pi-goal-list-loop-audit 0.38.18 → 0.38.19

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.38.19 — disapproval response: dispatch stall root-cause + state clear (2026-09-04)
+
+### Fixed
+- Track 2 root cause (post-answer stall): the wait-for-idle send gate deferred an owed continuation forever when the session went phantom-busy — busy, nothing pending, zero stream (neonbreak: 35 re-arms, zero sends, 45m to the zombie abort). A busy session with nothing pending and no real stream for `GLLA_BUSY_SILENT_SEND_MS` (default 5m) is wedged, not working: the marker is now sent into pi's followUp queue instead (`goal_continuation_send_busy_bypass`, `busyBypass` on the sent event). Genuinely working sessions and loaded queues keep the old wait path.
+- Track 3 state clear (stale waiting-verdict): `auditorDisplayPhase` projects `awaiting-verdict` only while the goal is still `auditing`. Closed goals (complete/aborted) and pre-archive snapshots carrying a stale running claim fall through to the quiet gate — no stale progress object can resurrect the wait after `goal_archived`.
+- Both fixes carry behavioral MockPi regression tests with empirical fail-before (old code fails the new assertions, guards pass throughout): `tests/answered-question-dispatch.test.ts` (3), `tests/closed-goal-clears-waiting.test.ts` (2).
+
 ## 0.38.18 — completion/lifecycle field trilogy (2026-09-04)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.18 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.19 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/goal-continuation.ts

@@ -330,6 +330,26 @@ export function sendRearmDelayMs(streak: number): number {
   return 30_000;
 }
 
+/** v0.38.19 (track 2): how long a busy session with an owed send may go
+ * without real stream output before the marker is sent into pi's followUp
+ * queue anyway. 5m matches SEND_REARM_ESCALATE_SILENT_MS's definition of
+ * wedged silence, far below the ~45m zombie abort that used to be the only
+ * exit from a phantom-busy session. */
+export function busySilentSendMs(): number {
+  const raw = Number(process.env.GLLA_BUSY_SILENT_SEND_MS ?? 5 * 60_000);
+  return Number.isFinite(raw) && raw >= 0 ? raw : 5 * 60_000;
+}
+
+/** v0.38.19 (track 2): true when the session's business is stale enough
+ * that waiting for idle is the stall, not patience. Requires observed
+ * stream history (lastRealActivityAt > 0): a session that never streamed
+ * in this process is ignorance, not evidence of wedging — it keeps the old
+ * wait path (storm → escalation → zombie abort). */
+export function busySilentBypassDue(): boolean {
+  if (flags.lastRealActivityAt <= 0) return false;
+  return Date.now() - flags.lastRealActivityAt >= busySilentSendMs();
+}
+
 export function accountSendRearm(ctx: ExtensionContext, kind: "continuation" | "loop"): void {
   const streak = kind === "continuation" ? ++continuationRearmStreak : ++flags.loopRearmStreak;
   if (streak === 1) {
@@ -1225,12 +1245,35 @@ export function sendContinuation(goalId: string): void {
   }
   if (!guardGoalBeforeContinuation(ctx, "dispatch", goalId)) return;
   if (!isActionableGoal()) return;
+  // v0.38.19 (track 2): set when the busy-but-silent bypass below fires so
+  // the sent ledger event carries the marker. The test hook for the stream
+  // clock lives in loops/goal-ui.ts (__testOnlySetLastRealActivityAt).
+  let busyBypass = false;
   if (!ctx.isIdle() || ctx.hasPendingMessages()) {
     accountSendRearm(ctx, "continuation");
-    continuationScheduledFor = goalId;
-    // v0.28.29: backing-off cadence (was flat 50ms — 6,000 spins in 5m).
-    continuationTimer = scheduleSessionTimeout(() => sendContinuation(goalId), sendRearmDelayMs(continuationRearmStreak));
-    return;
+    // v0.38.19 (track 2, auditor-required): busy-but-silent bypass. A
+    // session that is busy with nothing pending and zero real stream for
+    // busySilentSendMs is not doing work a followUp could corrupt — it is
+    // wedged (neonbreak: answer in, 45m of phantom-busy, zero sends because
+    // wait-for-idle never cleared). pi's followUp queue is the designed
+    // vehicle for exactly this: the marker queues behind the stuck turn
+    // instead of rearming into the void until the zombie abort. Genuinely
+    // working sessions (fresh stream) and loaded queues (pending messages)
+    // keep the old wait path.
+    if (!ctx.isIdle() && !ctx.hasPendingMessages() && busySilentBypassDue()) {
+      busyBypass = true;
+      appendLedger(ctx.cwd, "goal_continuation_send_busy_bypass", {
+        goalId,
+        generation: flags.sessionGeneration,
+        silentMs: Date.now() - flags.lastRealActivityAt,
+        rearmStreak: continuationRearmStreak,
+      });
+    } else {
+      continuationScheduledFor = goalId;
+      // v0.28.29: backing-off cadence (was flat 50ms — 6,000 spins in 5m).
+      continuationTimer = scheduleSessionTimeout(() => sendContinuation(goalId), sendRearmDelayMs(continuationRearmStreak));
+      return;
+    }
   }
   if (!flags.extensionApi || flags.extensionApiStale) return;
   try {
@@ -1264,7 +1307,7 @@ export function sendContinuation(goalId: string): void {
     lastContinuationSentPayload = { content, display: false }; // v0.34.88: verbatim retry payload
     if (!dispatchAccepted(ctx, attempt)) return;
     continuationRearmStreak = 0; continuationRearmSince = 0; // v0.28.5 (E3): an accepted dispatch clears the storm
-    appendLedger(ctx.cwd, "goal_continuation_sent", { goalId, attemptId: attempt.id, generation: attempt.generation, kind, payloadChars: content.length });
+    appendLedger(ctx.cwd, "goal_continuation_sent", { goalId, attemptId: attempt.id, generation: attempt.generation, kind, payloadChars: content.length, ...(busyBypass ? { busyBypass: true } : {}) });
     // v0.35.37 (audit finding): the welcome-back recovery notice must fire
     // EXACTLY ONCE per auto-resume. The payload above was built with the
     // notice in it; once the dispatch is ACCEPTED the message has landed in

package/extensions/goal-loop-display.ts

@@ -668,7 +668,15 @@ export function auditorDisplayPhase(g: Goal, audit: AuditDisplayProgress | null
   const label = audit?.label?.toLowerCase() ?? "";
   if (label === "queued") return "queued";
   if (/infra|error|failed|blocked|no verdict/.test(label)) return "blocked";
-  if (audit?.phase === "complete") return "awaiting-verdict";
+  // v0.38.19 (track 3, auditor-required): awaiting-verdict is a LIVE claim
+  // — a worker done, its verdict not yet applied. A closed goal (complete /
+  // aborted, or anything past auditing) can never be waiting: the verdict
+  // landed or the claim died with the archive. A stale progress object
+  // handed in for a closed goal must not resurrect the wait (junk-runner:
+  // session narrating "waiting on the auditor's verdict" after
+  // goal_archived complete). Stale timestamps fall through to the quiet
+  // gate below, which is true — no worker will ever speak again.
+  if (audit?.phase === "complete" && g.status === "auditing") return "awaiting-verdict";
   const age = auditorActivityAge(audit, now);
   if (age !== undefined && age > AUDITOR_QUIET_MS) {
     // v0.37.0: progress-aware quiet gate. A tool that is still running INSIDE
@@ -691,7 +699,12 @@ export function auditorDisplayPhase(g: Goal, audit: AuditDisplayProgress | null
       return "running";
     return "quiet";
   }
-  if (!audit && g.pendingCompletion?.phase === "running") return "awaiting-verdict";
+  // Same lifecycle scope as above: a stale goal snapshot that still
+  // carries a running pendingCompletion must not project a wait either.
+  // (The archive strips pendingCompletion; this guards pre-archive
+  // snapshots read after the close.)
+  if (!audit && g.status === "auditing" && g.pendingCompletion?.phase === "running") return "awaiting-verdict";
+  if (!audit && g.pendingCompletion?.phase === "running") return "quiet";
   return "running";
 }
 

package/extensions/loops/goal-ui.ts

@@ -1044,6 +1044,12 @@ function isContextStarvedRefused(): boolean {
 export function __testOnlySetLastCompactionAt(at: number | null): void {
   lastCompactionAt = at ?? 0;
 }
+/** Test-only: set the real-stream clock directly so busy-silence scenarios
+ * (answered question, phantom-busy host, zero stream) are drivable without
+ * wall-clock waits. Exported through loops/goal.js like the other hooks. */
+export function __testOnlySetLastRealActivityAt(at: number): void {
+  lastRealActivityAt = at;
+}
 
 /** Test-only: expose the live activity projection without requiring a TUI
  * renderer. This drives the same scope/timestamp checks used by refreshUI. */

package/extensions/loops/goal.ts

@@ -74,7 +74,7 @@ export {
   __testOnlyResetOwnerSession,
   __testOnlyRunFanOutListAuditFindings,
 } from "./goal-session.js";
-export { __testOnlySetLastCompactionAt, __testOnlyLoadState, __testOnlyRegisterAgentTools, __testOnlyRememberCtx, __testOnlyDisplayActivityFor, __testOnlyResetToolActivity } from "./goal-ui.js";
+export { __testOnlySetLastCompactionAt, __testOnlyLoadState, __testOnlyRegisterAgentTools, __testOnlyRememberCtx, __testOnlyDisplayActivityFor, __testOnlyResetToolActivity, __testOnlySetLastRealActivityAt } from "./goal-ui.js";
 export { auditorRetryPlan, runDetachedCompletionWithFallback, __testOnlySetAuditorRecoveryRetryDelay, __testOnlyResetAuditorRecoveryRuntime, type AuditorModelCandidate } from "./goal-auditor-hooks.js";
 export { handleSettingChoice } from "./goal-settings-ui.js";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.18",
+  "version": "0.38.19",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",