pi-goal-list-loop-audit 0.35.13 → 0.35.64

package/extensions/goal-heartbeat.ts

@@ -19,6 +19,7 @@
 //     stranded_audit_recovered, subagent_hang_detected, ...).
 // ============================================================================
 
+import { randomUUID } from "node:crypto";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { state } from "./goal-state.js";
 import {
@@ -26,6 +27,7 @@ import {
   appendLedger,
   nowIso,
   resolveEffectiveAggressiveSettings,
+  supervisorPaused,
   type Goal,
 } from "./goal-loop-core.js";
 import { loadSettings } from "./goal-settings.js";
@@ -39,7 +41,7 @@ import {
   shouldWedgeAlert,
 } from "./goal-loop-backoff.js";
 import { isLoopActive, loopTimerPending, scheduleLoopTick } from "./goal-loop.js";
-import { mainModelRecoveryActive, markCompletionAuditRecoveryPending } from "./goal-recovery.js";
+import { mainModelRecoveryActive, markCompletionAuditRecoveryPending, probeMainModelRecovery } from "./goal-recovery.js";
 import type { ContinuationDispatch } from "./goal-loop-dispatch.js";
 
 /** goal.ts-owned module lets the heartbeat reads/writes through this accessor.
@@ -175,6 +177,108 @@ const ZOMBIE_RUN_SILENT_MS = 20 * 60_000;
 const ZOMBIE_RUN_ABORT_GRACE_MS = 10 * 60_000;
 const ZOMBIE_RUN_ALERT_THROTTLE_MS = 10 * 60_000;
 
+// v0.35.26 (issue #13): ONE shared name set for "the parent is legitimately
+// stream-silent because it is blocked on a subagent call" — consumed by both
+// the zombie stand-down and the wedge-alert hint so the two sites cannot
+// drift apart again (that drift is exactly the bug). The legacy built-in
+// names (Agent / get_subagent_result / steer_subagent) are joined by the
+// pi-subagents extension's registrations: its foreground dispatch tool is
+// named "subagent" and its blocking background wait is "subagent_wait"
+// (field 2026-08-21: a healthy foreground child wrote Postgres records for
+// 30 productive minutes while the parent was stream-silent on `subagent` —
+// the watchdog aborted it at the grace boundary anyway).
+const SUBAGENT_WAIT_TOOL_NAMES: ReadonlySet<string> = new Set([
+  "Agent",
+  "get_subagent_result",
+  "steer_subagent",
+  "subagent",
+  "subagent_wait",
+]);
+const isSubagentWaitCall = (t: { name?: string }): boolean =>
+  typeof t.name === "string" && SUBAGENT_WAIT_TOOL_NAMES.has(t.name);
+
+// ============================================================================
+// v0.35.28 (issue #16): due-wait backstop — the durable invariant that a
+// pauseKind "wait" actually resumes when its pauseResumeAt lapses.
+//
+// Field report: a goal sat paused for 30+ minutes past its scheduled
+// auto-resume while the agent narrated "the system should have auto-resumed
+// by now". Investigation found auto-resume relied SOLELY on in-memory
+// timers: agent-authored waits (pause_goal kind="wait") armed NO timer at
+// all while their own copy promised automatic continuation; error-brake
+// cooldowns were not re-armed on session_start; and every scheduled resume
+// died with the session that created it. The heartbeat now compares wall
+// time against pauseResumeAt on every tick and re-fires the route.
+const WAIT_OVERDUE_GRACE_MS = 90 * 1_000;
+/** One backstop attempt per (goalId:resumeAt) pair — the underlying route
+ * rewrites pauseResumeAt when it re-parks, which re-arms the key. */
+let lastOverdueWaitKey = "";
+
+function overdueWaitDue(): boolean {
+  const goal = state.goal;
+  if (!goal || goal.status !== "paused" || goal.pauseKind !== "wait") return false;
+  if (typeof goal.pauseResumeAt !== "string") return false;
+  const dueMs = Date.now() - Date.parse(goal.pauseResumeAt);
+  if (!Number.isFinite(dueMs) || dueMs < WAIT_OVERDUE_GRACE_MS) return false;
+  // Manual /glla pause and the v0.35.23 load hold freeze ALL automatic
+  // dispatch — an overdue wait under them stays frozen until an explicit
+  // resume releases the hold (same consent boundary as session_start).
+  if (supervisorPaused(state)) return false;
+  return `${goal.id}:${goal.pauseResumeAt}` !== lastOverdueWaitKey;
+}
+
+function overdueWaitBackstop(ctx: ExtensionContext): void {
+  // v0.35.48 (audit finding): this backstop MUTATES DURABLE STATE — parked →
+  // active, pauseResumeAt cleared — and then dispatches. It may only fire
+  // when the dispatch surface can actually carry the resume; otherwise it
+  // manufactures an ACTIVE goal with nothing scheduled until a fresh
+  // session_start (the paused-is-safe invariant, broken).
+  //   - mid-handoff or stale-latched windows: stay parked; when a healthy
+  //     session rebinds, subsequent ticks re-arm the backstop naturally.
+  //   - active main-model recovery: ONLY recovery-routed waits may fire
+  //     (the probe route re-parks with a FRESH resumeAt on failure); an
+  //     unrelated agent-authored wait would dispatch into the same broken
+  //     model, so it stays parked until recovery resolves.
+  // These gates sit BEFORE the lastOverdueWaitKey latch: a skipped window
+  // must stay retriable on later ticks, never latched as "already done".
+  if (flags.sessionHandoffPending || flags.staleTerminalDone || flags.extensionApiStale) return;
+  if (mainModelRecoveryActive() && !(state.goal?.pauseReason ?? "").startsWith("main model recovery")) return;
+  if (!overdueWaitDue()) return;
+  const goal = state.goal!;
+  const reason = goal.pauseReason ?? "";
+  lastOverdueWaitKey = `${goal.id}:${goal.pauseResumeAt}`;
+  appendLedger(ctx.cwd, "wait_pause_overdue_resume", {
+    goalId: goal.id,
+    pauseResumeAt: goal.pauseResumeAt,
+    overdueMs: Date.now() - Date.parse(goal.pauseResumeAt!),
+    reason: reason.slice(0, 160),
+    route: reason.startsWith("main model recovery") ? "main-model-probe" : "continuation",
+  });
+  if (reason.startsWith("main model recovery")) {
+    void probeMainModelRecovery(ctx).catch(() => { /* re-parks with a fresh resumeAt on failure */ });
+    return;
+  }
+  // Agent-authored waits and error-brake cooldowns alike: the stated wait
+  // condition's deadline has passed — clear the park and re-dispatch, with
+  // a recovery stamp so the continuation prompt tells the agent it was
+  // ITSELF that was recovered (issue #16 part 2).
+  updateGoal({
+    status: "active",
+    pauseKind: undefined,
+    pauseResumeAt: undefined,
+    pauseReason: undefined,
+    pauseSuggestedAction: undefined,
+    autoResumedAt: new Date().toISOString(),
+    autoResumedEvent: `overdue wait resumed (${reason.slice(0, 80) || "time-gated wait"})`,
+  }, ctx);
+  scheduleContinuation(ctx, true);
+}
+
+/** Test-only: reset the due-wait backstop latch between isolated rigs. */
+export function __testOnlyResetOverdueWaitBackstop(): void {
+  lastOverdueWaitKey = "";
+}
+
 function zombieRunSilentMs(): number {
   return zombieRunSilentMsOverride ?? ZOMBIE_RUN_SILENT_MS;
 }
@@ -200,6 +304,15 @@ export function __testOnlyResetZombieRunWatchdog(): void {
   lastZombieAbortKey = "";
 }
 
+/** v0.35.17: release the one-shot abort latch when the bounded automatic
+ * retry dispatches a fresh attempt. Without this, a retry whose send never
+ * even starts (no agent_start to advance the stream clock) would reproduce
+ * the exact abort key of its parent episode and the heartbeat could warn but
+ * NEVER re-abort — a permanently BUSY-silent session. */
+export function releaseZombieAbortKey(): void {
+  lastZombieAbortKey = "";
+}
+
 let lastUnansweredAlertAt = 0;
 
 // v0.35.4: one-shot-per-episode latch for the context-starved warning. The
@@ -226,9 +339,11 @@ let heartbeatStaleDebounce = HEARTBEAT_STALE_DEBOUNCE;
 // (tool uses or assistant output tokens) for SUBAGENT_HANG_NO_PROGRESS_MS
 // (5m default — SHORTER than the auditor's 10m, because a hung subagent
 // costs parent tokens on every turn) is surfaced to the user and ledgered
-// `subagent_hang_detected`. Detection + guidance only: the main session
-// decides whether to abort — never an auto-kill.
+// `subagent_hang_detected`. A much longer second threshold can request one
+// child-specific abort; zero disables that action while retaining detection.
 const SUBAGENT_HANG_NO_PROGRESS_MS = 5 * 60_000;
+const SUBAGENT_HANG_ESCALATION_DEFAULT_MINUTES = 30;
+const SUBAGENT_HANG_ESCALATION_MIN_MS = 5 * 60_000;
 // v0.34.102 (field: pully W161 rehearsal agent aac4ab1e, 2026-08-08T08:15
 // → 10:13 — a 118-minute wedge where `subagent_hang_detected` NEVER fired
 // because the manager record was unreachable and classifyHungSubagents
@@ -265,6 +380,8 @@ interface SubagentHangProbe {
   agentType?: string;
   summary?: string;
   spawnedAt: number;
+  /** Host generation that observed this child spawn. */
+  ownerGeneration: number;
   /** Last time the subagent delivered NEW progress (tool use / output tokens). */
   lastProgressAt: number;
   /** Last polled record.toolUses — progress when it increases. */
@@ -273,6 +390,9 @@ interface SubagentHangProbe {
   lastOutputTokens: number;
   /** Throttle: last user-facing hang warning for this subagent. */
   hangAlertedAt?: number;
+  /** One-shot action state for the current no-progress episode. */
+  hangAction?: "abort-requested" | "unavailable" | "failed";
+  hangActionAt?: number;
   endedAt?: number;
 }
 
@@ -285,8 +405,18 @@ const subagentHangProbes = new Map<string, SubagentHangProbe>();
  * cross-extension stream event. Defensive: absent when pi-subagents isn't
  * loaded or the record shape changes (falls back to event-only evidence). */
 const SUBAGENT_MANAGER_KEY = Symbol.for("pi-subagents:manager");
-type SubagentRecordPoll = { toolUses?: number; lifetimeUsage?: { output?: number }; status?: string };
-type SubagentManagerPoll = { getRecord?: (id: string) => SubagentRecordPoll | undefined };
+type SubagentRecordPoll = {
+  toolUses?: number;
+  lifetimeUsage?: { output?: number };
+  status?: string;
+  /** Present on pi-subagents records; required before automatic control. */
+  parentAgentId?: string;
+};
+type SubagentManagerPoll = {
+  getRecord?: (id: string) => SubagentRecordPoll | undefined;
+  /** Optional future registry capability; never fall back to a parent abort. */
+  abort?: (id: string) => boolean;
+};
 function subagentManagerPoller(): SubagentManagerPoll {
   try {
     return ((globalThis as any)[SUBAGENT_MANAGER_KEY] ?? {}) as SubagentManagerPoll;
@@ -295,25 +425,158 @@ function subagentManagerPoller(): SubagentManagerPoll {
   }
 }
 
+/** Minimal pi.events surface used by the pinned pi-subagents RPC bridge. */
+export interface SubagentRpcEventBus {
+  on(event: string, handler: (data: unknown) => void): () => void;
+  emit(event: string, data: unknown): void;
+}
+
+type SubagentStopRpcResult =
+  | { kind: "requested" }
+  | { kind: "unavailable"; reason: string }
+  | { kind: "failed"; error: string }
+  | { kind: "stale" };
+
+type SubagentRpcBinding = {
+  events: SubagentRpcEventBus;
+  generation: number;
+  ready: boolean;
+};
+
+const SUBAGENT_RPC_STOP_TIMEOUT_MS = 2_000;
+let subagentRpcBinding: SubagentRpcBinding | null = null;
+const observedSubagentRpcBuses = new Set<SubagentRpcEventBus>();
+const readySubagentRpcBuses = new Set<SubagentRpcEventBus>();
+
+/**
+ * Observe readiness at factory time. Extension factories run before lifecycle
+ * events, so this catches `subagents:ready` even when pi-subagents' handler is
+ * registered before GLLA's `session_start` handler. The event bus is only
+ * usable for control after bindSubagentRpcHost admits the current host.
+ */
+export function observeSubagentRpcReadiness(events: SubagentRpcEventBus): void {
+  if (observedSubagentRpcBuses.has(events)) return;
+  observedSubagentRpcBuses.add(events);
+  try {
+    events.on("subagents:ready", () => {
+      readySubagentRpcBuses.add(events);
+      if (subagentRpcBinding?.events === events) subagentRpcBinding.ready = true;
+    });
+  } catch {
+    // A factory-time event bus can be unavailable on older hosts; control will
+    // remain fail-closed and produce the durable unavailable escalation.
+  }
+}
+
+/** Bind the RPC stop capability to an admitted MAIN host generation. */
+export function bindSubagentRpcHost(events: SubagentRpcEventBus, generation: number): void {
+  observeSubagentRpcReadiness(events);
+  const retainedReady = subagentRpcBinding?.events === events && subagentRpcBinding.ready;
+  subagentRpcBinding = {
+    events,
+    generation,
+    ready: retainedReady || readySubagentRpcBuses.has(events),
+  };
+}
+
+/** Clear a host-bound RPC capability before its event bus becomes stale. */
+export function releaseSubagentRpcHost(events?: SubagentRpcEventBus): void {
+  if (events && subagentRpcBinding?.events !== events) return;
+  const boundEvents = subagentRpcBinding?.events ?? events;
+  subagentRpcBinding = null;
+  if (boundEvents) readySubagentRpcBuses.delete(boundEvents);
+}
+
+function requestSubagentStopViaRpc(recordId: string, generation: number): Promise<SubagentStopRpcResult> | undefined {
+  const binding = subagentRpcBinding;
+  if (!binding) return undefined;
+  if (!binding.ready) {
+    return Promise.resolve({ kind: "unavailable", reason: "the subagents RPC service is not ready" });
+  }
+  if (binding.generation !== generation || flags.sessionGeneration !== generation) {
+    return Promise.resolve({ kind: "stale" });
+  }
+
+  const requestId = randomUUID();
+  const replyChannel = `subagents:rpc:stop:reply:${requestId}`;
+  return new Promise<SubagentStopRpcResult>((resolve) => {
+    let settled = false;
+    let unsubscribe = () => {};
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    const finish = (result: SubagentStopRpcResult): void => {
+      if (settled) return;
+      settled = true;
+      unsubscribe();
+      if (timeout) clearTimeout(timeout);
+      resolve(result);
+    };
+    try {
+      unsubscribe = binding.events.on(replyChannel, (raw) => {
+        if (subagentRpcBinding?.events !== binding.events
+          || subagentRpcBinding.generation !== generation
+          || flags.sessionGeneration !== generation) {
+          finish({ kind: "stale" });
+          return;
+        }
+        const reply = raw as { success?: boolean; error?: unknown } | null;
+        if (reply?.success === true) finish({ kind: "requested" });
+        else finish({ kind: "failed", error: typeof reply?.error === "string" ? reply.error : "the RPC service rejected the request" });
+      });
+      // Arm the timeout before emitting: a compatible host/test bus may reply
+      // synchronously, and finish() must then be able to clear the timer.
+      timeout = setTimeout(() => finish({ kind: "unavailable", reason: "the subagents stop RPC timed out" }), SUBAGENT_RPC_STOP_TIMEOUT_MS);
+      timeout.unref?.();
+      binding.events.emit("subagents:rpc:stop", { requestId, agentId: recordId });
+    } catch (error) {
+      finish({ kind: "unavailable", reason: error instanceof Error ? error.message : String(error) });
+    }
+  });
+}
+
+let subagentHangEscalationMsOverride: number | null = null;
+function subagentHangEscalationMs(cwd: string): number {
+  if (subagentHangEscalationMsOverride !== null) return Math.max(0, subagentHangEscalationMsOverride);
+  const minutes = loadSettings(cwd).subagentHangEscalationMinutes;
+  if (minutes === 0) return 0;
+  if (typeof minutes !== "number" || !Number.isFinite(minutes) || minutes < 5) {
+    return SUBAGENT_HANG_ESCALATION_DEFAULT_MINUTES * 60_000;
+  }
+  return minutes * 60_000;
+}
+
+function ownerGeneration(): number {
+  try { return flags?.sessionGeneration ?? 0; } catch { return 0; }
+}
+
 export function upsertSubagentHangProbe(recordId: string, agentType: string | undefined, summary: string | undefined, now = Date.now()): void {
   const existing = subagentHangProbes.get(recordId);
   if (existing) {
     // Re-observation (resume / re-run): fresh evidence + refreshed metadata.
     existing.lastProgressAt = now;
+    existing.ownerGeneration = ownerGeneration();
     existing.endedAt = undefined;
+    existing.hangAlertedAt = undefined;
+    existing.hangAction = undefined;
+    existing.hangActionAt = undefined;
     if (agentType) existing.agentType = agentType;
     if (summary) existing.summary = summary;
     return;
   }
   subagentHangProbes.set(recordId, {
     recordId, agentType, summary,
+    ownerGeneration: ownerGeneration(),
     spawnedAt: now, lastProgressAt: now, lastToolUses: 0, lastOutputTokens: 0,
   });
 }
 
 export function markSubagentHangProgress(recordId: string, now = Date.now()): void {
   const p = subagentHangProbes.get(recordId);
-  if (p) p.lastProgressAt = now;
+  if (p) {
+    p.lastProgressAt = now;
+    p.hangAlertedAt = undefined;
+    p.hangAction = undefined;
+    p.hangActionAt = undefined;
+  }
 }
 
 export function endSubagentHangProbe(recordId: string, now = Date.now()): void {
@@ -334,6 +597,9 @@ export function classifyHungSubagents(
     lastProgressAt: number;
     lastToolUses: number;
     lastOutputTokens: number;
+    hangAlertedAt?: number;
+    hangAction?: "abort-requested" | "unavailable" | "failed";
+    hangActionAt?: number;
     endedAt?: number;
   }>,
   getRecord: (id: string) => SubagentRecordPoll | undefined,
@@ -362,6 +628,9 @@ export function classifyHungSubagents(
       p.lastToolUses = toolUses;
       p.lastOutputTokens = output;
       p.lastProgressAt = now;
+      p.hangAlertedAt = undefined;
+      p.hangAction = undefined;
+      p.hangActionAt = undefined;
       continue;
     }
     const silentMs = now - p.lastProgressAt;
@@ -370,8 +639,177 @@ export function classifyHungSubagents(
   return hung;
 }
 
+function isLiveSubagentRecord(rec: SubagentRecordPoll | undefined): boolean {
+  return !!rec && (rec.status === "running" || rec.status === "steered" || rec.status === "queued");
+}
+
+/** Only a child with fresh evidence keeps the generic parent zombie watchdog
+ * stood down. A classified stale child must not shield an unrelated parent
+ * turn forever; an event-only child gets the longer event-evidence window. */
+function hasHealthySubagentHangProbe(now = Date.now()): boolean {
+  const poll = subagentManagerPoller();
+  for (const probe of subagentHangProbes.values()) {
+    if (probe.endedAt !== undefined || probe.hangActionAt !== undefined) continue;
+    const rec = poll.getRecord?.(probe.recordId);
+    if (rec && isLiveSubagentRecord(rec)) {
+      const toolUses = rec.toolUses ?? 0;
+      const output = rec.lifetimeUsage?.output ?? 0;
+      if (toolUses > probe.lastToolUses || output > probe.lastOutputTokens
+          || now - probe.lastProgressAt < SUBAGENT_HANG_NO_PROGRESS_MS) return true;
+    } else if (!rec && now - probe.lastProgressAt < SUBAGENT_HANG_EVENT_ONLY_MS) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function hasStaleSubagentHangProbe(now = Date.now()): boolean {
+  const poll = subagentManagerPoller();
+  for (const probe of subagentHangProbes.values()) {
+    if (probe.endedAt !== undefined || probe.hangActionAt !== undefined) continue;
+    const rec = poll.getRecord?.(probe.recordId);
+    if (rec && isLiveSubagentRecord(rec) && now - probe.lastProgressAt >= SUBAGENT_HANG_NO_PROGRESS_MS) return true;
+    if (!rec && now - probe.lastProgressAt >= SUBAGENT_HANG_EVENT_ONLY_MS) return true;
+  }
+  return false;
+}
+
+function requestSubagentHangAction(
+  ctx: ExtensionContext,
+  probe: SubagentHangProbe,
+  silentMs: number,
+  poll: SubagentManagerPoll,
+  now: number,
+  escalationMs: number,
+): void {
+  if (escalationMs <= 0 || silentMs < escalationMs || probe.hangActionAt !== undefined) return;
+  // Claim the episode before any capability call. A rejected/throwing manager
+  // must not produce a ledger/notify storm on every 15s heartbeat tick.
+  probe.hangActionAt = now;
+  const label = [probe.agentType, probe.summary].filter(Boolean).join(" ") || "subagent";
+  const common = {
+    recordId: probe.recordId,
+    agentType: probe.agentType,
+    summary: probe.summary,
+    silentMs,
+    generation: flags.sessionGeneration,
+    ownerGeneration: probe.ownerGeneration,
+    at: nowIso(),
+  };
+  const unavailable = (reason: string): void => {
+    probe.hangAction = "unavailable";
+    appendLedger(ctx.cwd, "subagent_hang_action_unavailable", { ...common, reason });
+    const msg = `glla: ${label} stayed frozen for ${Math.max(1, Math.round(silentMs / 60_000))}m, but no safe child-abort capability is available (${reason}). The warning and partial evidence are preserved; inspect the Agents panel and decide whether to interrupt the parent.`;
+    ctx.ui.notify(msg, "warning");
+    notifyExternal(ctx, msg);
+  };
+
+  if (probe.ownerGeneration !== flags.sessionGeneration) {
+    unavailable("the child belongs to an older host generation");
+    return;
+  }
+  const rec = poll.getRecord?.(probe.recordId);
+  if (!rec) {
+    unavailable("the manager record is unavailable");
+    return;
+  }
+  if (!isLiveSubagentRecord(rec)) {
+    unavailable(`the child is no longer running (status=${rec.status ?? "unknown"})`);
+    return;
+  }
+  // Automatic control is limited to top-level records. The capability is
+  // deliberately required to expose the ownership field; guessing about a
+  // nested child could kill work owned by another subagent.
+  if (!("parentAgentId" in rec) || rec.parentAgentId !== undefined) {
+    unavailable("the child is nested or its ownership is unknown");
+    return;
+  }
+  const toolUses = rec.toolUses ?? 0;
+  const output = rec.lifetimeUsage?.output ?? 0;
+  if (toolUses > probe.lastToolUses || output > probe.lastOutputTokens) {
+    // Progress arrived between classification and the capability call. Drop
+    // the latch so a later genuine no-progress episode can be evaluated.
+    probe.hangActionAt = undefined;
+    probe.hangAction = undefined;
+    probe.lastToolUses = toolUses;
+    probe.lastOutputTokens = output;
+    probe.lastProgressAt = now;
+    return;
+  }
+  const recordRequestedAbort = (): void => {
+    probe.hangAction = "abort-requested";
+    appendLedger(ctx.cwd, "subagent_hang_action_requested", { ...common, action: "abort", via: "subagents:rpc:stop" });
+    const msg = `glla: requested a bounded abort for frozen ${label} after ${Math.max(1, Math.round(silentMs / 60_000))}m with no progress. The parent was not aborted; partial child output remains available for inspection. /goal resume or /list resume retries the owning work after it settles.`;
+    ctx.ui.notify(msg, "warning");
+    notifyExternal(ctx, msg);
+  };
+  const applyRpcResult = (result: SubagentStopRpcResult): void => {
+    // A reply from a disposed host must not mutate the successor's ledger/UI.
+    if (result.kind === "stale"
+      || flags.sessionGeneration !== probe.ownerGeneration
+      || flags.sessionGeneration !== common.generation) return;
+    if (result.kind === "requested") {
+      recordRequestedAbort();
+      return;
+    }
+    if (result.kind === "unavailable") {
+      unavailable(result.reason);
+      return;
+    }
+    appendLedger(ctx.cwd, "subagent_hang_action_failed", { ...common, action: "abort", error: result.error, via: "subagents:rpc:stop" });
+    probe.hangAction = "failed";
+    ctx.ui.notify(`glla: the child-stop RPC failed for ${label}; the parent was not aborted. Inspect the Agents panel and use an explicit interrupt if needed.`, "warning");
+    notifyExternal(ctx, `glla: the child-stop RPC failed for ${label}; the parent was not aborted. Inspect the Agents panel and use an explicit interrupt if needed.`);
+  };
+
+  // v0.35.65: the pinned pi-subagents registry intentionally exposes only
+  // polling; production child control is the admitted root-session RPC.
+  const rpcRequest = requestSubagentStopViaRpc(probe.recordId, common.generation);
+  if (rpcRequest) {
+    void rpcRequest.then(applyRpcResult);
+    return;
+  }
+
+  // Keep compatibility with a future registry capability and with the focused
+  // unit seam, but never infer a parent abort from a missing child capability.
+  if (typeof poll.abort !== "function") {
+    unavailable("the manager exposes no child-specific abort method or stop RPC");
+    return;
+  }
+  let accepted = false;
+  try {
+    accepted = poll.abort(probe.recordId);
+  } catch (error) {
+    appendLedger(ctx.cwd, "subagent_hang_action_failed", {
+      ...common,
+      action: "abort",
+      error: error instanceof Error ? error.message : String(error),
+    });
+    probe.hangAction = "failed";
+    ctx.ui.notify(`glla: could not request a child-specific abort for ${label}; the parent was not aborted. Inspect the Agents panel and use an explicit interrupt if needed.`, "warning");
+    return;
+  }
+  if (!accepted) {
+    appendLedger(ctx.cwd, "subagent_hang_action_failed", { ...common, action: "abort", error: "manager rejected the running child" });
+    probe.hangAction = "failed";
+    ctx.ui.notify(`glla: the manager rejected the child-specific abort for ${label}; the parent was not aborted. Inspect the Agents panel and use an explicit interrupt if needed.`, "warning");
+    return;
+  }
+  recordRequestedAbort();
+}
+
 function heartbeatTick(): void {
   if (flags.zombieStoodDown || flags.initialSessionLoadPending) return; // blank startup waits for pi to bind a real session
+  // v0.35.15: a MANUAL `/glla pause` freezes the supervisor's automatic
+  // machinery — re-arms, stale probes, zombie cleanup, refires, everything
+  // this tick drives. The user explicitly asked for a hands-off window; no
+  // heartbeat side-effect may fire inside it. `/glla resume` restores it.
+  // v0.35.23 (note.md Next #2): the automatic LOAD HOLD is different — the
+  // tick stays ALIVE under it because host-loss supervision is safety
+  // machinery, not automation (a held plane must not become an unprobed
+  // idle plane). Everything this tick could DISPATCH downstream checks the
+  // same hold via supervisorPaused() and refuses; only probes/ledger run.
+  if (typeof state.supervisorPausedAt === "number") return;
   // A completed/paused/held plane has no host-bound work to supervise. Do
   // not probe the retained ExtensionAPI in that idle state: pi may dispose a
   // session handle during an unrelated session transition, and reporting
@@ -390,7 +828,11 @@ function heartbeatTick(): void {
     || state.loop?.stopReason?.startsWith("extension api stale");
   const parkedCompletionAuditRecovery = state.goal?.status === "paused"
     && state.goal.pendingCompletion?.phase === "recovery-pending";
-  if (state.goal?.status !== "active"
+  // v0.35.28 (issue #16): a lapsed wait-pause is host-bound work too — the
+  // heartbeat owns its durable due-time backstop (see overdueWaitBackstop).
+  if (overdueWaitDue()) {
+    // fall through: the backstop below needs a heartbeat opportunity
+  } else if (state.goal?.status !== "active"
     && state.goal?.status !== "auditing"
     && !isLoopActive()
     && !staleRecoveryDebt
@@ -497,19 +939,19 @@ function heartbeatTick(): void {
   // 74305f7e while the MAIN model was also in recovery; heartbeatTick
   // returned at the `mainModelRecoveryActive()` gate BELOW, so the
   // subagent hang scan never ran and the 12m+ wedge produced ZERO
-  // `subagent_hang_detected`). The scan is detection + notify only
-  // (never an auto-kill, never a send) — it MUST run even while the
-  // main model is parked, because a shared provider failure can freeze
-  // subagents and the main model at the same time.
+  // `subagent_hang_detected`). The scan still runs before that gate.
+  // Detection remains warning/telemetry-first; only a much longer, confirmed
+  // frozen top-level record may request the manager's child-specific abort.
   if (subagentHangProbes.size > 0) {
     const nowMs = Date.now();
     const poll = subagentManagerPoller();
+    const escalationMs = subagentHangEscalationMs(ctx.cwd);
     const hung = classifyHungSubagents([...subagentHangProbes.values()], (id) => poll.getRecord?.(id), nowMs);
     pruneEndedSubagentHangProbes(nowMs);
     for (const h of hung) {
       const p = subagentHangProbes.get(h.recordId);
-      if (!p || (p.hangAlertedAt !== undefined && nowMs - p.hangAlertedAt < SUBAGENT_HANG_ALERT_THROTTLE_MS)) continue;
-      p.hangAlertedAt = nowMs;
+      if (!p) continue;
+      const shouldAlert = p.hangAlertedAt === undefined || nowMs - p.hangAlertedAt >= SUBAGENT_HANG_ALERT_THROTTLE_MS;
       const label = [p.agentType, p.summary].filter(Boolean).join(" ");
       const mins = Math.max(1, Math.round(h.silentMs / 60_000));
       // v0.34.102: classifyHungSubagents cannot tell us the evidence class
@@ -519,23 +961,31 @@ function heartbeatTick(): void {
       // only its event trail (spawn/compacted/steered) remains. Name it so
       // the user knows whether the Agents panel can still show a live child.
       const stillTracked = poll.getRecord?.(p.recordId) !== undefined;
-      appendLedger(ctx.cwd, "subagent_hang_detected", {
-        recordId: p.recordId,
-        agentType: p.agentType,
-        summary: p.summary,
-        silentMs: h.silentMs,
-        spawnedAt: new Date(p.spawnedAt).toISOString(),
-        evidence: stillTracked ? "record-frozen" : "event-only",
-        at: nowIso(),
-      });
-      const msg = `glla: subagent${label ? ` (${label})` : ""} shows no progress for ${mins}m — ${stillTracked
-        ? "still running with no new tool calls or output"
-        : "its manager record is unreachable and it produced no events (spawn/compaction/steer)"}. It may be hung; the main session can decide to abort it.`;
-      ctx.ui.notify(msg, "warning");
-      notifyExternal(ctx, msg);
+      if (shouldAlert) {
+        p.hangAlertedAt = nowMs;
+        appendLedger(ctx.cwd, "subagent_hang_detected", {
+          recordId: p.recordId,
+          agentType: p.agentType,
+          summary: p.summary,
+          silentMs: h.silentMs,
+          spawnedAt: new Date(p.spawnedAt).toISOString(),
+          evidence: stillTracked ? "record-frozen" : "event-only",
+          at: nowIso(),
+        });
+        const msg = `glla: subagent${label ? ` (${label})` : ""} shows no progress for ${mins}m — ${stillTracked
+          ? "still running with no new tool calls or output"
+          : "its manager record is unreachable and it produced no events (spawn/compaction/steer)"}. It may be hung; a longer frozen interval will request a bounded child abort when safe.`;
+        ctx.ui.notify(msg, "warning");
+        notifyExternal(ctx, msg);
+      }
+      requestSubagentHangAction(ctx, p, h.silentMs, poll, nowMs, escalationMs);
     }
   }
-  if (mainModelRecoveryActive()) return;
+  if (mainModelRecoveryActive()) {
+    overdueWaitBackstop(ctx);
+    return;
+  }
+  overdueWaitBackstop(ctx);
   let idle = false;
   let pending = false;
   try {
@@ -598,12 +1048,17 @@ function heartbeatTick(): void {
     // abort and parked a run whose child was legitimately working). A parent
     // BUSY-waiting on Agent / steer_subagent / get_subagent_result is
     // EXPECTED to be stream-silent; child liveness is the subagent-hang
-    // watchdog's detection+notify territory and the wedge alert names the
-    // wait. Stand down the whole branch while a live probe or an in-flight
-    // subagent tool call is recorded — the abort must not own that case.
-    const subagentWaitInFlight =
-      hasLiveSubagentHangProbes() ||
-      [...flags.inFlightToolCalls.values()].some((t) => t.name === "Agent" || t.name === "get_subagent_result" || t.name === "steer_subagent");
+    // watchdog's detection/action territory and the wedge alert names the
+    // wait. Stand down only while a probe still has fresh evidence. Once a
+    // child is classified stale or an action was requested, it must not shield
+    // an unrelated parent turn from its own bounded cleanup.
+    const inFlightSubagentTool = [...flags.inFlightToolCalls.values()].some(isSubagentWaitCall);
+    const healthySubagentWait = hasHealthySubagentHangProbe();
+    const staleSubagent = hasStaleSubagentHangProbe();
+    // Keep the legacy tool-name path for a foreground wait whose lifecycle
+    // event has not reached the probe registry yet. Once a probe is already
+    // stale, however, the same ambiguous tool name must not shield cleanup.
+    const subagentWaitInFlight = healthySubagentWait || (inFlightSubagentTool && !staleSubagent);
     if (subagentWaitInFlight) {
       if (streamSilentMs >= zombieAbortMs && !flags.abortedStandDown) {
         appendLedger(ctx.cwd, "zombie_run_stood_down_subagent_wait", { streamSilentMs });
@@ -745,7 +1200,7 @@ function heartbeatTick(): void {
     // whose tool-use counter stops moving is hung, not thinking.
     const subWaits = new Set(
       [...flags.inFlightToolCalls.values()]
-        .filter((t) => t.name === "get_subagent_result" || t.name === "Agent")
+        .filter(isSubagentWaitCall)
         .map((t) => t.name),
     );
     const subHint = subWaits.size > 0
@@ -845,6 +1300,69 @@ export function __testOnlySetHeartbeatStaleDebounce(n: number | null): void {
   heartbeatStaleDebounce = n ?? HEARTBEAT_STALE_DEBOUNCE;
 }
 
+/** v0.35.29 (issue #15): production snapshot of the tracked-subagent table
+ * for /glla agents and the widget segment. Read-only copies — never mutates
+ * probe counters (unlike classifyHungSubagents, which advances them).
+ * Hung classification mirrors the heartbeat scan's semantics without its
+ * mutation: no new progress for >= SUBAGENT_HANG_NO_PROGRESS_MS with the
+ * manager record still pollable = record-frozen; without a record, the longer
+ * SUBAGENT_HANG_EVENT_ONLY_MS window applies = event-only. */
+export interface SubagentAgentView {
+  recordId: string;
+  agentType?: string;
+  summary?: string;
+  status: "running" | "hung" | "ended";
+  spawnedAt: number;
+  lastProgressAt: number;
+  toolUses: number;
+  outputTokens: number;
+  /** ms since the last NEW progress (tool use / output tokens). */
+  silentMs: number;
+  evidence: "record-frozen" | "event-only" | "live";
+  hangAlertedAt?: number;
+  action?: "abort-requested" | "unavailable" | "failed";
+  endedAt?: number;
+}
+
+export function getSubagentAgentsSnapshot(now = Date.now()): { agents: SubagentAgentView[]; managerAvailable: boolean } {
+  const poll = subagentManagerPoller();
+  const managerAvailable = typeof poll.getRecord === "function";
+  const agents: SubagentAgentView[] = [];
+  for (const probe of subagentHangProbes.values()) {
+    const ended = probe.endedAt !== undefined;
+    let status: SubagentAgentView["status"] = "running";
+    let evidence: SubagentAgentView["evidence"] = "live";
+    let record: SubagentRecordPoll | undefined;
+    if (!ended) {
+      record = poll.getRecord?.(probe.recordId);
+      const stillTracked = record !== undefined;
+      const silentMs = now - probe.lastProgressAt;
+      if (record && !isLiveSubagentRecord(record)) {
+        status = "ended";
+      } else if (silentMs >= (stillTracked ? SUBAGENT_HANG_NO_PROGRESS_MS : SUBAGENT_HANG_EVENT_ONLY_MS)) {
+        status = "hung";
+        evidence = stillTracked ? "record-frozen" : "event-only";
+      }
+    }
+    agents.push({
+      recordId: probe.recordId,
+      ...(probe.agentType ? { agentType: probe.agentType } : {}),
+      ...(probe.summary ? { summary: probe.summary } : {}),
+      status,
+      spawnedAt: probe.spawnedAt,
+      lastProgressAt: probe.lastProgressAt,
+      toolUses: probe.lastToolUses,
+      outputTokens: probe.lastOutputTokens,
+      silentMs: Math.max(0, now - probe.lastProgressAt),
+      evidence,
+      ...(probe.hangAlertedAt !== undefined ? { hangAlertedAt: probe.hangAlertedAt } : {}),
+      ...(probe.hangAction !== undefined ? { action: probe.hangAction } : {}),
+      ...(probe.endedAt !== undefined ? { endedAt: probe.endedAt } : {}),
+    });
+  }
+  return { agents, managerAvailable };
+}
+
 /** Test-only: snapshot of the live subagent-hang probe registry. Returns
  * the LIVE probe objects (tests backdate lastProgressAt / read hangAlertedAt)
  * — read-only misuse is on the test author. Never called by production
@@ -853,8 +1371,15 @@ export function __testOnlySubagentHangProbes(): SubagentHangProbe[] {
   return [...subagentHangProbes.values()];
 }
 
+/** Test-only: override the long frozen-child action threshold. `0` keeps
+ * detection warning-only; null restores the settings-backed default. */
+export function __testOnlySetSubagentHangEscalationMs(ms: number | null): void {
+  subagentHangEscalationMsOverride = ms;
+}
+
 /** Test-only: clear the subagent-hang probe registry (between tests). Never
  * called by production code. */
 export function __testOnlyClearSubagentHangProbes(): void {
   subagentHangProbes.clear();
+  subagentHangEscalationMsOverride = null;
 }