coerced unset→true (aggressiveMode defaults on), which made
+    // stock installs AUTO-RESUME everything on every load — defeating the
+    // documented v0.28.21 tri-state whose undefined default is HOLD, and
+    // the pinned settings-menu copy ("default: hold on EVERY load"). The
+    // aggressive dial still owns its caps; only explicit `autoResume: true`
+    // consents to load-time automation now.
+    const autoResumeSetting = loadGlobalSettings().autoResume;
     const autoResume = shouldAutoResumeOnSessionStart(event?.reason, autoResumeSetting);
     const mainRecovery = state.mainModelRecovery;
     if (mainRecovery?.manualResumeRequired) {
@@ -1218,13 +1384,13 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // stuck, and zero-stream abort reasons are intentionally excluded by the
     // shared predicate and remain explicitly resumable only.
     if (state.loop && !state.loop.active && isLifecycleHeldLoopReason(state.loop.stopReason)
-        && (autoResume || loopSuccessorResume)) {
+        && (autoResume || explicitRecovery || sameProcessSuccessorResume)) {
       const held = state.loop;
       state.loop = { ...held, active: true, stopReason: undefined };
       persistState(ctx);
       releaseContinuationDispatchStandDown();
       appendLedger(ctx.cwd, "loop_auto_resumed_on_restore", {
-        via: loopSuccessorResume ? "successor" : "auto-resume",
+        via: recoveryResume ? "recovery" : rebindResume ? "rebind" : handoffResume ? "handoff" : sameProcessSuccessorResume ? "same-process-successor" : "auto-resume",
         iteration: held.iteration,
         best: held.bestValue,
       });
@@ -1261,7 +1427,12 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // rebind marker were consumed before the startup barrier above.
     if (isLoopActive()) {
       const l = state.loop!;
-      if (autoResume || loopSuccessorResume) {
+      // v0.35.23: a different-pid crash successor no longer consents by
+      // itself — a crash restart IS a cold load, and cold loads hold for an
+      // explicit decision (note.md Next #2). Validated handoffs/rebinds,
+      // SAME-PROCESS successors, and the Auto-resume setting keep today's
+      // continuity.
+      if (autoResume || explicitRecovery || sameProcessSuccessorResume) {
         ctx.ui.notify(
           `Resuming loop (iteration ${l.iteration}/${l.maxIterations > 0 ? l.maxIterations : "∞"}, best ${l.bestValue ?? "n/a"}, stall ${l.stallCount}/${l.plateauWindow}): ${displaySlice(l.target, 60)}`,
           "info",
@@ -1359,12 +1530,12 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
         markCompletionAuditRecoveryPending(ctx, `session_start:${startReason}`);
       }
       const recoveredClaim = state.goal?.pendingCompletion;
-      // A timeout/no-verdict claim may already own one durable recovery slot.
-      // A validated host lifecycle can consume that slot even when global
-      // Auto-resume is off; ordinary cold startup still holds legacy/manual
-      // parked claims for explicit consent.
-      const scheduledRecovery = !!recoveredClaim?.recoveryRetryAt;
-      const canRecoverNow = explicitRecovery || autoResume || (hostLifecycleStart && scheduledRecovery);
+      // v0.35.23 (note.md Next #2): the old third disjunct — a validated
+      // host lifecycle consuming the durable retry slot even without
+      // Auto-resume — dispatched automation on a cold load. Removed: parked
+      // claims hold for explicit consent like every other pending state;
+      // the else branch below defers them with a truthful ledger event.
+      const canRecoverNow = explicitRecovery || autoResume;
       if (canRecoverNow && recoveredClaim && (recoveredClaim.phase ?? "recovery-pending") === "recovery-pending") {
         completionAuditRecoveryArmed = true;
         const started = maybeAutoRetryParkedCompletionAudit(hostLifecycleStart || explicitRecovery ? "host-rebind" : "session-start");
@@ -1406,6 +1577,36 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // state that doesn't mutate on load) rendered nothing — "can't tell if
     // it's on" is a bug. Painting unconditionally also clears/refreshes any
     // stale widget carried over from a previous in-process session.
+    // v0.35.23 (note.md Next #2): a consent-less cold load with pending
+    // durable state engages the LOAD HOLD — same freeze gates as /glla
+    // pause (continuation dispatch, loop ticks, heartbeat probes, recovery
+    // timers all check supervisorPaused()), but DISTINCT from it: released
+    // by any explicit work command, never by timers. State stays fully
+    // restored and DISPLAYED — only automation waits for the user.
+    if (!autoResume && !explicitRecovery && !staleRearmedOnSessionStart) {
+      const somethingLive = (!!state.goal && ["active", "auditing"].includes(state.goal.status)) || isLoopActive();
+      const pendingDurableState = !!state.goal || (state.list?.length ?? 0) > 0 || !!state.loop;
+      // v0.35.23: restore itself may have consented to live work (journal
+      // replay activating a deferred item, stale rearm) — a hold must never
+      // freeze what restore deliberately started.
+      if (pendingDurableState && !somethingLive && typeof state.loadHoldAt !== "number") {
+        replaceState({ ...state, loadHoldAt: Date.now() });
+        persistState(ctx);
+        appendLedger(ctx.cwd, "load_hold_engaged", { reason: startReason ?? "startup" });
+        ctx.ui.notify(
+          "Loaded without starting: your goal/list/loop state is restored and shown below, but automation is HELD for your decision. /goal resume, /list resume, or /list next starts work; enable Auto-resume in /glla settings to restore load-time automation.",
+          "warning",
+        );
+      }
+    } else if ((autoResume || explicitRecovery) && typeof state.loadHoldAt === "number") {
+      // v0.35.28 (issue #16): a hold persisted by a PREVIOUS process must
+      // not outlive the user's consent — with auto-resume on, a stale
+      // hold would freeze supervisorPaused()-gated machinery (including
+      // the due-wait backstop) until a manual resume that may never come.
+      replaceState({ ...state, loadHoldAt: undefined });
+      persistState(ctx);
+      appendLedger(ctx.cwd, "load_hold_released", { via: "consenting-reload" });
+    }
     refreshUI(ctx);
   });
 

package/extensions/loops/goal-auditor-hooks.ts

@@ -114,6 +114,8 @@ import {
   isForbiddenModel,
 isGoalRevisionCurrent,
   nextHourlyProbeMs,
+  supervisorPaused,
+  loadHoldActive,
   type ModelSwitchRecord,
   type ListItem,
 } from "../goal-loop-core.js";
@@ -715,6 +717,12 @@ export type AutomaticCompletionRecoveryTrigger = "session-start" | "host-rebind"
  * is not eligible for another automatic event-triggered attempt.
  */
 export function maybeAutoRetryParkedCompletionAudit(trigger: AutomaticCompletionRecoveryTrigger): boolean {
+  // v0.35.23 (note.md Next #2): a plain LOAD HOLD stops every automatic
+  // recovery trigger — pending claims wait for an explicit decision. The
+  // single exempt is "main-model-recovery": the claim was parked BY the
+  // provider failure, and the recovery ladder healing IS the pinned
+  // one-shot consent. Manual /glla pause freezes all triggers regardless.
+  if (loadHoldActive(state) && trigger !== "main-model-recovery") return false;
   const goal = state.goal;
   const claim = goal?.pendingCompletion;
   if (!goal || goal.status !== "paused" || !claim) return false;
@@ -749,7 +757,7 @@ export function maybeAutoRetryParkedCompletionAudit(trigger: AutomaticCompletion
   // beginCompletionAudit runs before retryStoredCompletionAudit reaches its
   // first await, atomically replacing the parked claim with a running claim
   // and consuming the durable one-shot marker.
-  void retryStoredCompletionAudit("session-recovery");
+  void retryStoredCompletionAudit("session-recovery", trigger === "main-model-recovery");
   return true;
 }
 
@@ -810,7 +818,17 @@ export async function runDetachedCompletionWithFallback(
  * impossible, semantic infra) → preserve the claim and pause for explicit `/goal resume`, while
  * semantic verdicts remain durable in auditHistory.
  */
-async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provider-retry"): Promise<void> {
+async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provider-retry", exemptLoadHold = false): Promise<void> {
+  // v0.35.15: `/glla pause` freezes automatic audit recovery — provider
+  // retries and session-recovery re-starts stay parked while the supervisor
+  // is paused. Explicit manual requests (`/goal resume`, `/goal verify`)
+  // still run: the user typed them, so they are not "automatic machinery".
+  // v0.35.23: exemptLoadHold carves out ONE narrow path from the automatic
+  // LOAD HOLD (never from a manual /glla pause): a main-model-recovery
+  // triggered retry. The claim was parked by provider infrastructure
+  // failure; the recovery ladder healing the provider IS the durable
+  // consent for its single retry (pinned v0.35.x).
+  if (origin !== "manual" && supervisorPaused(state) && !exemptLoadHold) return;
   const goal = state.goal;
   if (!goal?.pendingCompletion) return;
   const goalId = goal.id;
@@ -878,6 +896,10 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provi
           verificationSummary: claim.verificationSummary,
           model: candidate.model,
           thinkingLevel: (settings.auditorThinkingLevel ?? "high") as any, // may be "max" — pi ≥0.83 understands it; the dev-types predate it
+          // v0.36.0: raw settings allowlist; the process layer resolves
+          // entries to install paths before hashing (see
+          // goal-loop-auditor-process.ts).
+          allowedExtensions: settings.auditorAllowedExtensions,
           runtime: { attemptId: () => newDetachedAuditJobAttemptId(claim.attemptId!), logicalAttemptId: claim.attemptId!, wallTimeoutMs: AUDITOR_WALL_TIMEOUT_MS },
           onProgress: (progress) => {
             publishDetachedAuditProgress(generation, goalId, claim.attemptId!, progress);
@@ -1030,7 +1052,21 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provi
       : state.goal.objective;
     const recap = displaySlice(recapSrc, 110);
     const approvalVia = `${origin === "manual" ? " on /goal verify" : origin === "session-recovery" ? " after session recovery" : " on the provider retry"}${fallbackUsed ? " after an auditor-model fallback" : ""}`;
-    archiveCurrentGoal(liveCtx, "complete", `auditor ${result.model} approved (${origin})`);
+    const archived = archiveCurrentGoal(liveCtx, "complete", `auditor ${result.model} approved (${origin})`);
+    if (!archived) {
+      // archiveCurrentGoal already preserved the live record and warned the
+      // user. Keep the approved claim recoverable, but never emit a terminal
+      // success after the durable archive failed.
+      updateGoal({
+        status: "paused",
+        pendingCompletion: undefined,
+        pauseKind: "blocked",
+        pauseReason: "completion approved but terminal archive persistence failed",
+        pauseSuggestedAction: `Fix .pi-glla disk access or resolve the archive fence, then ${activeGoalSurfaceCommand("resume")} and call complete_goal again.`,
+      }, liveCtx);
+      appendLedger(liveCtx.cwd, "goal_archive_failed_after_approval", { goalId, attemptId: claim.attemptId, origin });
+      return;
+    }
     liveCtx.ui.notify(`✓ done: ${recap} — auditor ${result.model} approved${approvalVia}.`, "info");
     notifyExternal(liveCtx, `Goal complete (auditor approved, ${origin}): ${displaySlice(recapSrc, 120)}`);
     return;

package/extensions/loops/goal-list-queue.ts

@@ -645,7 +645,23 @@ function activateNextListItem(ctx: ExtensionContext, n = 1, opts?: { explicit?:
   // completion cascade, /list next, list_activate, list-draft auto-activate)
   // may activate a list item over a live loop, present or future.
   if (isLoopActive()) {
-    appendLedger(ctx.cwd, "list_activation_blocked_loop", {});
+    // v0.35.22 (note.md Next #3, field 2026-08-21): this refusal used to be
+    // LEDGER-ONLY — a queued repair card behind a paused suspicious goal
+    // was unstartable AND invisibly so (screenshots 134442/134645: the user
+    // is told to run /list next, it silently no-ops while a loop holds the
+    // surface). One-active-thing still refuses, but LOUDLY and with the way
+    // out; the loop-end cascade (announceQueuedListAfterLoopEnd) surfaces
+    // that the item is startable again once the loop ends.
+    const head = listQueue()[0];
+    appendLedger(ctx.cwd, "list_activation_blocked_loop", {
+      ...(head ? { queueItemId: head.id, objective: head.objective.slice(0, 200) } : {}),
+    });
+    ctx.ui.notify(
+      head
+        ? `The queued item cannot start while a loop owns the surface — "${head.objective.slice(0, 80)}" stays queued. /loop stop the loop (or let its bounds end it), then /list next starts the item.`
+        : "A loop is active — one active thing at a time. /loop stop it first, then /list next.",
+      "warning",
+    );
     return false;
   }
   // v0.28.14: carryover resolution runs BEFORE the item is taken — under

package/extensions/loops/goal-orchestrator.ts

@@ -109,6 +109,7 @@ import {
   deleteQueueItemFile,
   missingGllaTools,
   runPersistStep,
+  isSafePersistedId,
   isPersistenceDegraded,
   lastPersistenceFailure,
   modelSwitch,
@@ -116,6 +117,7 @@ import {
 isGoalRevisionCurrent,
   nextHourlyPromptMs,
   nextHourlyProbeMs,
+  clearLoadHold,
   type ModelSwitchRecord,
   type ListItem,
 } from "../goal-loop-core.js";
@@ -586,6 +588,14 @@ async function handleMainModelAgentEnd(ctx: ExtensionContext, rawLastA: any, las
 
 function createGoal(objective: string, ctx: ExtensionContext, policy: "goal" | "list" = "goal"): Goal {
   ensureDirs(ctx.cwd);
+  // v0.35.23 (note.md Next #2): creating a goal — via /goal start, a list
+  // item activation, or an accepted draft — IS the explicit decision a
+  // load hold waits for. Release before the new work's first continuation
+  // would otherwise be frozen.
+  if (clearLoadHold(state)) {
+    persistState(ctx);
+    appendLedger(ctx.cwd, "load_hold_released", { via: `goal-created:${policy}` });
+  }
   // Extract verification contract if present in objective.
   const { objective: roleCleaned, agentRole } = extractAgentRole(objective);
   const { objective: cleanObj, verificationContract } = extractVerificationContract(roleCleaned);
@@ -893,6 +903,10 @@ function archiveCurrentGoal(
 ): boolean {
   if (!state.goal) return false;
   const goal = state.goal;
+  if (!isSafePersistedId(goal.id)) {
+    ctx.ui.notify("Could not archive the goal — its persisted id is invalid, so no filesystem path was used. Repair the state before retrying.", "warning");
+    return false;
+  }
   const pendingAttemptId = goal.pendingCompletion?.attemptId;
   const target = archivedGoalPath(ctx.cwd, goal.id);
   const terminalGoal: Goal = {
@@ -984,7 +998,20 @@ function archiveCurrentGoal(
   // had a chance to choose a successor.
   const closeArchivedSlot = () => {
     if (state.goal?.id !== goal.id) return;
-    replaceState({ ...state, goal: null });
+    // v0.35.30: the archive nulled the slot, which blanked the widget — the
+    // verdict (approval or abort) survived only as one transient toast. Keep
+    // a durable last-outcome record so the widget can answer "did the final
+    // audit actually run?" hours later, after the agent's turn has ended.
+    replaceState({
+      ...state,
+      goal: null,
+      lastOutcome: {
+        at: nowIso(),
+        ok: status === "complete",
+        title: stopReason ?? status,
+        recap: (goal.completionSummary?.trim() || goal.objective).replace(/\s+/g, " ").slice(0, 300),
+      },
+    });
     persistState(ctx);
   };
   // Loop 2: a list-sourced goal COMPLETED → auto-activate the next item.