pi-goal-list-loop-audit 0.35.13 → 0.35.64

package/CHANGELOG.md

@@ -1,5 +1,982 @@
 # Changelog
 
+## 0.35.64 — bounded recovery for frozen subagents (2026-08-25)
+
+### Fix
+  A tracked top-level subagent that produces no tool-use or output-token
+  progress now receives the existing short warning first, then one
+  generation-fenced child-specific abort request after the configurable
+  `subagentHangEscalationMinutes` threshold (default 30; 0 keeps
+  warning/telemetry-only behavior). Nested, unreachable, or ownership-
+  ambiguous children remain warning-only. A stale child no longer shields an
+  unrelated parent zombie watchdog, and `/glla agents` shows ABORTING,
+  unavailable, or failed action state while preserving partial output.
+
+### Tests
+  `tests/subagent-hang-detection.test.ts` covers one-shot escalation,
+  progress-before-action cancellation, manager-unavailable and nested-child
+  safety, and `tests/agents-panel.test.ts` pins the action surface. Settings
+  menu/editor and INSTALL documentation expose the new threshold.
+
+### Follow-up hardening
+  Frozen-child escalation now uses pi-subagents' existing root-session
+  `subagents:rpc:stop` bridge, with readiness, ownership, generation, and
+  timeout-race fencing. The real AgentManager/RPC path is covered by a
+  deterministic pending-provider integration test without modifying the
+  upstream package.
+
+  Malformed saved goal/list objectives now produce a bounded repair/replan
+  card instead of a self-blocking first turn. One durable bootstrap turn
+  carries the complete preserved target and `propose_task_list` confirmation;
+  automatic repeats are fenced, while explicit `/list resume` re-arms one
+  retry. The card keeps its concrete recovery action and queue position
+  visible.
+
+### Tests
+  Focused repair/replan, display, stale-probe, and RPC regressions are
+  included in the release contract. The complete gate remains the source of
+  truth for the published artifact.
+
+## 0.35.63 — auditor context held until resume (2026-08-25)
+
+### Fix
+  Cold session restores now keep unfinished goal/list objectives and their
+  status visible without automatically injecting the previous auditor report
+  or dispatching a new continuation. Explicit `/goal resume`, list/glla/loop
+  continuation commands, validated lifecycle continuity, and global
+  `autoResume: true` release the auditor-context gate. The prior Pi transcript
+  and durable audit history remain untouched.
+
+### Tests
+  `tests/auditor-blank-until-resume.test.ts` proves objective visibility,
+  pre-consent report/TODO suppression, explicit resume release, auto-resume
+  release, and rejected stale-resume suppression. Version metadata is
+  synchronized to 0.35.63.
+
+### Follow-up hardening
+  `/goal resume` now releases the auditor surface only after its existing
+  stale/foreign admission probe. Active-idle resumes receive the same probe;
+  stale paused resumes preserve the existing active/interrupted recovery
+  marker without exposing old auditor context. Main-model recovery resumes
+  now use the same stale/foreign admission probe and release the surface on
+  manual-hold, retry, and primary-probe recovery paths; a recovery regression
+  test pins the consent behavior.
+
+## 0.35.62 — subagent host-state boundary (2026-08-25)
+
+### Fix
+  Headless child sessions are now rejected before state-root registration,
+  restore, owner claims, and tool repair. The same fail-closed boundary covers
+  persistent children, foreign slash commands, and missing tool invocation
+  contexts. File-backed host successors remain eligible for legitimate reload
+  and silent-rebind recovery. Main-host subagent telemetry continues through
+  the event bus and `/glla agents` path.
+
+### Tests
+  `tests/subagent-host-boundary.test.ts` proves first-claim prevention,
+  foreign slash-command refusal, persistent-worker refusal, legitimate host
+  successor admission, and durable Explore telemetry. Version metadata is
+  synchronized to 0.35.62.
+
+## 0.35.61 — list queue visibility across host replacement (2026-08-25)
+
+### Fix
+  Waiting-only list state now has an actionable status/widget projection even
+  when no list item is active. Silent host-successor and same-session stale
+  recovery boundaries also re-read the selected durable root and hydrate queue
+  sidecars before repainting. A recovered queue now stays visible and can be
+  started with `/list next` without requiring a full reload.
+
+### Tests
+  `tests/list-invisible-restart.test.ts` covers waiting-only visibility and
+  activation plus sidecar-only silent-successor rehydration. Version metadata
+  is synchronized to 0.35.61.
+
+## 0.35.60 — pre-turn glla tool visibility (2026-08-25)
+
+### Fix
+  GLLA agent tools are now registered and reactivated immediately before
+  agent turns, with `agent_start`/`turn_start` compatibility fallbacks. This
+  closes the interval where an external tool allowlist or modlist could remove
+  `pause_goal` after session restore and Pi would answer a valid model call
+  with `Tool pause_goal not found`, leaving a parked objective looking stuck
+  until reload.
+
+### Tests
+  `tests/gettick-tool-visibility.test.ts` simulates a post-restore active-tool
+  replacement and verifies the pre-turn boundary restores `pause_goal` and
+  keeps it callable. Version metadata is synchronized to 0.35.60.
+
+## 0.35.59 — safe cancel/wipe across unresolved session roots (2026-08-25)
+
+### Fix
+  `/glla cancel`, `/glla wipe`, `/list cancel`, `/list clear`, and the shared
+  goal archive path now fail closed while opt-in `sessionDir` resolution is
+  pending. They leave the in-memory objective/list untouched and do not
+  recreate or mutate an ambiguous cwd state tree; after host lifecycle
+  admission registers the session root, cancel and wipe archive/clear under
+  the selected session root as before.
+
+### Tests
+  `tests/objective-loss-lifecycle.test.ts` covers both deferred destructive
+  commands and successful `/glla cancel` + `/glla wipe` cleanup under a
+  registered session root. Version metadata is synchronized to 0.35.59.
+
+## 0.35.58 — objective-loss lifecycle repair (2026-08-24)
+
+### Fix
+  Wired the opt-in `sessionDir` root into the admitted production lifecycle.
+  `session_start` and silent host-successor admission now register Pi's
+  canonical `SessionManager.getSessionDir()` before owner, invalidation, or
+  restore writes; in-memory worker sessions remain pending instead of creating
+  an ambiguous cwd tree. The configured session directory wins over an
+  imported session-file parent, while `PI_SESSION_FILE` remains the explicit
+  child-process fallback.
+
+### Evidence
+  Added `tests/objective-loss-lifecycle.test.ts`: a real registered
+  `session_start` handler proves production root registration, and separate
+  fresh Bun writer/reader processes recover an objective across a cwd switch.
+  The report intentionally does not claim to simulate a crash mid-write or a
+  specific version migration. Full evidence:
+  audit/OBJECTIVE-LOSS-VALIDATION-2026-08-24.md.
+
+### Tests
+  Focused lifecycle/state-root tests and clean tsc pass; the full release gate
+  is run for this version before closure.
+
+## 0.35.57 — objective-loss validation (2026-08-24)
+
+### Evidence
+  Validated the Now report that objectives disappeared after a Wez crash or
+  version/cwd switch. The historical workingDir default intentionally makes a
+  cwd switch select a different on-disk root, while explicit sessionDir keeps
+  the objective visible across cwd changes. Pending session-root resolution
+  does not migrate or delete the old cwd tree. The bounded result was
+  evidence-based closure pending production lifecycle wiring; crash-only loss
+  was not reproduced. The subsequent gettick, list-reload, and
+  subagent-visibility reports remain separate items.
+  Full evidence: audit/OBJECTIVE-LOSS-VALIDATION-2026-08-24.md.
+## 0.35.56 — state-root consumer/lifecycle hardening (2026-08-24)
+
+### Fix
+  Hardened every remaining state-root consumer and lifecycle boundary missed
+  by the core/settings slice. Raw `<cwd>/.pi-glla` joins in auditor jobs,
+  dispatch, goal-loop ledger reads, reviewer, stats rollup/discovery, and
+  session owner/handoff/pending-list paths now route through `piGlaDir` and
+  respect the selected root. Pending `sessionDir` resolution (no session dir
+  yet) is a strict deferral: dispatch, reviewer, session owner, handoff, and
+  pending-list writes return a deferred/false result without creating a
+  fallback `<cwd>/.pi-glla` tree, and legacy `.pi-gla` trees are still never
+  migrated. Audit-loop open-count helpers now resolve via the selected root
+  as well. Host/subagent ownership stays per-process via `PI_SESSION_FILE`
+  fallback and the explicit `setRuntimeSessionDir` hook — no global overwrite.
+
+### Tests
+  New `tests/state-root-consumers.test.ts` pins resolved-root routing for
+  dispatch/stats/audit helpers, pending deferral for dispatch/reviewer, the
+  `PI_SESSION_FILE` fallback, and source-level absence of raw hardcodings plus
+  pending guards. Existing `tests/state-root.test.ts` continues to cover core
+  core/settings behavior. Red/green: breaking the `piGlaDir` routing makes the
+  consumer pins fail; restoring passes 9/9 focused plus 56 prior. tsc and full
+  release gate green for this tree.
+## 0.35.55 — opt-in session-root state core/settings slice (2026-08-24)
+
+### Fix
+  Ported the valid state-root portion of PR #21 onto current main without
+  merging the stale PR verbatim. New dependency-free
+  extensions/glla-state-root.ts owns the typed global root selector and
+  session-directory resolution so goal-loop-core can select a root without a
+  settings import cycle. The historical <cwd>/.pi-glla workingDir remains
+  the default; sessionDir is explicit opt-in and resolves to the top-level Pi
+  session directory (or PI_SESSION_FILE's parent for worker processes).
+  Session-root mode is global-only because project settings.json lives inside
+  the selected root. Pending sessionDir resolution is a write boundary:
+  core directory/ledger/queue/sentinel/audit-log writes defer rather than
+  recreate an ambiguous cwd tree, and old .pi-gla/.pi-glla trees are never
+  migrated or deleted by the new mode. The settings menu exposes the two
+  choices and project attempts to override stateRoot are stripped.
+
+### Tests
+  tests/state-root.test.ts covers default cwd persistence, opt-in session-root
+  persistence, pending-write/no-migration behavior, PI_SESSION_FILE fallback,
+  and global-only settings round-trip. settings-editors and
+  settings-menu-complete pin the UI/provenance surface; the long-term
+  preferences boundary now checks the dependency-free global path owner.
+  Red/green proved the session-root branch is required (2 of 5 focused tests
+  fail when neutered; restored 5/5). tsc and focused tests pass before the
+  full release gate.
+## 0.35.54 — RESUMABLE_STOP honors the v0.35.31 "metric never moved" stop (2026-08-24)
+
+### Fix
+  Collect-pass HIGH finding: the v0.35.31 "metric never moved" stop reason
+  promises "/loop resume retries or /loop stop" in its own message, but the
+  RESUMABLE_STOP predicate in /loop resume never matched that prefix - the
+  promised command answered "No held loop to resume", and with
+  propose_loop_refine gated on an ACTIVE loop, the only recovery was
+  /loop stop + a fresh start discarding iteration history. Same class as
+  the v0.35.25 issue-#14 zombie prefix bug (fixed there for zero-stream,
+  missed for this brand-new prefix). The prefix is now resumable: resuming
+  re-arms the error/stuck/stall counters while preserving iteration, best,
+  and history; if the metric is still dead it re-stops loudly after its
+  window, and a measure-changing propose_loop_refine (usable again once
+  resumed) re-scopes the measure era so the never-moved grace re-arms.
+
+### Tests
+  tests/metric-never-moved-resumable.test.ts: behavioral - a loop parked by
+  the exact production reason string resumes via /loop resume with
+  iteration/best/history preserved and all three streak counters re-armed;
+  negative pin - a bounded stop ("max iterations reached") stays
+  non-resumable. Red-proven by removing the predicate clause (behavioral
+  fails, negative pin stays green).
+## 0.35.53 — false repair card after abort+reload: parser marker fix + contract-derived objective heal (2026-08-24)
+
+### Fix
+  note.md Now: "objective needs repair issue, but before reload it looked
+  fine". Field forensics (neonbreak, item 20260823082852-in3rc7): the list
+  draft batch wrote an item with objective "" and the ENTIRE intent inside
+  the verification contract - extractVerificationContract's line marker
+  regex `verify\b[^:]*:` misread the imperative sentence "Verify the
+  shipped PREMIUM-UIUX pass (...): confirm ..." as a contract marker
+  ("verify" is both a marker word and an ordinary imperative verb), leaving
+  the objective empty. The activation gate then correctly flagged "empty"
+  and jammed a repair card ahead of the item - 42
+  faulty_objective_list_activation_blocked events over 22 hours, an endless
+  repair-card loop that wedged the session. Two-layer durable fix:
+  (1) WRITER - the line marker for the ambiguous verbs now requires the
+  colon immediately ("Verify:" / "Verify when:" / "Verification:");
+  "done"/"done when"/"verified when" keep a bounded 60-char decorated-marker
+  gap so prose tails cannot masquerade as markers either. The field text
+  now parses with the real objective and only the grep tail as contract.
+  (2) READER - legacy items already persisted with an empty objective plus
+  a clean, actionable contract derive their objective deterministically
+  from the contract's leading imperative sentence at activation
+  (list_objective_derived_from_contract) instead of demanding a repair
+  card. Empty objective + absent or suspicious contract still takes the
+  true broken-objective repair path, unchanged.
+
+### Tests
+  tests/false-repair-card.test.ts: the exact field text parses with its
+  intent in the objective; short-marker and decorated-marker forms still
+  parse; derivation unit rules (first sentence, suspicious/non-imperative
+  contracts rejected); behavioral - a legacy stuck item activates with the
+  derived objective (no repair demand, contract preserved), a truly broken
+  item still triggers the repair card, and a fresh /list add of the field
+  text activates directly end-to-end. Red-proven by neutering both layers
+  (4 of 6 fail; the true-broken-path tests stay green).
+## 0.35.52 — context hygiene: era-scope failed error-only turns out of the effective context (2026-08-24)
+
+### Fix
+  note.md Now: "failed requests add to the context, while clearly adding
+  nothing of value". When retries are exhausted, the failed assistant turn
+  (stopReason "error", errorMessage set, content empty/partial) STAYS in
+  agent state and the session - pi strips it from live state only for
+  mid-flight retries. Every later LLM call receives it and compaction
+  summarizes it; nothing downstream filters these. Field evidence (polis,
+  2026-08-23): a run of 503/network_error/retry-cancelled turns drove the
+  estimated context to 122.7% of the 200k window, and auto-compaction then
+  aborted on its own bloated summarization input. New
+  extensions/context-hygiene.ts: a durable bounded rule drops error-only
+  assistant turns (stopReason "error", NO tool-call blocks) from the
+  effective context EXCEPT the most recent one, which stays so the model
+  sees why the previous attempt failed on the retry send. Applied at two
+  points: the `context` event projection (per-send, transcript untouched -
+  alongside the v0.35.51 payload guard) and `session_before_compact`
+  (prunes the shared preparation object the compaction runner summarizes,
+  shrinking the summarizer request and keeping failures out of the summary).
+  Tool-call-carrying error turns own paired toolResults and stay intact;
+  "aborted" turns are user-intent boundaries and are never touched. Drops
+  are ledgered (context_hygiene_dropped / context_hygiene_compaction_input).
+
+### Tests
+  tests/context-hygiene.test.ts: predicate (tool-carrying/aborted/healthy
+  never droppable); bounded drop rule (newest kept, older dropped, identity
+  preserved at/under the window, configurable window); seeded bloat (60
+  failures collapse, normal turns survive verbatim); in-place compaction
+  preparation pruning; behavioral wiring through MockPi for both hooks with
+  ledger assertions and clean-history no-op. Red-proven by neutering both
+  production call sites.
+## 0.35.51 — payload guard: bound inline image bytes on every outgoing LLM call (2026-08-24)
+
+### Fix
+  note.md Now: "req body too large due to images in context". Generated
+  images accumulate in conversation history as inline base64 blocks until
+  the provider rejects the request with 413 ("Downloaded image content
+  cannot exceed 30MB" / "Request Entity Too Large") - and every
+  main-model-recovery probe re-sent the same bloated history, so recovery
+  could never classify or heal the failure; the session was wedged until a
+  manual restart WITHOUT history. Two-layer durable fix: (1) a new
+  extensions/payload-guard.ts projects the outgoing message list at the pi
+  `context` event (fired before EVERY LLM call), bounding cumulative
+  inline-image bytes to 16MB - evicting the OLDEST images first, always
+  keeping the newest two, replacing each evicted block with a short text
+  placeholder. Disk history is untouched (per-send projection), and the
+  chokepoint protects ordinary turns AND recovery probes alike. Evictions
+  are ledgered as payload_guard_eviction. (2) classifyMainModelFailure now
+  maps 413/payload-size texts to "transient" - retryable in place, because
+  the payload guard (not a fallback-model switch) heals the size; the old
+  "unknown" classification burned the whole chain on useless rotations.
+
+### Tests
+  tests/payload-guard.test.ts: under-budget pass-through (same identity);
+  oldest-first eviction with newest-two floor; floor holds when the budget
+  cannot be met; idempotent projection, non-image content untouched;
+  behavioral wiring (context handler projects + ledgeres; under-budget
+  passes unprojected); 413 texts classify transient (not unknown, not
+  context-overflow). Red-proven by neutering both production sites.
+## 0.35.50 — same-process session successors auto-resume the main thread (2026-08-23)
+
+### Fix
+  note.md Now #2: session-start auto-resume asymmetry. The v0.35.23 loop
+  branch treats a SAME-PROCESS session successor (shutdown recorded in the
+  owner sidecar with a non-quit reason, previous pid === current pid) as
+  mid-flight continuity and resumes held loops - but a plain ACTIVE goal
+  held ("restored on session load - held for explicit resume") and a parked
+  completion-audit claim stayed parked in that exact corner: from the
+  user's seat, the list kept going after the session replacement while the
+  goal sat "awaiting first turn". The goal restore gate and the auditor
+  claim's canRecoverNow now accept the same consent, refined per the
+  v0.34.49 one-shot identity law: a PRESENT handoff marker is authoritative
+  even when mismatched (rejection holds); only an ABSENT marker with a
+  same-pid non-quit shutdown is continuity - the same distinction
+  listOperationLifecycleResume already draws. Different-pid crash
+  successors and cold loads still hold for an explicit decision;
+  Auto-resume stays the only load-time automation for them.
+
+### Tests
+  tests/same-process-successor-resume.test.ts: same-process successor
+  resumes a held ACTIVE goal (continuation dispatched, no stale interrupt
+  marker); same-process successor auto-retries a parked completion claim
+  (audit_recovery_auto_retry_claimed fence in the ledger); different-pid
+  crash successor still HOLDS (cold-load law). Red-proven by neutering
+  both consent sites; the v0.34.49 mismatched-marker identity test stays
+  green against the refined consent.
+## 0.35.49 — parent-side silence watchdogs close the auditor-AWOL gap (2026-08-23)
+
+### Fix
+  Field evidence across five projects (football-forever, doomtap,
+  junk-runner, email-api-compare, vps-compare): a detached auditor worker
+  whose provider hangs emits ONE boot RPC event (or none) and then total
+  silence. The v0.34.57 no-progress watchdog only arms while heartbeats
+  stay FRESH, so a stale heartbeat disarmed it, the worker's own stall
+  brake was the only other bound, and every doomed attempt burned its full
+  30m wall while the goal sat "auditing" and the queue looked dead. The
+  poll loop now owns two complementary silence axes with the same
+  running-tool exemption: heartbeat-stale (had an event, went silent for
+  the window) and first-event-timeout (never emitted anything within
+  firstEventTimeoutMs, a new runtime knob defaulting to the same window).
+  Both demote the HUD to quiet, emit auditor_stalled, terminate the
+  worker, and return retryable "timeout" infra - which the existing
+  fallback ladder re-drives with its eager 5s first retry instead of the
+  wall.
+
+### Tests
+  tests/auditor-stall-watchdog.test.ts: three workers (silent since boot,
+  one-boot-heartbeat-then-silence, tool-open-silent) prove both axes fail
+  fast BEFORE the wall, classify as retryable infra, SIGTERM the worker,
+  and remove the job scratch; the third pins the running-tool exemption.
+  Red-proven against pre-change code: both stall runs burned the full
+  wall and never stalled. tests/auditor-process.test.ts heartbeat test
+  disarms the new axis (firstEventTimeoutMs) to isolate its own.
+## 0.35.48 — overdue-wait backstop respects the dispatch-surface gates (2026-08-23)
+
+### Fix
+  Audit-pass finding: overdueWaitBackstop mutated durable state (parked to
+  active, pauseResumeAt cleared) without checking the
+  extensionApiStale/sessionHandoffPending/stale-terminal or
+  mainModelRecoveryActive gates - during a latched-stale heartbeat a
+  durably parked wait could become an ACTIVE goal with no dispatch until a
+  fresh session_start, breaking the paused-is-safe invariant. The backstop
+  now refuses mid-handoff and stale-latched windows, and under an active
+  main-model recovery releases ONLY recovery-routed waits (the probe route
+  re-parks with a fresh resumeAt on failure) - unrelated agent-authored
+  waits stay parked until recovery resolves. The gates sit BEFORE the
+  lastOverdueWaitKey one-shot latch so skipped windows stay retriable.
+
+## 0.35.47 — completions/handler parity for /list and /loop verbs (2026-08-23)
+
+### Fix
+  Audit-pass finding: verbs handled by the dispatchers but absent from the
+  subcommand completions - /list add|import|rm (and pause, caught while
+  pinning), and /loop resume|refine|polish. All seven now appear in their
+  getArgumentCompletions tables with accurate descriptions. A generic
+  parity pin in tests/command-registration-collisions.test.ts scans every
+  `sub === "x"` dispatch literal inside cmdList/cmdLoop and fails when a
+  handled verb has no completion entry - future verbs cannot ship
+  half-registered.
+
+## 0.35.46 — /glla agents --tail sanitization + bounded scan reads (2026-08-23)
+
+### Fix
+  Audit-pass finding, two parts: (1) child-transcript tail lines were
+  rendered through ctx.ui.notify WITHOUT ANSI/control-character
+  sanitization - unlike every other external-text projection - so a
+  hostile child transcript could emit terminal escape sequences;
+  formatTranscriptEntry now runs all output paths (both [raw] fallbacks
+  and the [role] text path) through sanitizeDisplayText. (2) The candidate
+  scan synchronously read up to 25 FULL transcript files on the main
+  thread; the reader contract now takes an optional maxBytes and the
+  production command passes a real partial tail read (256 KiB window,
+  TRANSCRIPT_SCAN_MAX_BYTES), so the scan touches at most the last 256 KiB
+  of each candidate. The single matched file still gets a full read so the
+  "last N of M" detail stays honest.
+
+## 0.35.45 — plan-mode seeded hint separator (2026-08-23)
+
+### Fix
+  Audit-pass finding: planNote ended "...than a regular draft." and was
+  concatenated directly with the label hint, producing
+  "...regular draft.Goal drafting - deep planning: ..." in the notified
+  seeded hint. The join is now explicit (planNote ? `${planNote} ` : "").
+  Behavioral test drives the real /goal plan command with a seed and
+  asserts the notified hint reads "regular draft. Goal drafting - deep
+  planning:"; proven red with the glued concatenation restored.
+
+## 0.35.44 — draftingDepth dead state removed; orphaned-gate windows closed (2026-08-23)
+
+### Fix
+  Audit-pass finding, three parts: (1) the draftingDepth runtime global was
+  write-only dead state - set in startDrafting, reset in clearDraftingState,
+  zero readers (template selection uses the depth parameter) - removed
+  outright; "no target => normal depth" now holds by construction, so no
+  consumer can observe stale depth across proposal-completion paths.
+  (2) The two bare `draftingTarget = null` completion paths that skipped the
+  drafter-model restore (batch-activation conflict refusal, zombie-twin
+  rejection) now restore like every other exit. (3) beginDrafterModel moved
+  inside a try that clears the drafting gate on throw - a throw used to
+  leave the orphaned gate startDrafting's own header warns about.
+
+## 0.35.43 — refine re-baselines specChecked with the spec write (2026-08-23)
+
+### Fix
+  Audit-pass finding: refine's orchestrator-side spec write updated
+  specHash but not loop.specChecked, so the next tick saw checked >
+  specChecked against the OLD file's count and ledged spec_item_progress
+  attributed to the agent's iteration - unearned progress feeding the
+  multi-signal stuck gate (the user confirmed the respec; the agent may
+  have done nothing). The refine handler now re-baselines specChecked
+  together with specHash after writing the new spec.
+
+## 0.35.42 — measure-era scoping for loop movement accounting (2026-08-23)
+
+### Fix
+  Audit-pass finding: applyRefinement re-baselines best/last/stall on a
+  measure-changing refine but keeps history, so OLD-era improved entries
+  made both movement checks permanently true for the NEW metric era - the
+  v0.35.31 flat-reading grace could never apply after a measure-changing
+  refine, and a dead new metric could never earn its never-moved stop.
+  applyMeasurement now scopes metricHasMoved and metricNeverMoved to the
+  current measure era (history after the last measure-changing
+  refinement's iteration; the boundary was already recorded on every
+  LoopRefinement). Two twin tests proven red without the scoping, green
+  with it.
+
+## 0.35.41 — the last two loop-stop routes announce queue resumption (2026-08-23)
+
+### Fix
+  Audit-pass finding: v0.35.22's "ends by ANY route ... ANNOUNCE loudly"
+  contract was only wired into some stop routes. The stuck-ladder stop and
+  the provider-error/abort-cap stop notified the loop line but never
+  announced that waiting list items can start again - a dead silent entry.
+  Both routes now call announceQueuedListAfterLoopEnd (exported from
+  goal-loop.ts for the goal-activation site). Two twin behavioral tests
+  drive each production route against a seeded waiting queue; both proven
+  red with their call neutered, green restored.
+
+## 0.35.40 — regression pins for the audit-kind measurement exemption (2026-08-23)
+
+### Tests
+  Audit-pass finding: commit 28131527's audit-kind exemption in
+  applyMeasurement shipped with zero regression pin. Two twin-loop tests in
+  tests/loop-forever.test.ts now pin it: (1) identical flat-metric shapes
+  diverge by kind - the audit loop counts every flat toward plateau from
+  iteration 1 while the non-audit loop's pre-movement flats stay free;
+  (2) a dead metric gets the dedicated "metric never moved" stop on plain
+  loops but never on audit loops, whose final verdict stays plateau.
+  Red/green proven: deleting both halves of guard one fails both twins;
+  the never-moved kind-guard proved unreachable-by-construction for audits
+  (plateau always returns first) and is pinned in source instead.
+
+## 0.35.39 — README Files map is actually complete (2026-08-23)
+
+### Docs
+  Audit-pass finding: the Files map showed 4 of 7 prompts (missing both
+  plan-draft prompts shipped in v0.35.33 and goal-loop-forever-metricless)
+  and ~19 of 44 extensions files while reading as complete. The map now
+  enumerates every file - 34 extensions/ + 10 loops/ + 7 prompts/ + all
+  scripts/ - grouped by concern, with one-line descriptions verified
+  against each module's exports.
+
+# 0.35.38 — README verb-semantics documentation (2026-08-23)
+
+### Docs
+  User-requested audit finding: what /goal|/list|/loop audit MEAN vs start
+  vs the plan verbs lived only in code comments. New "What the verbs mean"
+  table right after the quick-start block (audit is deliberately three
+  machines: one-shot fix-in-pass goal, collect-then-drain list item,
+  forever cadence loop; plan = extended draft on all surfaces; verify
+  audits the CURRENT goal, not the project), the drafting-rules paragraph
+  now names plan as the fourth depth, and "Which loop?" cross-links it.
+  Includes the DECIDED semantics: /list plan takes prose only — a file
+  path stays bulk import; files mentioned inside /list plan are research
+  input, never auto-imported.
+
+## 0.35.37 — recovery welcome-back notice now fires exactly once (2026-08-23)
+
+### Fix
+  Audit-pass finding: autoResumedAt/autoResumedEvent were set by three
+  auto-recovery sites (heartbeat overdue-wait backstop, main-model provider
+  recovery, auditor provider retry) but the ONLY clearing site was MANUAL
+  resume — so the continuation prompt injected the "WELCOME BACK, YOU WERE
+  RECOVERED" directive into EVERY dispatch of a goal that kept running days
+  after one recovery. The accepted-dispatch site in sendContinuation now
+  marks the notice delivered: the stamp clears and a
+  recovery_notice_delivered ledger entry records it, so the directive is
+  injected exactly once per auto-resume. Manual /goal resume keeps its own
+  clearing (user-driven, no notice needed).
+
+## 0.35.36 — complete_goal newObjective no longer launders agent text into userSeeds (2026-08-23)
+
+### Fix
+  Audit-pass finding: the newObjective branch appended the AGENT-authored
+  objective to objectiveProvenance.userSeeds; since createdVia stays "user"
+  from creation, the v0.35.31 seed trust then treated that agent-written
+  text as explicit user prose and dispatched it verbatim past the
+  suspicious-objective fence. userSeeds is now strictly human-confirmed
+  text (creation arg, /goal tweak Confirm dialog, repair-redraft task-list
+  confirm); a newObjective pivot is recorded via its goal_tweaked ledger
+  entry and reviewed by the isolated auditor against the NEW contract in
+  the same call. Regression test proves red-on-laundering /
+  green-on-fix; behavioral consequence observed: heuristic-tripping pivots
+  on user goals now flow through the normal fence (auto-restore from the
+  durable original) instead of being waved through.
+
+## 0.35.35 — user-seed trust works with contract clauses and role markers (2026-08-23)
+
+### Fix
+  Audit-pass finding: v0.35.31's seed trust compared the CLEANED
+  goal.objective against RAW stored seeds by exact equality — but createGoal
+  strips "Done when:" clauses and Agent:/Role: declarations out of the
+  objective while keeping the raw arg as the seed, so any seeded goal WITH a
+  clause/role silently no-op'd the trust and still parked behind the
+  suspicious-objective heuristic. New pure helper objectiveIsUserSeeded()
+  normalizes BOTH sides through the same extraction pipeline the creation
+  path applies; createdVia still gates WHO is trusted (agent-authored seeds
+  gain nothing). Regression tests: clause+role user seeds dispatch verbatim;
+  reviewer-created goals with matching-cleaned seeds never get the trust.
+
+### Mechanical pre-audit: maxBuffer ceiling killed verbose green suites (2026-08-23)
+
+#### Fix
+  runMechanicalPreAuditChecks passed no maxBuffer to execFileSync, so
+  Node's default 1 MB cap applied: any contract gate whose output exceeds
+  1 MB gets its child SIGTERMed by Node and the call throws ENOBUFS —
+  which the banner logic (signal==="SIGTERM") then misreported as "killed
+  after 600s". Field incident (2026-08-23, five consecutive auditor
+  rounds on hellhunter's `bun test src/lib/game`): the gate emits ~1.17 MB
+  of ALL-PASSING output and was unpassable by construction — every attempt
+  died at ~1 MB (~15s in) while the identical tree passed green from an
+  interactive shell 19/19 times, including piped-output and single-core
+  pinned runs. Now passes maxBuffer: 64 MB, and ENOBUFS deaths no longer
+  print the misleading 600s timeout banner.
+
+## 0.35.34 — lastOutcome actually durable (2026-08-23)
+
+### Fix
+  Audit-pass finding: v0.35.30's "durable" last-outcome record was never
+  serialized — persistStateLine omitted the field and readState never
+  restored it, so any restart/reload blanked the widget retention line
+  within its 24h window (the exact failure v0.35.30 fixed). Now always
+  written (null when absent — readState spreads successive state events, so
+  an omitted key would resurrect stale values and /glla wipe could never
+  clear the record) and restored through a strict shape sanitizer (corrupt
+  lines degrade to absent, never throw). Round-trip + corruption regression
+  tests added.
+
+## 0.35.33 — plan mode: the extended draft (2026-08-22)
+
+### Add
+  /goal plan | /list plan | /loop plan — the EXTENDED DRAFT for
+  greenfield/megaplan work where the standard 5–7-question interview is too
+  shallow (user design 2026-08-22). Research BEFORE questions (Explore
+  subagents, file reads), multi-round interviewing (architecture → scope →
+  failure conditions → verification), and a structured expanded objective:
+  current-state analysis, decisions with rationale, milestone breakdown,
+  per-milestone verification contract. Deliberately NOT a separate artifact —
+  the objective itself is the single truth (the respec lesson: a second
+  document always goes stale). Trust machinery unchanged: propose_*_draft +
+  the Confirm card still gate activation; regular drafts stay the fast path.
+  New prompts prompts/goal-loop-plan.md + goal-loop-plan-loop.md; depth flag
+  on the drafting session (runtime-global, reset by clearDraftingState);
+  completions on all three commands; /list plan gated as a mutating verb on
+  stale handles. respec stays untouched (kept by user decision).
+
+## 0.35.32 — hermetic settings round-trip test (2026-08-22)
+
+### Fix
+  tests/auditor-extensions.test.ts depended on the developer machine having
+  ~/.pi/agent extensions to discover: on a bare CI home the discovered list
+  was empty, the handler fell back to the input prompt, and the TUI-picker
+  branch under test never ran (publish workflow failure). The test now seeds
+  a project-scope `.pi/extensions/hermetic-ext.js` so discovery is non-empty
+  on every machine; verified green under both an empty HOME and a populated one.
+
+## 0.35.31 — user-seed trust for /goal start; loop plateau no longer false-stops on a never-moved baseline (2026-08-22)
+
+### Fix 1: explicit /goal start paused by the suspicious-objective heuristic
+  Field: Screenshot_20260822_193744 — `/goal start "…because we are logged in"`
+  was parked as "Suspicious objective detected (dangling-fragment)" with a
+  repair task queued instead of dispatching. The fragment heuristics exist
+  for AGENT-authored report garbage; an explicit `/goal start` whose
+  objective is verbatim a user seed now dispatches and ledgers
+  `faulty_objective_user_seed_trusted` (/goal tweak remains available).
+### Fix 2: loop plateau vs a degenerate zero baseline
+  Field: doomtap loop stopped "plateau — best: 0" while iterations visibly
+  fixed real findings: a min-direction metric reading 0 before work starts
+  pins best at 0, so every later productive reading scores flat and burns
+  plateau slots. Flat readings now count toward plateau only once the metric
+  has demonstrably moved (an improvement on record, or best ≠ first measured
+  reading of the run); a metric that NEVER moves gets its own loud bounded
+  stop ("metric never moved …") after 2× window, not a fake plateau.
+
+## 0.35.30 — durable last-outcome retention: the final verdict stays visible (2026-08-22)
+
+### Gap
+  Field report with screenshots (email-api-compare, 2026-08-22): "goal gets
+  closed before final audit, so auditor never approves." Forensics showed the
+  lifecycle was CORRECT — every archived goal had an approving verdict — but
+  closeArchivedSlot nulled the widget slot the moment the goal archived, so
+  after the agent's turn ended the surface went completely blank and the only
+  trace of the approval was one transient toast. Returning later, "Auditor
+  verdict pending" was the last visible text: indistinguishable from closed-
+  without-audit.
+### Ship
+  - State.lastOutcome {at, ok, title, recap}: written by closeArchivedSlot on
+    every terminal slot close (approved AND aborted), overwritten per outcome.
+  - Widget: while no goal/list/loop occupies the slot, one dim retention line
+    renders for 24h — "✓ done · auditor … approved · <recap>" or "▪ ended ·
+    <reason>" — then goes silent. A live goal always outranks it.
+  - /glla wipe clears the record (clean slate means clean).
+  - Tests: tests/last-outcome-retention.test.ts (5) — render shapes, expiry +
+    garbage-timestamp safety, live-goal precedence, source pins for both
+    write and wipe-clear sites.
+
+## 0.35.29 — /glla agents: tracked-subagent panel, transcript tail, widget segment (2026-08-22, GitHub issue #15)
+
+### Gap
+  During long fan-outs the only child visibility was the widget's 3-slot
+  recent-action ring. A child that "almost completed its final report, went
+  back to check some more, then crashed" was invisible: no live status, no
+  counters, and no post-mortem trail anyone could find (issue #15).
+  Scope agreed with the user: panel + transcript tail + widget line; a live
+  activity stream was explicitly rejected as too noisy.
+### Ship
+  - getSubagentAgentsSnapshot() (goal-heartbeat.ts): read-only view of the
+    tracked-subagent probes with hung classification mirroring the watchdog
+    scan WITHOUT its counter mutation; record-frozen vs event-only evidence
+    named; degrades gracefully when the pi-subagents manager registry is
+    absent (as on currently installed versions).
+  - /glla agents: ranked table (hung > running > ended), per-child
+    tools/output/silent clocks, liveness hint on hung rows, 20-row cap with
+    an explicit trim notice. Read-only, stale-safe.
+  - /glla agents --tail <id> [--lines N]: locates the child's session file
+    in the cwd-munged session store by needle + newest mtime and prints the
+    last N entries tolerantly ([role] text, raw fallback). LOUD when nothing
+    matches — searched dir, transcript count, needles. Never resumes or
+    attaches to a child session.
+  - Widget segment: "● N agents · <busiest> silent Xm ⚠" appended to every
+    card shape via buildWidgetLines; hidden at zero tracked children.
+  - New pure module extensions/goal-agents-panel.ts; snapshot reaches
+    goal-commands via CommandDeps injection (no heartbeat import cycle).
+
+## 0.35.28 — due-wait backstop: lapsed wait pauses actually resume; "you were recovered" notice (2026-08-22, GitHub issue #16)
+
+### Root cause (field: goal paused 30min past its scheduled auto-resume while the agent narrated "the system should have auto-resumed by now")
+  Auto-resume for pauseKind "wait" relied SOLELY on in-memory timers. An
+  exhaustive map of every wait-pause site found: agent-authored waits
+  (pause_goal kind="wait") armed NO timer at all while their own copy
+  promised automatic continuation; error-brake cooldown waits were not
+  re-armed on session_start; single-slot provider-retry timers could be
+  silently clobbered by a later schedule; and no code path anywhere compared
+  wall time against pauseResumeAt outside display rendering.
+### Fix
+  The heartbeat owns the durable invariant now: every tick, a wait whose
+  pauseResumeAt lapsed >90s is re-fired — main-model recovery waits route to
+  a provider probe, everything else clears the park and dispatches one fresh
+  continuation. supervisorPaused() still freezes it under /glla pause and
+  the load hold, one attempt per (goalId:resumeAt) key prevents storms (the
+  route re-parks with a fresh resumeAt on failure), and every fire is
+  ledgered wait_pause_overdue_resume. A stale hold persisted by a previous
+  process is released when a consenting reload arrives. Issue part 2:
+  resumed goals carry an autoResumed stamp rendered as a RECOVERY NOTICE in
+  the continuation prompt — "welcome back, YOU were recovered" — so agents
+  stop waiting for an external recovery signal that already happened.
+
+## 0.35.27 — Windows auditor launch: quote only when needed, gate always first (2026-08-22, PR #17)
+
+### Field report (PR #17, reproduced on Windows 11 + pnpm global shim)
+  The detached auditor died ~0.5s after launch and retried forever: quoting
+  EVERY argument wraps a bare executable name in quotes, which changes how
+  cmd.exe resolves it and how npm/pnpm .CMD shims compute their own
+  directory -> MODULE_NOT_FOUND -> "pi exited without an agent_settled RPC
+  event" in a 60s retry loop of flashing terminal windows.
+### Fix
+  buildAuditorPiSpawnSpec now runs the WINDOWS_UNSAFE_ARG rejection on EVERY
+  argument BEFORE the quoting decision, then quotes only when tokenization
+  requires it (whitespace / cmd metacharacters / empty). Clean bare tokens
+  reach cmd.exe untouched (shims resolve; full RPC sessions work); the
+  upstream PR's variant was not mergeable as-is because its needs-quoting
+  regex also gated the unsafe-arg check, letting %/CR/LF through bare.
+  Regression tests pin all three classes through the spec builder.
+
+## 0.35.26 — zombie watchdog recognizes pi-subagents tool names (2026-08-22, GitHub issue #13)
+
+### Gap
+  The v0.35.4 subagent-wait carve-out matched only the legacy built-in names
+  (Agent / get_subagent_result / steer_subagent). The pi-subagents extension
+  registers its foreground dispatch tool as "subagent" and a blocking wait as
+  "subagent_wait", so a parent legitimately BUSY on a healthy foreground child
+  tripped the bounded abort: field report shows a child writing Postgres
+  records productively for 30 minutes while the parent was stream-silent on
+  `subagent` — zombie_run_suspected at 20m, loop_stopped + zombie_run_aborted
+  at 30m, productive work killed mid-write.
+### Fix
+  One shared SUBAGENT_WAIT_TOOL_NAMES set + isSubagentWaitCall predicate in
+  goal-heartbeat.ts, consumed by BOTH sites (zombie stand-down and wedge-alert
+  hint) so the lists cannot drift apart again. New names: "subagent",
+  "subagent_wait". Behavioral tests drive the real heartbeat tick with a real
+  tool_call event: stand-down while in flight, clean abort once it settles,
+  no blanket amnesty.
+
+## 0.35.25 — /loop resume honors the zero-stream abort park (2026-08-22, GitHub issue #14)
+
+### Gap
+  abortZombieRun parks a loop with stopReason "stopped: automatic zero-stream
+  abort — ... (iteration N preserved; /loop resume to retry)" and its message
+  promises /loop resume — but the RESUMABLE_STOP predicate in the resume
+  handler never matched that prefix. The explicit resume answered "No held
+  loop to resume"; iteration count, best value, and preserved history were
+  unreachable without re-drafting from scratch (field report: a metricless
+  24h loop parked at iteration 210 with 200 history entries).
+### Fix
+  RESUMABLE_STOP gains the "stopped: automatic zero-stream abort" prefix.
+  The explicit resume now re-arms the loop exactly as promised: fresh stall
+  window, re-armed counters, load hold released, one new dispatch — with
+  iteration/best/history intact. Control test pins that non-resumable stops
+  (e.g. bounds) stay stopped.
+
+## 0.35.24 — auditor model picker at full selector parity: forbidden-models filtering (2026-08-22, note.md Next #1)
+
+### Gap
+  The /glla -> Auditor model row already hosted the /model-style fuzzy
+  picker and persisted to the exact key resolveAuditorModel reads — but
+  unlike every main-agent flow it did NOT apply forbidden-models policy:
+  blocked models appeared in the list and the typed escape hatch accepted
+  them, yielding pins the resolver silently skips at audit time.
+### Fix
+  promptModelRef gains an excludeRefs opt threading into buildModelPickItems
+  (list-level filter) AND validating typed entries against isForbiddenModel
+  (a policy match is refused with a warning naming the ref — never saved).
+  Both auditor slots use it: Auditor model and Auditor fallback agent.
+  A pin saved by the picker is one the resolver honors; runtime skips
+  (auditor_model_fallback reason:"forbidden") remain as belt-and-suspenders.
+
+## 0.35.23 — load without autostart: cold sessions hold automation for an explicit decision (2026-08-22, note.md Next #2)
+
+### Root cause
+  shouldAutoResumeOnSessionStart already demanded explicit `autoResume ===
+  true` (v0.28.21 tri-state, undefined default = HOLD) — but its only
+  consumer fed it the AGGRESSIVE-MODE COERCED value (unset -> true because
+  aggressiveMode defaults on), so stock installs auto-resumed everything on
+  every session load despite the documented default. Three further paths
+  bypassed the consent entirely.
+### Fixes
+  - Load consent now reads the RAW global autoResume setting; aggressive
+    mode keeps owning its caps only. Default (unset/false) = restore and
+    DISPLAY state, hold automation.
+  - New durable loadHoldAt state engages through the SAME freeze gates as
+    /glla pause (continuation dispatch, loop ticks, heartbeat refires,
+    recovery timers); released by any explicit work command (/goal resume,
+    /list resume, /list next, /loop resume|start, new goal creation),
+    each release ledgered load_hold_released. Heartbeat host-loss
+    supervision stays armed under the hold — a held plane is never an
+    unprobed idle plane.
+  - Closed consent bypasses: different-pid crash successors no longer
+    auto-resume held loops or replay journals as automation (same-process
+    /reload successors keep continuity); parked completion-audit claims no
+    longer auto-retry on a bare cold start (the main-model-recovery one-
+    shot retry keeps its pinned consent).
+
+## 0.35.22 — a queued item blocked by a live loop is loud and self-heals at loop end (2026-08-22)
+
+### suspicious-unstartable-repair-card fix (note.md Next #3)
+  Field (screenshots 20260821_114109/114210/134442/134645): /goal start of a
+  lowercase-fragment objective paused the goal and queued a repair task; the
+  card said "/list next starts the preserved repair/replan task" — but with
+  the Chrome-Bridge loop owning the surface, activateNextListItem's
+  one-active-thing guard refused activation LEDGER-ONLY: unstartable AND
+  invisibly blocked. Two fixes:
+  - the refusal now notifies with the queued objective and the way out
+    ("/loop stop … then /list next"), and the ledger names what stayed queued;
+  - when a loop ends by ANY route (/loop stop, /loop finish, plateau/bounds
+    stop), resumeQueuedListAfterLoopEnd retries list activation when no goal
+    owns the surface — the blocked entry starts instead of staying dead.
+  Also: tests/list-invisible-restart.test.ts no longer depends on co-resident
+  module state (unique owner session + explicit reset), fixing the cross-file
+  ordering failure surfaced by audit round eight.
+
+## 0.35.21 — list queue stays visible across lifecycle boundaries (2026-08-22)
+
+### list-invisible-until-restart fix (note.md Next #4)
+  Field: a stopped/interrupted /list exec left the queue surface blank —
+  active item only, no "N waiting · up next" line — until a session
+  restart. Root cause: the sidebar renders state.list from MEMORY while the
+  durable queue is the UNION of the state ledger and the per-item
+  .queue.json sidecars (v0.34.60 disk-first writes); a plugin re-init /
+  stale-handle window reset RAM to defaults and only some later path
+  re-ran the disk merge. session_start's restore now converges memory to
+  that union immediately (hydrateListQueueFromDisk after readState), so
+  the next lifecycle boundary heals the surface without a restart; the
+  hydration notifies with a truthful count ("restored N queued list
+  item(s)"). Regression tests: sidecar-only item is hydrated AND rendered;
+  convergence is idempotent (no duplicate for items in both stores).
+
+## 0.35.20 — one bounded automatic retry for transient mechanical-check deaths (2026-08-21)
+
+### Gate resilience
+  Field (sixth audit round): the pre-audit gate died MID-RUN under machine
+  load ~30 — output ends inside a passing file, no runner summary, exit 1 —
+  while the identical tree passed green twice in isolation. Resource
+  contention, not a red suite. Mechanical check commands now get exactly ONE
+  bounded automatic retry on failure: a deterministic red command stays red
+  on both attempts (final output names the retry and preserves the second
+  attempt's diagnostics); a first-attempt transient death followed by a
+  passing retry passes with an honest `recoveredRetryNote` in the result.
+  Mirrors the v0.35.17 zero-stream auto-retry philosophy at the gate level.
+
+## 0.35.19 — load-resilient budgets for the aggressive-recovery test (2026-08-21)
+
+### Flake hardening
+  At machine load ~50 (16 cores), the aggressive no-verdict recovery test's
+  wall-clock wait budgets (2x 25s inside a 60s per-test ceiling) expired
+  before two real subprocess-based auditor retry cycles completed — while
+  the canonical full-suite run stayed green in the same conditions. Raised:
+  per-test 60s→120s, retry waits 25s→45s, state-transition waits 8s→20s.
+  Budgets only; semantics untouched (same precedent as v0.35.15's 30s→60s).
+
+## 0.35.18 — mechanical checks resolve raw runners to their canonical scripts (2026-08-21)
+
+### Spurious fast-fail fix (fourth audit round)
+  A verification contract that names a RAW RUNNER in prose ("passes under
+  `bun test`") made the deterministic pre-audit execute `bun test` bare,
+  ignoring the project's own required configuration encoded in package.json
+  scripts (--parallel=1 --max-concurrency=1 --timeout; this suite shares
+  module state process-wide by design and serializes deliberately). The bare
+  invocation failed 6 tests + 5 nested-test errors while the canonical gate
+  was green twice — a spurious fast-fail of finished work. Mechanical check
+  commands that are exactly a raw runner invocation (bun test / vitest /
+  jest, no extra args) now resolve to the package script that wraps them;
+  narrower runs and non-runner programs pass through untouched. Pure resolver
+  (`resolveCanonicalRunnerCommand`) lives in goal-loop-backoff.ts with unit
+  tests; bunfig cannot express the required flags (verified empirically:
+  `[test] timeout` is not honored on bun 1.3.14).
+
+## 0.35.17 — zero-stream abort gains ONE bounded automatic retry; tag backfill (2026-08-21)
+
+### Post-accept hang self-heal (note.md Next §1)
+  Turns dispatched by accepting a Confirm dialog hung with zero provider
+  stream activity often enough that users repeatedly returned to parked
+  "action needed" sessions (field screenshot 20260821_152311). The watchdog's
+  bounded abort was correct; what was missing is self-heal. The FIRST silence
+  of a zero-stream streak now arms exactly ONE automatic retry ~90s after the
+  park — the parked goal/list item/loop auto-resumes through the durable
+  continuation machinery and one fresh dispatch goes out. A SECOND consecutive
+  silence refuses further retries (`zombie_auto_retry_refused_streak`) and
+  parks permanently for manual resume; real stream activity between aborts
+  resets the streak so an independent later hang earns its own single retry.
+  `/glla pause` freezes the retry like every other automatic side-effect;
+  the timer only clears a pause carrying exactly the watchdog's own reason
+  (a newer manual/recovery pause supersedes it); the heartbeat's one-shot
+  abort latch is released on retry dispatch so a fully-silent retry can still
+  be re-aborted. Pure streak decision lives in goal-loop-backoff.ts
+  (`zombieRetryDecision`) with unit tests; behavioral coverage drives the
+  full hang→abort/park→auto-resume→re-dispatch arc plus the double-hang and
+  pause-during-waystation paths (tests/post-accept-hang-retry.test.ts).
+
+### Version tags backfilled
+  All 41 released versions missing their `v<version>` git tag (v0.34.20 …
+  v0.35.16) were tagged at the historical commit whose package.json carried
+  that exact version and pushed to all remotes. Additive-only — no history
+  rewrite.
+
+### README currency pass
+  Documents the v0.35.15 per-phase glyphs/activity meter/silent-stretch
+  footer, `/glla pause`, and the v0.35.17 zero-stream auto-retry.
+
+## 0.35.16 — mechanical pre-audit gate no longer kills legitimate long checks (2026-08-21)
+
+### Deterministic pre-audit timeout fix
+  `runMechanicalPreAuditChecks` executed every contract command under a
+  hard 60-second `execFileSync` ceiling — but this repo's own contract
+  command (`npm run release:check`) legitimately needs ~3 minutes. Every
+  deterministic pre-audit therefore fast-failed with a truncated
+  head-of-output report showing only startup logs (two field rounds:
+  2026-08-21 14:17 and 16:01), burning two auditor cycles on a gate that
+  could never pass inside its own bound. The default bound is now 10 minutes
+  — still a hang guard, no longer an honest-slow-work guard. Failed output
+  keeps the TAIL (where failures live) instead of the head, truncation is
+  labeled, and a timeout kill is bannered as such instead of masquerading as
+  an exit-code-1 test failure.
+
+## 0.35.15 — glla status-surface UX: visual footer, /glla pause, proactive quiet notify (2026-08-21)
+
+### Visual status footer
+  The auditing footer now leads each auditor phase with a distinct glyph
+  (queued ⋯ · running ▶ · quiet ◌ · blocked ⛔ · awaiting-verdict ✓) and a
+  compact draining activity meter (▰▱) that empties as worker silence grows
+  toward the quiet threshold. A glance answers "is the audit alive?" without
+  reading the sentence.
+
+### /glla pause | resume — broad supervisor freeze
+  `/glla pause` freezes ALL automatic machinery — heartbeat re-arms, stale
+  probes, zombie cleanup, main-model recovery probes, automatic completion-
+  audit recovery, continuation dispatch, loop ticks, and the proactive quiet
+  notification — while leaving the active goal/list item/loop and any
+  detached worker untouched. The flag persists via `supervisorPausedAt`, so a
+  session restart cannot silently re-arm machinery the user explicitly
+  stopped. `/glla resume` clears it first, then resumes whatever else is
+  resumable, and never follows with a misleading "Nothing to resume". Manual
+  user commands always still work.
+
+### Proactive auditor quiet reporting
+  Entering the quiet phase (~3 min of zero worker activity) now fires exactly
+  ONE warning notify instead of only recoloring the status chip — the field
+  complaint was an 8-minute silent stretch the user only discovered after the
+  fact. Once activity resumes, the footer shows "silent Xm then resumed" for
+  10 minutes so a missed silence stays visible.
+
+### Persistence fix (latent bug)
+  `persistStateLine` never serialized `lastCompactionAt` despite v0.34.97's
+  comment claiming it did — the ⏳ compacting… chip silently lost its reload
+  survival. Both epoch fields now ride the state line with explicit nulls so
+  ledger merges clear them correctly.
+
+## 0.35.14 — full extension audit hardening (2026-08-21)
+
+### Verification and lifecycle integrity
+  Mechanical contract checks now run through a shell-free literal-argument
+  boundary, auditor verdicts require one final terminal marker, and regression
+  shield references must appear inside `<evidence>`. Invalid persisted IDs are
+  rejected at state hydration and filesystem boundaries. Child extension
+  factories no longer claim the host API or start timers before an admitted
+  `session_start`; completion approval cannot report success when terminal
+  archiving fails, and branch-mode loop resumes refuse the wrong branch.
+
+### Release contract
+  Published documentation includes the linked planning files, the workflow
+  runs the release contract on pushes and pull requests, and release tooling
+  uses pinned Node/npm versions.
+
 ## 0.35.13 — stale-API recovery loop fix (2026-08-20)
 
 ### Stale-handle recovery correctness