pi-goal-list-loop-audit 0.35.69 → 0.35.71

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.35.71 — bounded Pi-core retry containment (2026-08-26)
+
+### Changed
+  GLLA now exposes a configurable zero-stream retry budget (default 3,
+  allowed range 0–10). When Pi remains BUSY without stream activity, GLLA
+  still aborts and durably parks the owner, then re-dispatches repeatedly
+  within that finite budget before requiring explicit resume. A real stream
+  starts a fresh budget; supervisor pause, generation fences, and durable
+  recovery semantics remain intact. This contains the Pi-core retry-sleeper
+  failure at GLLA's public boundary without modifying Pi or any other plugin.
+
+### Tests
+  Added repeated-silence exhaustion, budget persistence/validation, settings
+  menu/editor coverage, and existing lifecycle/park/no-storm regressions.
+
+## 0.35.70 — optional-provider boundary and recovery alignment (2026-08-26)
+
+### Changed
+  GLLA now delegates the managed subagent agent-directory lookup to pi's
+  host resolver, honoring custom `PI_CODING_AGENT_DIR` values instead of
+  assuming `~/.pi/agent`. The core extension remains independent of the
+  optional `@tintinweb/pi-subagents` provider.
+
+### Tests
+  Added a genuine no-provider load smoke test that forbids the optional
+  provider import while loading the extension, plus custom-agent-directory
+  coverage. The existing context-overflow recovery path remains the single
+  configured fallback route; no hardcoded free model was introduced.
+
 ## 0.35.69 — metricless-loop cadence (2026-08-26)
 
 ### Added

package/INSTALL.md

@@ -147,7 +147,10 @@ Useful controls:
 ```
 
 `/glla pause` freezes supervisor automation without killing active work.
-`/glla resume` releases it. A user abort means stop; recovery is not silently
+`/glla resume` releases it. A BUSY/no-stream Pi turn is aborted and parked by
+GLLA, then automatically re-dispatched within the **Zero-stream retries**
+budget (default 3, configurable from 0–10); exhaustion requires an explicit
+mode-correct resume. A user abort means stop; recovery is not silently
 re-fired behind your back.
 
 ## Auditor model requirement

package/README.md

@@ -329,7 +329,9 @@ that silence means success. Error text is **not trusted** to pick a retry policy
 failure wording is retained as bounded diagnostics, not interpreted as
 proof of a quota or billing state.
 
-- automatic retries are bounded and visible;
+- automatic retries are bounded and visible; a BUSY/no-stream turn is parked
+  and re-dispatched within the configurable **Zero-stream retries** budget
+  (default 3, range 0–10), then requires explicit resume;
 - `/goal resume`, `/list resume`, and `/loop resume` are explicit recovery
   paths;
 - a user abort means stop, not “try again behind my back”;
@@ -358,6 +360,8 @@ Open `/glla` for the settings table. The most important choices are:
   choices win;
 - **Subagent hang escalation:** warning-only at `0`, or one child-specific
   action after a confirmed frozen interval;
+- **Zero-stream retries:** automatic GLLA recovery attempts after a busy,
+  stream-silent Pi turn; `0` keeps recovery manual and `1–10` bounds repeats;
 - **Audit cap and retry cadence:** bounds for repeated objections and
   infrastructure recovery.
 

package/docs/DESIGN.md

@@ -354,6 +354,23 @@ replacement without delivering a successor `session_start`:
   and normalize old files. Canonical persisted state uses `retry-waiting`,
   `retryAttempts`, `retryFirstAt`, and `retryUntil`.
 
+## Addendum v0.35.71 (GLLA-only external-failure containment)
+
+GLLA is a workflow supervisor, not a maintenance fork of its host ecosystem.
+The repository changes only GLLA-owned code. Pi-core, OS, provider, and
+third-party-plugin failures may be observed through public hooks and contained
+by durable GLLA state (for example, a BUSY/no-stream turn can be aborted,
+parked, and retried within a finite configured budget), but GLLA never edits
+those external implementations or claims to repair them. Reports whose only
+code lives outside GLLA are explicitly documented and disposed of as
+out-of-scope.
+
+The zero-stream budget defaults to three automatic re-dispatches and accepts
+0–10. Each uninterrupted silent attempt consumes one slot; a real stream
+starts a fresh episode. Exhaustion leaves the goal/list item/loop parked for
+explicit resume. Generation, supervisor-pause, persistence, and dispatch
+ownership fences remain authoritative throughout.
+
 ## Addendum v0.35.0 (long-running judgment, Designer, and drafting chain)
 
 - **Judgment is a prompt-level contract**: drafting and continuation preserve

package/extensions/goal-commands.ts

@@ -2413,6 +2413,7 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
       fmt("aggressiveMode", "aggressiveMode"),
       fmt("stuckMaxInterventions", "stuckMaxInterventions"),
       fmt("stallEscalationRefires", "stallEscalation"),
+      fmt("zombieRetryMaxAttempts", "zombieRetryMaxAttempts"),
       fmt("subagentHangEscalationMinutes", "subagentHangActionMinutes"),
       fmt("wedgeAlertMinutes", "wedgeAlert"),
       fmt("stallShortWords", "stallShortWords"),

package/extensions/goal-heartbeat.ts

@@ -1036,7 +1036,7 @@ function heartbeatTick(): void {
   // v0.29.16/v0.35.x: zombie-run watchdog. pi reports BUSY (a run is
   // "active") but zero stream events for the warning window — the provider
   // stream has likely hung silently, and queued continuations cannot land.
-  // Keep the first warning human-readable, then apply one bounded automatic
+  // Keep the first warning human-readable, then apply bounded automatic
   // abort/cleanup after the grace window. A notification-only Esc instruction
   // left list items ACTIVE for 85–96 minutes in the field; the bounded abort
   // now parks the item and leaves /list resume + /list cancel as explicit,

package/extensions/goal-loop-backoff.ts

@@ -248,11 +248,17 @@ export function accountTurnForNudgesRich(
 // Field (note.md Next §1, screenshot 20260821_152311): turns dispatched by
 // ACCEPTING a Confirm dialog hang with zero provider stream activity often
 // enough that users repeatedly return to "action needed - this won't fix
-// itself" parks. The watchdog's abort is correct; the missing half is ONE
-// bounded automatic re-dispatch per silence streak. This pure decision is
-// the one-retry bound; the timer that consumes it lives in goal-activation.ts.
+// itself" parks. The watchdog's abort is correct; the missing half is a
+// finite repeated re-dispatch budget per silence streak. This pure decision
+// is consumed by the timer in goal-activation.ts.
 
 export const ZOMBIE_RETRY_DELAY_MS = 90_000;
+/** Maximum automatic re-dispatches after one uninterrupted zero-stream
+ * episode. Three attempts give a transient Pi-core retry sleeper several
+ * chances to recover without turning the watchdog into an infinite loop. */
+export const DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS = 3;
+/** Hand-edited settings are bounded to keep recovery finite and reviewable. */
+export const MAX_ZOMBIE_RETRY_ATTEMPTS = 10;
 
 export interface ZombieRetryStreak {
   key: string;
@@ -262,21 +268,26 @@ export interface ZombieRetryStreak {
 }
 
 /** A new owner key OR stream activity newer than the recorded abort point
- * starts a fresh streak; otherwise the streak deepens and the SECOND
- * consecutive silence is refused (no retry storm). A retried turn that
- * actually streams advances lastStreamActivityAt past the previous abort's
- * observation point, so any LATER independent hang earns its own single
- * retry. */
+ * starts a fresh streak; otherwise the streak deepens until the caller's
+ * finite retry budget is exhausted. A retried turn that actually streams
+ * advances lastStreamActivityAt past the previous abort's observation point,
+ * so any later independent hang earns a fresh budget. */
 export function zombieRetryDecision(
   observedStreamAt: number,
   key: string,
   prev: ZombieRetryStreak,
+  maxAttempts = DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS,
 ): { retry: boolean; streak: ZombieRetryStreak } {
+  const limit = Number.isInteger(maxAttempts) && maxAttempts >= 0
+    ? Math.min(maxAttempts, MAX_ZOMBIE_RETRY_ATTEMPTS)
+    : DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS;
   const sameEpisode = key === prev.key && observedStreamAt <= prev.lastAbortStreamAt;
+  // Keep one terminal refusal count beyond the retry budget so repeated
+  // heartbeat observations remain cheap and deterministic.
   const streak: ZombieRetryStreak = sameEpisode
-    ? { key, count: Math.min(prev.count + 1, 2), lastAbortStreamAt: observedStreamAt }
+    ? { key, count: Math.min(prev.count + 1, MAX_ZOMBIE_RETRY_ATTEMPTS + 1), lastAbortStreamAt: observedStreamAt }
     : { key, count: 1, lastAbortStreamAt: observedStreamAt };
-  return { retry: streak.count === 1, streak };
+  return { retry: streak.count <= limit, streak };
 }
 
 // =================================================================

package/extensions/goal-loop-subagents.ts

@@ -25,8 +25,8 @@
 // to add embedded copies here.
 
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
 
 /** Frontmatter marker identifying files this module wrote. Files without it
  * are user-owned: never modified, never deleted. */
@@ -178,9 +178,11 @@ const EMBEDDED_DEFAULTS: Record<string, EmbeddedAgentDefault> = {
 export const OVERRIDABLE_AGENT_TYPES = Object.keys(EMBEDDED_DEFAULTS);
 
 /** Default global agent dir (pi-subagents reads $PI_CODING_AGENT_DIR/agents,
- * default ~/.pi/agent/agents). Parameterized in sync for tests. */
+ * default ~/.pi/agent/agents). Delegate to pi's runtime resolver so custom
+ * `PI_CODING_AGENT_DIR` and future app-specific config-dir names stay aligned
+ * with the host rather than being silently ignored by glla. */
 export function defaultAgentDir(): string {
-  return path.join(os.homedir(), ".pi", "agent");
+  return getAgentDir();
 }
 
 /** Build the override .md file content. With `model`, the pin is written;

package/extensions/goal-settings.ts

@@ -30,6 +30,10 @@ import {
   DEFAULT_MAIN_MODEL_PRIMARY_PROBE_MINUTES,
   normalizeMainModelFallbackRefs,
 } from "./main-model-recovery.js";
+import {
+  DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS,
+  MAX_ZOMBIE_RETRY_ATTEMPTS,
+} from "./goal-loop-backoff.js";
 
 export interface Settings {
   /** Where glla's durable state directory lives. This is global-only because
@@ -169,6 +173,9 @@ export interface Settings {
   /** v0.27.3: a turn with no tool calls AND fewer words than this is a
    * nudge. Default 15 words. Higher = stricter (more pauses). */
   stallShortWords?: number;
+  /** Maximum automatic re-dispatches after one uninterrupted busy/no-stream
+   * episode (default 3; 0 = manual resume only; max 10). */
+  zombieRetryMaxAttempts?: number;
   /** v0.27.3: a turn with no tool calls whose text trigram-similarity to
    * the prior assistant turn exceeds this is a nudge. Default 0.6. Higher
    * = stricter (more pauses). */
@@ -281,6 +288,9 @@ export const DEFAULT_SETTINGS: Settings = {
   // v0.35.64: warn at the short detection thresholds, then take one
   // child-specific action after a much longer confirmed frozen interval.
   subagentHangEscalationMinutes: 30,
+  // v0.35.x: repeated Pi-core busy/no-stream recovery is useful for a
+  // transient retry sleeper, but must remain finite and user-configurable.
+  zombieRetryMaxAttempts: DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS,
 };
 
 // Re-exported for compatibility; the dependency-free state-root module owns
@@ -329,6 +339,12 @@ function normalizeLoadedSettings(settings: Settings): Settings {
       || (settings.subagentHangEscalationMinutes !== 0 && settings.subagentHangEscalationMinutes < 5)) {
     settings.subagentHangEscalationMinutes = 30;
   }
+  if (typeof settings.zombieRetryMaxAttempts !== "number"
+      || !Number.isInteger(settings.zombieRetryMaxAttempts)
+      || settings.zombieRetryMaxAttempts < 0
+      || settings.zombieRetryMaxAttempts > MAX_ZOMBIE_RETRY_ATTEMPTS) {
+    settings.zombieRetryMaxAttempts = DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS;
+  }
   // v0.34.142: these old policy knobs no longer control recovery. Drop
   // them from the effective object so stale files cannot resurrect the old
   // behavior or make the settings UI imply that quota inspection exists.
@@ -416,6 +432,7 @@ export const SETTINGS_KEYS: Array<keyof Settings> = [
   "stuckMaxInterventions",
   "subagentHangEscalationMinutes",
   "stallEscalationRefires",
+  "zombieRetryMaxAttempts",
   "stallShortWords",
   "stallSimilarityThreshold",
   "postaudit",

package/extensions/loops/goal-activation.ts

@@ -350,6 +350,7 @@ import {
   PENDING_LATCH_STUCK_MS,
   shouldFirePendingLatchWatchdog,
   AUDITOR_WALL_TIMEOUT_MS,
+  DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS,
   ZOMBIE_RETRY_DELAY_MS,
   zombieRetryDecision,
   type ZombieRetryStreak,
@@ -427,29 +428,20 @@ export function enqueueFaultRepairTask(ctx: ExtensionContext, objective: string,
   appendLedger(ctx.cwd, "faulty_objective_repair_promoted", { goalId: repair.id, targetId: target?.id, position: 1, source: target?.source ?? "unknown" });
 }
 
-/** v0.35.17 — bounded automatic retry after a confirmed zero-stream abort.
+/** v0.35.x — bounded repeated automatic recovery after a confirmed
+ * zero-stream abort.
  *
- * Field evidence (note.md Next §1, screenshot 20260821_152311): turns
- * dispatched by ACCEPTING a Confirm dialog hang with zero provider stream
- * activity often enough that users repeatedly return to "Goal paused after
- * 30m ... action needed - this won't fix itself" sessions. The watchdog's
- * abort is correct (it stops the token bleed); what was missing is the
- * self-heal half. This adds ONE bounded automatic re-dispatch per silent
- * streak, mirroring main-model recovery's timer pattern:
+ * A Pi-core retry sleeper can keep the host BUSY long after the useful stream
+ * has stopped. GLLA owns the safe boundary: abort the stale host turn, park
+ * durable work, and re-dispatch while the configured zero-stream retry budget
+ * remains. A real stream resets the episode; uninterrupted silence eventually
+ * reaches the budget and stays parked instead of producing an infinite retry
+ * storm.
  *
- *   - exactly ONE automatic retry per zero-stream STREAK: a retried turn
- *     that actually streams advances lastStreamActivityAt past the previous
- *     abort's observation point, so any LATER independent hang starts a
- *     fresh streak and earns its own single retry;
- *   - a SECOND consecutive silence (retry hung too, or the original turn
- *     never streamed again) parks permanently — no retry storm;
- *   - `/glla pause` freezes the retry like every other automatic
- *     side-effect: the parked claim stays durable for manual resume;
- *   - manual /goal resume · /loop resume remain available at all times.
- *
- * The streak counter is process-memory by design: if the session restarts
- * inside the retry window the park stands and manual resume applies — an
- * honest degradation, not a phantom promise.
+ * `/glla pause` freezes the retry like every other automatic side-effect, and
+ * manual /goal resume · /loop resume remain available at all times. The streak
+ * counter is process-memory by design: a session restart inside the retry
+ * window leaves the park standing for manual resume.
  */
 const ZOMBIE_PAUSE_REASON = "automatic zero-stream abort — no provider activity was observed";
 
@@ -466,25 +458,32 @@ function clearInBandProviderFailure(): void {
   inBandProviderFailureRaw = null;
 }
 
-/** Arm the one-shot automatic re-dispatch after a successful zombie abort.
- * Returns true when a retry was scheduled (the caller adjusts its user-facing
- * copy accordingly). */
+/** Arm the next automatic re-dispatch after a successful zombie abort.
+ * The configured retry budget keeps repeated recovery finite; the caller gets
+ * the attempt number so user-facing copy and ledger evidence stay truthful. */
 function scheduleZombieAutoRetry(
   ctx: ExtensionContext,
   generation: number,
   goalId: string | undefined,
   observedStreamAt: number,
   silentMinutes: number,
-): boolean {
+): { scheduled: boolean; attempt: number; maxAttempts: number } {
   const key = goalId ?? "loop";
-  const { retry, streak } = zombieRetryDecision(observedStreamAt, key, zombieRetryStreak);
+  const maxAttempts = zombieRetryMaxAttemptsOverride
+    ?? loadSettings(ctx.cwd).zombieRetryMaxAttempts
+    ?? DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS;
+  const { retry, streak } = zombieRetryDecision(observedStreamAt, key, zombieRetryStreak, maxAttempts);
   zombieRetryStreak = streak;
+  const plan = { scheduled: retry, attempt: streak.count, maxAttempts };
   appendLedger(ctx.cwd, retry ? "zombie_auto_retry_scheduled" : "zombie_auto_retry_refused_streak", {
     goalId,
     streakCount: streak.count,
+    maxAttempts,
     delayMs: zombieRetryDelayOverride ?? ZOMBIE_RETRY_DELAY_MS,
   });
-  if (!retry) return false;
+  if (!retry) return plan;
+  const retryAttempt = plan.attempt;
+  const retryMaxAttempts = plan.maxAttempts;
   if (zombieRetryTimer) {
     clearTimeout(zombieRetryTimer);
     zombieRetryTimer = null;
@@ -513,10 +512,15 @@ function scheduleZombieAutoRetry(
         pauseSuggestedAction: undefined,
         ...(usage ? { usage } : {}),
       }, fresh);
-      appendLedger(fresh.cwd, "zombie_auto_retry_dispatched", { goalId: goal.id, policy: goal.policy });
+      appendLedger(fresh.cwd, "zombie_auto_retry_dispatched", {
+        goalId: goal.id,
+        policy: goal.policy,
+        attempt: retryAttempt,
+        maxAttempts: retryMaxAttempts,
+      });
       releaseZombieAbortKey();
       try {
-        fresh.ui.notify(`Automatic retry starting — the earlier ${goal.policy === "list" ? "list item" : "goal"} turn was aborted after ${silentMinutes}m of zero stream activity. One bounded retry is dispatched now; if it hangs again the ${goal.policy === "list" ? "item" : "goal"} stays paused for ${activeGoalSurfaceCommand("resume")}.`, "info");
+        fresh.ui.notify(`Automatic retry ${retryAttempt}/${retryMaxAttempts} starting — the earlier ${goal.policy === "list" ? "list item" : "goal"} turn was aborted after ${silentMinutes}m of zero stream activity. If it hangs again, GLLA keeps retrying within this budget before requiring ${activeGoalSurfaceCommand("resume")}.`, "info");
       } catch { /* best-effort */ }
       scheduleContinuation(fresh, true);
       return;
@@ -529,14 +533,19 @@ function scheduleZombieAutoRetry(
     loop.active = true;
     loop.stopReason = undefined;
     persistState(fresh);
-    appendLedger(fresh.cwd, "zombie_auto_retry_dispatched", { kind: "loop", iteration: loop.iteration });
+    appendLedger(fresh.cwd, "zombie_auto_retry_dispatched", {
+      kind: "loop",
+      iteration: loop.iteration,
+      attempt: retryAttempt,
+      maxAttempts: retryMaxAttempts,
+    });
     releaseZombieAbortKey();
     try {
-      fresh.ui.notify(`Automatic retry starting — the loop was stopped after a zero-stream abort. One bounded retry ticks now; if it hangs again it stays stopped for /loop resume.`, "info");
+      fresh.ui.notify(`Automatic retry ${retryAttempt}/${retryMaxAttempts} starting — the loop was stopped after a zero-stream abort. GLLA keeps retrying within this budget; if it hangs again after the budget, it stays stopped for /loop resume.`, "info");
     } catch { /* best-effort */ }
     scheduleLoopTick(fresh);
   }, zombieRetryDelayOverride ?? ZOMBIE_RETRY_DELAY_MS);
-  return true;
+  return plan;
 }
 
 /** Test-only: reset the module-global retry streak/timer state. */
@@ -546,9 +555,11 @@ export function __testOnlyResetZombieAutoRetry(): void {
     zombieRetryTimer = null;
   }
   zombieRetryStreak = { key: "", count: 0, lastAbortStreamAt: 0 };
+  zombieRetryMaxAttemptsOverride = null;
 }
 
 let zombieRetryDelayOverride: number | null = null;
+let zombieRetryMaxAttemptsOverride: number | null = null;
 
 /** Test-only: shrink the automatic-retry delay (null restores the 90s
  * production default). Never called by production code. */
@@ -556,15 +567,19 @@ export function __testOnlySetZombieRetryDelay(ms: number | null): void {
   zombieRetryDelayOverride = ms;
 }
 
-/** v0.35.x (amended v0.35.17): terminate one confirmed zero-stream host turn
- * and park the owning goal/list item before asking pi to abort. This is
- * deliberately an activation-owned operation: it can clear the durable
- * continuation sidecar, stand down re-arms, and validate the current
- * generation before touching the host. A later /goal or /list resume
- * explicitly clears the stand-down and starts a new attempt — and since
- * v0.35.17, the FIRST silence of a streak additionally arms ONE bounded
- * automatic retry (scheduleZombieAutoRetry below); only a second consecutive
- * zero-stream abort leaves the park purely manual. */
+/** Test-only: pin the retry budget without depending on the caller's global
+ * settings file. Null restores the loaded setting/default. */
+export function __testOnlySetZombieRetryMaxAttempts(attempts: number | null): void {
+  zombieRetryMaxAttemptsOverride = attempts;
+}
+
+/** v0.35.x: terminate one confirmed zero-stream host turn and park the
+ * owning goal/list item before asking pi to abort. This is deliberately an
+ * activation-owned operation: it can clear the durable continuation sidecar,
+ * stand down re-arms, and validate the current generation before touching the
+ * host. A later /goal or /list resume explicitly clears the stand-down and
+ * starts a new attempt; each uninterrupted silence can also consume the
+ * configured bounded retry budget through scheduleZombieAutoRetry below. */
 export function abortZombieRun(
   ctx: ExtensionContext,
   generation: number,
@@ -596,7 +611,7 @@ export function abortZombieRun(
       status: "paused",
       pauseKind: "error",
       pauseReason: reason,
-      pauseSuggestedAction: `The stalled ${noun} turn was aborted safely and the work is saved. ${activeGoalSurfaceCommand("resume")} retries it once; ${activeGoalSurfaceCommand("cancel")} discards it.`,
+      pauseSuggestedAction: `The stalled ${noun} turn was aborted safely and the work is saved. Automatic retries use the configured zero-stream budget; ${activeGoalSurfaceCommand("resume")} retries immediately and ${activeGoalSurfaceCommand("cancel")} discards it.`,
     }, current);
   } else if (loop) {
     clearLoopTimer();
@@ -621,14 +636,14 @@ export function abortZombieRun(
   });
   const resume = goal ? activeGoalSurfaceCommand("resume") : "/loop resume";
   const cancel = goal ? activeGoalSurfaceCommand("cancel") : "/loop stop";
-  // v0.35.17: ONE bounded automatic retry per zero-stream streak — the park
-  // becomes a 90-second waystation instead of a dead end for the first
-  // silence. A refused streak (second consecutive hang) keeps the manual copy.
-  const retryScheduled = scheduleZombieAutoRetry(current, generation, goal?.id, observedStreamAt, silentMinutes);
+  // v0.35.x: keep the park as a bounded waystation for repeated
+  // zero-stream attempts. Once the configured budget is exhausted the
+  // refusal remains manual and durable.
+  const retryPlan = scheduleZombieAutoRetry(current, generation, goal?.id, observedStreamAt, silentMinutes);
   const message = `${goal ? goal.policy === "list" ? "List item" : "Goal" : "Loop"} paused after ${silentMinutes}m with zero stream activity; the zombie turn was aborted and queued retries were stopped. Work is saved. ${
-    retryScheduled
-      ? `An automatic retry starts in ~90s; ${resume} retries immediately instead.`
-      : `${resume} retries it, or ${cancel} discards/stops it.`
+    retryPlan.scheduled
+      ? `Automatic retry ${retryPlan.attempt}/${retryPlan.maxAttempts} starts in ~90s; ${resume} retries immediately instead.`
+      : `${resume} retries it, or ${cancel} discards/stops it; the automatic retry budget is exhausted.`
   }`;
   current.ui.notify(message, abortError ? "warning" : "info");
   notifyExternal(current, message);

package/extensions/loops/goal-settings-ui.ts

@@ -333,6 +333,7 @@ import {
   PENDING_LATCH_STUCK_MS,
   shouldFirePendingLatchWatchdog,
   AUDITOR_WALL_TIMEOUT_MS,
+  MAX_ZOMBIE_RETRY_ATTEMPTS,
 } from "../goal-loop-backoff.js";
 
 import {
@@ -1322,6 +1323,21 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       }
       return;
     }
+    case "zombieRetryMaxAttempts": {
+      const v = await ctx.ui.input("Automatic retries after a busy zero-stream abort", "integer from 0 to 10; 0 = manual resume only; empty = default 3");
+      if (v !== undefined) {
+        const raw = v.trim();
+        const n = Number.parseInt(raw, 10);
+        if (/^\d+$/.test(raw) && Number.isInteger(n) && n >= 0 && n <= MAX_ZOMBIE_RETRY_ATTEMPTS) {
+          saveSettings("global", ctx.cwd, { zombieRetryMaxAttempts: n });
+        } else if (!raw) {
+          saveSettings("global", ctx.cwd, { zombieRetryMaxAttempts: undefined });
+        } else {
+          ctx.ui.notify(`Automatic retry count must be an integer from 0 to ${MAX_ZOMBIE_RETRY_ATTEMPTS}: ${v}`, "warning");
+        }
+      }
+      return;
+    }
     case "stallShortWords": {
       const v = await ctx.ui.input("Stall short words threshold", "non-negative integer; 0 = off, empty = default 15");
       if (v !== undefined) {

package/extensions/settings-menu.ts

@@ -37,6 +37,7 @@ import {
 import {
   DEFAULT_STALL_SIM_THRESHOLD,
   DEFAULT_STALL_SHORT_WORDS,
+  DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS,
 } from "./goal-loop-backoff.ts";
 import type { Settings } from "./goal-settings.ts";
 import { MAX_MAIN_MODEL_FALLBACKS } from "./main-model-recovery.ts";
@@ -453,6 +454,14 @@ export function buildSettingsRows(
       description:
         "heartbeat refires with no turn before the goal pauses / loop stops (0 = never)",
     },
+    {
+      id: "zombieRetryMaxAttempts",
+      section: "stall-brakes",
+      label: "Zero-stream retries",
+      valueText: show("zombieRetryMaxAttempts", `${DEFAULT_ZOMBIE_RETRY_MAX_ATTEMPTS}`),
+      sourceText: src("zombieRetryMaxAttempts"),
+      description: "automatic retries after a busy zero-stream abort (0 = manual only; max 10)",
+    },
     {
       id: "stallShortWords",
       section: "stall-brakes",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.35.69",
+  "version": "0.35.71",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",