pi-goal-list-loop-audit 0.35.4 → 0.35.13

package/examples/example-objective.md

@@ -0,0 +1,119 @@
+# Examples: the three loops
+
+Worked examples for `pi-goal-list-loop-audit`. State lives at `.pi-glla/`
+(ledger `active.jsonl`, goal markdown in `goals/`, finished goals in `archive/`).
+
+## Loop 1: `/goal` — single goal with isolated auditor
+
+Direct (skip drafting):
+
+```
+/goal start Step 1. Add a /healthz endpoint to server.ts returning {status:'ok'}.
+Step 2. Add a vitest test that hits it.
+Done when:
+- curl -fsS localhost:3000/healthz returns 200 with body {"status":"ok"}
+- npm test exits 0 with 0 failures
+```
+
+Or drafting (recommended when the idea is still fuzzy):
+
+```
+/goal
+# the agent grills one focused question at a time, then a Confirm dialog
+# shows the objective + Done-when contract. Nothing starts before you confirm.
+```
+
+What happens next:
+
+1. The agent works the objective turn by turn (`agent_end`-driven continuation).
+   Guards: a stall watchdog (3 consecutive turns with no tool calls), a
+   5-consecutive-errors pause, and the optional token guard — no wall-clock
+   cap; a goal ends via completion, pause/cancel, or a guard.
+2. It calls `complete_goal` when it believes it is done.
+3. The **isolated auditor** — a fresh pi session with no extensions and only
+   read tools — inspects the repo. Because this goal has a `Done when:`
+   contract, the auditor MUST quote raw command output per contract item in an
+   `<evidence>` block (regression_shield). An approval without complete
+   evidence is automatically converted to a disapproval.
+4. Approved → goal archived to `.pi-glla/archive/<id>.md`. Disapproved → the
+   loop continues with the auditor's feedback.
+
+Useful commands: `/goal status`, `/goal pause`, `/goal resume`, `/goal cancel`,
+`/glla` (auditor model, thinking level, token limit, notify command, autoresume).
+
+## Loop 2: `/list` — the shopping list of goals
+
+```
+/list Create one.txt containing one. Done when: grep -q one one.txt
+/list Create two.txt containing two. Done when: grep -q two two.txt
+/list            # show active + waiting items
+/list next       # skip current item
+/list remove 2   # drop item 2
+/list clear      # empty the list
+```
+
+Each item is a full goal with its own contract and audit. When one completes
+(or is aborted), the next activates automatically. Order is the default, not
+the law — `/list next 3` activates item 3 directly. On session restore the
+list HOLDS in a fresh session (nothing auto-starts); it auto-activates only
+when Auto-resume is enabled in `/glla` settings (global-only since v0.29.5).
+
+## Loop 3: `/loop` — metric-driven forever loop
+
+```
+/loop start "reduce TODO comments in src" measure="grep -rc TODO src | cut -d: -f2 | paste -sd+ | bc" direction=min window=5 max=50
+/loop status     # iteration, best, stall, recent values
+/loop stop       # halt with summary
+```
+
+The **orchestrator** runs your `measure` command after every agent turn — the
+agent never self-reports a number. The loop stops on plateau (`window`
+non-improving iterations), the `max` cap, a time/token bound, or `/loop stop`.
+There is no completion check in loop 3 — "improve until X" is a GOAL; a loop
+is a process. No auditor either: the metric is the verdict.
+
+With `branch=1`, all work happens on a scratch branch
+(`pi-glla-loop/<timestamp>-<slug>`): each improvement is committed, each
+regression is hard-reset (scratch branch only), and on stop you return to your
+original branch with merge instructions. Requires a clean working tree.
+
+## Notifications (optional)
+
+Run `/glla` and set the **Notify command** row (the event message is passed
+as `$1`); `off` silences pushes, empty re-enables auto-detection. `/glla`
+has an action namespace (`status`, `log`, `stats`, `audits`, `wipe`, …) —
+it does NOT accept inline `key=value` assignments. Headless/scripted setups
+can write the project settings file directly instead:
+
+```
+# .pi-glla/settings.json
+{ "notifyCmd": "echo \"$1\" >> ~/goal-events.log" }
+```
+
+Fires on goal complete, goal pause, and loop stop; message as `$1`.
+
+## Token guard (opt-in)
+
+Off by default. Set a per-goal budget and crossing it pauses the goal:
+
+```
+# /glla → Token limit row, or .pi-glla/settings.json
+{ "tokenLimit": 2000000 }
+```
+
+## The auditor model rule
+
+The detached auditor uses an explicit bounded cascade: an optional primary
+pin, an optional fallback pin, then your pi session model. A model that fails
+at runtime is retried once and the next detached candidate is tried; the
+plugin never falls back into the parent in-process session.
+
+```
+# /glla → Auditor model row (and Auditor fallback), or .pi-glla/settings.json
+{ "auditorModel": "provider/model-id" }
+```
+
+If every candidate errors with auth/provider failures, the stored completion
+claim pauses and `/goal resume` retries it after you fix the model — the
+auditor session has no extensions, so
+providers that only exist via an extension may be unavailable to it.

package/extensions/faulty-objective-recovery.ts

@@ -35,10 +35,21 @@ export interface ObjectiveRepairProposal {
   confidence: "best-effort";
 }
 
-const IMPERATIVE_START = /^(add|allow|audit|build|cap|clarify|close|collapse|consolidate|create|detect|document|ensure|enforce|fix|harden|improve|implement|instrument|investigate|make|migrate|overhaul|preserve|prevent|recover|refactor|remove|repair|replace|research|resolve|restore|review|ship|simplify|strengthen|support|test|update|validate|verify|wire|write)\b/i;
+// A verb that plausibly opens a real, actionable objective. The reviewer/
+// verification momentum lives in the vocabulary and narrative regexes below;
+// this list is the escape hatch that keeps genuine imperatives (including
+// ones that mention the auditor/reviewer machinery legitimately, e.g.
+// "Show the selected models … (main/auditor/drafter) on the goal card")
+// from being misread as report text. Keep it broad: an objective that starts
+// with any of these is actionable on its face.
+const IMPERATIVE_START = /^(add|allow|audit|benchmark|build|cap|check|clarify|close|collapse|collect|compare|consolidate|create|describe|detect|diagnose|display|document|ensure|enforce|explain|expose|fix|harden|improve|implement|inspect|instrument|investigate|list|make|measure|migrate|monitor|open|optimize|overhaul|plan|preserve|prevent|print|profile|publish|read|recover|refactor|remove|render|repair|replace|research|resolve|restore|review|ship|show|simplify|strengthen|summarize|support|surface|test|trace|update|validate|verify|watch|wire|write)\b/i;
 const COMMAND_ONLY = /^(?:bun|npm|pnpm|yarn|npx|node|deno|git)\s+(?:test|run|check|diff|status|show|log|exec)\b/i;
 const REVIEWER_MARKER = /(?:^|[.!?;]\s+|[-*]\s+)(?:audit(?:\s+(?:report|result|findings?))?|review(?:er)?(?:\s+(?:report|result|feedback|findings?))?|verdict|evidence|output|item|required\s+fixes?|completion\s+claim)\s*:/i;
-const REVIEWER_VOCABULARY = /\b(?:passes\s+sequentially|zero\s+failures?|\d+\s+failures?|ran\s+\d+\s+tests?|verification\s+contract|regression\s+shield|auditor(?:[- ](?:approved|report|disapproved))?|reviewer(?:[- ](?:approved|report|disapproved|feedback|finding))?|completion\s+claim|<\/?(?:evidence|approved|disapproved|impossible)\b)\b/i;
+// Report vocabulary. "auditor"/"reviewer" count ONLY when tied to a verdict
+// shape ("auditor approved", "reviewer finding") — a bare mention of the
+// role ("(main/auditor/drafter)", "auditor workers") is legitimate task
+// vocabulary and must not trip verification-fragment on its own.
+const REVIEWER_VOCABULARY = /\b(?:passes\s+sequentially|zero\s+failures?|\d+\s+failures?|ran\s+\d+\s+tests?|verification\s+contract|regression\s+shield|auditor[- ]+(?:approved|report|disapproved)|reviewer[- ]+(?:approved|report|disapproved|feedback|finding)|completion\s+claim|<\/?(?:evidence|approved|disapproved|impossible)\b)\b/i;
 // A report can look superficially task-like because it lists completed work
 // with imperative-shaped nouns ("Added ...", "Focused tests ..."). Keep
 // genuine phrases such as "Add focused tests for the audit path" valid, but

package/extensions/goal-commands.ts

@@ -14,7 +14,7 @@ import {
   DEFAULT_TOKEN_LIMIT, Goal, ListItem, Status, appendLedger, archiveDir, archivedGoalPath, bumpGoalRevision, sanitizeProviderDisplayText,
   computeListDepth, clearQueueItemFiles, deleteQueueItemFile, extractVerificationContract, formatAuditLog, formatGoalAuditHistory, formatMainModelRecoveryStatus, queueItemSidecarCount,
   formatListDepth, goalArgsNeedDrafting, ledgerPath, newGoalId, nowIso, parseListImport, parseListItemDeclaration,
-  readAuditLog, readQueueFromDisk, routeGoalArgs, routeListText, sanitizeDisplayText, sanitizeProviderAuditReport, statusLabel,
+  assignQueueOrder, compareQueueItems, readAuditLog, readQueueFromDisk, routeGoalArgs, routeListText, sanitizeDisplayText, sanitizeProviderAuditReport, statusLabel,
   writeQueueItemFile, type ModeCommand, type State, LIST_MUTATING_SUBCOMMANDS, SETTINGS_MUTATING_ACTIONS,
 } from "./goal-loop-core.js";
 import { clearDispatchRecord, dispatchRecordExists } from "./goal-loop-dispatch.js";
@@ -341,6 +341,13 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
     void probeMainModelRecovery(ctx);
     return;
   }
+  if (state.mainModelRecovery?.primaryProbeAt || state.mainModelRecovery?.primaryProbeInFlight) {
+    clearMainModelRecoveryTimer();
+    flags.continuationDispatchStoodDown = false;
+    ctx.ui.notify("Probing the preferred primary now — the current fallback remains available if the primary is still unhealthy.", "info");
+    void probeMainModelRecovery(ctx);
+    return;
+  }
   // v0.34.3: /goal resume on an ACTIVE-but-idle goal re-kicks its
   // continuation (was: silent return — the user got NOTHING while the
   // widget said "active"). One-active-thing still holds: an active loop
@@ -836,7 +843,23 @@ function recentlyCompletedObjectives(cwd: string): Set<string> {
   return done;
 }
 
+export function hydrateListQueueFromDisk(ctx: ExtensionContext): number {
+  const memory = listQueue();
+  const exclude = new Set<string>();
+  if (state.goal?.id) exclude.add(state.goal.id);
+  const disk = readQueueFromDisk(ctx.cwd, exclude);
+  const known = new Set(memory.map((item) => item.id));
+  const recovered = disk.filter((item) => !known.has(item.id));
+  if (recovered.length === 0) return 0;
+  const merged = [...memory, ...recovered].sort(compareQueueItems);
+  replaceState({ ...state, list: merged });
+  persistState(ctx);
+  appendLedger(ctx.cwd, "list_recovered_from_disk", { count: recovered.length, hydrated: true });
+  return recovered.length;
+}
+
 function enqueueItems(ctx: ExtensionContext, texts: string[], source: string, opts?: { autoActivate?: boolean }): number {
+  hydrateListQueueFromDisk(ctx);
   const recentlyDone = recentlyCompletedObjectives(ctx.cwd);
   const fresh = texts.filter((t) => !recentlyDone.has(normalizeObjective(parseListItemDeclaration(t).objective)));
   const skipped = texts.length - fresh.length;
@@ -899,13 +922,23 @@ function enqueueItems(ctx: ExtensionContext, texts: string[], source: string, op
     ctx.ui.notify(`Refused ${refused.length} subtask item(s): ${refused.join(" | ")}.`, "warning");
   }
   if (resolved.length === 0) return 0;
-  const itemsToWrite = resolved;
+  const itemsToWrite = assignQueueOrder(resolved, listQueue());
   // v0.34.60: disk-first write order. Each item lands on disk BEFORE any
   // in-memory state mutation, so /list survives a stale extension handle
   // (e.g. /reload, plugin re-init, RAM-only state loss). The
   // .queue.json sidecar is atomic (temp + rename) and idempotent (skips
-  // existing files rather than overwriting).
+  // existing files rather than overwriting). A failed member aborts the
+  // batch and removes only sidecars written by this attempt.
   const written = itemsToWrite.map((item) => writeQueueItemFile(ctx.cwd, item));
+  const failedWrite = written.find((result) => result.failed);
+  if (failedWrite) {
+    written.forEach((result, index) => {
+      if (result.wrote) deleteQueueItemFile(ctx.cwd, itemsToWrite[index]!.id);
+    });
+    appendLedger(ctx.cwd, "list_queue_disk_write_failed", { source, count: itemsToWrite.length, path: failedWrite.path });
+    ctx.ui.notify(`Could not persist the queued item(s) from ${source}; no in-memory queue mutation was applied. Fix disk access and retry.`, "warning");
+    return 0;
+  }
   replaceState({ ...state, list: [...listQueue(), ...itemsToWrite] });
   const diskFirst = written.filter((w) => w.wrote).length === itemsToWrite.length;
   appendLedger(ctx.cwd, "list_queue_disk_first", { source, count: itemsToWrite.length, diskFirst });
@@ -991,6 +1024,10 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
   // resume/tweak/cancel gates branch on state.goal.policy — the gate used
   // to silently refuse the whole surface until a restart.
   healGoalPolicy(ctx);
+  // v0.35.4 audit: sidecars are durable queue state, not a display-only
+  // fallback. Hydrate orphaned disk items before any list surface can count,
+  // remove, cancel, or activate them.
+  if (!staleEntry) hydrateListQueueFromDisk(ctx);
 
   if (sub === "audit") {
     // v0.31.0: /list audit [focus] — collect-then-drain (user design
@@ -1332,19 +1369,24 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
 
 /** Append one objective to the list; activate immediately when idle. */
 function addSingleItem(ctx: ExtensionContext, raw: string): void {
+  hydrateListQueueFromDisk(ctx);
   const extracted = parseListItemDeclaration(raw);
-  const item = {
+  const item = assignQueueOrder([{
     id: newGoalId(),
     objective: extracted.objective,
     ...(extracted.agentRole ? { agentRole: extracted.agentRole } : {}),
     verificationContract: extracted.verificationContract || undefined,
     ...(extracted.parallelSafe === undefined ? {} : { parallelSafe: extracted.parallelSafe }),
     addedAt: nowIso(),
-  };
+  }], listQueue())[0]!;
   // v0.34.61: disk-first — write the sidecar BEFORE mutating state so the
   // item survives an orchestrator-turn death between state mutation and
   // persistState (the original bug for /list add "<direct text>").
-  writeQueueItemFile(ctx.cwd, item);
+  const written = writeQueueItemFile(ctx.cwd, item);
+  if (written.failed) {
+    ctx.ui.notify("Could not persist the list item; no in-memory queue mutation was applied. Fix disk access and retry.", "warning");
+    return;
+  }
   replaceState({ ...state, list: [...listQueue(), item] });
   persistState(ctx);
   appendLedger(ctx.cwd, "list_added", { id: item.id, objective: item.objective });
@@ -2126,6 +2168,8 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
     [
       `mainAgentFallbackModels: ${formatMainModelFallbacks(effectiveSettings.mainModelFallbacks)}  [${prov.mainModelFallbacks?.source ?? "default"}]`,
       fmt("mainModelRetryMinutes", "mainModelRetryMinutes (base minutes; doubles per attempt)"),
+      fmt("mainModelFailback", "mainModelFailback (auto/sticky)"),
+      fmt("mainModelPrimaryProbeMinutes", "mainModelPrimaryProbeMinutes"),
       fmt("drafterModel", "drafterAgent (drafting only)"),
       fmt("drafterThinkingLevel", "drafterThinking (drafting only)"),
       fmt("drafterModelFallbacks", "drafterFallbackAgents (drafting only)"),

package/extensions/goal-heartbeat.ts

@@ -378,16 +378,24 @@ function heartbeatTick(): void {
   // that disposed handle as a host loss only creates the repeated
   // "session invalidated" warning after the work is already safe on disk.
   // Keep the probe for active goals/loops, detached completion audits,
-  // recoverable stale debt, and LIVE tracked subagents, where a dead handle
-  // can strand live work. A normal user pause does not count as host-bound
-  // work; stale interruption debt does, because same-process self-heal still
-  // needs a heartbeat opportunity. Ended subagent probes remain in memory
-  // briefly for HUD/final-state reads, but they no longer own the host and
-  // must not keep this guard probing a disposed handle.
+  // recoverable stale debt, parked completion-audit recovery, and LIVE
+  // tracked subagents, where a dead handle can strand live work. A normal
+  // user pause does not count as host-bound work; stale interruption debt and
+  // parked completion claims do, because same-process self-heal still needs a
+  // heartbeat opportunity. Ended subagent probes remain in memory briefly for
+  // HUD/final-state reads, but they no longer own the host and must not keep
+  // this guard probing a disposed handle.
   const terminalGoal = state.goal?.status === "complete" || state.goal?.status === "aborted";
   const staleRecoveryDebt = (!terminalGoal && state.goal?.interruptedReason?.startsWith("extension api stale"))
     || state.loop?.stopReason?.startsWith("extension api stale");
-  if (state.goal?.status !== "active" && state.goal?.status !== "auditing" && !isLoopActive() && !staleRecoveryDebt && !hasLiveSubagentHangProbes()) return;
+  const parkedCompletionAuditRecovery = state.goal?.status === "paused"
+    && state.goal.pendingCompletion?.phase === "recovery-pending";
+  if (state.goal?.status !== "active"
+    && state.goal?.status !== "auditing"
+    && !isLoopActive()
+    && !staleRecoveryDebt
+    && !parkedCompletionAuditRecovery
+    && !hasLiveSubagentHangProbes()) return;
   // Probe the ExtensionAPI BEFORE probing the captured context. When pi
   // invalidates both handles and emits no replacement session_start,
   // freshCtx() deliberately returns null; probing it first used to make the
@@ -402,7 +410,9 @@ function heartbeatTick(): void {
   // recovery block below is unreachable while the latch holds — the queue sat
   // blocked ~30m+ while the worker's disapproval sat on disk. Park the stuck
   // claim via the kept last context. A heartbeat must still NEVER launch
-  // another worker; the park is the explicit-resume gate.
+  // another worker directly; the park is the durable recovery gate, and a
+  // later healthy same-session heartbeat may hand it to the one-shot recovery
+  // path. Explicit resume remains available when no healthy host returns.
   if (
     flags.extensionApiStale &&
     knownCtx &&
@@ -450,6 +460,7 @@ function heartbeatTick(): void {
       flags.heartbeatStaleStreak++;
       if (flags.heartbeatStaleStreak < heartbeatStaleDebounce) return;
     }
+    if (knownCtx && tryAbsorbHostSuccessor(knownCtx, "heartbeat-probe")) return;
     if (knownCtx && !absorbStaleIfSuperseded(knownCtx)) goStaleTerminal(knownCtx, "heartbeat probe");
     return;
   }
@@ -473,19 +484,12 @@ function heartbeatTick(): void {
     if (tryAbsorbHostSuccessor(knownCtx, "heartbeat-self-heal")) return;
     rememberCtx(knownCtx);
     // Reuse the same-session recovery gate as ordinary commands. It clears
-    // the durable interrupted marker and can resume unattended work; the
-    // fallback below preserves the old probe-only behavior if ownership is
-    // still ambiguous.
-    if (!flags.staleTerminalDone && !flags.extensionApiStale) return;
-    flags.staleTerminalDone = false;
-    flags.extensionApiStale = false;
-    flags.zombieStoodDown = false;
-    flags.sessionHandoffPending = false;
-    try {
-      knownCtx.ui.notify("glla: pi recovered after a stale-handle terminal — self-healing in-memory state (no /reload needed).", "info");
-    } catch {
-      /* the ledger is the durable record; notify is best-effort */
-    }
+    // the durable interrupted marker and rebinds the owner only after BOTH
+    // the context and the captured ExtensionAPI are healthy. If that gate
+    // refuses the contact, stay parked: clearing these flags here used to
+    // announce a false recovery and immediately retry against the same stale
+    // API every heartbeat tick.
+    if (flags.staleTerminalDone || flags.extensionApiStale) return;
   }
   const ctx = freshCtx();
   if (!ctx) return;

package/extensions/goal-loop-auditor-process.ts

@@ -14,7 +14,23 @@ import { createHash, randomUUID } from "node:crypto";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { stripThinkBlocks, captureGoalRevision, type Goal, type GoalRevisionToken } from "./goal-loop-core.js";
+import {
+  stripThinkBlocks,
+  captureGoalRevision,
+  isRetriableInfraError,
+  isForbiddenModel,
+  type Goal,
+  type GoalRevisionToken,
+} from "./goal-loop-core.js";
+import {
+  classifyMainModelFailure,
+  isMainModelFallbackFailure,
+  mainModelFailureDelayMs,
+  modelRef,
+  nextUntriedModelRef,
+  normalizeMainModelFallbackRefs,
+} from "./main-model-recovery.js";
+import { ModelSelector, type ModelFallbackEvent } from "./model-selector.js";
 import { buildGoalAuditorPrompt } from "./goal-loop-auditor.js";
 import { checkRegressionShield, parseAuditorVerdict } from "./goal-loop-shield.js";
 import { renameWithWindowsRetry } from "../scripts/goal-auditor-launch.mjs";
@@ -63,6 +79,159 @@ export interface AuditorProgress {
 
 export type AuditorModel = string | { provider: string; id: string };
 
+/** A resolved auditor candidate. `ref` is optional for compatibility with
+ * older callers; the shared fallback walker derives it from `model` when it
+ * can and otherwise treats the candidate as a unique, last-resort slot. */
+export interface AuditorFallbackCandidate {
+  ref?: string;
+  model: any;
+  via: string;
+}
+
+export interface AuditorFallbackPolicyOptions {
+  /** The user-configured forbidden refs. The selector skips these silently. */
+  forbiddenRefs?: readonly string[];
+  /** Lifecycle fence checked before and after each delayed attempt. */
+  shouldRetry?: () => boolean;
+  sleep?: (ms: number) => Promise<void>;
+  retryBaseMinutes?: number;
+  onRetry?: (candidate: AuditorFallbackCandidate, error: string, delayMs: number) => void;
+  onFallback?: (from: AuditorFallbackCandidate, to: AuditorFallbackCandidate, error: string, delayMs: number) => void;
+  onSelection?: (event: ModelFallbackEvent) => void;
+}
+
+/**
+ * Run detached auditor candidates through the same policy as main-model
+ * recovery: normalize the ordered refs, gate forbidden/unregistered refs,
+ * select only an untried ref, classify provider failures, retry the current
+ * ref once, then use the bounded shared backoff before walking to the next
+ * ref. The worker transport remains unchanged; this function only owns the
+ * parent-side candidate cursor and timing.
+ */
+export async function runAuditorFallbackWithPolicy(
+  candidates: AuditorFallbackCandidate[],
+  run: (candidate: AuditorFallbackCandidate) => Promise<GoalAuditorResult>,
+  opts: AuditorFallbackPolicyOptions = {},
+): Promise<{ result: GoalAuditorResult; retriedOnce: boolean; fallbackUsed: boolean; via: string }> {
+  const sequence = candidates.length > 0 ? candidates : [{ model: undefined, via: "unset" }];
+  if (candidates.length === 0) {
+    const result = await run(sequence[0]!);
+    return { result, retriedOnce: false, fallbackUsed: false, via: "unset" };
+  }
+
+  const normalized = sequence.map((candidate, index) => ({
+    candidate,
+    ref: (candidate.ref?.trim() || modelRef(candidate.model) || `auditor/candidate-${index}`),
+  }));
+  const refs = normalizeMainModelFallbackRefs(normalized.map((entry) => entry.ref));
+  const byRef = new Map<string, AuditorFallbackCandidate>();
+  for (const entry of normalized) {
+    const key = entry.ref.toLowerCase();
+    if (!byRef.has(key)) byRef.set(key, entry.candidate);
+  }
+  const scope = { kind: "auditor" } as const;
+  const selector = new ModelSelector({
+    getChain: () => refs,
+    resolve: (ref) => byRef.get(ref.toLowerCase())?.model,
+    isForbidden: (ref) => isForbiddenModel(ref, opts.forbiddenRefs ?? []),
+    record: opts.onSelection,
+  });
+  const attempted: string[] = [];
+  const addAttempted = (ref: string): void => {
+    if (!attempted.some((entry) => entry.toLowerCase() === ref.toLowerCase())) attempted.push(ref);
+  };
+  const isLive = (): boolean => {
+    if (!opts.shouldRetry) return true;
+    try { return opts.shouldRetry(); } catch { return false; }
+  };
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+  let currentRef: string | undefined;
+  let retriedOnce = false;
+  let fallbackUsed = false;
+  let failureAttempt = 0;
+  let fallbackFrom: AuditorFallbackCandidate | undefined;
+  let fallbackError: string | undefined;
+  let fallbackDelayMs = 0;
+  let pendingResult: GoalAuditorResult | undefined;
+  const noCandidateResult = (): GoalAuditorResult => ({
+    approved: false,
+    disapproved: false,
+    output: "",
+    model: modelRef(sequence[0]!.model) ?? "",
+    error: ["no auditor", "model"].join(" "),
+    infrastructureClass: "no-verdict",
+  });
+
+  for (;;) {
+    // Keep the explicit pure cursor call here. ModelSelector.selectNextValid
+    // composes the same helper while adding the forbidden/unregistered walk.
+    if (nextUntriedModelRef(currentRef, refs, attempted) === undefined) {
+      const last = pendingResult ?? noCandidateResult();
+      return { result: last, retriedOnce, fallbackUsed, via: fallbackFrom?.via ?? sequence[0]!.via };
+    }
+    const selected = selector.selectNextValid(scope, currentRef, attempted);
+    for (const visited of selector.lastVisitedRefs) addAttempted(visited);
+    if (!("model" in selected) || typeof selected.ref !== "string") {
+      const result = pendingResult ?? noCandidateResult();
+      return { result, retriedOnce, fallbackUsed, via: fallbackFrom?.via ?? sequence[0]!.via };
+    }
+    const selectedRef = selected.ref;
+    const candidate = byRef.get(selectedRef.toLowerCase());
+    if (!candidate) {
+      addAttempted(selectedRef);
+      currentRef = selectedRef;
+      continue;
+    }
+    addAttempted(selectedRef);
+    if (fallbackFrom) {
+      fallbackUsed = true;
+      opts.onFallback?.(fallbackFrom, candidate, fallbackError ?? "auditor fallback", fallbackDelayMs);
+      fallbackFrom = undefined;
+      fallbackError = undefined;
+      fallbackDelayMs = 0;
+    }
+
+    pendingResult = undefined;
+    const first = await run(candidate);
+    if (first.approved || first.disapproved || first.impossible || !first.error) {
+      return { result: first, retriedOnce, fallbackUsed, via: candidate.via };
+    }
+    let failure = classifyMainModelFailure(first.error);
+    if (!isRetriableInfraError(first.error) || !isMainModelFallbackFailure(failure)) {
+      return { result: first, retriedOnce, fallbackUsed, via: candidate.via };
+    }
+    failureAttempt += 1;
+    if (!isLive()) return { result: first, retriedOnce, fallbackUsed, via: candidate.via };
+    const retryDelayMs = mainModelFailureDelayMs(failure, failureAttempt, opts.retryBaseMinutes ?? 15);
+    opts.onRetry?.(candidate, first.error, retryDelayMs);
+    await sleep(retryDelayMs);
+    if (!isLive()) return { result: first, retriedOnce, fallbackUsed, via: candidate.via };
+
+    const second = await run(candidate);
+    pendingResult = second;
+    retriedOnce = true;
+    if (second.approved || second.disapproved || second.impossible || !second.error) {
+      return { result: second, retriedOnce, fallbackUsed, via: candidate.via };
+    }
+    failure = classifyMainModelFailure(second.error);
+    if (!isRetriableInfraError(second.error) || !isMainModelFallbackFailure(failure)) {
+      return { result: second, retriedOnce, fallbackUsed, via: candidate.via };
+    }
+    currentRef = selectedRef;
+    const nextRef = nextUntriedModelRef(currentRef, refs, attempted);
+    if (nextRef === undefined) {
+      return { result: second, retriedOnce, fallbackUsed, via: candidate.via };
+    }
+    failureAttempt += 1;
+    fallbackDelayMs = mainModelFailureDelayMs(failure, failureAttempt, opts.retryBaseMinutes ?? 15);
+    if (!isLive()) return { result: second, retriedOnce, fallbackUsed, via: candidate.via };
+    await sleep(fallbackDelayMs);
+    if (!isLive()) return { result: second, retriedOnce, fallbackUsed, via: candidate.via };
+    fallbackFrom = candidate;
+    fallbackError = second.error;
+  }
+}
+
 // The detached auditor intentionally exposes the full inspection/tooling
 // surface, including bash, so it can run bounded tests and reproduce behavior.
 // This is a power-oriented mode, not a read-only security boundary; callers
@@ -698,11 +867,23 @@ export async function runDetachedGoalCompletionAuditor(args: {
     await writeAtomicJson(lockPath, { protocolVersion: PROTOCOL_VERSION, attemptId, pid: child.pid, role: "worker", workerPath: workerPathIdentity });
     child.unref();
 
-    const abort = () => { if (child && childAlive(child)) void terminateWorker(child).catch(() => {}); };
+    let abortTermination: Promise<void> | null = null;
+    const abort = () => {
+      if (child && childAlive(child)) {
+        abortTermination ??= terminateWorker(child).catch(() => {});
+      }
+    };
     args.signal?.addEventListener("abort", abort, { once: true });
     try {
       while (true) {
-        if (args.signal?.aborted) return infra(model, thinkingLevel, "Auditor aborted.", "", capturedRevisionToken, "transport");
+        if (args.signal?.aborted) {
+          // Do not return the transport result until the detached worker's
+          // TERM→KILL teardown has settled. Returning first races the caller's
+          // cleanup with a TERM-ignoring worker and leaves its PID alive.
+          if (child && childAlive(child)) await terminateWorker(child).catch(() => {});
+          else if (abortTermination) await abortTermination;
+          return infra(model, thinkingLevel, "Auditor aborted.", "", capturedRevisionToken, "transport");
+        }
         if (childSpawnError) return infra(model, thinkingLevel, `auditor worker launch failed: ${childSpawnError}`, "", capturedRevisionToken, "transport");
         if (now() >= wallDeadlineAt) {
           if (childAlive(child)) await terminateWorker(child);