pi-goal-list-loop-audit 0.38.22 → 0.38.24

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.38.24 — audit pass: abort-latch send guards, ownership compare-and-swap, auditor inherit parity (2026-09-07)
+
+### Fixed
+- Full display/lifecycle/settings audit pass (goal `20260907131550-12ddoy`, three parallel read-only scouts): 44 findings → 0 open. Display decisions (user-grilled): head owns liveness (status drops the `LIVE` capsule/tails, keeps `[WORKING]` + counts), exceptions-only `quiet` default (troubled rows + count line; healthy fan-out lives on the fleet panel), `active {age}` / `quiet {age}` worker labels.
+- Lifecycle HIGH: `sendContinuation` / `sendStallEscalation` / `sendLengthContinue` refuse on `flags.abortedStandDown`; terminal-notice refusal scoped to the abort latch so transcript closure still wins; zombie retry routes on the abort-closure owner (loop abort no longer stranded by a goal started mid-delay); cycle-reset consumes budget (`attempts+1`) and honors the 24h horizon while the probe turn stays prompt per the v0.34.132 contract.
+- Lifecycle MED/LOW: fallback `agent_start`/`turn_start` acks refuse on intervening user messages; successor absorb + self-heal share `clearDeadGenerationDispatch` (no more idle behind a "re-armed" lie); ownership refresh is compare-and-swap (live foreign claims never clobbered; dead records still refresh for heartbeat reclaim); command entry forces a fresh ownership read past the background throttle; length-continue lost its stale-classifier exemption.
+- Settings: `stallShortWords: 0` (= off) survives normalization; auditor thinking gains the drafter's `session — inherit` row + non-reasoning picks clear stale overrides; bare `/glla fallbacks` reads on stale handles (only `clear/off/unset/none` mutates); typing `auto` in the notify editor round-trips to unset; v0.38.23 comment/doc drift swept (richness/quiet copy, reviewer write→migrate lifecycle, DESIGN one-line rows, SETTINGS wedge vs aggressive default). Full audit: `audit/AUDIT-PASS-2026-09-07.md`. Coverage: `release:check` 1979 pass / 0 fail.
+
+## 0.38.23 — below-chat widget: forced placement, single-line rows, evidence lifesign (2026-09-07)
+
+### Fixed
+- Below-chat pinning (field: GLLA card vs fleet visibly swapping slots across ticks, 2026-09-06 screenshots). The `pi-glla` widget now passes `{ placement: "belowEditor" }` — the same zone the native fleet defaults to — so both surfaces stop trading places. Forced, not a setting: one stable layout for everyone, no new settings row or drift pin.
+- Extension-meta footers deleted. The orphan-worker `└─ /glla agents for full worker detail`, the card `└─ /goal status · /glla` / `└─ /list · /glla` hints, and the `… N more agents · /glla agents` overflow pointer all named our extension, not the user's task — pure noise once `/glla` is known. Queue depth survives as task info (`└─ N queued`); empty queue means no footer at all.
+- Option-2 worker rows: one glyph-first line per tracked child (`▶ scout · ui-fixes · silent 2m`, `⚠ worker · art-batch · silent 31m`), age before any suffix so narrow-terminal truncation cuts the least important field first. The `→ <objective>` task-linkage header is gone (the card head already names the objective — it repeated it verbatim), ids stay in the `/glla agents` table, overflow names its count only. `/glla agents` full table untouched (`└ blocks:`, Recent hangs, abort guidance all intact).
+- Evidence lifesign on active-clear heads: freshest-worker-evidence readout as the last head segment (`· stream 8s`), breathing glyph derived from evidence counters (`Σ toolUses + outputTokens mod 4` over `●→◉→○→◉`) — never from wall-clock, so the widget key stays stable between evidence and the v0.37.1 re-layout cannot return. Fresh (<5m) breathes, aging (5–30m) freezes the ring, stale (30m+) hollows it, a hung child triangles the head. Non-active statuses (⏸/⟡/⚠/⏳) keep their own glyph language; no rows means no readout invented.
+- Semantic color ramp on head glyph + age text + row glyphs only (success <5m, warning to 30m, error past it; queued caps at amber — waiting is not broken; meter stays progress-colored, fleet line untouched). Color never rides alone: glyph shape (▶/◉/⚠) plus the silence number carry the same meaning unpainted, and a no-theme render contains zero ANSI. Coverage: `tests/lifesign.test.ts` (7 tests: bands incl. queued cap, empty-invents-nothing, counter-derived breath, head readout/triangle/pause/bare, row color + unpainted shape+number, 80-col fit + bucket key-stability) plus reshaped pins in `display`/`agents-panel`/`subagent-display-richness`.
+
 ## 0.38.22 — subagent display unification: richness ladder + upstream triple-render report (2026-09-05)
 
 ### Fixed

package/docs/DESIGN-subagent-visibility.md

@@ -29,15 +29,29 @@ holds (no new instrumentation):
 - Ledger history of `subagent_hang_detected` for the "Recent hangs" footer
   of the panel.
 
-Row shape:
+Row shape (shipped one-glyph-line since v0.38.23: age-first single lines
+replace the v0.38.22 two-line shape — footers deleted, ids live in
+`/glla agents`; audit 2026-09-07 verified this against the doc and kept
+the code — the doc, not the pins, was stale):
 
 ```
-● explore   map-model-picker   RUNNING 4m12s   tools 18 · out 2.1k · silent 0m
-● plan      audit-contract     HUNG? 31m       tools 6 → frozen · out 890 · silent 26m
-  └ blocks: foreground subagent call (zombie stand-down active)
-✓ explore   schema-check       ENDED ok 3m44s
+▶ explore · map-model-picker · active 8s
+▶ plan · audit-contract · quiet 26m
+⚠ plan · stuck-render · HUNG · quiet 31m · id e5f6…
 ```
 
+Troubled rows append the short id; healthy rows stay self-contained
+without the fleet panel (the v0.38.22 `└ check the Agents panel` footer
+is gone — the row itself says what is wrong). `/glla agents` keeps the
+full detail view (recent hangs read the durable `subagent_hang_detected`
+ledger, absent when empty — never a placeholder).
+
+The `└ blocks:` row renders only from an OBSERVED in-flight parent
+subagent wait (tool args carry no run id, so per-row correlation is
+impossible — the wait NAME is named, never inferred). The "Recent hangs"
+footer reads the durable `subagent_hang_detected` ledger (last 3, absent
+when empty — never a placeholder).
+
 Hung classification reuses `classifyHungSubagents` semantics (record-frozen
 vs event-only evidence). Cap display at ~20 rows; prune ended probes per
 the existing SUBAGENT_HANG_PRUNE_MS rule.
@@ -83,8 +97,13 @@ safety property by other means — `renderAgentsWidgetLines` buckets silence
 ages exactly like the compact line, so the widget key only moves on genuine
 state transitions — and restores rich ambient rows behind the
 `subagentDisplayRichness` ladder (`rich` default / `compact` / `quiet`, HUNG
-never silent), plus the task-linkage header (`→ <objective>`) only GLLA can
-show. Triplication/ordering against pi-subagents native panels is upstream
+never silent), plus — until v0.38.23 — the task-linkage header
+(`→ <objective>`) only GLLA can show. v0.38.23 removes the header (the
+card head already names the objective), collapses worker rows to one
+glyph-first line each, forces the card below the chat
+(`{ placement: "belowEditor" }`), and adds the evidence lifesign
+(counter-derived breathing glyph + `stream {age}` readout + semantic
+band colors on head and rows, queued capped at amber). Triplication/ordering against pi-subagents native panels is upstream
 (nicobailon/pi-subagents#1931, read-only); GLLA owns its slot only and
 documents the native escapes. Assembly is the pure `assembleAgentsExtras`
 (pinned in `tests/subagent-display-richness.test.ts`).

package/docs/INDEX.md

@@ -18,15 +18,16 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.22 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.24 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen
   subagent recovery, bounded repair/replan recovery, production RPC child
   stopping, mandatory hermetic auditor-extension validation, optional provider
   extensions, bounded zero-stream retry containment, crash-safe persistence,
-  and packed-artifact release verification — see CHANGELOG.md for the full
-  trail.
+  packed-artifact release verification, and the 2026-09-07 display/lifecycle/
+  settings audit pass (abort-latch send guards, ownership compare-and-swap,
+  auditor inherit/clear parity) — see CHANGELOG.md for the full trail.
 - `../README.md` — what the plugin is, install, quickstart, and the
   architectural guarantee (drafting + confirm + detached auditor).
 - `../INSTALL.md` — source install / local development setup; the recommended
@@ -35,6 +36,7 @@ For shipped docs, the relevant entry points are:
 
 ## Entry points
 - `../README.md` — what the plugin is, install, quickstart
+- `SETTINGS.md` — canonical settings reference (files, precedence, every key)
 - `../INSTALL.md` — source install / local development setup
 - `../CHANGELOG.md` — user-facing changelog; the first versioned heading is
   the current released package version (use `/glla version` to compare with

package/docs/SETTINGS.md

@@ -0,0 +1,85 @@
+# GLLA settings reference
+
+Canonical settings reference (audit 2026-09-06 — settings truth previously
+lived only in the menu/headless renderers and the changelog). The live
+views remain `/glla` (headless display with provenance) and the `/glla`
+settings menu; this file is the shipped, reviewable contract. A release-gate
+test pins that every `SETTINGS_KEYS` entry in `extensions/goal-settings.ts`
+appears here, so the table cannot silently drift.
+
+## Files and precedence
+
+- Global file: `~/.pi/agent/glla/settings.json` (machine/provider policy).
+- Project file: `<cwd>/.pi-glla/settings.json` (project artifact).
+- Effective value: project wins over global wins over built-in default.
+- `/glla` shows per-key provenance (`project` / `global` / `default`).
+- Hand-edited files are normalized on every load
+  (`normalizeLoadedSettings`): unknown enums fall back, out-of-range
+  numbers reset to unset (consumer `??` fallbacks apply), junk strings are
+  dropped, and legacy keys migrate (`reviewer` → `postaudit`,
+  `auditorModelFallback` → `auditorModelFallbacks`,
+  `hourlyQuotaProbe` → `hourlyRetryProbe`).
+
+## Global-only keys
+
+These describe machine/provider policy, not a project artifact. Project
+copies are ignored (the recovery runtime reads the global file):
+
+`stateRoot`, `mainModelFallbacks`, `mainModelRetryMinutes`,
+`mainModelFailback`, `mainModelPrimaryProbeMinutes`, `hourlyRetryProbe`,
+`autoResume`, `drafterModel`, `drafterThinkingLevel`,
+`drafterModelFallbacks`, `compactorModel`, `compactorModelFallbacks`,
+`auditorModelFallbacks`, `auditorToolTimeoutMs`, `auditorStallMs`,
+`auditJobRetentionMs`, `auditorInspection`.
+
+## Keys
+
+| Key | Default | Meaning |
+| --- | ------- | ------- |
+| `stateRoot` | `"workingDir"` | Where durable state lives; `"sessionDir"` is explicit opt-in. Global-only. |
+| `mainModelFallbacks` | `[]` | Ordered provider/model refs on main-model failure. Global-only. |
+| `drafterModel` | unset (session) | Drafting-only primary model. Global-only. |
+| `drafterThinkingLevel` | unset (inherit) | Thinking level for the drafting agent. Global-only. |
+| `drafterModelFallbacks` | `[]` | Ordered drafting fallbacks; session model is final. Global-only. |
+| `compactorModel` | unset (plan B) | Emergency-compactor primary; never the session model. Global-only. |
+| `compactorModelFallbacks` | `[]` | Ordered compactor fallbacks; no session last resort. Global-only. |
+| `mainModelRetryMinutes` | `15` | Base minutes before main-session recovery; doubles per attempt, caps 5h. Global-only. |
+| `mainModelFailback` | `"auto"` | `"auto"` re-probes the primary; `"sticky"` keeps the fallback. Global-only. |
+| `mainModelPrimaryProbeMinutes` | `15` | Minutes between preferred-primary health probes. Global-only. |
+| `forbiddenModels` | `[]` | Refs that must never be selected (case-insensitive substring). |
+| `blockForbiddenModelSwitches` | `true` | Revert forbidden switches (`false` = stand but ledger). |
+| `visionAssist` | `true` | Continuation prompts carry the prefer-native-vision directive. |
+| `auditorModel` | unset (session) | Detached auditor primary (`"provider/id"` or bare id). |
+| `auditorModelFallbacks` | `[]` | Ordered auditor fallbacks; session model is final. Global-only. |
+| `auditorAllowedExtensions` | `[]` | Extension specs the detached auditor may load; resolved fail-closed, `[]` = isolated. |
+| `auditorSameSessionSwap` | `true` | Walk the fallback chain when the auditor is the session model. |
+| `auditorThinkingLevel` | unset (inherit) | Detached auditor reasoning level; picked with the model. |
+| `auditorToolTimeoutMs` | `300000` | Base budget per auditor tool call (30s–6h). Global-only. |
+| `auditorStallMs` | `600000` | Base silence budget for the detached auditor (1m–24h). Global-only. |
+| `auditJobRetentionMs` | `900000` | How long proven-dead audit job dirs are kept (0–7d, 0 = reap now). Global-only. |
+| `auditorInspection` | `false` | Auditor runs as a persistent session you can tail/resume. Global-only. |
+| `notifyCmd` | unset | Shell command on goal complete / pause / loop stop; message is `$1`. |
+| `tokenLimit` | unset (off) | Per-goal token budget; crossing it pauses. `0` = off. |
+| `wedgeAlertMinutes` | unset (30, or off while aggressive mode is on — the default) | Busy-but-silent minutes before the wedge alert; `0` = off. The menu shows the effective value. |
+| `autoResume` | `false` | Restored goals/loops/lists auto-resume in fresh sessions. Global-only. |
+| `decisionPopup` | `true` | Decision pauses pop the picker (`false` = widget card only). |
+| `carryover` | `"pause"` | Stale carryover on new activation: `"pause"` / `"clear"` / `"resume"`. |
+| `autoAcceptDrafts` | `false` | Drafts activate without the Confirm dialog (unattended rigs). |
+| `auditCap` | `5` (10 aggressive) | Pause after N consecutive auditor disapprovals (`0` = unlimited). |
+| `auditFeedbackChars` | `0` (full) | Max auditor-report chars returned after disapproval (`0` = full). |
+| `auditorSilent` | `true` | Auditor report renders final-only, no word-by-word HUD. |
+| `auditorProgressSignals` | `true` | Silent audits show phase label + byte counter. |
+| `hourlyRetryProbe` | `true` | Extra blind retry at :00:30 every hour while parked. Global-only. |
+| `subagentModelStrategy` | `"inherit-parent"` | Default subagent model policy for new sessions. |
+| `subagentModelOverrides` | unset | Per-agent-type model pin; always wins over strategy. |
+| `subagentFallbacks` | unset | Per-role fallback chains (first eligible ref wins). |
+| `aggressiveMode` | `true` | Keep-going defaults (`false` = pause-first policy). |
+| `stuckMaxInterventions` | `5` (10 aggressive) | Consecutive stuck interventions before a loop stops. |
+| `subagentHangEscalationMinutes` | `30` | Confirmed no-progress minutes before child-specific abort (`0` = warn only). |
+| `stallEscalationRefires` | `5` | Heartbeat refires before pause/stop (`0` = never). |
+| `zombieRetryMaxAttempts` | `3` | Re-dispatches per busy/no-stream episode (`0` = manual; max 10). |
+| `stallShortWords` | `15` | Tool-less turn under this many words is a nudge. |
+| `stallSimilarityThreshold` | `0.6` | Trigram similarity above this (tool-less) is a nudge. |
+| `postaudit` | unset | Post-completion audit config (same shape as legacy `reviewer`). |
+| `toolOverrides` | unset | Per-tool allow/hide/per-tool-config overrides. |
+| `reviewer` | legacy | Deprecated alias for `postaudit`; migrated on load, `postaudit` wins. |

package/extensions/auditor-extensions.ts

@@ -185,7 +185,10 @@ export function resolveAuditorAllowedExtensions(
   return out;
 }
 
-/** Bounded, deterministic normalization of the allowlist value. */
+/** Bounded, deterministic normalization of the allowlist value.
+ * Audit 2026-09-06: dedup is case-insensitive like the model fallback
+ * chains (npm names cannot differ by case; a same-case pair is always the
+ * same intent). The first spelling wins; the original is preserved. */
 export function normalizeAuditorAllowedExtensions(value: unknown): string[] {
   if (!Array.isArray(value)) return [];
   const seen = new Set<string>();
@@ -193,9 +196,10 @@ export function normalizeAuditorAllowedExtensions(value: unknown): string[] {
   for (const entry of value) {
     if (typeof entry !== "string") continue;
     const spec = entry.trim();
-    if (!spec || seen.has(spec)) continue;
+    const key = spec.toLowerCase();
+    if (!spec || seen.has(key)) continue;
     if (out.length >= 32) break; // bounded: the request hash stays sane
-    seen.add(spec);
+    seen.add(key);
     out.push(spec);
   }
   return out;
@@ -294,10 +298,19 @@ export function discoverAuditorExtensions(home: string, cwd?: string): Discovere
 }
 
 /** Expand the allowlist into `pi` CLI args: ["--extension", spec, …].
- * Empty/absent list → [] (the worker keeps plain --no-extensions). */
-export function auditorExtensionArgs(allowed: string[] | undefined): string[] {
+ * Audit 2026-09-06: entries resolve fail-closed through
+ * resolveAuditorAllowedExtensions first — raw `npm:`/relative specs are
+ * never emitted (a raw npm: entry would trigger a fresh network install,
+ * or silently load nothing offline). Empty/absent list → [] (the worker
+ * keeps plain --no-extensions). */
+export function auditorExtensionArgs(
+  allowed: string[] | undefined,
+  home: string,
+  cwd?: string,
+  settingsBase?: string,
+): string[] {
   const args: string[] = [];
-  for (const spec of normalizeAuditorAllowedExtensions(allowed)) {
+  for (const spec of resolveAuditorAllowedExtensions(allowed, home, cwd, settingsBase)) {
     args.push("--extension", spec);
   }
   return args;

package/extensions/completion-summary.ts

@@ -1,4 +1,5 @@
 import type { Goal, Status } from "./goal-loop-core.js";
+import { truncateToWidth } from "@earendil-works/pi-tui";
 
 /**
  * The durable, user-facing terminal recap contract. Keep this as a small
@@ -191,7 +192,7 @@ export function buildApprovalChatLines(notice: {
  * word-bounded values. This is the user-facing `✓ done` block — six short
  * facts that stay scannable in chat. The single-line projection remains
  * for width-bound surfaces (TUI widget card, external notifies). */
-export function completionSummaryLines(text: string | undefined, maxValueLength = 240): string[] {
+export function completionSummaryLines(text: string | undefined, maxValueLength = 240, lineWidth?: number): string[] {
   const source = completionSummaryBody(text ?? "").replace(/\s+/g, " ").trim();
   const lower = source.toLowerCase();
   const positions = COMPLETION_SUMMARY_LABELS
@@ -207,7 +208,10 @@ export function completionSummaryLines(text: string | undefined, maxValueLength
       .map((entry) => entry.start)
       .sort((a, b) => a - b)[0] ?? source.length;
     const rawValue = source.slice(valueStart, nextStart).trim();
-    return `${name}: ${clipSummaryValue(rawValue || "not recorded", maxValueLength)}`;
+    const line = `${name}: ${clipSummaryValue(rawValue || "not recorded", maxValueLength)}`;
+    // Audit 2026-09-06: optional width budget for width-bound surfaces —
+    // the default 240-char values previously had no width-conscious path.
+    return lineWidth && lineWidth > 0 ? truncateToWidth(line, lineWidth, "…") : line;
   });
 }
 
@@ -322,8 +326,9 @@ export function terminalCompletionSummaryLines(
   facts: CompletionSummaryFacts,
   candidate = facts.goal.completionSummary,
   maxValueLength = 240,
+  lineWidth?: number,
 ): string[] {
-  return completionSummaryLines(resolveCompletionSummary(facts, candidate).summary, maxValueLength);
+  return completionSummaryLines(resolveCompletionSummary(facts, candidate).summary, maxValueLength, lineWidth);
 }
 
 /**

package/extensions/context-checkpoint.ts

@@ -78,26 +78,28 @@ function loopNumber(value: unknown): string {
 
 /**
  * The loop is a separate work surface from Goal. Keep its durable target and
- * progress in the checkpoint so a loop-only session does not lose its
- * authority when old goal-event payloads are projected out. Recent history is
- * useful for orientation, but is deliberately capped and treated as data.
+ * authority in the checkpoint so a loop-only session does not lose its
+ * context when old goal-event payloads are projected out.
+ *
+ * CACHE-STABILITY INVARIANT (provider prefix-cache rule): this checkpoint is
+ * inserted into the effective per-send message list at the position of the
+ * first removed goal-event payload — i.e. EARLY in history, before every
+ * provider call. Any byte change here invalidates the cache prefix for every
+ * token after it. This block therefore renders ONLY fields that are stable
+ * for the life of the loop run (target / measure / bounds config). Live
+ * counters (iteration, best, last, stall, tokens, history, timestamps) are
+ * intentionally NOT repeated here: they already ride the newest retained
+ * `[LOOP ITERATION …]` prompt (message-list suffix) and durable
+ * `.pi-glla/active.jsonl`. Rendering them here changed the prefix on every
+ * tick, making every loop iteration a full cache miss.
  */
 function loopCheckpointLines(loop: LoopState): string[] {
-  const history = Array.isArray(loop.history) ? loop.history : [];
-  const recentHistory = history.slice(-8).map((entry) =>
-    `iteration=${loopNumber(entry.iteration)}, value=${entry.value === null ? "null" : loopNumber(entry.value)}, improved=${entry.improved === true ? "true" : "false"}, at=${safeInline(entry.at, 80) || "(unknown)"}`,
-  );
-  if (history.length > recentHistory.length) {
-    recentHistory.unshift(`[…${history.length - recentHistory.length} earlier loop measurement(s) omitted]`);
-  }
   return [
     "Active loop authority (durable loop state; not a user request):",
     `Loop target: ${safeInline(loop.target, 2_000) || "(missing — recover from durable loop state before proceeding)"}`,
     `Loop measure: command=${safeInline(loop.measureCmd, 1_200) || "(metricless)"}; direction=${safeInline(loop.direction, 20) || "(none)"}`,
-    `Loop progress: active=${loop.active === true ? "true" : "false"}; iteration=${loopNumber(loop.iteration)}; best=${loopNumber(loop.bestValue)}; last=${loopNumber(loop.lastValue)}; stall=${loopNumber(loop.stallCount)}; nullMeasures=${loopNumber(loop.consecutiveNullMeasures)}; errors=${loopNumber(loop.consecutiveErrors)}`,
-    `Loop bounds: maxIterations=${loopNumber(loop.maxIterations)}; plateauWindow=${loopNumber(loop.plateauWindow)}; timeLimitHours=${loopNumber(loop.timeLimitHours)}; tokenBudget=${loopNumber(loop.tokenBudget)}; tokensUsed=${loopNumber(loop.tokensUsed)}; stopReason=${safeInline(loop.stopReason, 400) || "(none)"}`,
-    `Loop history (latest ${Math.min(history.length, 8)} of ${history.length}):\n${recentHistory.length > 0 ? recentHistory.join("\n") : "(none yet)"}`,
-    `Loop lifecycle: startedAt=${safeInline(loop.startedAt, 100) || "(unknown)"}; lastIterationCompletedAt=${safeInline(loop.lastIterationCompletedAt, 100) || "(none)"}; specFile=${safeInline(loop.specFile, 300) || "(none)"}; refineHint=${safeInline(loop.refineHint, 600) || "(none)"}`,
+    `Loop bounds: maxIterations=${loopNumber(loop.maxIterations)}; plateauWindow=${loopNumber(loop.plateauWindow)}; timeLimitHours=${loopNumber(loop.timeLimitHours)}; tokenBudget=${loopNumber(loop.tokenBudget)}; specFile=${safeInline(loop.specFile, 300) || "(none)"}; startedAt=${safeInline(loop.startedAt, 100) || "(unknown)"}`,
+    "Loop progress: live counters (iteration/best/last/stall/history/tokens/completed-at) are intentionally omitted here — read the newest retained [LOOP ITERATION …] prompt and .pi-glla/active.jsonl. This checkpoint stays byte-stable across iterations so provider prefix caches keep hitting.",
   ];
 }
 
@@ -146,15 +148,13 @@ const OVERFLOW_AUDIT_CHARS = 1_100;
 const OVERFLOW_EMERGENCY_LINE_CHARS = 500;
 
 function compactLoopCheckpointLines(loop: LoopState): string[] {
-  const historyCount = Array.isArray(loop.history) ? loop.history.length : 0;
-  const latest = historyCount > 0 ? loop.history[historyCount - 1] : undefined;
+  // Same cache-stability invariant as loopCheckpointLines: stable fields only.
   return [
     "Active loop authority (durable loop state; not a user request):",
     `Loop target: ${safeInline(loop.target, OVERFLOW_LOOP_TARGET_CHARS) || "(missing — recover from durable loop state before proceeding)"}`,
     `Loop measure: command=${safeInline(loop.measureCmd, OVERFLOW_LOOP_MEASURE_CHARS) || "(metricless)"}; direction=${safeInline(loop.direction, 20) || "(none)"}`,
-    `Loop progress: active=${loop.active === true ? "true" : "false"}; iteration=${loopNumber(loop.iteration)}; best=${loopNumber(loop.bestValue)}; last=${loopNumber(loop.lastValue)}; stall=${loopNumber(loop.stallCount)}; nullMeasures=${loopNumber(loop.consecutiveNullMeasures)}; errors=${loopNumber(loop.consecutiveErrors)}`,
-    `Loop bounds: maxIterations=${loopNumber(loop.maxIterations)}; plateauWindow=${loopNumber(loop.plateauWindow)}; timeLimitHours=${loopNumber(loop.timeLimitHours)}; tokenBudget=${loopNumber(loop.tokenBudget)}; tokensUsed=${loopNumber(loop.tokensUsed)}; stopReason=${safeInline(loop.stopReason, 180) || "(none)"}`,
-    `Loop lifecycle: startedAt=${safeInline(loop.startedAt, 70) || "(unknown)"}; lastIterationCompletedAt=${safeInline(loop.lastIterationCompletedAt, 70) || "(none)"}; specFile=${safeInline(loop.specFile, 160) || "(none)"}; historyCount=${historyCount}; latestIteration=${latest ? loopNumber(latest.iteration) : "(none)"}`,
+    `Loop bounds: maxIterations=${loopNumber(loop.maxIterations)}; plateauWindow=${loopNumber(loop.plateauWindow)}; timeLimitHours=${loopNumber(loop.timeLimitHours)}; tokenBudget=${loopNumber(loop.tokenBudget)}; specFile=${safeInline(loop.specFile, 160) || "(none)"}`,
+    "Loop progress: live counters omitted by design — see the newest retained loop prompt and .pi-glla/active.jsonl (keeps this checkpoint byte-stable for prefix-cache stability).",
   ];
 }
 
@@ -212,7 +212,7 @@ function buildOverflowCheckpoint(
 
   const optionalLines = [
     loop
-      ? `Loop history summary: count=${Array.isArray(loop.history) ? loop.history.length : 0}; latest=${Array.isArray(loop.history) && loop.history.length > 0 ? loopNumber(loop.history[loop.history.length - 1]?.value) : "(none)"}`
+      ? "Loop history summary: omitted by design — live history rides the newest retained loop prompt (keeps this checkpoint byte-stable for prefix-cache stability)"
       : null,
     goal
       ? `Auto-continuation: ${goal.autoContinue === true ? "enabled" : "disabled/unknown"}; stopReason=${safeInline(goal.stopReason, 220) || "(none)"}; pauseKind=${safeInline(goal.pauseKind, 40) || "(none)"}`
@@ -312,28 +312,12 @@ function customType(message: unknown): string | null {
   return typeof value === "string" ? value : null;
 }
 
-function messageText(message: unknown): string {
-  if (typeof message !== "object" || message === null) return "";
-  const content = (message as { content?: unknown }).content;
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return "";
-  return content.map((block) => {
-    if (typeof block === "string") return block;
-    if (typeof block !== "object" || block === null) return "";
-    const text = (block as { text?: unknown }).text;
-    return typeof text === "string" ? text : "";
-  }).join("\n");
-}
-
-/** True for GLLA control-plane messages that may be safely bounded. */
-export function isGllaControlMessage(message: unknown): boolean {
-  const type = customType(message);
-  if (type === "goal-event" || type === AUTHORITATIVE_CHECKPOINT_CUSTOM_TYPE) return true;
-  const text = messageText(message);
-  return typeof (message as { role?: unknown } | null)?.role === "string"
-    && (text.includes("[GOAL CHECKPOINT") || text.includes("[STALL WARNING"));
-}
-
+// Audit 2026-09-06: a substring-based `isGllaControlMessage` predicate used
+// to live here (any message containing "[GOAL CHECKPOINT" / "[STALL
+// WARNING" counted as control plane). It had zero callers — the live
+// projection keys on customType only — and any future caller would inherit
+// the forgeable-substring hazard (crafted text projected out of context).
+// Deleted instead of hardened: control-plane identity is customType.
 function isGoalEventPayload(message: unknown): boolean {
   return customType(message) === "goal-event";
 }

package/extensions/drafter-model.ts

@@ -98,7 +98,14 @@ export function resolveDrafterModel(ctx: ExtensionContext, settings: Pick<Settin
     candidates.push({ ref: selected.ref, model: selected.model, via: "configured" });
   }
   if (ctx.model && currentRef && !candidates.some((candidate) => candidate.ref.toLowerCase() === currentRef.toLowerCase())) {
-    candidates.push({ ref: currentRef, model: ctx.model, via: "session-last-resort" });
+    // Audit 2026-09-06: the session last resort must not bypass the
+    // forbiddenModels gate — a forbidden session model is refused (and
+    // ledgered) instead of being leased silently.
+    if (forbidden(currentRef)) {
+      appendLedger(ctx.cwd, "forbidden_model_switch", { scope: "drafter", ref: currentRef, via: "session-last-resort", blocked: true });
+    } else {
+      candidates.push({ ref: currentRef, model: ctx.model, via: "session-last-resort" });
+    }
   }
   return { configuredRefs, candidates, selected: candidates[0] };
 }