pi-goal-list-loop-audit 0.35.32 → 0.35.65

package/CHANGELOG.md

@@ -1,5 +1,637 @@
 # Changelog
 
+## 0.35.65 — status surfaces and worker liveness (2026-08-26)
+
+### Added
+  The persistent footer now stays compact and global, while the detailed
+  widget and `/glla agents` share one evidence-backed worker projection. Active
+  non-auditor workers expose sanitized identity/purpose, queued/running/hung/
+  ended status, coarse phase, elapsed time, silence age, and ownership-aware
+  lifecycle evidence. Narrow widgets retain essential liveness fields and
+  point explicitly to `/glla agents` when rows overflow.
+
+### Changed
+  Detached completion-auditor evidence remains a separate verification HUD;
+  it is not mixed into the worker roster or duplicated in the global footer.
+  Existing command names, lifecycle, persistence, recovery, and auditor
+  semantics are unchanged.
+
+### Tests
+  Focused status and worker-lifecycle coverage, fresh active/queue/recovery/
+  auditor fixtures, the full release gate, TypeScript checking, offline auditor
+  validation, and npm packaging were completed for this release.
+
+## 0.35.64 — bounded recovery for frozen subagents (2026-08-25)
+
+### Fix
+  A tracked top-level subagent that produces no tool-use or output-token
+  progress now receives the existing short warning first, then one
+  generation-fenced child-specific abort request after the configurable
+  `subagentHangEscalationMinutes` threshold (default 30; 0 keeps
+  warning/telemetry-only behavior). Nested, unreachable, or ownership-
+  ambiguous children remain warning-only. A stale child no longer shields an
+  unrelated parent zombie watchdog, and `/glla agents` shows ABORTING,
+  unavailable, or failed action state while preserving partial output.
+
+### Tests
+  `tests/subagent-hang-detection.test.ts` covers one-shot escalation,
+  progress-before-action cancellation, manager-unavailable and nested-child
+  safety, and `tests/agents-panel.test.ts` pins the action surface. Settings
+  menu/editor and INSTALL documentation expose the new threshold.
+
+### Follow-up hardening
+  Frozen-child escalation now uses pi-subagents' existing root-session
+  `subagents:rpc:stop` bridge, with readiness, ownership, generation, and
+  timeout-race fencing. The real AgentManager/RPC path is covered by a
+  deterministic pending-provider integration test without modifying the
+  upstream package.
+
+  Malformed saved goal/list objectives now produce a bounded repair/replan
+  card instead of a self-blocking first turn. One durable bootstrap turn
+  carries the complete preserved target and `propose_task_list` confirmation;
+  automatic repeats are fenced, while explicit `/list resume` re-arms one
+  retry. The card keeps its concrete recovery action and queue position
+  visible.
+
+### Tests
+  Focused repair/replan, display, stale-probe, and RPC regressions are
+  included in the release contract. The complete gate remains the source of
+  truth for the published artifact.
+
+## 0.35.63 — auditor context held until resume (2026-08-25)
+
+### Fix
+  Cold session restores now keep unfinished goal/list objectives and their
+  status visible without automatically injecting the previous auditor report
+  or dispatching a new continuation. Explicit `/goal resume`, list/glla/loop
+  continuation commands, validated lifecycle continuity, and global
+  `autoResume: true` release the auditor-context gate. The prior Pi transcript
+  and durable audit history remain untouched.
+
+### Tests
+  `tests/auditor-blank-until-resume.test.ts` proves objective visibility,
+  pre-consent report/TODO suppression, explicit resume release, auto-resume
+  release, and rejected stale-resume suppression. Version metadata is
+  synchronized to 0.35.63.
+
+### Follow-up hardening
+  `/goal resume` now releases the auditor surface only after its existing
+  stale/foreign admission probe. Active-idle resumes receive the same probe;
+  stale paused resumes preserve the existing active/interrupted recovery
+  marker without exposing old auditor context. Main-model recovery resumes
+  now use the same stale/foreign admission probe and release the surface on
+  manual-hold, retry, and primary-probe recovery paths; a recovery regression
+  test pins the consent behavior.
+
+## 0.35.62 — subagent host-state boundary (2026-08-25)
+
+### Fix
+  Headless child sessions are now rejected before state-root registration,
+  restore, owner claims, and tool repair. The same fail-closed boundary covers
+  persistent children, foreign slash commands, and missing tool invocation
+  contexts. File-backed host successors remain eligible for legitimate reload
+  and silent-rebind recovery. Main-host subagent telemetry continues through
+  the event bus and `/glla agents` path.
+
+### Tests
+  `tests/subagent-host-boundary.test.ts` proves first-claim prevention,
+  foreign slash-command refusal, persistent-worker refusal, legitimate host
+  successor admission, and durable Explore telemetry. Version metadata is
+  synchronized to 0.35.62.
+
+## 0.35.61 — list queue visibility across host replacement (2026-08-25)
+
+### Fix
+  Waiting-only list state now has an actionable status/widget projection even
+  when no list item is active. Silent host-successor and same-session stale
+  recovery boundaries also re-read the selected durable root and hydrate queue
+  sidecars before repainting. A recovered queue now stays visible and can be
+  started with `/list next` without requiring a full reload.
+
+### Tests
+  `tests/list-invisible-restart.test.ts` covers waiting-only visibility and
+  activation plus sidecar-only silent-successor rehydration. Version metadata
+  is synchronized to 0.35.61.
+
+## 0.35.60 — pre-turn glla tool visibility (2026-08-25)
+
+### Fix
+  GLLA agent tools are now registered and reactivated immediately before
+  agent turns, with `agent_start`/`turn_start` compatibility fallbacks. This
+  closes the interval where an external tool allowlist or modlist could remove
+  `pause_goal` after session restore and Pi would answer a valid model call
+  with `Tool pause_goal not found`, leaving a parked objective looking stuck
+  until reload.
+
+### Tests
+  `tests/gettick-tool-visibility.test.ts` simulates a post-restore active-tool
+  replacement and verifies the pre-turn boundary restores `pause_goal` and
+  keeps it callable. Version metadata is synchronized to 0.35.60.
+
+## 0.35.59 — safe cancel/wipe across unresolved session roots (2026-08-25)
+
+### Fix
+  `/glla cancel`, `/glla wipe`, `/list cancel`, `/list clear`, and the shared
+  goal archive path now fail closed while opt-in `sessionDir` resolution is
+  pending. They leave the in-memory objective/list untouched and do not
+  recreate or mutate an ambiguous cwd state tree; after host lifecycle
+  admission registers the session root, cancel and wipe archive/clear under
+  the selected session root as before.
+
+### Tests
+  `tests/objective-loss-lifecycle.test.ts` covers both deferred destructive
+  commands and successful `/glla cancel` + `/glla wipe` cleanup under a
+  registered session root. Version metadata is synchronized to 0.35.59.
+
+## 0.35.58 — objective-loss lifecycle repair (2026-08-24)
+
+### Fix
+  Wired the opt-in `sessionDir` root into the admitted production lifecycle.
+  `session_start` and silent host-successor admission now register Pi's
+  canonical `SessionManager.getSessionDir()` before owner, invalidation, or
+  restore writes; in-memory worker sessions remain pending instead of creating
+  an ambiguous cwd tree. The configured session directory wins over an
+  imported session-file parent, while `PI_SESSION_FILE` remains the explicit
+  child-process fallback.
+
+### Evidence
+  Added `tests/objective-loss-lifecycle.test.ts`: a real registered
+  `session_start` handler proves production root registration, and separate
+  fresh Bun writer/reader processes recover an objective across a cwd switch.
+  The report intentionally does not claim to simulate a crash mid-write or a
+  specific version migration. Full evidence:
+  audit/OBJECTIVE-LOSS-VALIDATION-2026-08-24.md.
+
+### Tests
+  Focused lifecycle/state-root tests and clean tsc pass; the full release gate
+  is run for this version before closure.
+
+## 0.35.57 — objective-loss validation (2026-08-24)
+
+### Evidence
+  Validated the Now report that objectives disappeared after a Wez crash or
+  version/cwd switch. The historical workingDir default intentionally makes a
+  cwd switch select a different on-disk root, while explicit sessionDir keeps
+  the objective visible across cwd changes. Pending session-root resolution
+  does not migrate or delete the old cwd tree. The bounded result was
+  evidence-based closure pending production lifecycle wiring; crash-only loss
+  was not reproduced. The subsequent gettick, list-reload, and
+  subagent-visibility reports remain separate items.
+  Full evidence: audit/OBJECTIVE-LOSS-VALIDATION-2026-08-24.md.
+## 0.35.56 — state-root consumer/lifecycle hardening (2026-08-24)
+
+### Fix
+  Hardened every remaining state-root consumer and lifecycle boundary missed
+  by the core/settings slice. Raw `<cwd>/.pi-glla` joins in auditor jobs,
+  dispatch, goal-loop ledger reads, reviewer, stats rollup/discovery, and
+  session owner/handoff/pending-list paths now route through `piGlaDir` and
+  respect the selected root. Pending `sessionDir` resolution (no session dir
+  yet) is a strict deferral: dispatch, reviewer, session owner, handoff, and
+  pending-list writes return a deferred/false result without creating a
+  fallback `<cwd>/.pi-glla` tree, and legacy `.pi-gla` trees are still never
+  migrated. Audit-loop open-count helpers now resolve via the selected root
+  as well. Host/subagent ownership stays per-process via `PI_SESSION_FILE`
+  fallback and the explicit `setRuntimeSessionDir` hook — no global overwrite.
+
+### Tests
+  New `tests/state-root-consumers.test.ts` pins resolved-root routing for
+  dispatch/stats/audit helpers, pending deferral for dispatch/reviewer, the
+  `PI_SESSION_FILE` fallback, and source-level absence of raw hardcodings plus
+  pending guards. Existing `tests/state-root.test.ts` continues to cover core
+  core/settings behavior. Red/green: breaking the `piGlaDir` routing makes the
+  consumer pins fail; restoring passes 9/9 focused plus 56 prior. tsc and full
+  release gate green for this tree.
+## 0.35.55 — opt-in session-root state core/settings slice (2026-08-24)
+
+### Fix
+  Ported the valid state-root portion of PR #21 onto current main without
+  merging the stale PR verbatim. New dependency-free
+  extensions/glla-state-root.ts owns the typed global root selector and
+  session-directory resolution so goal-loop-core can select a root without a
+  settings import cycle. The historical <cwd>/.pi-glla workingDir remains
+  the default; sessionDir is explicit opt-in and resolves to the top-level Pi
+  session directory (or PI_SESSION_FILE's parent for worker processes).
+  Session-root mode is global-only because project settings.json lives inside
+  the selected root. Pending sessionDir resolution is a write boundary:
+  core directory/ledger/queue/sentinel/audit-log writes defer rather than
+  recreate an ambiguous cwd tree, and old .pi-gla/.pi-glla trees are never
+  migrated or deleted by the new mode. The settings menu exposes the two
+  choices and project attempts to override stateRoot are stripped.
+
+### Tests
+  tests/state-root.test.ts covers default cwd persistence, opt-in session-root
+  persistence, pending-write/no-migration behavior, PI_SESSION_FILE fallback,
+  and global-only settings round-trip. settings-editors and
+  settings-menu-complete pin the UI/provenance surface; the long-term
+  preferences boundary now checks the dependency-free global path owner.
+  Red/green proved the session-root branch is required (2 of 5 focused tests
+  fail when neutered; restored 5/5). tsc and focused tests pass before the
+  full release gate.
+## 0.35.54 — RESUMABLE_STOP honors the v0.35.31 "metric never moved" stop (2026-08-24)
+
+### Fix
+  Collect-pass HIGH finding: the v0.35.31 "metric never moved" stop reason
+  promises "/loop resume retries or /loop stop" in its own message, but the
+  RESUMABLE_STOP predicate in /loop resume never matched that prefix - the
+  promised command answered "No held loop to resume", and with
+  propose_loop_refine gated on an ACTIVE loop, the only recovery was
+  /loop stop + a fresh start discarding iteration history. Same class as
+  the v0.35.25 issue-#14 zombie prefix bug (fixed there for zero-stream,
+  missed for this brand-new prefix). The prefix is now resumable: resuming
+  re-arms the error/stuck/stall counters while preserving iteration, best,
+  and history; if the metric is still dead it re-stops loudly after its
+  window, and a measure-changing propose_loop_refine (usable again once
+  resumed) re-scopes the measure era so the never-moved grace re-arms.
+
+### Tests
+  tests/metric-never-moved-resumable.test.ts: behavioral - a loop parked by
+  the exact production reason string resumes via /loop resume with
+  iteration/best/history preserved and all three streak counters re-armed;
+  negative pin - a bounded stop ("max iterations reached") stays
+  non-resumable. Red-proven by removing the predicate clause (behavioral
+  fails, negative pin stays green).
+## 0.35.53 — false repair card after abort+reload: parser marker fix + contract-derived objective heal (2026-08-24)
+
+### Fix
+  note.md Now: "objective needs repair issue, but before reload it looked
+  fine". Field forensics (neonbreak, item 20260823082852-in3rc7): the list
+  draft batch wrote an item with objective "" and the ENTIRE intent inside
+  the verification contract - extractVerificationContract's line marker
+  regex `verify\b[^:]*:` misread the imperative sentence "Verify the
+  shipped PREMIUM-UIUX pass (...): confirm ..." as a contract marker
+  ("verify" is both a marker word and an ordinary imperative verb), leaving
+  the objective empty. The activation gate then correctly flagged "empty"
+  and jammed a repair card ahead of the item - 42
+  faulty_objective_list_activation_blocked events over 22 hours, an endless
+  repair-card loop that wedged the session. Two-layer durable fix:
+  (1) WRITER - the line marker for the ambiguous verbs now requires the
+  colon immediately ("Verify:" / "Verify when:" / "Verification:");
+  "done"/"done when"/"verified when" keep a bounded 60-char decorated-marker
+  gap so prose tails cannot masquerade as markers either. The field text
+  now parses with the real objective and only the grep tail as contract.
+  (2) READER - legacy items already persisted with an empty objective plus
+  a clean, actionable contract derive their objective deterministically
+  from the contract's leading imperative sentence at activation
+  (list_objective_derived_from_contract) instead of demanding a repair
+  card. Empty objective + absent or suspicious contract still takes the
+  true broken-objective repair path, unchanged.
+
+### Tests
+  tests/false-repair-card.test.ts: the exact field text parses with its
+  intent in the objective; short-marker and decorated-marker forms still
+  parse; derivation unit rules (first sentence, suspicious/non-imperative
+  contracts rejected); behavioral - a legacy stuck item activates with the
+  derived objective (no repair demand, contract preserved), a truly broken
+  item still triggers the repair card, and a fresh /list add of the field
+  text activates directly end-to-end. Red-proven by neutering both layers
+  (4 of 6 fail; the true-broken-path tests stay green).
+## 0.35.52 — context hygiene: era-scope failed error-only turns out of the effective context (2026-08-24)
+
+### Fix
+  note.md Now: "failed requests add to the context, while clearly adding
+  nothing of value". When retries are exhausted, the failed assistant turn
+  (stopReason "error", errorMessage set, content empty/partial) STAYS in
+  agent state and the session - pi strips it from live state only for
+  mid-flight retries. Every later LLM call receives it and compaction
+  summarizes it; nothing downstream filters these. Field evidence (polis,
+  2026-08-23): a run of 503/network_error/retry-cancelled turns drove the
+  estimated context to 122.7% of the 200k window, and auto-compaction then
+  aborted on its own bloated summarization input. New
+  extensions/context-hygiene.ts: a durable bounded rule drops error-only
+  assistant turns (stopReason "error", NO tool-call blocks) from the
+  effective context EXCEPT the most recent one, which stays so the model
+  sees why the previous attempt failed on the retry send. Applied at two
+  points: the `context` event projection (per-send, transcript untouched -
+  alongside the v0.35.51 payload guard) and `session_before_compact`
+  (prunes the shared preparation object the compaction runner summarizes,
+  shrinking the summarizer request and keeping failures out of the summary).
+  Tool-call-carrying error turns own paired toolResults and stay intact;
+  "aborted" turns are user-intent boundaries and are never touched. Drops
+  are ledgered (context_hygiene_dropped / context_hygiene_compaction_input).
+
+### Tests
+  tests/context-hygiene.test.ts: predicate (tool-carrying/aborted/healthy
+  never droppable); bounded drop rule (newest kept, older dropped, identity
+  preserved at/under the window, configurable window); seeded bloat (60
+  failures collapse, normal turns survive verbatim); in-place compaction
+  preparation pruning; behavioral wiring through MockPi for both hooks with
+  ledger assertions and clean-history no-op. Red-proven by neutering both
+  production call sites.
+## 0.35.51 — payload guard: bound inline image bytes on every outgoing LLM call (2026-08-24)
+
+### Fix
+  note.md Now: "req body too large due to images in context". Generated
+  images accumulate in conversation history as inline base64 blocks until
+  the provider rejects the request with 413 ("Downloaded image content
+  cannot exceed 30MB" / "Request Entity Too Large") - and every
+  main-model-recovery probe re-sent the same bloated history, so recovery
+  could never classify or heal the failure; the session was wedged until a
+  manual restart WITHOUT history. Two-layer durable fix: (1) a new
+  extensions/payload-guard.ts projects the outgoing message list at the pi
+  `context` event (fired before EVERY LLM call), bounding cumulative
+  inline-image bytes to 16MB - evicting the OLDEST images first, always
+  keeping the newest two, replacing each evicted block with a short text
+  placeholder. Disk history is untouched (per-send projection), and the
+  chokepoint protects ordinary turns AND recovery probes alike. Evictions
+  are ledgered as payload_guard_eviction. (2) classifyMainModelFailure now
+  maps 413/payload-size texts to "transient" - retryable in place, because
+  the payload guard (not a fallback-model switch) heals the size; the old
+  "unknown" classification burned the whole chain on useless rotations.
+
+### Tests
+  tests/payload-guard.test.ts: under-budget pass-through (same identity);
+  oldest-first eviction with newest-two floor; floor holds when the budget
+  cannot be met; idempotent projection, non-image content untouched;
+  behavioral wiring (context handler projects + ledgeres; under-budget
+  passes unprojected); 413 texts classify transient (not unknown, not
+  context-overflow). Red-proven by neutering both production sites.
+## 0.35.50 — same-process session successors auto-resume the main thread (2026-08-23)
+
+### Fix
+  note.md Now #2: session-start auto-resume asymmetry. The v0.35.23 loop
+  branch treats a SAME-PROCESS session successor (shutdown recorded in the
+  owner sidecar with a non-quit reason, previous pid === current pid) as
+  mid-flight continuity and resumes held loops - but a plain ACTIVE goal
+  held ("restored on session load - held for explicit resume") and a parked
+  completion-audit claim stayed parked in that exact corner: from the
+  user's seat, the list kept going after the session replacement while the
+  goal sat "awaiting first turn". The goal restore gate and the auditor
+  claim's canRecoverNow now accept the same consent, refined per the
+  v0.34.49 one-shot identity law: a PRESENT handoff marker is authoritative
+  even when mismatched (rejection holds); only an ABSENT marker with a
+  same-pid non-quit shutdown is continuity - the same distinction
+  listOperationLifecycleResume already draws. Different-pid crash
+  successors and cold loads still hold for an explicit decision;
+  Auto-resume stays the only load-time automation for them.
+
+### Tests
+  tests/same-process-successor-resume.test.ts: same-process successor
+  resumes a held ACTIVE goal (continuation dispatched, no stale interrupt
+  marker); same-process successor auto-retries a parked completion claim
+  (audit_recovery_auto_retry_claimed fence in the ledger); different-pid
+  crash successor still HOLDS (cold-load law). Red-proven by neutering
+  both consent sites; the v0.34.49 mismatched-marker identity test stays
+  green against the refined consent.
+## 0.35.49 — parent-side silence watchdogs close the auditor-AWOL gap (2026-08-23)
+
+### Fix
+  Field evidence across five projects (football-forever, doomtap,
+  junk-runner, email-api-compare, vps-compare): a detached auditor worker
+  whose provider hangs emits ONE boot RPC event (or none) and then total
+  silence. The v0.34.57 no-progress watchdog only arms while heartbeats
+  stay FRESH, so a stale heartbeat disarmed it, the worker's own stall
+  brake was the only other bound, and every doomed attempt burned its full
+  30m wall while the goal sat "auditing" and the queue looked dead. The
+  poll loop now owns two complementary silence axes with the same
+  running-tool exemption: heartbeat-stale (had an event, went silent for
+  the window) and first-event-timeout (never emitted anything within
+  firstEventTimeoutMs, a new runtime knob defaulting to the same window).
+  Both demote the HUD to quiet, emit auditor_stalled, terminate the
+  worker, and return retryable "timeout" infra - which the existing
+  fallback ladder re-drives with its eager 5s first retry instead of the
+  wall.
+
+### Tests
+  tests/auditor-stall-watchdog.test.ts: three workers (silent since boot,
+  one-boot-heartbeat-then-silence, tool-open-silent) prove both axes fail
+  fast BEFORE the wall, classify as retryable infra, SIGTERM the worker,
+  and remove the job scratch; the third pins the running-tool exemption.
+  Red-proven against pre-change code: both stall runs burned the full
+  wall and never stalled. tests/auditor-process.test.ts heartbeat test
+  disarms the new axis (firstEventTimeoutMs) to isolate its own.
+## 0.35.48 — overdue-wait backstop respects the dispatch-surface gates (2026-08-23)
+
+### Fix
+  Audit-pass finding: overdueWaitBackstop mutated durable state (parked to
+  active, pauseResumeAt cleared) without checking the
+  extensionApiStale/sessionHandoffPending/stale-terminal or
+  mainModelRecoveryActive gates - during a latched-stale heartbeat a
+  durably parked wait could become an ACTIVE goal with no dispatch until a
+  fresh session_start, breaking the paused-is-safe invariant. The backstop
+  now refuses mid-handoff and stale-latched windows, and under an active
+  main-model recovery releases ONLY recovery-routed waits (the probe route
+  re-parks with a fresh resumeAt on failure) - unrelated agent-authored
+  waits stay parked until recovery resolves. The gates sit BEFORE the
+  lastOverdueWaitKey one-shot latch so skipped windows stay retriable.
+
+## 0.35.47 — completions/handler parity for /list and /loop verbs (2026-08-23)
+
+### Fix
+  Audit-pass finding: verbs handled by the dispatchers but absent from the
+  subcommand completions - /list add|import|rm (and pause, caught while
+  pinning), and /loop resume|refine|polish. All seven now appear in their
+  getArgumentCompletions tables with accurate descriptions. A generic
+  parity pin in tests/command-registration-collisions.test.ts scans every
+  `sub === "x"` dispatch literal inside cmdList/cmdLoop and fails when a
+  handled verb has no completion entry - future verbs cannot ship
+  half-registered.
+
+## 0.35.46 — /glla agents --tail sanitization + bounded scan reads (2026-08-23)
+
+### Fix
+  Audit-pass finding, two parts: (1) child-transcript tail lines were
+  rendered through ctx.ui.notify WITHOUT ANSI/control-character
+  sanitization - unlike every other external-text projection - so a
+  hostile child transcript could emit terminal escape sequences;
+  formatTranscriptEntry now runs all output paths (both [raw] fallbacks
+  and the [role] text path) through sanitizeDisplayText. (2) The candidate
+  scan synchronously read up to 25 FULL transcript files on the main
+  thread; the reader contract now takes an optional maxBytes and the
+  production command passes a real partial tail read (256 KiB window,
+  TRANSCRIPT_SCAN_MAX_BYTES), so the scan touches at most the last 256 KiB
+  of each candidate. The single matched file still gets a full read so the
+  "last N of M" detail stays honest.
+
+## 0.35.45 — plan-mode seeded hint separator (2026-08-23)
+
+### Fix
+  Audit-pass finding: planNote ended "...than a regular draft." and was
+  concatenated directly with the label hint, producing
+  "...regular draft.Goal drafting - deep planning: ..." in the notified
+  seeded hint. The join is now explicit (planNote ? `${planNote} ` : "").
+  Behavioral test drives the real /goal plan command with a seed and
+  asserts the notified hint reads "regular draft. Goal drafting - deep
+  planning:"; proven red with the glued concatenation restored.
+
+## 0.35.44 — draftingDepth dead state removed; orphaned-gate windows closed (2026-08-23)
+
+### Fix
+  Audit-pass finding, three parts: (1) the draftingDepth runtime global was
+  write-only dead state - set in startDrafting, reset in clearDraftingState,
+  zero readers (template selection uses the depth parameter) - removed
+  outright; "no target => normal depth" now holds by construction, so no
+  consumer can observe stale depth across proposal-completion paths.
+  (2) The two bare `draftingTarget = null` completion paths that skipped the
+  drafter-model restore (batch-activation conflict refusal, zombie-twin
+  rejection) now restore like every other exit. (3) beginDrafterModel moved
+  inside a try that clears the drafting gate on throw - a throw used to
+  leave the orphaned gate startDrafting's own header warns about.
+
+## 0.35.43 — refine re-baselines specChecked with the spec write (2026-08-23)
+
+### Fix
+  Audit-pass finding: refine's orchestrator-side spec write updated
+  specHash but not loop.specChecked, so the next tick saw checked >
+  specChecked against the OLD file's count and ledged spec_item_progress
+  attributed to the agent's iteration - unearned progress feeding the
+  multi-signal stuck gate (the user confirmed the respec; the agent may
+  have done nothing). The refine handler now re-baselines specChecked
+  together with specHash after writing the new spec.
+
+## 0.35.42 — measure-era scoping for loop movement accounting (2026-08-23)
+
+### Fix
+  Audit-pass finding: applyRefinement re-baselines best/last/stall on a
+  measure-changing refine but keeps history, so OLD-era improved entries
+  made both movement checks permanently true for the NEW metric era - the
+  v0.35.31 flat-reading grace could never apply after a measure-changing
+  refine, and a dead new metric could never earn its never-moved stop.
+  applyMeasurement now scopes metricHasMoved and metricNeverMoved to the
+  current measure era (history after the last measure-changing
+  refinement's iteration; the boundary was already recorded on every
+  LoopRefinement). Two twin tests proven red without the scoping, green
+  with it.
+
+## 0.35.41 — the last two loop-stop routes announce queue resumption (2026-08-23)
+
+### Fix
+  Audit-pass finding: v0.35.22's "ends by ANY route ... ANNOUNCE loudly"
+  contract was only wired into some stop routes. The stuck-ladder stop and
+  the provider-error/abort-cap stop notified the loop line but never
+  announced that waiting list items can start again - a dead silent entry.
+  Both routes now call announceQueuedListAfterLoopEnd (exported from
+  goal-loop.ts for the goal-activation site). Two twin behavioral tests
+  drive each production route against a seeded waiting queue; both proven
+  red with their call neutered, green restored.
+
+## 0.35.40 — regression pins for the audit-kind measurement exemption (2026-08-23)
+
+### Tests
+  Audit-pass finding: commit 28131527's audit-kind exemption in
+  applyMeasurement shipped with zero regression pin. Two twin-loop tests in
+  tests/loop-forever.test.ts now pin it: (1) identical flat-metric shapes
+  diverge by kind - the audit loop counts every flat toward plateau from
+  iteration 1 while the non-audit loop's pre-movement flats stay free;
+  (2) a dead metric gets the dedicated "metric never moved" stop on plain
+  loops but never on audit loops, whose final verdict stays plateau.
+  Red/green proven: deleting both halves of guard one fails both twins;
+  the never-moved kind-guard proved unreachable-by-construction for audits
+  (plateau always returns first) and is pinned in source instead.
+
+## 0.35.39 — README Files map is actually complete (2026-08-23)
+
+### Docs
+  Audit-pass finding: the Files map showed 4 of 7 prompts (missing both
+  plan-draft prompts shipped in v0.35.33 and goal-loop-forever-metricless)
+  and ~19 of 44 extensions files while reading as complete. The map now
+  enumerates every file - 34 extensions/ + 10 loops/ + 7 prompts/ + all
+  scripts/ - grouped by concern, with one-line descriptions verified
+  against each module's exports.
+
+# 0.35.38 — README verb-semantics documentation (2026-08-23)
+
+### Docs
+  User-requested audit finding: what /goal|/list|/loop audit MEAN vs start
+  vs the plan verbs lived only in code comments. New "What the verbs mean"
+  table right after the quick-start block (audit is deliberately three
+  machines: one-shot fix-in-pass goal, collect-then-drain list item,
+  forever cadence loop; plan = extended draft on all surfaces; verify
+  audits the CURRENT goal, not the project), the drafting-rules paragraph
+  now names plan as the fourth depth, and "Which loop?" cross-links it.
+  Includes the DECIDED semantics: /list plan takes prose only — a file
+  path stays bulk import; files mentioned inside /list plan are research
+  input, never auto-imported.
+
+## 0.35.37 — recovery welcome-back notice now fires exactly once (2026-08-23)
+
+### Fix
+  Audit-pass finding: autoResumedAt/autoResumedEvent were set by three
+  auto-recovery sites (heartbeat overdue-wait backstop, main-model provider
+  recovery, auditor provider retry) but the ONLY clearing site was MANUAL
+  resume — so the continuation prompt injected the "WELCOME BACK, YOU WERE
+  RECOVERED" directive into EVERY dispatch of a goal that kept running days
+  after one recovery. The accepted-dispatch site in sendContinuation now
+  marks the notice delivered: the stamp clears and a
+  recovery_notice_delivered ledger entry records it, so the directive is
+  injected exactly once per auto-resume. Manual /goal resume keeps its own
+  clearing (user-driven, no notice needed).
+
+## 0.35.36 — complete_goal newObjective no longer launders agent text into userSeeds (2026-08-23)
+
+### Fix
+  Audit-pass finding: the newObjective branch appended the AGENT-authored
+  objective to objectiveProvenance.userSeeds; since createdVia stays "user"
+  from creation, the v0.35.31 seed trust then treated that agent-written
+  text as explicit user prose and dispatched it verbatim past the
+  suspicious-objective fence. userSeeds is now strictly human-confirmed
+  text (creation arg, /goal tweak Confirm dialog, repair-redraft task-list
+  confirm); a newObjective pivot is recorded via its goal_tweaked ledger
+  entry and reviewed by the isolated auditor against the NEW contract in
+  the same call. Regression test proves red-on-laundering /
+  green-on-fix; behavioral consequence observed: heuristic-tripping pivots
+  on user goals now flow through the normal fence (auto-restore from the
+  durable original) instead of being waved through.
+
+## 0.35.35 — user-seed trust works with contract clauses and role markers (2026-08-23)
+
+### Fix
+  Audit-pass finding: v0.35.31's seed trust compared the CLEANED
+  goal.objective against RAW stored seeds by exact equality — but createGoal
+  strips "Done when:" clauses and Agent:/Role: declarations out of the
+  objective while keeping the raw arg as the seed, so any seeded goal WITH a
+  clause/role silently no-op'd the trust and still parked behind the
+  suspicious-objective heuristic. New pure helper objectiveIsUserSeeded()
+  normalizes BOTH sides through the same extraction pipeline the creation
+  path applies; createdVia still gates WHO is trusted (agent-authored seeds
+  gain nothing). Regression tests: clause+role user seeds dispatch verbatim;
+  reviewer-created goals with matching-cleaned seeds never get the trust.
+
+### Mechanical pre-audit: maxBuffer ceiling killed verbose green suites (2026-08-23)
+
+#### Fix
+  runMechanicalPreAuditChecks passed no maxBuffer to execFileSync, so
+  Node's default 1 MB cap applied: any contract gate whose output exceeds
+  1 MB gets its child SIGTERMed by Node and the call throws ENOBUFS —
+  which the banner logic (signal==="SIGTERM") then misreported as "killed
+  after 600s". Field incident (2026-08-23, five consecutive auditor
+  rounds on hellhunter's `bun test src/lib/game`): the gate emits ~1.17 MB
+  of ALL-PASSING output and was unpassable by construction — every attempt
+  died at ~1 MB (~15s in) while the identical tree passed green from an
+  interactive shell 19/19 times, including piped-output and single-core
+  pinned runs. Now passes maxBuffer: 64 MB, and ENOBUFS deaths no longer
+  print the misleading 600s timeout banner.
+
+## 0.35.34 — lastOutcome actually durable (2026-08-23)
+
+### Fix
+  Audit-pass finding: v0.35.30's "durable" last-outcome record was never
+  serialized — persistStateLine omitted the field and readState never
+  restored it, so any restart/reload blanked the widget retention line
+  within its 24h window (the exact failure v0.35.30 fixed). Now always
+  written (null when absent — readState spreads successive state events, so
+  an omitted key would resurrect stale values and /glla wipe could never
+  clear the record) and restored through a strict shape sanitizer (corrupt
+  lines degrade to absent, never throw). Round-trip + corruption regression
+  tests added.
+
+## 0.35.33 — plan mode: the extended draft (2026-08-22)
+
+### Add
+  /goal plan | /list plan | /loop plan — the EXTENDED DRAFT for
+  greenfield/megaplan work where the standard 5–7-question interview is too
+  shallow (user design 2026-08-22). Research BEFORE questions (Explore
+  subagents, file reads), multi-round interviewing (architecture → scope →
+  failure conditions → verification), and a structured expanded objective:
+  current-state analysis, decisions with rationale, milestone breakdown,
+  per-milestone verification contract. Deliberately NOT a separate artifact —
+  the objective itself is the single truth (the respec lesson: a second
+  document always goes stale). Trust machinery unchanged: propose_*_draft +
+  the Confirm card still gate activation; regular drafts stay the fast path.
+  New prompts prompts/goal-loop-plan.md + goal-loop-plan-loop.md; depth flag
+  on the drafting session (runtime-global, reset by clearDraftingState);
+  completions on all three commands; /list plan gated as a mutating verb on
+  stale handles. respec stays untouched (kept by user decision).
+
 ## 0.35.32 — hermetic settings round-trip test (2026-08-22)
 
 ### Fix