pi-goal-list-loop-audit 0.35.66 → 0.35.68

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.35.68 — bound-stop recovery (2026-08-26)
+
+### Fixed
+  Explicit `/loop resume` now recovers time- and token-bound stops as fresh
+  supervised windows without discarding iteration, history, or best-value
+  state. Recoverable stopped loops can accept a confirmed
+  `propose_loop_refine` change while remaining stopped until explicitly
+  resumed. Clean max-iteration and finished loops remain terminal; automatic
+  startup does not silently reset an explicit budget.
+
+### Tests
+  Coverage verifies fresh time windows, token-budget resets, preserved loop
+  history, stopped-loop refinement, and the unchanged max-iteration guard.
+
+## 0.35.67 — in-band provider-result recovery (2026-08-26)
+
+### Fixed
+  Repeated successful tool transports that carry a strong 503/429/network
+  provider pane no longer enter loop stuck or plateau accounting as ordinary
+  work. After the same tool/result fingerprint repeats, the turn is routed
+  through the existing provider-recovery envelope; one-off status text in a
+  searched document remains ordinary output.
+
+### Tests
+  Coverage spans provider-marker classification, repeated-pane detection,
+  loop-turn exemption, durable recovery parking, and the unchanged real-error
+  and repetition paths. The full release gate remains green.
+
 ## 0.35.66 — compiled-host auditor launcher (2026-08-26)
 
 ### Fixed

package/extensions/goal-loop-forever.ts

@@ -54,6 +54,23 @@ export function isLifecycleHeldLoopReason(reason?: string): boolean {
     || !!reason?.startsWith("send-retry storm:");
 }
 
+/** A stopped loop can be respecified without discarding its history when the
+ * stop is a recoverable work failure or an explicit time/token window. Max
+ * iterations and clean/user stops remain terminal until a fresh `/loop start`.
+ */
+export function isRefinableStoppedLoopReason(reason?: string): boolean {
+  return !!reason && (
+    reason.startsWith("time bound reached")
+    || reason.startsWith("token budget exhausted")
+    || reason.startsWith("stuck —")
+    || reason.startsWith("plateau —")
+    || reason.startsWith("metric never moved —")
+    || reason.startsWith("measure command broken —")
+    || reason.startsWith("provider errors —")
+    || reason.startsWith("stalled:")
+  );
+}
+
 export interface LoopState {
   target: string;
   /** v0.23.0: optional — a metricless "spec loop" (measure=none) has no
@@ -113,8 +130,9 @@ export interface LoopState {
   recentPrints?: string[];
   /** v0.24.0: last few iteration texts (near-duplicate check + banned openings). */
   recentTexts?: string[];
-  /** v0.24.0: rolling tool-result fingerprints {tool, hash, isError}. */
-  recentToolResults?: { tool: string; hash: string; isError: boolean }[];
+  /** v0.24.0: rolling tool-result fingerprints {tool, hash, isError};
+   * providerFailure marks a repeated in-band provider/network pane. */
+  recentToolResults?: { tool: string; hash: string; isError: boolean; providerFailure?: boolean }[];
   /** v0.24.0: tool calls seen since the last completed iteration. */
   toolsThisTurn?: number;
   /** v0.24.0: consecutive iterations with zero tool calls. */

package/extensions/goal-loop-repetition.ts

@@ -129,6 +129,18 @@ export interface ToolResultPrint {
   tool: string;
   hash: string;
   isError: boolean;
+  /** Successful tool transport can still contain a repeated provider failure. */
+  providerFailure?: boolean;
+}
+
+/** The repeated in-band provider pane is an outage signal, not loop work. */
+export function repeatedInBandProviderFailure(results: ToolResultPrint[], repeat = REPETITION.toolResultRepeat): boolean {
+  if (repeat <= 0) return false;
+  const recent = results.slice(-repeat);
+  if (recent.length !== repeat || !recent[0]?.providerFailure) return false;
+  return recent.every((result) => result.providerFailure === true
+    && result.tool === recent[0]!.tool
+    && result.hash === recent[0]!.hash);
 }
 
 export interface LoopStuckInput {

package/extensions/goal-loop.ts

@@ -939,6 +939,8 @@ async function cmdLoop(args: string, ctx: ExtensionContext): Promise<void> {
       !!r?.startsWith("plateau —") ||
       !!r?.startsWith("stalled:") ||
       !!r?.startsWith("stuck —") ||
+      !!r?.startsWith("time bound reached") ||
+      !!r?.startsWith("token budget exhausted") ||
       // v0.35.54 (collect-pass HIGH finding): the v0.35.31 "metric never
       // moved" stop message promises "/loop resume retries or /loop stop",
       // but this predicate never matched that prefix — the promised command
@@ -983,8 +985,33 @@ async function cmdLoop(args: string, ctx: ExtensionContext): Promise<void> {
       // An explicit resume re-arms the counters: fresh stall window,
       // cleared dead-turn/stuck streaks, reprieves restored — the user
       // saying "push again" wins over the ladder's memory (v0.29.19).
-      state.loop = { ...stored, active: true, stopReason: undefined, consecutiveErrors: 0, consecutiveStuck: 0, lastStuckReason: undefined, stallCount: 0, auditPlateauReprieves: 0 };
+      // Time and token bounds are per supervised run window: resuming a
+      // bound-stopped loop preserves its iteration/history/best but starts a
+      // fresh elapsed-time window or token budget instead of stopping again
+      // on the same bound.
+      const resetTimeWindow = stored.stopReason?.startsWith("time bound reached") ?? false;
+      const resetTokenBudget = stored.stopReason?.startsWith("token budget exhausted") ?? false;
+      const resumedAt = nowIso();
+      state.loop = {
+        ...stored,
+        active: true,
+        stopReason: undefined,
+        consecutiveErrors: 0,
+        consecutiveStuck: 0,
+        lastStuckReason: undefined,
+        stallCount: 0,
+        auditPlateauReprieves: 0,
+        ...(resetTimeWindow ? { startedAt: resumedAt } : {}),
+        ...(resetTokenBudget ? { tokensUsed: 0 } : {}),
+      };
       persistState(ctx);
+      if (resetTimeWindow || resetTokenBudget) {
+        appendLedger(ctx.cwd, "loop_bound_window_reset", {
+          timeWindow: resetTimeWindow,
+          tokenBudget: resetTokenBudget,
+          iteration: stored.iteration,
+        });
+      }
       // v0.35.23 (note.md Next #2): an explicit resume is exactly the
       // decision a load hold waits for — release it or the tick below
       // would be frozen.
@@ -995,8 +1022,13 @@ async function cmdLoop(args: string, ctx: ExtensionContext): Promise<void> {
       releaseContinuationDispatchStandDown();
       releaseAuditorSurface();
       scheduleLoopTick(ctx);
+      const boundResetNote = resetTimeWindow
+        ? " · fresh time window"
+        : resetTokenBudget
+          ? " · fresh token budget"
+          : "";
       ctx.ui.notify(
-        `Loop resumed: iteration ${stored.iteration}/${stored.maxIterations > 0 ? stored.maxIterations : "∞"} · best ${stored.bestValue ?? "n/a"} — ${displaySlice(stored.target, 60)}`, 
+        `Loop resumed: iteration ${stored.iteration}/${stored.maxIterations > 0 ? stored.maxIterations : "∞"} · best ${stored.bestValue ?? "n/a"}${boundResetNote} — ${displaySlice(stored.target, 60)}`,
         "info",
       );
       return;

package/extensions/loops/goal-activation.ts

@@ -179,6 +179,7 @@ import {
 } from "../length-continue.js";
 import { isSubagentProviderFailure } from "../quota-retry.js";
 import {
+  classifyInBandProviderFailure,
   classifyMainModelFailure,
   isMainModelFallbackFailure,
   requiresMainModelRecovery,
@@ -229,6 +230,7 @@ import {
 import {
   REPETITION,
   isActuallyStuck,
+  repeatedInBandProviderFailure,
   loopInterventionDirective,
   continueVariant,
   textFingerprint,
@@ -456,6 +458,13 @@ const ZOMBIE_PAUSE_REASON = "automatic zero-stream abort — no provider activit
 // the park standing for manual resume — an honest degradation.
 let zombieRetryStreak: ZombieRetryStreak = { key: "", count: 0, lastAbortStreamAt: 0 };
 let zombieRetryTimer: NodeJS.Timeout | null = null;
+// An in-band provider pane is observed during tool_result and consumed at the
+// matching agent_end. Keep the raw text only in memory; the durable ledger
+// records the bounded classification, never the provider payload.
+let inBandProviderFailureRaw: string | null = null;
+function clearInBandProviderFailure(): void {
+  inBandProviderFailureRaw = null;
+}
 
 /** Arm the one-shot automatic re-dispatch after a successful zombie abort.
  * Returns true when a retry was scheduled (the caller adjusts its user-facing
@@ -951,11 +960,29 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       const loop = state.loop!;
       const out = event?.output ?? event?.result ?? event?.details ?? "";
       const text = typeof out === "string" ? out : JSON.stringify(out) ?? "";
+      const tool = String(event?.toolName ?? "?");
+      const inBandFailure = classifyInBandProviderFailure(text);
       loop.recentToolResults = pushRepetitionCapped(
         loop.recentToolResults ?? [],
-        { tool: String(event?.toolName ?? "?"), hash: textFingerprint(text), isError: Boolean(event?.isError ?? event?.error) },
+        {
+          tool,
+          hash: textFingerprint(text),
+          isError: Boolean(event?.isError ?? event?.error) || !!inBandFailure,
+          ...(inBandFailure ? { providerFailure: true } : {}),
+        },
         REPETITION.toolWindow,
       );
+      // Successful transport is not proof of successful work: only a stable
+      // repeated provider pane becomes a loop-level recovery signal. One-off
+      // 503/429 text in a searched document remains ordinary tool output.
+      if (inBandFailure && repeatedInBandProviderFailure(loop.recentToolResults)) {
+        inBandProviderFailureRaw = text.slice(0, 800);
+        appendLedger(eventCtx.cwd, "loop_in_band_provider_failure", {
+          tool,
+          kind: inBandFailure.kind,
+          repeats: REPETITION.toolResultRepeat,
+        });
+      }
       // v0.25.1: file-write progress signal for the multi-signal stuck
       // gate — a loop that is WRITING files is shipping, not stuck.
       if (isLoopWriteTool(String(event?.toolName ?? ""))) {
@@ -1034,6 +1061,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       });
     }
     appendLedger(ctx.cwd, "session_shutdown", { reason: shutdownReason });
+    clearInBandProviderFailure();
     markSessionOwnerShutdown(ctx.cwd, shutdownReason);
     writeSessionHandoff(ctx, shutdownReason);
     sessionReplacementUntil = Date.now() + SESSION_REBIND_GRACE_MS;
@@ -1136,6 +1164,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     const startReason = typeof event?.reason === "string" ? event.reason : "unknown";
     initialSessionLoadPending = isBlankInitialStartup(ctx, startReason);
     rememberCtx(ctx);
+    clearInBandProviderFailure();
     startHeartbeat();
     startUITicker();
     // v0.30.0: rebind bookkeeping — claim ownership, close any replacement
@@ -1744,10 +1773,10 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // v0.27.3: enrich lastA with text + priorText for the smarter nudge
     // accounting below.
     const assistants = (event.messages as any[]).filter((m: any) => m.role === "assistant");
-    const rawLastA = assistants.length ? assistants[assistants.length - 1] : null;
+    let rawLastA = assistants.length ? assistants[assistants.length - 1] : null;
     const rawPriorA = assistants.length >= 2 ? assistants[assistants.length - 2] : null;
     const extractText = (m: any): string => (m && Array.isArray(m.content)) ? m.content.filter((p: any) => p.type === "text").map((p: any) => p.text).join("\n") : "";
-    const lastA = rawLastA ? { stopReason: rawLastA.stopReason, text: extractText(rawLastA), priorText: extractText(rawPriorA) } : null;
+    let lastA = rawLastA ? { stopReason: rawLastA.stopReason, text: extractText(rawLastA), priorText: extractText(rawPriorA) } : null;
     // v0.34.19: pi-ai clamps max_tokens to the remaining context before the
     // provider call. At ~99% context that clamp can be 1 token, which the
     // provider reports as stopReason "length" — but this is NOT an overlong
@@ -1835,6 +1864,23 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       // never pass the same failure into main-goal recovery.
       return;
     }
+    // A repeated provider pane arrived through a successful tool transport,
+    // so pi reports an ordinary end_turn. Convert it into the same bounded
+    // recovery envelope as a provider error before loop measurement/stuck
+    // accounting can consume the dead turn.
+    if (inBandProviderFailureRaw && isLoopActive()) {
+      const raw = inBandProviderFailureRaw;
+      clearInBandProviderFailure();
+      const loop = state.loop!;
+      // The normal loop error branch owns the consecutive-error counter and
+      // its bounded recovery cap. Clearing the fingerprints here prevents the
+      // same pane from being reclassified before that branch runs.
+      loop.recentToolResults = [];
+      rawLastA = { ...(rawLastA ?? {}), stopReason: "error", errorMessage: raw, content: [] };
+      lastA = { stopReason: "error", text: raw, priorText: lastA?.priorText ?? "" };
+    } else if (inBandProviderFailureRaw) {
+      clearInBandProviderFailure();
+    }
     if (await handleMainModelAgentEnd(ctx, rawLastA, lastA)) return;
     // v0.25.2: per-goal turn telemetry (/glla stats).
     if (state.goal && state.goal.status === "active") {
@@ -2292,6 +2338,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
   });
   pi.on("agent_start", (_event: any, ctx: ExtensionContext) => {
     rememberCtx(ctx);
+    clearInBandProviderFailure();
     if (tryAbsorbHostSuccessor(ctx, "agent_start")) {
       ensureAgentToolsReady(ctx, true);
       return;

package/extensions/loops/goal-tools.ts

@@ -318,6 +318,7 @@ import {
   listAuditFanoutItemText,
   type LoopTickOutcome,
   HELD_ON_RESTORE,
+  isRefinableStoppedLoopReason,
   type LoopState,
 } from "../goal-loop-forever.js";
 import {
@@ -1928,7 +1929,7 @@ function registerAgentTools(pi: any): void {
   pi.registerTool(defineTool({
     name: "propose_loop_refine",
     label: "Propose loop spec refinement",
-    description: "While a loop is ACTIVE, propose refining the loop's spec — sharpen the target and/or change the measure command — when the current spec no longer captures 'better'. The user confirms; on a measure change the orchestrator test-runs the new command and re-baselines. Never edit the measure command or its inputs directly — that is gaming the metric.",
+    description: "While a loop is active or safely stopped by a recoverable bound/failure, propose refining its spec — sharpen the target and/or change the measure command — when the current spec no longer captures 'better'. The user confirms; on a measure change the orchestrator test-runs the new command and re-baselines. Never edit the measure command or its inputs directly — that is gaming the metric.",
     parameters: Type.Object({
       target: Type.Optional(Type.String({ description: "The sharpened target text (omit to keep the current target)" })),
       measureCmd: Type.Optional(Type.String({ description: "The new measure command printing ONE number (omit to keep the current metric)" })),
@@ -1943,9 +1944,11 @@ function registerAgentTools(pi: any): void {
       const liveCtx = currentToolContext(execCtx);
       if (!liveCtx) return staleToolResult();
       const loop = state.loop;
-      if (!loop?.active) {
-        return { content: [{ type: "text", text: "No active loop to refine. propose_loop_refine is only valid while a loop is running." }], details: {} };
+      const stoppedRefinable = !!loop && !loop.active && isRefinableStoppedLoopReason(loop.stopReason);
+      if (!loop || (!loop.active && !stoppedRefinable)) {
+        return { content: [{ type: "text", text: "No refinable loop is available. propose_loop_refine applies while a loop is running or after a recoverable bound/failure stop; clean max-iteration and user-finished loops require /loop start." }], details: {} };
       }
+      const wasActive = loop.active;
       const newTarget = p.target?.trim() || loop.target;
       const newMeasure = p.measureCmd?.trim() || loop.measureCmd || "";
       // v0.23.0: a metricless loop can't be refined into a measured one
@@ -1989,7 +1992,7 @@ function registerAgentTools(pi: any): void {
           confirmed = (await confirmDraft(
             liveCtx,
             "Confirm loop spec refinement",
-          `Rationale: ${sanitizeDisplayText(p.rationale)}\n\nTarget:\n  old: ${displaySlice(loop.target, 120)}\n  new: ${displaySlice(newTarget, 120)}\n\nMeasure:\n  old: ${sanitizeDisplayText(loop.measureCmd ?? "none")}\n  new: ${sanitizeDisplayText(newMeasure)}${newMeasure !== loop.measureCmd ? `\n  test-run: ${sanitizeDisplayText(testOutput).slice(0, 120)} → ${newBaseline}` : ""}${specChange ? `\n\nSpec file (${sanitizeDisplayText(loop.specFile ?? "")}:\n  ${p.specText?.trim() ? `REPLACE with ${p.specText!.trim().length} chars` : ""}${p.specText?.trim() && p.specAppend?.trim() ? " + " : ""}${p.specAppend?.trim() ? `APPEND: ${sanitizeDisplayText(p.specAppend!.trim()).slice(0, 120)}` : ""}` : ""}\n\nThe loop keeps running against the refined spec (iteration ${loop.iteration} so far). Apply?`,
+          `Rationale: ${sanitizeDisplayText(p.rationale)}\n\nTarget:\n  old: ${displaySlice(loop.target, 120)}\n  new: ${displaySlice(newTarget, 120)}\n\nMeasure:\n  old: ${sanitizeDisplayText(loop.measureCmd ?? "none")}\n  new: ${sanitizeDisplayText(newMeasure)}${newMeasure !== loop.measureCmd ? `\n  test-run: ${sanitizeDisplayText(testOutput).slice(0, 120)} → ${newBaseline}` : ""}${specChange ? `\n\nSpec file (${sanitizeDisplayText(loop.specFile ?? "")}:\n  ${p.specText?.trim() ? `REPLACE with ${p.specText!.trim().length} chars` : ""}${p.specText?.trim() && p.specAppend?.trim() ? " + " : ""}${p.specAppend?.trim() ? `APPEND: ${sanitizeDisplayText(p.specAppend!.trim()).slice(0, 120)}` : ""}` : ""}\n\nThe loop ${wasActive ? "keeps running" : "stays stopped until /loop resume"} against the refined spec (iteration ${loop.iteration} so far). Apply?`,
           )) === "yes";
         } catch {
           confirmed = false;
@@ -2026,8 +2029,10 @@ function registerAgentTools(pi: any): void {
       }
       persistState(liveCtx);
       appendLedger(liveCtx.cwd, "loop_refined", { iteration: loop.iteration, newTarget, newMeasureCmd: newMeasure, newBaseline, specChanged: specChange || undefined });
-      liveCtx.ui.notify(`Loop spec refined at iteration ${loop.iteration}.${newBaseline !== null ? ` New baseline: ${newBaseline}.` : ""}${specChange ? " Spec file updated." : ""}`, "info");
-      return { content: [{ type: "text", text: "Refinement confirmed and applied. Continue improving against the NEW spec — one small change per turn." }], details: {} };
+      liveCtx.ui.notify(`Loop spec refined at iteration ${loop.iteration}.${newBaseline !== null ? ` New baseline: ${newBaseline}.` : ""}${specChange ? " Spec file updated." : ""}${wasActive ? "" : " Run /loop resume to continue with the preserved history."}`, "info");
+      return { content: [{ type: "text", text: wasActive
+        ? "Refinement confirmed and applied. Continue improving against the NEW spec — one small change per turn."
+        : "Refinement confirmed and applied to the stopped loop. Run /loop resume to continue with the preserved history." }], details: {} };
     },
   }));
 

package/extensions/main-model-recovery.ts

@@ -159,6 +159,20 @@ export function classifyMainModelFailure(error: string | undefined, opts?: { isC
   return { kind: "unknown", raw };
 }
 
+/** A successful tool invocation can still carry a provider/network failure
+ * in its output. Only strong pane-shaped markers are eligible here; the loop
+ * caller additionally requires the same tool/result fingerprint to repeat
+ * before turning this into model recovery, so a one-off `503` in a searched
+ * document is not enough to park a loop. */
+const IN_BAND_PROVIDER_FAILURE_PATTERN = /\b(?:http\s*)?(?:429|5\d\d)\b|rate[_ -]?limit|too many requests|network[_ -]?error|upstream(?:\s+(?:error|failure|unavailable))?|service unavailable|fetch failed|econn(?:reset|refused)|gateway(?:\s+(?:error|timeout))?/i;
+
+export function classifyInBandProviderFailure(output: string | undefined): MainModelFailure | undefined {
+  const raw = typeof output === "string" ? output.trim() : "";
+  if (!raw || !IN_BAND_PROVIDER_FAILURE_PATTERN.test(raw)) return undefined;
+  const failure = classifyMainModelFailure(raw);
+  return failure.kind === "non-recoverable" ? undefined : failure;
+}
+
 /** v0.34.116: detect when a length-context failure happened AFTER the
  * session_compact already failed. The classifier maps this to
  * `context-overflow` (rollback path: rotate to a larger-context ref). The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.35.66",
+  "version": "0.35.68",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",