pi-goal-list-loop-audit 0.37.3 → 0.38.1

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.38.1 — drafter/auditor fallback parity with Main (2026-09-02)
+
+### Fixed
+  Drafter model selection now emits the same `model_fallback_select` ledger as Main (`scope: drafter`) for every forbidden/unregistered skip, so `forbiddenModels` edits mid-interview are honored even when the user edits settings while the interview is open.
+
+  Drafter recovery after a provider failure now walks the dedicated 0-10 chain via `ModelSelector` with the bounded ladder (`5s → base*2^(n-1) cap 5h`, base `mainModelRetryMinutes` default 15) and `forbiddenModels` re-check, instead of an immediate unbounded loop over the lease candidates. Same-model pin (drafter pinned to the session model) remains a same-model retry and is preserved.
+
+  Auditor `model_fallback_select` ledger (`scope: auditor`) now fires for both the settings-time `resolveAuditorModel` walk and the detached audit fallback (`runAuditorFallbackWithPolicy` via `runDetachedCompletionWithFallback`), closing the gap where detached retries skipped forbidden/unregistered refs silently. `forbiddenRefs` and `retryBaseMinutes` were already wired; `onSelection` is now forwarded.
+
+### Changed
+  `Drafter fallback agents` menu row → `Drafter fallback models (up to 10)` with count prefix `N/10 · 1. ref → 2. ref` and the shared `ordered and deselectable: current drafter → fallback 1 → fallback 2…` description, matching Main and Auditor rows. Prompt title and notification strings updated to `models` vocabulary. Watchdog budgets (`auditorToolTimeoutMs 5m`, `auditorStallMs 10m` x2 cap 4x) remain independent of the ladder and unchanged.
+
+## 0.38.0 — event-driven supervision and drafting discipline (2026-09-02)
+
+### Fixed
+  Keep-checking supervision: scheduling is now event-driven for every plane (including `isMonitorGoal` daemons) — lifecycle/durable/child-progress signals via `ContinuousSupervisor` plus 250ms→15s adaptive fallback poll, not a guessed task-duration wait. The 120s `GLLA_MONITOR_INTERVAL_MS` throttle that made a 10s task wait up to 120s is deprecated (`void MONITOR_CHECK_INTERVAL_MS`) and kept only for display parity (`👁 MONITORING` badge). A 10s task is now picked up after ~10s even when guessed at 10m.
+
+  Pinned context-growth fixtures (`tests/context-growth-measurement.test.ts`, `tests/context-checkpoint.test.ts`) refreshed for the larger continuation prompt (23015 chars, 23123 bytes) so `npm run test:all` stays green.
+
+### Changed
+  Drafting-batches zero mid-execution questions: `buildSeedGrillMessage` now batches 2-4 sharp, seed-specific questions up front in one `ask_user_question` picker with recommended defaults per question. `LONG_RUNNING_JUDGMENT_POLICY` and `ACTIVE_EXECUTION_QUESTION_GUIDANCE` plus `prompts/goal-loop-continuation.md` enforce drafting as the only place to gather scope/acceptance — active execution targets zero further clarification unless irreversible/destructive, missing permission, or comparable-cost, picking the safest contract-preserving default otherwise and deferring preferences to the completion summary.
+
+  `docs/DESIGN-long-running-supervision.md` now documents both Now requirements and the display-only monitor contract.
+
 ## 0.37.3 — pi 0.84 loop stall fix — agent_start fallback for continuation start proof (2026-09-02)
 
 ### Fixed

package/docs/DESIGN-long-running-supervision.md

@@ -39,6 +39,27 @@ The shared checker covers all GLLA-owned work planes: ordinary goals, list
 items and their queue, metric/spec/audit loops, detached completion auditors,
 tracked subagents, provider recovery, and lifecycle/session transitions.
 
+Two Now requirements are enforced alongside the checker:
+
+- **Keep checking, not waiting.** The checker is the primary reason to inspect
+  work; a guessed task duration is never a wait. A 10 s task is picked up
+  within the 250 ms → 15 s adaptive fallback, not after a 10 m estimate.
+  `isMonitorGoal` (daemon / old-goal name or age > 1 h) remains shared for
+  display parity (the dim 👁 MONITORING badge), but scheduling is event-driven
+  for every plane — the legacy 120 s monitor throttle (`GLLA_MONITOR_INTERVAL_MS`)
+  is retired and kept only as deprecated env-var compatibility (the checker
+  already backs off to 15 s when idle).
+- **Zero mid-execution questions — compensate up front.** Drafting batches 2–4
+  sharp scope/acceptance questions with recommended defaults via a single
+  `ask_user_question` invocation, so active execution needs no further
+  clarification. During `active` execution the target is zero questions unless
+  proceeding would cross an irreversible/destructive external boundary, require
+  a missing permission/credential, or face two genuinely comparable options
+  with materially different outcomes. `LONG_RUNNING_JUDGMENT_POLICY` encodes the
+  durable-fix default; `ACTIVE_EXECUTION_QUESTION_GUIDANCE` encodes the
+  drafting-only discipline; `buildSeedGrillMessage` enforces the floor
+  (propose is blocked until the user has replied).
+
 ## Aggressive automation
 
 Aggressive mode is the default effective keep-going policy unless the user

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.37.3 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.1 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/drafter-model.ts

@@ -7,7 +7,7 @@
 
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
-import { isForbiddenModel } from "./goal-loop-core.js";
+import { appendLedger, isForbiddenModel } from "./goal-loop-core.js";
 import { MAX_MAIN_MODEL_FALLBACKS, modelRef, normalizeMainModelFallbackRefs } from "./main-model-recovery.js";
 import { ModelSelector } from "./model-selector.js";
 import type { Settings } from "./goal-settings.js";
@@ -63,15 +63,22 @@ export function resolveDrafterModel(ctx: ExtensionContext, settings: Pick<Settin
     getChain: () => configuredRefs,
     resolve: (ref) => resolveDrafterModelRef(ctx, ref),
     isForbidden: forbidden,
+    record: (event) => {
+      appendLedger(ctx.cwd, "model_fallback_select", {
+        scope: event.scope.kind,
+        fromRef: event.fromRef,
+        toRef: event.toRef,
+        reason: event.reason,
+      });
+    },
   });
   const attempted: string[] = [];
   const candidates: DrafterModelCandidate[] = [];
 
-  // ModelSelector deliberately skips the current model so the main recovery
-  // walker never selects the model that just failed. Drafting is different:
-  // its configured primary may intentionally be the current session model,
-  // and that primary still needs a lease so its later fallbacks remain
-  // available if the first drafting turn fails.
+  // KEEP: drafting intentionally leases the current model when pinned (unlike
+  // Main which skips `current` via nextUntriedModelRef because it just failed).
+  // Align ledger to Main but keep this lease gate — removing it would force a
+  // needless setModel when the user pinned the drafter to the session model.
   const configuredPrimary = configuredRefs[0];
   if (
     configuredPrimary &&

package/extensions/goal-continuation.ts

@@ -65,11 +65,18 @@ import {
 import { BACKOFF_IDLE_RETRY_MS, HEARTBEAT_MAX_NUDGES } from "./goal-loop-backoff.js";
 import { LENGTH_CONTINUE_MAX, LENGTH_CONTINUE_TEXT } from "./length-continue.js";
 
+// v0.38.0: GLLA_MONITOR_INTERVAL_MS throttling is deprecated — scheduling is
+// event-driven (250ms→15s adaptive fallback) for every plane, including
+// monitoring goals (see scheduleContinuation comment). Kept for env-var
+// compatibility; display parity still uses isMonitorGoal, but the checker no
+// longer waits a fixed 120s. The constants remain so an explicit env var does
+// not silently disappear from process state during a rolling upgrade.
 const DEFAULT_MONITOR_CHECK_INTERVAL_MS = 120_000;
 const configuredMonitorIntervalMs = Number(process.env.GLLA_MONITOR_INTERVAL_MS);
 const MONITOR_CHECK_INTERVAL_MS = Number.isFinite(configuredMonitorIntervalMs) && configuredMonitorIntervalMs > 0
   ? Math.max(1_000, configuredMonitorIntervalMs)
   : DEFAULT_MONITOR_CHECK_INTERVAL_MS;
+void MONITOR_CHECK_INTERVAL_MS; // deprecated throttle — scheduling is now event-driven
 import { VISION_ASSIST_GUIDANCE } from "./vision-assist.js";
 import { loadSettings } from "./goal-settings.js";
 import { clearLoopTimer, isLoopActive } from "./goal-loop.js";
@@ -1024,10 +1031,16 @@ export function scheduleContinuation(ctx: ExtensionContext, force = false, delay
   } catch {
     return;
   }
-  // v0.37.x: monitor goals (daemon, long-running >1h) check less frequently to avoid constant QUEUED churn.
-  if (delayMs === undefined && state.goal && isMonitorGoal(state.goal)) {
-    delay = Math.max(delay, MONITOR_CHECK_INTERVAL_MS);
-  }
+  // v0.38.0 (note.md Now — "keep checking instead of waiting"): monitoring
+  // goals remain visually distinct (👁 MONITORING badge via isMonitorGoal, shared
+  // with the TUI), but scheduling is event-driven for every plane — the 120s
+  // throttle used to delay implicit continuations for daemon/old goals and
+  // made a 10s task wait up to 120s. The durable-state / lifecycle event +
+  // 250ms→15s adaptive fallback in ContinuousSupervisor is the primary checker;
+  // implicit continuation delay is 0 when idle, 50ms otherwise, never a guessed
+  // task-duration wait. isMonitorGoal stays pure for display parity, not for
+  // throttling the checker — a monitoring goal that actually finishes or
+  // progresses is picked up within the fallback window, not after a fixed age.
   // v0.34.104 ([Image-#1]): the post-list-completion settle window delays
   // the first continuation after a queue auto-advance. Any real agent
   // activity during the window clears `postCompletionSettleUntil`, so a

package/extensions/goal-loop-core.ts

@@ -783,7 +783,7 @@ export function goalArgsNeedDrafting(args: string): boolean {
  * via draftProposalBlock: propose is blocked until the user has replied.
  */
 export function buildSeedGrillMessage(tmpl: string, seed: string, tool: string): string {
-  return `${tmpl}\n\n${LONG_RUNNING_JUDGMENT_POLICY}\n\nThe user's initial objective (verbatim): ${seed}\n\nGRILL THEM ABOUT THIS SEED BEFORE PROPOSING. ${tool} is BLOCKED until the user has replied to at least one of your questions — proposing without interviewing returns an error.\n\nHow to grill:\n- Ask ONE sharp, seed-specific question at a time — about THIS objective, not generic filler. If an ask_user_question tool is available in this session, prefer it (structured options render better); plain conversation is fine for free-form answers.\n- Every question ships with a recommended default the user can accept with "yes".\n- Probe what matters: what "done" concretely looks like (checkable evidence — files, commands, behaviors), scope boundaries (what is explicitly OUT), constraints (what must not change), and priorities when the seed bundles several wishes.\n- A non-answer ("not sure", "none", "whatever") is a trigger to offer 2-3 concrete options to pick from — never silently proceed on a non-answer.\n- Do targeted read-only research first when it makes your questions sharper (repo layout, existing docs).\n- Do NOT activate the raw seed. Do NOT implement anything. When the contract is concrete, call ${tool}.`;
+  return `${tmpl}\n\n${LONG_RUNNING_JUDGMENT_POLICY}\n\nThe user's initial objective (verbatim): ${seed}\n\nGRILL THEM ABOUT THIS SEED BEFORE PROPOSING. ${tool} is BLOCKED until the user has replied to at least one of your questions — proposing without interviewing returns an error.\n\nHow to grill:\n- Ask 2-4 sharp, seed-specific questions UP FRONT in ONE batched ask_user_question call when multiple unknowns exist — about THIS objective, not generic filler. Each question ships with a recommended default the user can accept with "yes" (one picker, 2-4 concrete options per question). If only one unknown remains, one focused question is fine. Prefer the structured ask_user_question picker; plain conversation is fine for free-form answers.\n- Probe what matters in that single upfront batch: what "done" concretely looks like (checkable evidence — files, commands, behaviors), scope boundaries (what is explicitly OUT), constraints (what must not change), and priorities when the seed bundles several wishes. One well-batched interview up front eliminates mid-execution interruptions — do not dribble questions out one by one during execution.\n- A non-answer ("not sure", "none", "whatever") is a trigger to offer 2-3 concrete options to pick from — never silently proceed on a non-answer.\n- Do targeted read-only research first when it makes your questions sharper (repo layout, existing docs).\n- Do NOT activate the raw seed. Do NOT implement anything. When the contract is concrete, call ${tool}.`;
 }
 
 /**
@@ -2775,7 +2775,7 @@ ${formatDurableDeferPolicyLine()}
 - Use an opportunistic workaround only when the durable fix is genuinely unsafe, impossible, or blocked right now; the workaround must be reversible and testable, and its durable follow-up is recorded (ledger or comment) instead of silently treated as final.
 - Premium engineering standards are mandatory: code must be cleanly typed, tested, architecturally sound, and resilient across lifecycle boundaries. Never lower test standards, fake assertions, or bypass types.
 - Autonomous pivot strategy: if an implementation approach fails verification after 2 attempts, do not loop on the same failing line. Autonomously step back, diagnose the root invariant, and pivot to a clean alternative architecture.
-- Non-interruption & sensible defaults: never pause a multi-hour run for obvious choices, cosmetic naming, or non-blocking secondary questions. Pick the sensible architectural default, implement it, record the rationale, and continue. Defer non-blocking notes to the final completion summary.
+- Non-interruption & sensible defaults: never pause a multi-hour run for obvious choices, cosmetic naming, or non-blocking secondary questions. Pick the sensible architectural default, implement it, record the rationale, and continue. Defer non-blocking notes to the final completion summary. Compensate for zero mid-run questions by asking MORE up front: during drafting, batch 2-4 critical scope/acceptance questions with recommended defaults via a single ask_user_question invocation, so active execution needs no further clarification.
 - Decide autonomously through local implementation choices without interrupting the user. Ask one focused question ONLY at a genuine trade-off where the user's preference materially changes the outcome: an irreversible/destructive external action, a missing permission/credential, or two options with comparable real cost.
 - In unattended mode, choose the safest contract-preserving path and continue. If no safe choice exists, raise a concrete DECIDE question with a recommended default; never ask a vague progress question or wait on a guessed provider/quota reset.`;
 
@@ -2785,12 +2785,11 @@ ${formatDurableDeferPolicyLine()}
  * reversible local choices or turn them into user-facing pauses.
  */
 export const ACTIVE_EXECUTION_QUESTION_GUIDANCE = `ACTIVE-EXECUTION QUESTION DISCIPLINE:
-- Drafting is the default place to gather scope, acceptance criteria, constraints, and trade-offs. Once active, treat the confirmed objective and verification contract as sufficient context.
-- During active execution, do not ask about reversible implementation choices, naming, formatting, test shape, or whether to continue. Choose the maintainable contract-preserving option, record the rationale, and proceed.
+- Drafting is the ONLY place to gather scope, acceptance criteria, constraints, and trade-offs — batch 2-4 sharp questions up front with recommended defaults via one ask_user_question call. Once active, treat the confirmed objective and verification contract as sufficient context and do NOT reopen reversible local choices.
+- During active execution, do NOT ask about reversible implementation choices, naming, formatting, test shape, or whether to continue. Choose the maintainable contract-preserving option, record the rationale, and proceed. The target is zero mid-execution questions unless proceeding would cross an irreversible/destructive external boundary, require a missing permission/credential, or face two genuinely comparable options with materially different results.
 - Defer non-blocking preferences and alternatives to the completion summary (or a durable note); do not turn them into a pause or question.
-- Ask one focused user question only when proceeding would cross an irreversible or destructive external boundary, requires a missing permission or credential, or two genuinely comparable options would materially change the result or acceptance.
-- For a necessary question, state the exact impact, include a recommended default, and pause only the dependent action; continue independent work when possible.
-- Never ask a vague progress or "what next?" question, and never wait on a guessed provider or quota reset; use bounded recovery or choose the safe default.`;
+- For the rare necessary mid-run question, state the exact impact, include a recommended default, and pause only the dependent action; continue independent work when possible.
+- Never ask a vague progress or "what next?" question, and never wait on a guessed provider or quota reset; use bounded recovery or choose the safe default. If drafting left an ambiguity, pick the safest contract-preserving default and record it rather than interrupting a multi-hour run.`;
 
 /**
  * v0.23.5: normalize a drafter-supplied verification contract for the

package/extensions/loops/goal-activation.ts

@@ -2023,8 +2023,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // an interview must retry that chain before the main-goal recovery path;
     // otherwise a drafting failure would silently consume main-model backups.
     if (lastA?.stopReason === "error" && draftingTarget !== null) {
-      const retryDrafting = (globalThis as any).handleDrafterModelFailure as ((context: ExtensionContext) => Promise<boolean>) | undefined;
-      if (retryDrafting) await retryDrafting(ctx);
+      const retryDrafting = (globalThis as any).handleDrafterModelFailure as ((context: ExtensionContext, error?: string) => Promise<boolean>) | undefined;
+      if (retryDrafting) await retryDrafting(ctx, (rawLastA as any)?.errorMessage ?? (rawLastA as any)?.error ?? lastA.text);
       // Whether a configured fallback was available or not, drafting owns
       // this error. Leave the interview open for an explicit user retry and
       // never pass the same failure into main-goal recovery.

package/extensions/loops/goal-auditor-hooks.ts

@@ -904,6 +904,7 @@ export async function runDetachedCompletionWithFallback(
     onFallback?: (from: AuditorModelCandidate, to: AuditorModelCandidate, error: string) => void;
     forbiddenRefs?: readonly string[];
     retryBaseMinutes?: number;
+    onSelection?: (event: { scope: { kind: string }; fromRef?: string; toRef?: string; reason: string }) => void;
   } = {},
 ): Promise<{ result: DetachedAuditResult; retriedOnce: boolean; fallbackUsed: boolean; via: string }> {
   return runAuditorFallbackWithPolicy(candidates, run, {
@@ -911,6 +912,7 @@ export async function runDetachedCompletionWithFallback(
     shouldRetry: opts.shouldRetry,
     sleep: opts.sleep,
     retryBaseMinutes: opts.retryBaseMinutes,
+    onSelection: opts.onSelection,
     resumeCandidateRef: opts.resumeCandidateRef,
     attemptedRefs: opts.attemptedRefs,
     retryCandidateRef: opts.retryCandidateRef,
@@ -1101,6 +1103,7 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provi
         shouldRetry: () => detachedAuditContext(generation, goalId, claim.attemptId!) !== null,
         forbiddenRefs: settings.forbiddenModels,
         retryBaseMinutes: settings.mainModelRetryMinutes,
+        onSelection: (event: { scope: { kind: string }; fromRef?: string; toRef?: string; reason: string }) => appendLedger(liveCtx.cwd, "model_fallback_select", { scope: "auditor", fromRef: event.fromRef, toRef: event.toRef, reason: event.reason }),
         resumeCandidateRef: persistedAuditorCandidateRef,
         attemptedRefs: persistedAuditorAttemptedRefs,
         retryCandidateRef: persistedAuditorRetryCandidateRef,

package/extensions/loops/goal-list-queue.ts

@@ -371,6 +371,7 @@ import {
   resolveDrafterModel,
   type DrafterModelCandidate,
 } from "../drafter-model.js";
+import { ModelSelector } from "../model-selector.js";
 import {
   assessSuspiciousObjective,
   deriveObjectiveFromContract,
@@ -553,25 +554,57 @@ async function restoreDrafterModel(): Promise<void> {
 }
 
 /**
- * Generic drafting recovery: walk the dedicated chain after any provider
- * error and replay a continuation of the existing interview. No error text
- * is classified and the main-model recovery chain is never consulted.
+ * Generic drafting recovery: walk the dedicated chain via ModelSelector so
+ * forbidden/unregistered refs are skipped with the same ledger as Main,
+ * and provider retries use the bounded ladder (5s → base*2^(n-1) cap 5h).
+ * The session model remains the last resort; same-model lease is preserved.
  */
-async function handleDrafterModelFailure(ctx: ExtensionContext): Promise<boolean> {
+async function handleDrafterModelFailure(ctx: ExtensionContext, error?: string): Promise<boolean> {
   const lease = draftingModelLease;
   if (!lease || draftingTarget === null || lease.generation !== sessionGeneration || !extensionApi) return false;
-  for (const candidate of lease.candidates) {
-    if (lease.attempted.some((ref) => ref.toLowerCase() === candidate.ref.toLowerCase())) continue;
-    lease.attempted.push(candidate.ref);
+  const settings = loadSettings(ctx.cwd);
+  const failure = classifyMainModelFailure(error);
+  if (failure.kind === "non-recoverable") return false;
+  const configuredRefs = lease.candidates.filter((candidate) => candidate.via === "configured").map((candidate) => candidate.ref);
+  const selector = new ModelSelector({
+    getChain: () => configuredRefs,
+    resolve: (ref) => lease.candidates.find((candidate) => candidate.ref.toLowerCase() === ref.toLowerCase())?.model,
+    isForbidden: (ref) => isForbiddenModel(ref, settings.forbiddenModels),
+    record: (event) =>
+      appendLedger(ctx.cwd, "model_fallback_select", {
+        scope: "drafter",
+        fromRef: event.fromRef,
+        toRef: event.toRef,
+        reason: event.reason,
+      }),
+  });
+  let attempt = lease.attempted.length;
+  for (;;) {
+    const pick = selector.selectNextValid({ kind: "drafter" }, lease.activeRef, lease.attempted);
+    for (const visited of selector.lastVisitedRefs) {
+      if (!lease.attempted.some((ref) => ref.toLowerCase() === visited.toLowerCase())) lease.attempted.push(visited);
+    }
+    if (!("model" in pick)) break;
+    const delayMs = mainModelFailureDelayMs(failure, ++attempt, (settings as any).mainModelRetryMinutes ?? 15);
+    if (delayMs > 5_000) await new Promise<void>((resolve) => setTimeout(resolve, delayMs));
     let switched = false;
-    try { switched = await extensionApi.setModel(candidate.model); } catch { switched = false; }
-    const alreadyActive = candidate.ref.toLowerCase() === lease.activeRef.toLowerCase();
+    try {
+      switched = await extensionApi.setModel(pick.model);
+    } catch {
+      switched = false;
+    }
+    const alreadyActive = pick.ref.toLowerCase() === lease.activeRef.toLowerCase();
     if (!switched && !alreadyActive) continue;
     const previous = lease.activeRef;
-    lease.activeRef = candidate.ref;
+    lease.activeRef = pick.ref;
     lease.activeThinkingLevel = applyDrafterThinkingLevel(ctx, lease.requestedThinkingLevel);
-    appendLedger(ctx.cwd, alreadyActive ? "drafter_model_retry" : "drafter_model_fallback", { from: previous, to: candidate.ref, attempted: lease.attempted });
-    ctx.ui.notify(`Drafting provider failed; retrying the existing interview on ${candidate.ref}.`, "warning");
+    appendLedger(ctx.cwd, alreadyActive ? "drafter_model_retry" : "drafter_model_fallback", {
+      from: previous,
+      to: pick.ref,
+      attempted: lease.attempted.slice(),
+      delayMs,
+    });
+    ctx.ui.notify(`Drafting provider failed; retrying the existing interview on ${pick.ref} after ${Math.round(delayMs / 1000)}s.`, "warning");
     const safeSteer = (globalThis as any).safeSteerUser as ((context: ExtensionContext, text: string) => boolean) | undefined;
     if (!safeSteer || !safeSteer(ctx, DRAFTER_RECOVERY_PROMPT)) return false;
     draftingSeedInFlight = true;

package/extensions/loops/goal-settings-ui.ts

@@ -554,9 +554,13 @@ export function resolveAuditorModel(
     resolve: (candidate) => tryRef(candidate).model,
     isForbidden: forbidden,
     record: (event) => {
+      appendLedger(ctx.cwd, "model_fallback_select", {
+        scope: "auditor",
+        fromRef: event.fromRef,
+        toRef: event.toRef,
+        reason: event.reason,
+      });
       if (event.reason === "forbidden" && event.toRef) {
-        // Forbidden is an explicit user gate, not an unavailable-model
-        // warning. Keep the forensic ledger entry but do not nudge the UI.
         appendLedger(ctx.cwd, "auditor_model_fallback", { configured: event.toRef, reason: "forbidden" });
         return;
       }
@@ -1222,13 +1226,13 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       const current = normalizeMainModelFallbackRefs(global.drafterModelFallbacks);
       const refs = await promptModelRefs(
         ctx,
-        `Drafter fallback agents — ordered, up to ${MAX_MAIN_MODEL_FALLBACKS}; the session agent is the last resort; forbidden models are hidden`,
+        `Drafter fallback models (up to ${MAX_MAIN_MODEL_FALLBACKS}) — ordered; the session model is the last resort; forbidden models are hidden`,
         current,
         { excludeRefs: normalizeModelRefs(loadSettings(ctx.cwd).forbiddenModels), maxSelections: MAX_MAIN_MODEL_FALLBACKS, currentRef: modelRef(ctx.model) },
       );
       if (refs === undefined) return;
       saveSettings("global", ctx.cwd, { drafterModelFallbacks: refs.length ? refs : undefined });
-      ctx.ui.notify(refs.length ? `Drafter fallback agents saved: ${refs.join(" → ")}.` : "Drafter fallback agents cleared — the session model remains the last resort.", "info");
+      ctx.ui.notify(refs.length ? `Drafter fallback models saved: ${refs.join(" → ")}.` : "Drafter fallback models cleared — the session model remains the last resort.", "info");
       return;
     }
     case "forbiddenModels": {

package/extensions/loops/goal-tools.ts

@@ -889,6 +889,7 @@ function registerAgentTools(pi: any): void {
             shouldRetry: () => detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId) !== null,
             forbiddenRefs: settings.forbiddenModels,
             retryBaseMinutes: settings.mainModelRetryMinutes,
+            onSelection: (event: { scope: { kind: string }; fromRef?: string; toRef?: string; reason: string }) => appendLedger(ctx.cwd, "model_fallback_select", { scope: "auditor", fromRef: event.fromRef, toRef: event.toRef, reason: event.reason }),
             resumeCandidateRef: persistedAuditorCandidateRef,
             attemptedRefs: persistedAuditorAttemptedRefs,
             retryCandidateRef: persistedAuditorRetryCandidateRef,

package/extensions/settings-menu.ts

@@ -322,12 +322,12 @@ export function buildSettingsRows(
     {
       id: "drafterModelFallbacks",
       section: "drafter",
-      label: "Drafter fallback agents",
+      label: `Drafter fallback models (up to ${MAX_MAIN_MODEL_FALLBACKS})`,
       valueText: settings.drafterModelFallbacks?.length
-        ? modelChainText(settings.drafterModelFallbacks, drafterThinking, subagent)
-        : "none (session last resort)",
+        ? `${settings.drafterModelFallbacks.length}/${MAX_MAIN_MODEL_FALLBACKS} · ${settings.drafterModelFallbacks.map((ref, index) => `${index + 1}. ${modelThinkingText(ref, drafterThinking, subagent)}`).join(" → ")}`
+        : `0/${MAX_MAIN_MODEL_FALLBACKS} · ${sessionRef} · ${drafterThinking} (last resort)`,
       sourceText: src("drafterModelFallbacks"),
-      description: "ordered drafting-only fallback agents; each shows its effective/requested thinking level when the model registry exposes capabilities",
+      description: "ordered and deselectable: current drafter → fallback 1 → fallback 2…; every recoverable provider failure switches one eligible fallback at a time",
     },
   );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.37.3",
+  "version": "0.38.1",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",

package/prompts/goal-loop-continuation.md

@@ -73,7 +73,7 @@ When the agent calls any of these, the orchestrator tracks the call and persists
   - **Auditor rehearsal**: When the verification contract has checks a subagent can re-run, spawn ONE fresh-context `reviewer` agent to rehearse the contract before calling `complete_goal`.
 - **Eager continuation.** When in doubt, KEEP GOING on sub-tasks. If a subagent fails, retry with a different approach. Don't ask permission to continue — just continue. Pause only when you are genuinely blocked on information that does not exist in the repo, or the user explicitly pauses you.
 - **Premium engineering & autonomous pivot strategy.** Always implement root-cause architectural fixes rather than superficial band-aids or test hacks. If an implementation approach fails tests after 2 attempts, do NOT loop on the same failing line: autonomously step back, diagnose the root invariant, and pivot to an alternative clean architecture.
-- **Non-interruption & sensible defaults law.** Upfront drafting is where you interview the user; once the goal is active, you are in UNATTENDED autonomous mode. Never pause a multi-hour goal for obvious decisions, naming preferences, or non-blocking secondary questions. Choose the sensible architectural default, implement it, record the rationale, and continue. Defer non-blocking notes to the final completion summary.
+- **Non-interruption & sensible defaults law.** Batch 2–4 sharp questions UP FRONT in drafting (one `ask_user_question` picker with recommended defaults per question — scope, done-criteria, constraints, priorities) so active execution needs zero further clarification. Once the goal is ACTIVE, you are in UNATTENDED autonomous mode: never pause a multi-hour goal for obvious decisions, naming preferences, or non-blocking secondary questions. Compensate for zero mid-run questions by asking more upfront. Choose the sensible architectural default, implement it, record the rationale, and continue. Defer non-blocking notes to the final completion summary.
 - **Bound every long command.** Wrap test suites, builds, and dev servers in `timeout <seconds>` (e.g. `timeout 120 bun test src/lib`). An unbounded command that hangs burns an hour; a bounded one burns two minutes and tells you it hung. If a command produces no output for many minutes, treat it as hung: kill it, diagnose why, rerun bounded.
 - **Chunk output near context-full & microcompaction.** When the conversation is heavy (long-running audit, deep debug, big rollout), prefer smaller commits, smaller tool outputs, and focused reasoning — one or two punchy paragraphs, one well-scoped tool call at a time. Don't try to fit a thousand lines of work into one reply. Spool massive stdout/diffs to disk logs if needed. glla's auto-continue fires on `stop_reason="length"` and will reschedule you; chunking is cheaper than recovering from the cap. Save large file writes for their own turns.