pi-goal-list-loop-audit 0.35.13 → 0.35.64

package/extensions/goal-agents-panel.ts

@@ -0,0 +1,211 @@
+// pi-goal-list-loop-audit — v0.35.29
+// goal-agents-panel.ts — issue #15 subagent visibility (design:
+// docs/DESIGN-subagent-visibility.md, scope agreed 2026-08-22).
+//
+// Pure rendering + data assembly for:
+//   1. /glla agents            — tracked-subagent snapshot table
+//   2. /glla agents --tail <id> — read-only child transcript tail
+//   3. the widget agents segment (line built here, appended by the widget)
+//
+// Everything here is deterministic given its inputs; fs access happens only
+// in tailChildTranscript through an injected reader so tests stay hermetic.
+
+import * as path from "node:path";
+import { sanitizeDisplayText } from "./goal-loop-core.js";
+
+/** v0.35.45 (audit finding): the candidate scan reads a bounded TAIL of each
+ * transcript, not the whole file — up to 25 files were previously read in
+ * full, synchronously, on the main thread. 256 KiB is far more than any
+ * needle window needs (summary prefix / agentType / recordId recur
+ * throughout recent entries). */
+export const TRANSCRIPT_SCAN_MAX_BYTES = 256 * 1024;
+
+export interface AgentsPanelRow {
+  recordId: string;
+  agentType?: string;
+  summary?: string;
+  status: "running" | "hung" | "ended";
+  spawnedAt: number;
+  lastProgressAt: number;
+  toolUses: number;
+  outputTokens: number;
+  silentMs: number;
+  evidence: "record-frozen" | "event-only" | "live";
+  action?: "abort-requested" | "unavailable" | "failed";
+  endedOk?: boolean;
+  endedAt?: number;
+}
+
+/** Human label: agentType + short summary. */
+function rowLabel(row: AgentsPanelRow): string {
+  const summary = (row.summary ?? "").replace(/\s+/g, " ").trim();
+  return [row.agentType ?? "subagent", summary ? truncate(summary, 28) : ""].filter(Boolean).join(" · ");
+}
+
+export function truncate(text: string, max: number): string {
+  return text.length <= max ? text : text.slice(0, Math.max(1, max - 1)) + "…";
+}
+
+function fmtDuration(ms: number): string {
+  const totalSec = Math.max(0, Math.round(ms / 1000));
+  const min = Math.floor(totalSec / 60);
+  const sec = totalSec % 60;
+  if (min >= 60) return `${Math.floor(min / 60)}h${String(min % 60).padStart(2, "0")}m`;
+  if (min > 0) return `${min}m${String(sec).padStart(2, "0")}s`;
+  return `${sec}s`;
+}
+
+const PANEL_ROW_CAP = 20;
+
+/** Render the /glla agents table. Running/hung first (hung topmost), then
+ * ended; capped at PANEL_ROW_CAP rows with an explicit truncation notice. */
+export function renderAgentsPanel(rows: AgentsPanelRow[], now: number, managerAvailable: boolean): string[] {
+  if (rows.length === 0) {
+    return ["No subagents tracked yet — spawn one via the Agent tool and it appears here.", "(evidence: glla's event probes" + (managerAvailable ? " + pi-subagents manager records" : "") + ")"];
+  }
+  const rank = (r: AgentsPanelRow): number => (r.status === "hung" ? 0 : r.status === "running" ? 1 : 2);
+  const ordered = [...rows].sort((a, b) => rank(a) - rank(b) || a.silentMs - b.silentMs);
+  const shown = ordered.slice(0, PANEL_ROW_CAP);
+  const lines: string[] = [];
+  for (const row of shown) {
+    const glyph = row.status === "ended" ? "✓" : row.status === "hung" ? "⚠" : "●";
+    const stateWord = row.status === "ended"
+      ? `ENDED ${row.endedOk === false ? "✗" : "ok"} ${fmtDuration((row.endedAt ?? now) - row.spawnedAt)}`
+      : row.action === "abort-requested"
+        ? `ABORTING ${fmtDuration(now - row.spawnedAt)}`
+        : `${row.status === "hung" ? "HUNG?" : "RUNNING"} ${fmtDuration(now - row.spawnedAt)}`;
+    lines.push(`${glyph} ${rowLabel(row)}  ${stateWord}`);
+    lines.push(`  tools ${row.toolUses} · out ${row.outputTokens >= 1000 ? `${(row.outputTokens / 1000).toFixed(1)}k` : row.outputTokens} · silent ${fmtDuration(row.silentMs)}${row.evidence !== "live" ? ` (${row.evidence})` : ""}`);
+    if (row.action === "abort-requested") {
+      lines.push("  └ child-specific abort requested; partial output remains available while it settles");
+    } else if (row.action === "unavailable") {
+      lines.push("  └ no safe child-abort capability; inspect the child and interrupt explicitly if needed");
+    } else if (row.action === "failed") {
+      lines.push("  └ child-abort request failed; inspect the child and interrupt explicitly if needed");
+    } else if (row.status === "hung") {
+      lines.push("  └ check the Agents panel: a child whose counters stopped moving is hung, not thinking");
+    }
+  }
+  if (ordered.length > shown.length) {
+    lines.push(`… ${ordered.length - shown.length} more (oldest ended trimmed — cap ${PANEL_ROW_CAP})`);
+  }
+  return lines;
+}
+
+/** The ambient widget segment: hidden at zero tracked children by the caller. */
+export function renderAgentsWidgetLine(rows: AgentsPanelRow[]): string | undefined {
+  const active = rows.filter((r) => r.status !== "ended");
+  if (active.length === 0) return undefined;
+  const busiest = [...active].sort((a, b) => b.silentMs - a.silentMs)[0]!;
+  const hung = busiest.action === "abort-requested"
+    ? " ⚠ aborting"
+    : busiest.status === "hung"
+      ? " ⚠"
+      : "";
+  return `● ${active.length} agent${active.length === 1 ? "" : "s"} · ${(busiest.agentType ?? "subagent")} silent ${fmtDuration(busiest.silentMs)}${hung}`;
+}
+
+export interface TranscriptTailResult {
+  ok: boolean;
+  lines: string[];
+  /** What was searched / read — surfaced to the user on failure. */
+  detail: string;
+}
+
+/** Read-only tail of a child's session transcript. Candidate selection: all
+ * .jsonl files in sessionsDir whose content mentions the child's summary or
+ * agent type; most recently modified wins. NEVER resumes or attaches.
+ * readFile is injected for tests; production passes fs.readFileSync-wrapped. */
+export function tailChildTranscript(
+  sessionsDir: string,
+  row: { recordId: string; agentType?: string; summary?: string },
+  opts: {
+    lines?: number;
+    readFile?: (file: string, maxBytes?: number) => Buffer;
+    listDir?: (dir: string) => string[];
+    statMtime?: (file: string) => number;
+    now?: number;
+  } = {},
+): TranscriptTailResult {
+  const wantLines = Math.max(1, Math.min(200, opts.lines ?? 20));
+  const readFile = opts.readFile ?? (() => { throw new Error("no reader"); });
+  // v0.35.45: readers may honor maxBytes (production does — partial tail
+  // read); injected test readers ignore it and return the whole buffer.
+  const scanRead = (file: string): Buffer => readFile(file, TRANSCRIPT_SCAN_MAX_BYTES);
+  const listDir = opts.listDir ?? (() => []);
+  const statMtime = opts.statMtime ?? (() => 0);
+  let entries: string[];
+  try {
+    entries = listDir(sessionsDir);
+  } catch (error) {
+    return { ok: false, lines: [], detail: `cannot list ${sessionsDir}: ${error instanceof Error ? error.message.slice(0, 120) : String(error)}` };
+  }
+  const needles = [row.summary?.slice(0, 48), row.agentType, row.recordId]
+    .filter((n): n is string => typeof n === "string" && n.trim().length >= 6)
+    .map((n) => n.toLowerCase());
+  const candidates = entries
+    .filter((f) => f.endsWith(".jsonl"))
+    .map((f) => path.join(sessionsDir, f))
+    .map((f) => ({ f, mtime: statMtime(f) }))
+    .sort((a, b) => b.mtime - a.mtime);
+  let matched: string | undefined;
+  for (const candidate of candidates.slice(0, 25)) {
+    try {
+      const content = scanRead(candidate.f).toString("utf8").toLowerCase();
+      if (needles.some((needle) => content.includes(needle))) { matched = candidate.f; break; }
+    } catch { /* unreadable file — skip */ }
+  }
+  if (!matched) {
+    return {
+      ok: false,
+      lines: [],
+      detail: `no session file in ${sessionsDir} matches this child (searched ${candidates.length} transcripts for: ${needles.map((n) => `"${truncate(n, 24)}"`).join(", ") || "any needle"}) — the child may not persist a session, or it lives under another working directory`,
+    };
+  }
+  try {
+    const raw = readFile(matched).toString("utf8").split("\n").filter(Boolean);
+    const formatted = raw.map(formatTranscriptEntry).filter(Boolean) as string[];
+    return { ok: true, lines: formatted.slice(-wantLines), detail: `${matched} (last ${Math.min(wantLines, formatted.length)} of ${formatted.length})` };
+  } catch (error) {
+    return { ok: false, lines: [], detail: `cannot read ${matched}: ${error instanceof Error ? error.message.slice(0, 120) : String(error)}` };
+  }
+}
+
+/** Tolerant pi-session JSONL → `[role] text` line. Unparseable lines are
+ * truncated raw so forensic value survives shape drift. v0.35.45: output is
+ * ANSI/control-char sanitized — a hostile child transcript must not be able
+ * to emit terminal escape sequences through ctx.ui.notify. */
+export function formatTranscriptEntry(line: string): string | undefined {
+  const trimmed = line.trim();
+  if (!trimmed) return undefined;
+  try {
+    const entry = JSON.parse(trimmed) as {
+      type?: string;
+      role?: string;
+      message?: { role?: string; content?: unknown };
+      content?: unknown;
+    };
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return `[raw] ${truncate(sanitizeDisplayText(trimmed), 120)}`;
+    const role = entry.message?.role ?? entry.role ?? entry.type ?? "?";
+    const content = entry.message?.content ?? entry.content;
+    const text = extractText(content);
+    if (!text) return undefined;
+    return `[${role}] ${truncate(sanitizeDisplayText(text).replace(/\s+/g, " ").trim(), 160)}`;
+  } catch {
+    return `[raw] ${truncate(sanitizeDisplayText(trimmed), 120)}`;
+  }
+}
+
+function extractText(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content
+      .map((block) => typeof block === "string"
+        ? block
+        : typeof block === "object" && block !== null && typeof (block as { text?: unknown }).text === "string"
+          ? (block as { text: string }).text
+          : "")
+      .join(" ");
+  }
+  return "";
+}

package/extensions/goal-commands.ts

@@ -8,6 +8,14 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { renderAgentsPanel, tailChildTranscript } from "./goal-agents-panel.js";
+
+/** Child pi sessions live under the shared session store, munged by cwd
+ * (verified layout: ~/.pi/agent/sessions/--home-user-proj--/*.jsonl). */
+function childSessionsDir(cwd: string): string {
+  const munged = "--" + cwd.replaceAll("/", "-") + "--";
+  return path.join(os.homedir(), ".pi", "agent", "sessions", munged);
+}
 import type { ExtensionContext, ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { state, replaceState } from "./goal-state.js";
 import {
@@ -16,9 +24,11 @@ import {
   formatListDepth, goalArgsNeedDrafting, ledgerPath, newGoalId, nowIso, parseListImport, parseListItemDeclaration,
   assignQueueOrder, compareQueueItems, readAuditLog, readQueueFromDisk, routeGoalArgs, routeListText, sanitizeDisplayText, sanitizeProviderAuditReport, statusLabel,
   writeQueueItemFile, type ModeCommand, type State, LIST_MUTATING_SUBCOMMANDS, SETTINGS_MUTATING_ACTIONS,
+  clearLoadHold, stateRootPending,
 } from "./goal-loop-core.js";
 import { clearDispatchRecord, dispatchRecordExists } from "./goal-loop-dispatch.js";
 import type { AuditDisplayProgress } from "./goal-loop-display.js";
+import { fmtElapsed } from "./goal-loop-display.js";
 import { AUDIT_FINDINGS_REL, HELD_ON_RESTORE, LOOP_AUDIT_MARKER, listAuditCollectTarget, projectAuditTarget } from "./goal-loop-forever.js";
 import { ProjectRollup, discoverGllaProjects, filterPremature, formatRollupJson, formatRollupTable, parseLedgerEntries, rollupProject } from "./goal-loop-stats.js";
 import { OVERRIDABLE_AGENT_TYPES, resolveEffectiveSubagentModel } from "./goal-loop-subagents.js";
@@ -30,6 +40,7 @@ import { cmdLoop, clearLoopTimer, finishLoopGit, isLoopActive, scheduleLoopTick
 import { chooseObjectiveConflict, liveObjectives } from "./goal-objective-conflict.js";
 import { formatGllaVersion } from "./glla-version.js";
 import { cancelDetachedGoalCompletionAuditor } from "./goal-loop-auditor-process.js";
+import { releaseAuditorSurface } from "./loops/goal-auditor-surface.js";
 
 export interface CommandFlags {
   get draftingTarget(): "goal" | "list" | "loop" | null; set draftingTarget(v: "goal" | "list" | "loop" | null);
@@ -55,7 +66,7 @@ export interface CommandDeps {
   setGoal: (goal: Goal, ctx: ExtensionContext, via?: string) => boolean;
   archiveCurrentGoal: (ctx: ExtensionContext, status: Status, stopReason?: string) => boolean;
   healGoalPolicy: (ctx: ExtensionContext) => boolean;
-  startDrafting: (ctx: ExtensionContext, target: "goal" | "list" | "loop", seed?: string) => Promise<boolean>;
+  startDrafting: (ctx: ExtensionContext, target: "goal" | "list" | "loop", seed?: string, depth?: "normal" | "plan") => Promise<boolean>;
   warnIfStaleAtEntry: (ctx: ExtensionContext, what: string) => boolean;
   queuePendingListOperation: (ctx: ExtensionContext, args: string) => boolean;
   freshCtx: () => ExtensionContext | null;
@@ -87,9 +98,13 @@ export interface CommandDeps {
   goalNoun: () => string;
   displaySlice: (s: string, max: number) => string;
   shortObj: (s: string) => string;
+  /** v0.35.29 (issue #15): read-only tracked-subagent snapshot for /glla agents.
+   * Injected because goal-heartbeat must not be imported from here (cycle). */
+  agentsSnapshot: () => { agents: import("./goal-agents-panel.js").AgentsPanelRow[]; managerAvailable: boolean };
 }
 
 let deps: CommandDeps;
+let agentsSnapshot: CommandDeps["agentsSnapshot"];
 let flags: CommandFlags;
 let listQueue: CommandDeps["listQueue"], notifyExternal: CommandDeps["notifyExternal"], persistState: CommandDeps["persistState"], updateGoal: CommandDeps["updateGoal"], setGoal: CommandDeps["setGoal"],
     archiveCurrentGoal: CommandDeps["archiveCurrentGoal"], healGoalPolicy: CommandDeps["healGoalPolicy"], startDrafting: CommandDeps["startDrafting"], warnIfStaleAtEntry: CommandDeps["warnIfStaleAtEntry"], queuePendingListOperation: CommandDeps["queuePendingListOperation"], freshCtx: CommandDeps["freshCtx"],
@@ -108,6 +123,7 @@ export function createGoalCommands(d: CommandDeps): void {
   releaseInitialSessionLoadBarrier = d.releaseInitialSessionLoadBarrier; resolveCarryover = d.resolveCarryover; safeSteerUser = d.safeSteerUser; scheduleContinuation = d.scheduleContinuation; scheduleSessionTimeout = d.scheduleSessionTimeout;
   createGoal = d.createGoal; fireReviewer = d.fireReviewer; openSettingsUI = d.openSettingsUI; manuallyResumeMainModelRecovery = d.manuallyResumeMainModelRecovery; activeGoalCommand = d.activeGoalCommand;
   activeGoalStatusCommand = d.activeGoalStatusCommand; activeGoalSurfaceCommand = d.activeGoalSurfaceCommand; goalNoun = d.goalNoun; displaySlice = d.displaySlice; shortObj = d.shortObj;
+  agentsSnapshot = d.agentsSnapshot;
 }
 
 /* Moved bodies (bands b1 + b3 from goal.ts).                          */
@@ -188,6 +204,18 @@ async function cmdGoal(args: string, ctx: ExtensionContext): Promise<void> {
       }
       return cmdSet(route.rest, ctx, true);
     }
+    // v0.35.33: /goal plan [seed] — the EXTENDED DRAFT. Same trust machinery
+    // as a regular draft (Confirm card gates activation), deeper process:
+    // research-first, multi-round interview, structured expanded objective.
+    // For greenfield/megaplan work where the standard 5–7-question interview
+    // is too shallow. Regular /goal stays the fast path.
+    if (route.name === "plan") {
+      // Same entry gate as cmdSet: a stale MAIN cannot deliver the seed; do
+      // not leave an orphaned drafting gate behind a doomed process.
+      if (warnIfStaleAtEntry(ctx, "/goal")) return;
+      await startDrafting(ctx, "goal", route.rest || undefined, "plan");
+      return;
+    }
   }
   return cmdSet(route.kind === "set" ? route.text : "", ctx);
 }
@@ -331,9 +359,28 @@ async function cmdPause(ctx: ExtensionContext): Promise<void> {
 
 async function cmdResume(ctx: ExtensionContext): Promise<void> {
   releaseInitialSessionLoadBarrier();
+  // v0.35.23 (note.md Next #2): an explicit resume is exactly the decision
+  // the load hold waits for — release it before re-arming automation, or
+  // the scheduleContinuation below would be a frozen no-op.
+  if (clearLoadHold(state)) {
+    persistState(ctx);
+    appendLedger(ctx.cwd, "load_hold_released", { via: "goal-resume" });
+    ctx.ui.notify("Load hold released — automation is live again.", "info");
+  }
   const resumeCommand = activeGoalCommand("resume");
-  if (manuallyResumeMainModelRecovery(ctx)) return;
-  if (state.mainModelRecovery?.retryAt || state.mainModelRecovery?.pendingModelSwitch) {
+  // Main-model recovery returns before the normal paused-goal admission path.
+  // Probe the same stale/foreign boundary first so an admitted recovery resume
+  // can release the auditor surface, while a rejected one falls through to the
+  // existing stale-resume recovery marker without exposing old context.
+  const recoveryStaleEntry = state.mainModelRecovery
+    ? warnIfStaleAtEntry(ctx, resumeCommand)
+    : false;
+  if (!recoveryStaleEntry && manuallyResumeMainModelRecovery(ctx)) {
+    releaseAuditorSurface();
+    return;
+  }
+  if (!recoveryStaleEntry && (state.mainModelRecovery?.retryAt || state.mainModelRecovery?.pendingModelSwitch)) {
+    releaseAuditorSurface();
     clearMainModelRecoveryTimer();
     flags.continuationDispatchStoodDown = false;
     // v0.34.92: the chat-prompt re-arm was removed; recovery is timer-driven.
@@ -341,7 +388,8 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
     void probeMainModelRecovery(ctx);
     return;
   }
-  if (state.mainModelRecovery?.primaryProbeAt || state.mainModelRecovery?.primaryProbeInFlight) {
+  if (!recoveryStaleEntry && (state.mainModelRecovery?.primaryProbeAt || state.mainModelRecovery?.primaryProbeInFlight)) {
+    releaseAuditorSurface();
     clearMainModelRecoveryTimer();
     flags.continuationDispatchStoodDown = false;
     ctx.ui.notify("Probing the preferred primary now — the current fallback remains available if the primary is still unhealthy.", "info");
@@ -357,6 +405,21 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
       ctx.ui.notify("A loop is active — one active thing at a time. /loop stop it first, then resume the goal.", "warning");
       return;
     }
+    // An ACTIVE-but-idle goal still needs the entry admission probe: a stale
+    // command must not release the auditor surface before its schedule is
+    // rejected by the stale/foreign session boundary.
+    const staleEntry = warnIfStaleAtEntry(ctx, resumeCommand);
+    if (staleEntry) return;
+    releaseAuditorSurface();
+    if (state.goal.repairTarget?.replanPromptedAt) {
+      const target = state.goal.repairTarget;
+      updateGoal({ repairTarget: { ...target, replanPromptedAt: undefined } }, ctx);
+      appendLedger(ctx.cwd, "faulty_objective_replan_turn_reset", {
+        goalId: state.goal.id,
+        targetId: target.id,
+        via: "manual-resume",
+      });
+    }
     appendLedger(ctx.cwd, "resume_rekick", { goalId: state.goal.id, policy: state.goal.policy, via: resumeCommand });
     if (state.goal.interruptedAt) updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx); // v0.34.7: same marker law here
     ctx.ui.notify(
@@ -381,6 +444,7 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
     }
     const staleEntry = warnIfStaleAtEntry(ctx, resumeCommand);
     if (staleEntry) return;
+    releaseAuditorSurface();
     markCompletionAuditRecoveryPending(ctx, "manual-resume");
     flags.completionAuditRecoveryArmed = true;
     ctx.ui.notify("Resuming the stored completion claim — starting a detached auditor (no agent turn needed).", "info");
@@ -437,8 +501,9 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
   // manual resume exactly as by an automatic one. (staleEntry still re-marks
   // below — a resume inside a stale session is a NEW interrupt.)
   const storedCompletion = state.goal.pendingCompletion;
-  updateGoal({ status: "active", pauseReason: undefined, pauseSuggestedAction: undefined, pauseKind: undefined, pauseOptions: undefined, pauseRecommended: undefined, pauseResumeAt: undefined, interruptedAt: undefined, interruptedReason: undefined, ...(staleEntry ? { interruptedAt: nowIso(), interruptedReason: "resumed in a stale session" } : {}), ...(usage ? { usage } : {}) }, ctx);
+  updateGoal({ status: "active", pauseReason: undefined, pauseSuggestedAction: undefined, pauseKind: undefined, pauseOptions: undefined, pauseRecommended: undefined, pauseResumeAt: undefined, interruptedAt: undefined, interruptedReason: undefined, autoResumedAt: undefined, autoResumedEvent: undefined, ...(staleEntry ? { interruptedAt: nowIso(), interruptedReason: "resumed in a stale session" } : {}), ...(usage ? { usage } : {}) }, ctx);
   if (staleEntry) return;
+  releaseAuditorSurface();
   // A stored completion claim is a direct-audit resume, not an agent turn.
   // Keeping the claim while merely scheduling a continuation left manual
   // pause/resume with an ACTIVE goal that no timer would ever consume.
@@ -462,6 +527,10 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
 }
 
 async function cmdCancel(ctx: ExtensionContext): Promise<void> {
+  if (stateRootPending()) {
+    ctx.ui.notify("Cancel deferred — the selected sessionDir is not resolved yet, so no live state was changed. Reload the host session and retry.", "warning");
+    return;
+  }
   if (!state.goal) {
     // v0.28.14: users reach for /goal cancel to kill a LOOP (no goal
     // active) — point at the right verb instead of doing nothing silently.
@@ -1074,7 +1143,7 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
     return;
   }
 
-  if (sub === "pause") {
+  if (sub === "pause" && !rest) {
     if (!state.goal || state.goal.policy !== "list") {
       ctx.ui.notify(
         state.goal ? "The active work is a standalone goal — /goal pause to pause it." : "No active list item to pause. /list show to see the list.",
@@ -1086,7 +1155,7 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
     return;
   }
 
-  if (sub === "resume") {
+  if (sub === "resume" && !rest) {
     // Resume the list's head. The head activates AS the active goal, so this
     // is the same motion as /goal resume — named for the surface the user is
     // looking at (v0.22.7: "we would just unpause, and that is next").
@@ -1219,7 +1288,22 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
     return;
   }
 
-  if (sub === "clear") {
+  // v0.35.33: /list plan [seed] — the extended draft for LIST items: deep
+  // research + multi-round interview, then the agent proposes items[] through
+  // the SAME one-Confirm batch path (never per-item activation). Intended for
+  // greenfield/megaplan decomposition where the standard interview is too
+  // shallow. Plain /list add keeps its fast behavior unchanged.
+  if (sub === "plan") {
+    // staleEntry was already gated by LIST_MUTATING_SUBCOMMANDS above.
+    await startDrafting(ctx, "list", rest || undefined, "plan");
+    return;
+  }
+
+  if (sub === "clear" && !rest) {
+    if (stateRootPending()) {
+      ctx.ui.notify("List clear deferred — the selected sessionDir is not resolved yet, so no live state was changed. Reload the host session and retry.", "warning");
+      return;
+    }
     // v0.34.61: delete the sidecars of every removed item BEFORE clearing
     // state. The /list disk-recovery fallback scans .pi-glla/goals/*.queue.json
     // when memQueue is empty; without this, a /list clear followed by a
@@ -1237,7 +1321,11 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
   // v0.24.1: ONE verb for "stop this whole list" — aborts the active item
   // when it's list-sourced AND drops the waiting items. Before this the user
   // had to know to combine /goal cancel + /list clear.
-  if (sub === "cancel") {
+  if (sub === "cancel" && !rest) {
+    if (stateRootPending()) {
+      ctx.ui.notify("List cancel deferred — the selected sessionDir is not resolved yet, so no live state was changed. Reload the host session and retry.", "warning");
+      return;
+    }
     const waiting = listQueue().length;
     const activeIsListItem = state.goal?.policy === "list" && (state.goal.status === "active" || state.goal.status === "paused" || state.goal.status === "auditing");
     if (waiting === 0 && !activeIsListItem) {
@@ -1297,6 +1385,10 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
     }
     if (!activateNextListItem(ctx, n, { explicit: true })) {
       ctx.ui.notify(listQueue().length === 0 ? "List is empty — nothing to activate." : `No item #${n} (list has ${listQueue().length}).`, "info");
+    } else {
+      // Explicit list activation is also continuation consent, even when the
+      // activated item is a fresh queue head rather than the parked goal.
+      releaseAuditorSurface();
     }
     return;
   }
@@ -1737,6 +1829,10 @@ function cmdSwitchlog(args: string, ctx: ExtensionContext): void {
  */
 async function cmdGllaWipe(ctx: ExtensionContext, entryChecked = false): Promise<void> {
   if (!entryChecked && warnIfStaleAtEntry(ctx, "/glla wipe")) return;
+  if (stateRootPending()) {
+    ctx.ui.notify("Wipe deferred — the selected sessionDir is not resolved yet, so no live state was changed. Reload the host session and retry.", "warning");
+    return;
+  }
   const g = state.goal;
   const live = g && (g.status === "active" || g.status === "paused" || g.status === "auditing");
   const memoryQueue = listQueue();
@@ -1784,8 +1880,11 @@ async function cmdGllaWipe(ctx: ExtensionContext, entryChecked = false): Promise
     // Do not abort here: wipe still has to clear queue sidecars and loop
     // state. The old early abort made a second /glla wipe appear necessary.
     if (!archiveCurrentGoal(ctx, "aborted", "user wipe (/glla wipe)")) return;
+    // v0.35.30: the archive's closeArchivedSlot just recorded lastOutcome;
+    // a wipe means CLEAN SLATE — the ✓/▪ line must not survive it.
+    replaceState({ ...state, lastOutcome: undefined });
   } else if (g) {
-    replaceState({ ...state, goal: null });
+    replaceState({ ...state, goal: null, lastOutcome: undefined });
   }
   // Clear provider-recovery and continuation artifacts only after a live-goal
   // archive succeeds. An archive failure must leave all resumable work intact.
@@ -1837,12 +1936,56 @@ async function cmdGllaWipe(ctx: ExtensionContext, entryChecked = false): Promise
  * today) → the v0.28.23 decision-picker pattern. Verbs whose semantics
  * genuinely differ per type (tweak/finish/next/decide/refine) stay typed.
  */
+/**
+ * v0.35.15: `/glla pause` — freeze the SUPERVISOR, not the work.
+ *
+ * Broad by design (user-confirmed 2026-08-21): every automatic side-effect
+ * stops — heartbeat re-arms/stale probes/zombie cleanup, recovery probes,
+ * auto-resume, auto-continuation dispatch, loop ticks, and the proactive
+ * auditor quiet-phase notification. The active goal/list item/loop state is
+ * untouched and any detached worker keeps running; only the automatic
+ * machinery around it freezes. Manual user commands still work. Persisted
+ * via `supervisorPausedAt`, so a session restart cannot silently re-arm
+ * machinery the user explicitly stopped. Pausing while a recovery claim is
+ * parked keeps the claim durable on disk — nothing is discarded.
+ */
+async function cmdGllaPause(ctx: ExtensionContext): Promise<void> {
+  if (warnIfStaleAtEntry(ctx, "/glla pause")) return;
+  releaseInitialSessionLoadBarrier();
+  const already = typeof state.supervisorPausedAt === "number";
+  const pausedAtMs = Date.now();
+  replaceState({ ...state, supervisorPausedAt: pausedAtMs });
+  persistState(ctx);
+  appendLedger(ctx.cwd, "supervisor_pause", already ? { repeat: true } : {});
+  // An armed continuation/recovery timer may already be scheduled; every
+  // dispatch point checks supervisorPaused() so stale timers become no-ops.
+  ctx.ui.notify(already
+    ? "Supervisor is already paused — all automatic machinery stays frozen (active work untouched). /glla resume to unfreeze."
+    : "Supervisor PAUSED — heartbeat re-arms, recovery probes, auto-resume, continuation dispatch, loop ticks, and auditor quiet notifies are frozen. The active goal/list item/loop and detached workers keep running. /glla resume to unfreeze.",
+    "warning");
+}
+
 async function cmdGllaResume(ctx: ExtensionContext): Promise<void> {
   // v0.29.12: a zombie instance (handle dead after session replacement)
   // used to answer "Nothing to resume" — the resume path must name the
   // real recovery (/reload rebuilds extensions in place), not mislead.
   if (warnIfStaleAtEntry(ctx, "/glla resume")) return;
+  // /glla resume is the broad resume surface and therefore carries the same
+  // consent semantics as /goal resume or /list resume.
+  releaseAuditorSurface();
   releaseInitialSessionLoadBarrier();
+  // v0.35.15: clearing a supervisor pause is resume's first job — the flag
+  // outlives sessions, so an explicit /glla resume must always unfreeze the
+  // machinery even when there is nothing else to resume afterwards.
+  let clearedSupervisorPause = false;
+  if (typeof state.supervisorPausedAt === "number") {
+    const frozenMs = Date.now() - state.supervisorPausedAt;
+    delete (state as { supervisorPausedAt?: number }).supervisorPausedAt;
+    persistState(ctx);
+    clearedSupervisorPause = true;
+    appendLedger(ctx.cwd, "supervisor_resume", { frozenMs });
+    ctx.ui.notify(`Supervisor RESUMED after ${fmtElapsed(frozenMs)} — heartbeat re-arms, recovery probes, auto-resume, continuation dispatch, and auditor quiet notifies are live again.`, "info");
+  }
   if (manuallyResumeMainModelRecovery(ctx)) return;
   if (state.mainModelRecovery?.retryAt || state.mainModelRecovery?.pendingModelSwitch) {
     clearMainModelRecoveryTimer();
@@ -1929,6 +2072,11 @@ async function cmdGllaResume(ctx: ExtensionContext): Promise<void> {
     scheduleLoopTick(ctx);
     return;
   }
+  if (clearedSupervisorPause) {
+    // The pause was the only thing being resumed — do not follow it with a
+    // misleading "Nothing to resume".
+    return;
+  }
   ctx.ui.notify("Nothing to resume — no paused goal/list-item, no held loop. /goal, /list, or /loop to start something.", "info");
 }
 
@@ -1945,6 +2093,10 @@ async function cmdGllaResume(ctx: ExtensionContext): Promise<void> {
  * queue after aborting only its current item.
  */
 async function cmdGllaCancel(ctx: ExtensionContext): Promise<void> {
+  if (stateRootPending()) {
+    ctx.ui.notify("Cancel deferred — the selected sessionDir is not resolved yet, so no live state was changed. Reload the host session and retry.", "warning");
+    return;
+  }
   // A running loop is itself the active objective. Stop it before looking at
   // an unrelated waiting list; otherwise `/glla cancel` can silently drop the
   // queue while leaving the loop running.
@@ -2013,6 +2165,55 @@ function cmdGllaVersion(ctx: ExtensionContext): void {
   ctx.ui.notify(formatGllaVersion(), "info");
 }
 
+// v0.35.29 (issue #15): tracked-subagent visibility — snapshot panel plus a
+// read-only child transcript tail (design: docs/DESIGN-subagent-visibility.md).
+function cmdAgents(args: string, ctx: ExtensionContext): void {
+  const { agents, managerAvailable } = agentsSnapshot();
+  const tailMatch = args.match(/--tail\s+(\S+)/);
+  if (tailMatch) {
+    const id = tailMatch[1]!;
+    const row = agents.find((a) => a.recordId === id || a.recordId.startsWith(id));
+    if (!row) {
+      ctx.ui.notify(`No tracked subagent matches "${id}". /glla agents lists the current ids.`, "warning");
+      return;
+    }
+    const linesMatch = args.match(/--lines\s+(\d+)/);
+    // v0.35.45 (audit finding): the candidate scan reads a bounded TAIL of
+    // each transcript instead of up to 25 FULL files synchronously on the
+    // main thread. The single matched file still gets a full read so the
+    // "last N of M" detail stays honest.
+    const readTailAware = (file: string, maxBytes?: number): Buffer => {
+      if (maxBytes === undefined) return fs.readFileSync(file);
+      try {
+        const size = fs.statSync(file).size;
+        if (size <= maxBytes) return fs.readFileSync(file);
+        const fd = fs.openSync(file, "r");
+        try {
+          const buf = Buffer.alloc(maxBytes);
+          const bytesRead = fs.readSync(fd, buf, 0, maxBytes, size - maxBytes);
+          return buf.subarray(0, bytesRead);
+        } finally {
+          fs.closeSync(fd);
+        }
+      } catch {
+        return fs.readFileSync(file);
+      }
+    };
+    const result = tailChildTranscript(childSessionsDir(ctx.cwd), row, {
+      lines: linesMatch ? Number(linesMatch[1]) : undefined,
+      readFile: readTailAware,
+      listDir: (dir) => fs.readdirSync(dir),
+      statMtime: (file) => { try { return fs.statSync(file).mtimeMs; } catch { return 0; } },
+    });
+    const header = result.ok
+      ? `transcript tail — ${row.agentType ?? row.recordId} (${result.detail})`
+      : `no transcript tail for ${row.agentType ?? row.recordId}`;
+    ctx.ui.notify([header, ...result.lines, ...(result.ok ? [] : [result.detail])].join("\n"), result.ok ? "info" : "warning");
+    return;
+  }
+  ctx.ui.notify(`glla agents${managerAvailable ? "" : " (pi-subagents manager registry not present — event evidence only)"}\n${renderAgentsPanel(agents, Date.now(), managerAvailable).join("\n")}`, "info");
+}
+
 // v0.29.8: /glla status — the unified "what's running" surface (user: "we
 // need to type goal status [to check], so that command at least is missing
 // for checking on whatever active process we have"). Read-only aggregate of
@@ -2020,6 +2221,11 @@ function cmdGllaVersion(ctx: ExtensionContext): void {
 // to the deep surfaces.
 function cmdGllaStatus(ctx: ExtensionContext): void {
   const lines: string[] = [];
+  // v0.35.15: name a frozen supervisor FIRST — it changes how every other
+  // line reads (nothing automatic will fire while this is set).
+  if (typeof state.supervisorPausedAt === "number") {
+    lines.push(`supervisor: ⏸ PAUSED since ${new Date(state.supervisorPausedAt).toISOString()} — re-arms/recovery/dispatch frozen — /glla resume`);
+  }
   const g = state.goal;
   if (g) {
     const tok = (g.usage?.tokensUsed ?? 0) > 0 ? ` · ${g.usage!.tokensUsed} tok` : "";
@@ -2078,6 +2284,11 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
     cmdAudits(trimmed.slice("audits".length).trim(), ctx);
     return;
   }
+  // v0.35.29 (issue #15): tracked-subagent panel — read-only, stale-safe.
+  if (/^agents(?:\s|$)/.test(trimmed)) {
+    cmdAgents(trimmed.slice("agents".length).trim(), ctx);
+    return;
+  }
   if (/^status(?:\s|$)/.test(trimmed)) {
     cmdGllaStatus(ctx);
     return;
@@ -2127,6 +2338,10 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
     await cmdGllaResume(ctx);
     return;
   }
+  if (/^pause(?:\s|$)/.test(trimmed)) {
+    await cmdGllaPause(ctx);
+    return;
+  }
   if (/^cancel(?:\s|$)/.test(trimmed)) {
     await cmdGllaCancel(ctx);
     return;
@@ -2198,6 +2413,7 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
       fmt("aggressiveMode", "aggressiveMode"),
       fmt("stuckMaxInterventions", "stuckMaxInterventions"),
       fmt("stallEscalationRefires", "stallEscalation"),
+      fmt("subagentHangEscalationMinutes", "subagentHangActionMinutes"),
       fmt("wedgeAlertMinutes", "wedgeAlert"),
       fmt("stallShortWords", "stallShortWords"),
       fmt("stallSimilarityThreshold", "stallSimilarityThreshold"),