pi-goal-list-loop-audit 0.37.1 → 0.37.3

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.37.3 — pi 0.84 loop stall fix — agent_start fallback for continuation start proof (2026-09-02)
+
+### Fixed
+  `continuation_start_unacknowledged` stall on every `/loop` iteration under pi >=0.84 — `before_agent_start` is not emitted for `sendMessage({ deliverAs: "followUp" })` continuations, so the start proof never arrived (10/10 `loop_turn_sent` unacknowledged in issue #40). `dispatchStartAcknowledged` now accepts `agent_start`/`turn_start` as fallback while keeping `before_agent_start`+marker as primary; owner/generation/foreign fences still apply so only an unrelated manual turn in the same session could falsely settle — strictly better than 0% success. Ledger records `startProofSource` as `agent_start`/`turn_start` when fallback fires.
+
+  Hardcoded 60s retry backoff after the first 30s start-proof window is now env-configurable (`GLLA_CONTINUATION_RETRY_BACKOFF_MS`, legacy `GLLA_CONTINUATION_START_RETRY_BACKOFF_MS`) independent of `GLLA_CONTINUATION_START_TIMEOUT_MS`, so slow local models can extend both windows (observed 5m + 60s hard cap in issue #40 secondary).
+
+### Added
+  Regression pins for the fallback path and env var (`tests/loop-start-proof-fallback.test.ts`, `tests/stale-api-terminal.test.ts`, `tests/stall-handling.test.ts`).
+
+## 0.37.2 — queued vs monitoring visuals and long-running daemon handling (2026-09-01)
+
+### Added
+  Monitor icon for long-running daemon/supervisor goals: goals matching
+  `daemon|supervisor|keep.*running|monitor|healthz` or with `total >1h` are
+  displayed as `👁 MONITORING` (dim) instead of `⏳ QUEUED` (accent), with
+  "next check" instead of "awaiting pi turn", and are scheduled with
+  `GLLA_MONITOR_INTERVAL_MS` (default 120s) instead of immediate continuation
+  to avoid constant queued churn.
+
+### Changed
+  `QUEUED` now renders as `⏳ QUEUED` in accent blue (distinct from `BUSY`
+  warning yellow) with `awaiting pi turn` detail, fixing the "mistook it
+  for stuck" report (note.md 2026-09-01, screenshots 190127/193438/193529).
+  `LIVE · WORKING` remains success-accent with signal.
+
+### Fixed
+  Stale `followUp` continuations that survived `archiveCurrentGoal` via Pi's
+  `followUpQueue` are sanitized at `message_end` (ExtensionRunner →
+  AgentSession) plus timer disarm at archival — `LENGTH_CONTINUE` and foreign
+  ctx are exempt.
+
 ## 0.37.1 — auditor watchdogs, continuous list handoff, and audit hardening (2026-09-01)
 
 ### Added

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.37.1 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.37.3 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/goal-continuation.ts

@@ -47,6 +47,7 @@ import {
   isStaleApiError,
   supervisorPaused,
   objectiveIsUserSeeded,
+  isMonitorGoal,
   type Goal,
   type ObjectiveRepairTarget,
 } from "./goal-loop-core.js";
@@ -63,6 +64,12 @@ import {
 } from "./goal-loop-dispatch.js";
 import { BACKOFF_IDLE_RETRY_MS, HEARTBEAT_MAX_NUDGES } from "./goal-loop-backoff.js";
 import { LENGTH_CONTINUE_MAX, LENGTH_CONTINUE_TEXT } from "./length-continue.js";
+
+const DEFAULT_MONITOR_CHECK_INTERVAL_MS = 120_000;
+const configuredMonitorIntervalMs = Number(process.env.GLLA_MONITOR_INTERVAL_MS);
+const MONITOR_CHECK_INTERVAL_MS = Number.isFinite(configuredMonitorIntervalMs) && configuredMonitorIntervalMs > 0
+  ? Math.max(1_000, configuredMonitorIntervalMs)
+  : DEFAULT_MONITOR_CHECK_INTERVAL_MS;
 import { VISION_ASSIST_GUIDANCE } from "./vision-assist.js";
 import { loadSettings } from "./goal-settings.js";
 import { clearLoopTimer, isLoopActive } from "./goal-loop.js";
@@ -197,7 +204,11 @@ export function createGoalContinuation(flagsArg: ContinuationFlags, d: Continuat
 // self-heal; only the second window failure declares unacknowledged (the
 // explicit /list|/goal|/loop resume fallback for genuine provider stalls).
 const CONTINUATION_START_TIMEOUT_MS = Number(process.env.GLLA_CONTINUATION_START_TIMEOUT_MS ?? 30_000);
-const NO_TURN_START_RETRY_BACKOFF_MS = 60_000;
+const NO_TURN_START_RETRY_BACKOFF_MS = Number(
+  process.env.GLLA_CONTINUATION_RETRY_BACKOFF_MS ??
+  process.env.GLLA_CONTINUATION_START_RETRY_BACKOFF_MS ??
+  60_000,
+);
 let continuationStartTimeoutOverrideMs: number | null = null;
 let continuationRetryBackoffOverrideMs: number | null = null;
 function continuationStartTimeoutMs(): number {
@@ -561,21 +572,43 @@ export function dispatchStartAcknowledged(ctx: ExtensionContext, source: string,
   }
   // A dispatch has one accepted window and one start proof. Once a start was
   // recorded, later low-level events must not re-settle it; before that,
-  // events without the exact before_agent_start marker are unrelated manual
-  // activity and cannot clear the watchdog.
+  // only a marker-carrying before_agent_start or the pi>=0.84 fallback
+  // (agent_start/turn_start without a prompt) may clear the watchdog.
   const pending = pendingContinuationDispatch;
   if (!pending || pending.phase !== "accepted") return false;
-  if (source !== "before_agent_start" && !pending.startProofSource) return false;
+  // v0.37.3 (issue #40): pi >=0.84 does not emit before_agent_start for
+  // followUp continuations (sendMessage { deliverAs: "followUp" }) — the
+  // only delivery path for continuations. Gate on the strongest proof when
+  // available, but accept agent_start/turn_start as fallback so the
+  // continuation is not stuck at 0% success. Owner/generation/foreign
+  // checks below still fence the fallback to the same session/generation.
+  if (
+    source !== "before_agent_start" &&
+    source !== "agent_start" &&
+    source !== "turn_start" &&
+    !pending.startProofSource
+  )
+    return false;
   const record = pendingContinuationDispatch;
   if (!record || flags.sessionHandoffPending || flags.extensionApiStale || flags.staleTerminalDone || flags.zombieStoodDown) return false;
   if (record.generation !== flags.sessionGeneration || isForeignCtx(ctx)) return false;
   if (!dispatchMatchesOwner(record, flags.sessionGeneration, sessionManagerId(ctx))) return false;
   if ((record.kind === "goal" || record.kind === "stall") && (!state.goal || state.goal.id !== record.goalId || state.goal.status !== "active")) return false;
-  // before_agent_start is the required proof: it must carry this exact
-  // dispatch marker. Older low-level events without a prompt are liveness
-  // signals only; accepting them would let an unrelated manual turn settle
-  // this dispatch and suppress its recovery watchdog.
-  if (source !== "before_agent_start" || !dispatchPromptMatches(record, prompt)) return false;
+  // before_agent_start must carry this exact dispatch marker. The fallback
+  // (agent_start/turn_start) carries no prompt in pi >=0.84 for followUp
+  // turns — owner/generation/foreign above already fence it to the same
+  // session, so an unrelated manual turn in the same session is the only
+  // remaining false-positive, strictly better than never acknowledging.
+  if (source === "before_agent_start") {
+    if (!dispatchPromptMatches(record, prompt)) return false;
+  } else if (source === "agent_start" || source === "turn_start") {
+    // fallback — no prompt to match
+  } else {
+    // message_update / agent_end / other liveness signals cannot settle
+    // without an existing proof, and pending.phase !== "accepted" already
+    // blocks re-settlement after the first proof.
+    return false;
+  }
   const settledAt = Date.now();
   const started: ContinuationDispatch = {
     ...transitionDispatch(record, "started"),
@@ -991,6 +1024,10 @@ export function scheduleContinuation(ctx: ExtensionContext, force = false, delay
   } catch {
     return;
   }
+  // v0.37.x: monitor goals (daemon, long-running >1h) check less frequently to avoid constant QUEUED churn.
+  if (delayMs === undefined && state.goal && isMonitorGoal(state.goal)) {
+    delay = Math.max(delay, MONITOR_CHECK_INTERVAL_MS);
+  }
   // v0.34.104 ([Image-#1]): the post-list-completion settle window delays
   // the first continuation after a queue auto-advance. Any real agent
   // activity during the window clears `postCompletionSettleUntil`, so a

package/extensions/goal-loop-core.ts

@@ -568,6 +568,19 @@ export function objectiveIsUserSeeded(goal: Pick<Goal, "objective" | "createdVia
   });
 }
 
+/**
+ * A long-running goal whose next turn is a health check should not look like
+ * a wedged queue. Keep this predicate pure and shared by scheduling and both
+ * TUI surfaces so a goal cannot be throttled without receiving the matching
+ * monitoring icon (or vice versa).
+ */
+export function isMonitorGoal(goal: Pick<Goal, "objective" | "createdAt">, now = Date.now()): boolean {
+  const objective = goal.objective.toLowerCase();
+  if (/daemon|supervisor|keep.*running|monitor|healthz|book-daemon/.test(objective)) return true;
+  const started = Date.parse(goal.createdAt);
+  return Number.isFinite(started) && now - started > 60 * 60 * 1000;
+}
+
 /**
  * During a LIST drafting session the agent must not add items one by one
  * with list_add/list_activate — that bypasses the user's Confirm gate

package/extensions/goal-loop-display.ts

@@ -13,7 +13,9 @@
 import { truncateToWidth as tuiTruncateToWidth, visibleWidth as tuiVisibleWidth } from "@earendil-works/pi-tui";
 
 import type { DurableDeferRecommendationInput, Goal, MainModelRecovery, State } from "./goal-loop-core.js";
-import { buildDurableDeferRecommendation, compactDisplayText, formatMainModelRecoveryStatus, isPersistenceDegraded, lastPersistenceFailure, sanitizeDisplayText, sanitizeProviderAuditReport, sanitizeProviderDisplayText, stripThinkBlocks } from "./goal-loop-core.js";
+import { buildDurableDeferRecommendation, compactDisplayText, formatMainModelRecoveryStatus, isMonitorGoal, isPersistenceDegraded, lastPersistenceFailure, sanitizeDisplayText, sanitizeProviderAuditReport, sanitizeProviderDisplayText, stripThinkBlocks } from "./goal-loop-core.js";
+
+export { isMonitorGoal };
 import { HELD_ON_RESTORE, type LoopState } from "./goal-loop-forever.js";
 import { auditorSurfaceSuppressed } from "./loops/goal-auditor-surface.js";
 
@@ -95,7 +97,7 @@ export interface RecentActionDisplay {
 }
 
 /** v0.33.0: widget extras — the refire streak plus the recent-action feed. */
-export type GoalDisplayActivity = "active" | "awaiting-first-turn" | "working" | "busy" | "queued" | "idle";
+export type GoalDisplayActivity = "active" | "awaiting-first-turn" | "working" | "busy" | "queued" | "monitoring" | "idle";
 
 export interface ModelProvenanceDisplay {
   /** The primary model reference selected for the supervised work. */
@@ -354,7 +356,8 @@ function activityStatusMarker(activity: GoalDisplayActivity | undefined, now: nu
   switch (activity) {
     case "working": return activityBadge("LIVE · WORKING", now, theme);
     case "busy": return activityStateBadge("BUSY", theme, "warning");
-    case "queued": return activityStateBadge("QUEUED", theme, "warning");
+    case "queued": return activityStateBadge("⏳ QUEUED", theme, "accent");
+    case "monitoring": return activityStateBadge("👁 MONITORING", theme, "dim");
     case "idle": return activityStateBadge("IDLE", theme, "warning");
     case "awaiting-first-turn": return activityStateBadge("AWAITING FIRST TURN", theme, "warning");
     case "active": return activityStateBadge("ACTIVE", theme, "accent");
@@ -757,9 +760,11 @@ function lastAuditorTool(audit: AuditDisplayProgress | null | undefined): string
   return typeof name === "string" && name.trim() ? truncate(name, 30) : undefined;
 }
 
-function goalDisplayActivity(g: Goal, extras?: WidgetExtras): GoalDisplayActivity {
+function goalDisplayActivity(g: Goal, extras?: WidgetExtras, now = Date.now()): GoalDisplayActivity {
   if (g.status !== "active") return "active";
-  return extras?.activity ?? "active";
+  const activity = extras?.activity ?? "active";
+  if (activity === "queued" && isMonitorGoal(g, now)) return "monitoring";
+  return activity;
 }
 
 function hostLastActivity(extras: WidgetExtras | undefined, now: number): string {
@@ -1031,7 +1036,7 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
     if (attention) {
       return withRecovery(`glla: ${paint(theme, attention.color, `⚠ ${attention.label}`)}${heldSuffix}`);
     }
-    const activity = goalDisplayActivity(g, extras);
+    const activity = goalDisplayActivity(g, extras, now);
     // v0.34.97: while the post-compaction grace window is open, surface
     // "compacting…" so the user knows the session just shrank. The chip
     // survives reload because lastCompactionAt is persisted on State.
@@ -1074,11 +1079,14 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
     const n = state.list?.length ?? 0;
     const live = activity === "working";
     const queued = activity === "queued";
+    const monitoring = activity === "monitoring";
     const marker = live
       ? activityBadge("LIVE · WORKING", now, theme)
-      : queued
-        ? activityStateBadge("QUEUED", theme, "warning")
-        : activityStateBadge("ACTIVE", theme, "accent");
+      : monitoring
+        ? activityStateBadge("👁 MONITORING", theme, "dim")
+        : queued
+          ? activityStateBadge("⏳ QUEUED", theme, "accent")
+          : activityStateBadge("ACTIVE", theme, "accent");
     // When recovery parks a queued goal, name the blocker — `[QUEUED] 12m
     // 26s` reads as a stalled queue with no WHY. State.mainModelRecovery is
     // the bounded envelope's parked state; the status line says what is
@@ -1096,8 +1104,9 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
       // v0.34.124: the QUEUED "why" — an accepted dispatch that pi has not
       // started, and the last real activity age. A ticking timer with no
       // freshness told the user nothing (note.md 221249).
-      queued && extras?.turnPending ? "turn pending" : "",
-      queued ? hostLastActivity(extras, now).replace(/^ · /, "") : "",
+      queued && extras?.turnPending ? "awaiting pi turn" : "",
+      monitoring ? "next check" : "",
+      (queued || monitoring) ? hostLastActivity(extras, now).replace(/^ · /, "") : "",
       n > 0 ? `${n} queued` : "",
     ].filter(Boolean);
     return withRecovery(`glla: ${marker}${details.length > 0 ? ` ${details.join(" · ")}` : ""}${recoverySuffix}${heldSuffix}`);

package/extensions/loops/goal-activation.ts

@@ -671,6 +671,36 @@ function refuseForeignCommand(ctx: ExtensionContext): boolean {
   return true;
 }
 
+export function __testOnlyClassifyStaleContinuation(content: string, cwd: string): string | null {
+  const goalIdMatch = content.match(/\[GOAL CHECKPOINT goalId=([^\]\s]+)\]/);
+  const loopMatch = content.match(/\[LOOP ITERATION (\d+)\]/);
+  const isStall = content.includes("[STALL WARNING");
+  const isLengthContinue = content.includes("Your previous response was cut off") || content.includes("Response hit the output-token cap");
+  if (isLengthContinue) return null;
+  if (goalIdMatch) {
+    const gid = goalIdMatch[1]!;
+    if (!state.goal) return `no active goal (expected ${gid})`;
+    if (state.goal.id !== gid) return `goal mismatch (expected ${gid}, active ${state.goal.id})`;
+    if (state.goal.status !== "active") return `goal ${gid} not active (status=${state.goal.status})`;
+    try {
+      const p = archivedGoalPath(cwd, gid);
+      if (fs.existsSync(p)) return `goal ${gid} already archived`;
+    } catch {}
+    if ((state.goal as any).stopReason) return `goal ${gid} terminal stopReason present`;
+    return null;
+  }
+  if (loopMatch) {
+    if (!state.loop?.active) return `loop not active (iteration ${loopMatch[1]})`;
+    return null;
+  }
+  if (isStall) {
+    if (!state.goal || state.goal.status !== "active") return "stall warning with no active goal";
+    return null;
+  }
+  if (!state.goal && !state.loop?.active) return "no active supervision for generic goal-event";
+  return null;
+}
+
 export function registerGoalRuntime(pi: ExtensionAPI): void {
   // Factories run before lifecycle events, so observe readiness now; the
   // admitted session_start below decides which bus/generation may control a
@@ -973,6 +1003,37 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     draftingUserReplies++;
   });
 
+  // v0.37.2: stale queued goal-event continuations (hidden display:false
+  // custom messages) can survive goal archival via Pi's followUp queue.
+  // Pi has no public clear queue API, so sanitize at delivery: replace
+  // stale content before it is persisted or drives a turn.
+  pi.on("message_end", async (event: any, ctx: ExtensionContext) => {
+    const msg: any = event?.message;
+    if (!msg || msg.role !== "custom" || msg.customType !== "goal-event") return;
+    if (isForeignCtx(ctx)) return;
+    let content = "";
+    if (typeof msg.content === "string") content = msg.content;
+    else if (Array.isArray(msg.content)) content = msg.content.map((c: any) => typeof c === "string" ? c : (c?.text ?? "")).join("\n");
+    else if (msg.content != null) content = String(msg.content);
+    const staleReason = __testOnlyClassifyStaleContinuation(content, ctx.cwd);
+    if (!staleReason) return;
+    const goalIdMatch = content.match(/\[GOAL CHECKPOINT goalId=([^\]\s]+)\]/);
+    const loopMatch = content.match(/\[LOOP ITERATION (\d+)\]/);
+    const sanitizedContent = `[GLLA: discarded stale continuation — ${staleReason}. No action required. Live state: ${state.goal ? `goal ${state.goal.id} (${state.goal.status})` : state.loop?.active ? `loop active iteration ${state.loop.iteration}` : "idle (no goal/loop)"}.]`;
+    appendLedger(ctx.cwd, "stale_continuation_sanitized", {
+      reason: staleReason,
+      goalId: goalIdMatch?.[1],
+      loopIteration: loopMatch?.[1],
+      originalPreview: content.slice(0, 200),
+    });
+    const sanitized = {
+      ...msg,
+      content: sanitizedContent,
+      display: false,
+    };
+    return { message: sanitized };
+  });
+
   // v0.15.1: ask_user_question answers arrive as tool results, not chat
   // messages — count answered (non-cancelled) questionnaires as replies too.
   pi.on("tool_result", async (event: any, eventCtx: ExtensionContext) => {

package/extensions/loops/goal-orchestrator.ts

@@ -1237,6 +1237,9 @@ function archiveCurrentGoal(
   }
   releaseContinuationDispatchStandDown();
   clearDispatchRecord(ctx.cwd);
+  clearContinuationTimer();
+  clearContinuationStartWatchdog();
+  clearQueueStuckProbe();
   postCompactResumeOwed = false; // v0.33.1: the dead goal's compact debt/resync dies with it
   postCompactResyncPending = false;
   // v0.34.120: archive is the durable history; a terminal goal must not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.37.1",
+  "version": "0.37.3",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",