pi-goal-list-loop-audit 0.38.28 → 0.38.30

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.38.30 — fresh audit pass: nine low-severity fixes (2026-09-08)
+
+### Fixed
+- Approval-render replay no longer runs before the stale/ownership fence: wrappers skip replay on stale, worker, owner-denied, handoff, and rebind handles (`shouldSkipApprovalRenderReplay`), so a superseded session running stale-allowed `/loop status` cannot mark delivery into a dead session.
+- `countDone` counts all descendants of closed parents, matching the recursive `countTotal` (a closed parent with nested grandchildren no longer under-reads done).
+- Plain-text surfaces use the ANSI-free truncator: `completion-summary.ts` width budgets and the headless settings flat rows route through `truncateCells`; the painted TUI tables keep `truncateToWidth`.
+- Narrow-terminal budgets clamp to the available width instead of the floor, and the compact recovery line takes width-aware inner budgets — provenance/fallback chains truncate indoors instead of hard-cutting mid-token.
+- The display-only objective projection additionally strips `#` headers, `>` quotes, `[label](url)` links, and `*em*` emphasis. Stored objectives unchanged.
+- The approval-render sidecar repairs a corrupt file after ledgering once, truncates objectives by code points, and caps chat lines (60 lines × 1000 chars) behind the 20-entry spillway.
+- The goal card owns goal-kind recovery episodes only: `kind:loop` episodes keep the parked/standalone cards and no longer suppress the goal's provenance; blank-primary recovery falls back to provenance instead of leaving no model fact.
+- `topOpenAuditFinding` strips aligned/tabbed boxes with the same `[ \t]+` class as its matcher, so the reprieve note never carries checkbox markup.
+- `parseLoopStartArgs` consumes known keys only with valid values — junk like unquoted `time=out` stays in the target prose instead of vanishing while defaults silently apply (`done` still always teaches its removal; `measure` accepts any non-empty command).
+- Regression coverage in `tests/audit-2026-09-08.test.ts` (11 pins); `tsc` clean; focused display/loop-forever/approval suites green.
+
+## 0.38.29 — compact active-card recovery and judgment details (2026-09-08)
+
+### Fixed
+- The active goal card now renders main-model recovery as one compact, truthful row instead of repeating the full chain, current model, pending switch, attempts, and skip details. Full recovery diagnostics remain available through `/goal status`; the status footer no longer duplicates that report.
+- Durable-vs-defer plaques cap their glance-card prose while preserving ordering, recommendation, and selected-choice facts. The final judgment row closes the tree cleanly.
+- Markdown emphasis/code wrappers are removed from the display-only objective projection, so `**objective**` and backtick-wrapped commands no longer add visual noise. Stored objectives remain unchanged.
+- Added regression coverage for compact recovery, duplicate suppression, Markdown cleanup, and the closed judgment tail.
+
 ## 0.38.28 — close redundant provenance rows in the active goal card (2026-09-08)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.28 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.30 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen
@@ -28,7 +28,7 @@ For shipped docs, the relevant entry points are:
   packed-artifact release verification, and the 2026-09-07 display/lifecycle/
   settings audit pass (abort-latch send guards, ownership compare-and-swap,
   auditor inherit/clear parity) and the v0.38.25 post-objective summary
-  (canonical approval render, persist + replay, audit-goal counts line), the v0.38.27 selective port of PRs #45/#46 (`/loop pause` soft-hold, widget subtask count), and the v0.38.28 provenance-row closure fix — see CHANGELOG.md for the full trail.
+  (canonical approval render, persist + replay, audit-goal counts line), the v0.38.27 selective port of PRs #45/#46 (`/loop pause` soft-hold, widget subtask count), the v0.38.28 provenance-row closure fix, and the v0.38.29 compact active-card recovery/judgment projection — see CHANGELOG.md for the full trail.
 - `../README.md` — what the plugin is, install, quickstart, and the
   architectural guarantee (drafting + confirm + detached auditor).
 - `../INSTALL.md` — source install / local development setup; the recommended

package/extensions/approval-render-store.ts

@@ -31,6 +31,10 @@ export interface PendingApprovalRender {
  * briefly for inspection; undelivered ones are never dropped by the cap. */
 const MAX_STORED_RENDERS = 20;
 const MAX_REPLAY_PER_CONTACT = 5;
+// v0.38.30 audit: bound the sidecar behind the "each is ~1KB" comment — a
+// long approval trailer used to grow the 20-entry file without bound.
+const MAX_RENDER_CHAT_LINES = 60;
+const MAX_RENDER_LINE_CHARS = 1000;
 
 export function approvalRenderStorePath(cwd: string): string {
   return path.join(piGlaDir(cwd), "pending-approval-renders.json");
@@ -63,10 +67,15 @@ function readRenders(cwd: string): PendingApprovalRender[] {
         dropped: parsed.length - valid.length,
         kept: valid.length,
       });
+      // v0.38.30 audit: repair the file after ledgering once — otherwise
+      // every user command re-appended the same ledger while the file
+      // stayed corrupt. Best-effort; a failed rewrite simply ledgers again.
+      writeRenders(cwd, valid);
     }
     return valid;
   } catch {
     appendLedger(cwd, "terminal_approval_render_store_invalid", { dropped: "all", kept: 0 });
+    writeRenders(cwd, []);
     return [];
   }
 }
@@ -94,8 +103,10 @@ export function persistApprovalRender(cwd: string, render: {
   const existing = readRenders(cwd);
   const entry: PendingApprovalRender = {
     goalId: render.goalId,
-    objective: render.objective.slice(0, 300),
-    chatLines: render.chatLines,
+    // v0.38.30 audit: code-point truncation (char slice split surrogate
+    // pairs) + bounded chat lines (the 20-entry cap never bound bytes).
+    objective: [...render.objective].slice(0, 300).join(""),
+    chatLines: render.chatLines.slice(0, MAX_RENDER_CHAT_LINES).map((line) => [...line].slice(0, MAX_RENDER_LINE_CHARS).join("")),
     createdAt: at,
     ...(render.delivered ? { deliveredAt: at } : {}),
   };

package/extensions/completion-summary.ts

@@ -1,5 +1,5 @@
 import type { Goal, Status } from "./goal-loop-core.js";
-import { truncateToWidth } from "@earendil-works/pi-tui";
+import { truncateCells } from "./goal-loop-display.js";
 
 /**
  * The durable, user-facing terminal recap contract. Keep this as a small
@@ -303,7 +303,10 @@ export function completionSummaryLines(text: string | undefined, maxValueLength
     const line = `${name}: ${clipSummaryValue(rawValue || "not recorded", maxValueLength)}`;
     // Audit 2026-09-06: optional width budget for width-bound surfaces —
     // the default 240-char values previously had no width-conscious path.
-    return lineWidth && lineWidth > 0 ? truncateToWidth(line, lineWidth, "…") : line;
+    // v0.38.30 audit: plain-text surface — use the ANSI-free truncator
+    // (pi-tui truncateToWidth wraps the ellipsis in resets even for plain
+    // text, polluting notify/log/pager consumers).
+    return lineWidth && lineWidth > 0 ? truncateCells(line, lineWidth) : line;
   });
 }
 

package/extensions/goal-loop-display.ts

@@ -87,6 +87,24 @@ function displayPauseReason(reason: string): string {
   return compactDisplayText(sanitizeProviderDisplayText(reason));
 }
 
+/** Objectives are stored verbatim, but the glance card is a plain-text
+ * surface. Remove the common Markdown emphasis/code wrappers that otherwise
+ * turn a long objective into noisy `**...**` and backtick litter. This is a
+ * display-only projection; prompts, archives, and state keep the original. */
+function displayObjective(objective: string): string {
+  return compactDisplayText(objective)
+    .replace(/\*\*([^*]+)\*\*/g, "$1")
+    .replace(/__([^_]+)__/g, "$1")
+    .replace(/`([^`\n]*)`/g, "$1")
+    // v0.38.30 audit: strip the remaining common single-line wrappers so the
+    // glance card keeps its plain-text promise (headers, quotes, links,
+    // single-emphasis). Display-only; prompts/archives/state keep verbatim.
+    .replace(/^#{1,6}\s+/gm, "")
+    .replace(/^>\s?/gm, "")
+    .replace(/\[([^\]]+)\]\([^)]*\)/g, "$1")
+    .replace(/\*([^*\n]+)\*/g, "$1");
+}
+
 /** v0.33.1: painted strings measure by their terminal-cell width. */
 function visibleLen(s: string): number {
   return tuiVisibleWidth(s);
@@ -250,7 +268,11 @@ export const WORKER_TEXT_SPACER = "\u00A0";
 
 function budgetFor(width: number | undefined, prefixCols: number, floor: number): number {
   if (!width || width <= 0) return floor;
-  return Math.max(floor, width - WIDGET_HORIZONTAL_MARGIN - prefixCols);
+  // v0.38.30 audit: clamp to the available width (narrow terminals used to
+  // get the floor, so the inner truncate no-opped and the outer hard-cut
+  // sliced mid-token). Floor applies only when width is unknown; otherwise
+  // the available width wins with a small absolute minimum to avoid junk.
+  return Math.max(10, width - WIDGET_HORIZONTAL_MARGIN - prefixCols);
 }
 
 function uniqueModelRefs(refs: readonly string[] | undefined): string[] {
@@ -280,6 +302,55 @@ function modelSourceLabel(source: string): string {
   return source.trim();
 }
 
+function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, configuredBackups: string[] = [], now = Date.now(), width?: number): string | undefined {
+  if (!recovery || !recovery.primary.trim()) return undefined;
+  // v0.38.30 audit: width-aware inner budgets (fixed 48/56 silently dropped
+  // the attempts/skipped tail at narrow widths when the outer hard-cut ran).
+  const primary = recovery.primary.trim();
+  const current = (recovery.active ?? primary).trim() || primary;
+  const backups = uniqueModelRefs(configuredBackups).slice(0, 10);
+  const chain = [primary, ...backups];
+  const currentIndex = chain.findIndex((ref) => ref.toLowerCase() === current.toLowerCase());
+  const selected = currentIndex === 0
+    ? "primary"
+    : currentIndex > 0
+      ? `backup ${currentIndex}/${backups.length}`
+      : "fallback";
+  const retryMs = recovery.retryAt ? Date.parse(recovery.retryAt) - now : Number.NaN;
+  const probeMs = recovery.primaryProbeAt ? Date.parse(recovery.primaryProbeAt) - now : Number.NaN;
+  const phase = recovery.manualResumeRequired
+    ? "manual hold"
+    : recovery.pendingModelSwitch
+      ? `switching → ${truncate(recovery.pendingModelSwitch, budgetFor(width, 20, 48))}`
+      : Number.isFinite(retryMs)
+        ? retryMs <= 0 ? "retrying now" : `retrying in ${fmtElapsed(retryMs)}`
+        : recovery.primaryProbeInFlight
+          ? "primary probe pending"
+          : Number.isFinite(probeMs)
+            ? probeMs <= 0 ? "probing primary now" : `primary probe in ${fmtElapsed(probeMs)}`
+            : `${selected} selected`;
+  const attempted = recovery.attempted?.length ?? 0;
+  const skipped = recovery.skipped?.length ?? 0;
+  const hasEpisode = !!recovery.manualResumeRequired
+    || !!recovery.pendingModelSwitch
+    || Number.isFinite(retryMs)
+    || Number.isFinite(probeMs)
+    || !!recovery.primaryProbeInFlight
+    || recovery.attempts > 0
+    || attempted > 1
+    || skipped > 0
+    || currentIndex !== 0;
+  // A recovery object can briefly survive the successful primary selection.
+  // Do not label that normal state as an incident, but keep the selected model
+  // on the card when no separate provenance row is available.
+  if (!hasEpisode) return `model: ${truncate(current, budgetFor(width, 12, 56))} · primary`;
+  const history = [
+    recovery.attempts > 0 ? `attempts ${recovery.attempts}` : "",
+    skipped > 0 ? `skipped ${skipped}` : "",
+  ].filter(Boolean);
+  return `recovery: ${phase} · ${selected} ${truncate(current, budgetFor(width, 20, 48))}${history.length > 0 ? ` · ${history.join(" · ")}` : ""}`;
+}
+
 function modelProvenanceLines(provenance: ModelProvenanceDisplay | undefined, width?: number): string[] {
   if (!provenance) return [];
   const budget = budgetFor(width, 3, 60);
@@ -328,9 +399,14 @@ export function buildDurableDeferDecisionLines(input: DurableDeferRecommendation
       // Reserve room for the recommendation marker and the outer tree prefix
       // so a normal 80-column production widget cannot truncate away the
       // fact that the durable plaque is the selected action.
+      // Recommendation bodies are durable facts, but the glance card is not
+      // the command's full report. A wide terminal used to turn these plaques
+      // into sentence-length banners and crowd out the actual work state;
+      // /goal status retains the complete text.
+      const bodyCap = plaque.kind === "durable" ? 96 : 72;
       const bodyBudget = width && width > 0
-        ? Math.max(8, width - WIDGET_HORIZONTAL_MARGIN - 3 - visibleLen(prefix) - visibleLen(marker))
-        : budgetFor(width, 3, 60);
+        ? Math.max(8, Math.min(bodyCap, width - WIDGET_HORIZONTAL_MARGIN - 3 - visibleLen(prefix) - visibleLen(marker)))
+        : Math.min(bodyCap, budgetFor(width, 3, 60));
       return `${prefix}${truncate(plaque.body, bodyBudget)}${marker}`;
     }),
     `selected: ${recommendation.choice}${recommendation.choice === "inline" ? " (durable fix)" : " (reversible workaround)"}`,
@@ -1163,21 +1239,21 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
     return `glla: ${paint(theme, pauseIsError(g) ? "error" : "warning", label)}${pausedStatusSuffix(g, state, extras, now)}${heldSuffix}`;
   }
   if (g.status === "active") {
-    const recoverySummary = formatMainModelRecoveryStatus(state.mainModelRecovery, extras?.mainModelFallbacks);
-    const withRecovery = (value: string): string => recoverySummary.length > 0
-      ? `${value} · ${recoverySummary.join(" · ")}`
-      : value;
+    // The footer is a glance/liveness surface. Recovery details belong to the
+    // card (and the full /goal status report), not a second horizontally
+    // concatenated copy here. This keeps exceptions readable without making
+    // a healthy WORKING line look like an incident.
     // v0.28.1 (S1/S2): a stale-handle interrupt keeps the goal ACTIVE.
     // It outranks any older operational note on the same state snapshot.
     if (g.interruptedAt) {
       const label = interruptedForNoStart(g)
         ? "⚠ turn start not observed — automatic retry held"
         : "⚠ interrupted — stale handle · /new (or a fresh session_start) rebinds";
-      return withRecovery(`glla: ${paint(theme, "error", label)}${heldSuffix}`);
+      return `glla: ${paint(theme, "error", label)}${heldSuffix}`;
     }
     const attention = activeAttention(g);
     if (attention) {
-      return withRecovery(`glla: ${paint(theme, attention.color, `⚠ ${attention.label}`)}${heldSuffix}`);
+      return `glla: ${paint(theme, attention.color, `⚠ ${attention.label}`)}${heldSuffix}`;
     }
     const activity = goalDisplayActivity(g, extras, now);
     // v0.34.97: while the post-compaction grace window is open, surface
@@ -1186,10 +1262,10 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
     const compactAgeMs = state.lastCompactionAt ? now - state.lastCompactionAt : Number.POSITIVE_INFINITY;
     const compacting = Number.isFinite(compactAgeMs) && compactAgeMs >= 0 && compactAgeMs < 180_000; // COMPACTION_GRACE_MS = 3 min
     if (compacting) {
-      return withRecovery(`glla: ${paint(theme, "warning", `⏳ compacting… (${fmtElapsed(compactAgeMs)} ago)`)}${heldSuffix}`);
+      return `glla: ${paint(theme, "warning", `⏳ compacting… (${fmtElapsed(compactAgeMs)} ago)`)}${heldSuffix}`;
     }
     if (activity === "awaiting-first-turn") {
-      return withRecovery(`glla: ${activityStateBadge("AWAITING FIRST TURN", theme, "warning")}${heldSuffix}`);
+      return `glla: ${activityStateBadge("AWAITING FIRST TURN", theme, "warning")}${heldSuffix}`;
     }
     if (activity === "idle") {
       // Audit 2026-09-07 (DECIDED: head owns liveness): the status keeps
@@ -1200,7 +1276,7 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
         goalTotalText(g, now),
         (state.list?.length ?? 0) > 0 ? `${state.list!.length} queued` : "",
       ].filter(Boolean);
-      return withRecovery(`glla: ${activityStateBadge("IDLE", theme, "warning")}${idleDetails.length > 0 ? ` ${idleDetails.join(" · ")}` : ""}${heldSuffix}`);
+      return `glla: ${activityStateBadge("IDLE", theme, "warning")}${idleDetails.length > 0 ? ` ${idleDetails.join(" · ")}` : ""}${heldSuffix}`;
     }
     // v0.34.39: distinguish durable state from evidence of a live host turn.
     // A spinner is reserved for recent stream/tool evidence; BUSY without
@@ -1212,7 +1288,7 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
         g.taskList ? `${countDone(g)}/${countTotal(g)} tasks` : "",
         (state.list?.length ?? 0) > 0 ? `${state.list!.length} queued` : "",
       ].filter(Boolean);
-      return withRecovery(`glla: ${activityStateBadge("BUSY", theme, "warning")}${busyDetails.length > 0 ? ` ${busyDetails.join(" · ")}` : ""}${heldSuffix}`);
+      return `glla: ${activityStateBadge("BUSY", theme, "warning")}${busyDetails.length > 0 ? ` ${busyDetails.join(" · ")}` : ""}${heldSuffix}`;
     }
     // v0.34.16: a fresh session_start owns the handoff. A cold boot still
     // follows the global autoResume setting, so the widget names the actual
@@ -1258,7 +1334,7 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
       monitoring ? "next check" : "",
       n > 0 ? `${n} queued` : "",
     ].filter(Boolean);
-    return withRecovery(`glla: ${marker}${details.length > 0 ? ` ${details.join(" · ")}` : ""}${recoverySuffix}${heldSuffix}`);
+    return `glla: ${marker}${details.length > 0 ? ` ${details.join(" · ")}` : ""}${recoverySuffix}${heldSuffix}`;
   }
   // v0.34.65: a terminal goal names its outcome + wall duration instead of
   // clearing the segment (note.md 2026-08-07: "this seems weak for a complete
@@ -1277,6 +1353,12 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
 
 function countDone(g: Goal): number {
   let n = 0;
+  const countAllDescendants = (ts?: any[]): number => {
+    if (!ts) return 0;
+    let c = 0;
+    for (const s of ts) c += 1 + countAllDescendants(s.subtasks);
+    return c;
+  };
   const walk = (ts: Array<{ status: string; subtasks?: any[] }>) => {
     for (const t of ts) {
       if (t.status === "complete") {
@@ -1284,7 +1366,9 @@ function countDone(g: Goal): number {
         // (field: 2 closed parents with pending subtasks displayed "2/24"
         // for 6 real tasks). Mid-flight parents still count done subtasks
         // independently via the walk below.
-        n += 1 + (t.subtasks?.length ?? 0);
+        // v0.38.30 audit: count ALL descendants, not just direct children
+        // (a closed parent with nested grandchildren under-read done).
+        n += 1 + countAllDescendants(t.subtasks);
       } else if (t.subtasks) {
         walk(t.subtasks);
       }
@@ -1352,6 +1436,16 @@ export function buildWidgetLines(state: State, audit?: AuditDisplayProgress | nu
       withAgents = orphanHead ? [orphanHead, ...agentLines] : [...agentLines];
     }
   }
+  // Keep the final tree row visually closed when the compact judgment block
+  // ends without a queue footer. Without this, its last `├─` reads like a
+  // missing continuation and makes an already dense card feel unfinished.
+  if (withAgents && inner && detailedAgents.length === 0 && extras?.durableDeferRecommendation && withAgents.length > 0) {
+    const tailIndex = withAgents.length - 1;
+    const tail = withAgents[tailIndex]!;
+    if (tail.startsWith("├─ ") || tail.startsWith("│ ")) {
+      withAgents[tailIndex] = `└─ ${tail.slice(3)}`;
+    }
+  }
   // v0.28.6 (E1): a persistence failure outranks everything — first line,
   // on every render, until a write lands again.
   let lines: string[] | undefined = withAgents;
@@ -1373,7 +1467,7 @@ export function buildWidgetLines(state: State, audit?: AuditDisplayProgress | nu
 function waitingListStatus(state: State, _now: number, theme?: DisplayTheme, width?: number): string {
   const queue = state.list ?? [];
   const head = queue[0];
-  const objective = head?.objective?.trim() ? sanitizeDisplayText(head.objective) : "unnamed queued item";
+  const objective = head?.objective?.trim() ? displayObjective(head.objective) : "unnamed queued item";
   const hold = typeof state.loadHoldAt === "number" ? " · held on restore" : "";
   // Audit 2026-09-06: the width budget truncates the END of the status
   // line — the `/glla resume` action must survive, so the OBJECTIVE takes
@@ -1390,7 +1484,7 @@ function waitingListStatus(state: State, _now: number, theme?: DisplayTheme, wid
 function waitingListLines(state: State, theme?: DisplayTheme, width?: number): string[] {
   const queue = state.list ?? [];
   const head = queue[0];
-  const objective = head?.objective?.trim() ? sanitizeDisplayText(head.objective) : "unnamed queued item";
+  const objective = head?.objective?.trim() ? displayObjective(head.objective) : "unnamed queued item";
   const objectiveBudget = budgetFor(width, visibleLen("├─ up next: "), 56);
   const action = typeof state.loadHoldAt === "number"
     ? "held on restore · /glla resume starts the queue · /list next skips/chooses"
@@ -1555,7 +1649,7 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
   const headIcon = headLive
     ? paint(theme, headLive.band === "fresh" ? "success" : headLive.band === "aging" ? "warning" : "error", headLive.breath)
     : icon;
-  const head = `${headIcon} ${truncate(g.objective.replace(/\s+/g, " "), objBudget)} ${paint(theme, "dim", "·")} ${segsText}`;
+  const head = `${headIcon} ${truncate(displayObjective(g.objective), objBudget)} ${paint(theme, "dim", "·")} ${segsText}`;
   const lines = [head];
   // v0.38.8: durable verdict tally as a first-class card row — the widget
   // is the glance surface, and stored verdicts are the progress evidence
@@ -1572,20 +1666,28 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
     lines.push(`├─ ${paint(theme, "dim", `Recovery: ${repairStep}`)}`);
   }
   // A model switch crosses an asynchronous boundary while the goal remains
-  // active. Keep the complete durable recovery projection on the widget too;
-  // otherwise the head says only "active" while pending/attempted/skipped
-  // candidates are invisible until the goal is parked.
-  if (g.status === "active" && state.mainModelRecovery) {
-    const recoverySummary = formatMainModelRecoveryStatus(state.mainModelRecovery, extras?.mainModelFallbacks);
-    recoverySummary.forEach((line, i) => {
-      lines.push(`${i === 0 ? "├─" : "│ "} ${paint(theme, "dim", line)}`);
-    });
+  // active. Keep that fact visible, but do not print the full recovery report
+  // into the glance card; it made the card taller than the space below the
+  // editor. `/goal status` remains the detailed recovery surface.
+  // v0.38.30 audit: goal card owns goal-kind episodes only (a kind:loop
+  // episode beside an active goal used to misattribute loop recovery here
+  // and hide the goal's own provenance; loop kinds keep the parked /
+  // standalone cards). Fall back to provenance when the compact line is
+  // undefined (blank-primary edge left no model fact at all).
+  const goalRecovery = state.mainModelRecovery?.kind === "goal" ? state.mainModelRecovery : undefined;
+  let recoveryLine: string | undefined;
+  if (g.status === "active" && goalRecovery) {
+    recoveryLine = compactMainModelRecoveryLine(goalRecovery, extras?.mainModelFallbacks, now, width);
+    if (recoveryLine) lines.push(`├─ ${paint(theme, "dim", recoveryLine)}`);
   }
   // Model provenance is a card fact, not a notification: keep it visible
-  // across active, interrupted, auditing, and paused branches. In
-  // particular, never replace a configured forbidden ref with "none" — the
-  // skipped line explains why it did not handle the turn.
-  const provenance = modelProvenanceLines(extras?.modelProvenance, width);
+  // across active, interrupted, auditing, and paused branches. During an
+  // active recovery the compact recovery row owns the model fact, so do not
+  // print a second primary/current row beside it. The full chain and skipped
+  // refs remain available through `/goal status`.
+  const provenance = recoveryLine
+    ? []
+    : modelProvenanceLines(extras?.modelProvenance, width);
   const provenanceStart = lines.length;
   provenance.forEach((line, i) => {
     lines.push(`${i === 0 ? "├─" : "│ "} ${paint(theme, "dim", line)}`);
@@ -1915,12 +2017,22 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
   // no recent action, pending task, or queue footer. Close that block with a
   // terminator instead of leaving `├─`/`│` suggesting missing rows.
   const provenanceEnd = provenanceStart + provenance.length;
-  if (provenance.length > 0 && provenanceEnd === lines.length) {
+  const detailedAgentRows = extras?.agents?.lines ?? (extras?.agents?.line ? [extras.agents.line] : []);
+  if (provenance.length > 0 && detailedAgentRows.length === 0 && provenanceEnd === lines.length) {
     const last = lines[provenanceEnd - 1]!;
     if (last.startsWith("├─ ") || last.startsWith("│ ")) {
       lines[provenanceEnd - 1] = `└─ ${last.slice(3)}`;
     }
   }
+  // A compact recovery/model row can be the final detail when no other card
+  // fact follows it. Close that one row without changing the established
+  // open-row shape for recent actions or worker details.
+  if (recoveryLine && detailedAgentRows.length === 0 && lines.length > 0) {
+    const last = lines[lines.length - 1]!;
+    if (last.includes(recoveryLine) && (last.startsWith("├─ ") || last.startsWith("│ "))) {
+      lines[lines.length - 1] = `└─ ${last.slice(3)}`;
+    }
+  }
   return lines;
 }
 

package/extensions/goal-loop-forever.ts

@@ -431,8 +431,23 @@ export function parseLoopStartArgs(raw: string): {
   const spans: Array<[number, number]> = [];
   while ((m = kvRe.exec(rest)) !== null) {
     if (insideQuote(m.index)) continue; // key-looking text inside the target's quotes — leave it
-    if (!KNOWN_KEYS.has(m[1]!.toLowerCase())) continue; // unknown key — leave it in the target
-    kv.set(m[1]!.toLowerCase(), m[2] ?? m[3] ?? m[4] ?? "");
+    const key = m[1]!.toLowerCase();
+    if (!KNOWN_KEYS.has(key)) continue; // unknown key — leave it in the target
+    const value = m[2] ?? m[3] ?? m[4] ?? "";
+    // v0.38.30 audit: only consume known keys with VALID values — junk like
+    // unquoted `time=out` used to be stripped from the target while silently
+    // falling back to defaults. Invalid values stay in the target prose.
+    // `done` always consumes (any use teaches the v0.15.0 removal); `measure`
+    // accepts any non-empty command string.
+    let valid = true;
+    if (key === "direction") valid = value.toLowerCase() === "min" || value.toLowerCase() === "max";
+    else if (key === "window") { const n = Number.parseInt(value, 10); valid = Number.isFinite(n) && n > 0; }
+    else if (key === "max") { const n = Number.parseInt(value, 10); valid = Number.isFinite(n) && n >= 0; }
+    else if (key === "branch" || key === "force") valid = ["1", "true", "yes", "0", "false", "no"].includes(value.toLowerCase());
+    else if (key === "time" || key === "cadence") { const n = Number.parseFloat(value); valid = Number.isFinite(n) && n > 0; }
+    else if (key === "tokens" || key === "toolsamerepeat") { const n = Number.parseInt(value, 10); valid = Number.isInteger(n) && n >= 0; }
+    if (!valid) continue; // junk value — leave the span in the target
+    kv.set(key, value);
     spans.push([m.index, m.index + m[0].length]);
   }
   // Remove kv spans from the target text.
@@ -601,7 +616,9 @@ export function topOpenAuditFinding(cwd: string): string | null {
     const p = join(piGlaDir(cwd), "audit-loop/findings.md");
     if (!existsSync(p)) return null;
     const line = readFileSync(p, "utf-8").split("\n").find((l) => /^- \[[ \t]+\]/.test(l));
-    return line ? line.replace(/^- \[ \]\s*/, "").trim().slice(0, 120) : null;
+    // v0.38.30 audit: strip with the same [ \t]+ class as the matcher
+    // (an aligned `- [  ]` box used to leak markup into the reprieve note).
+    return line ? line.replace(/^- \[[ \t]+\]\s*/, "").trim().slice(0, 120) : null;
   } catch {
     return null;
   }

package/extensions/loops/goal-activation.ts

@@ -227,6 +227,7 @@ import {
   type ProjectRollup,
 } from "../goal-loop-stats.js";
 import { releaseAuditorSurface, suppressAuditorSurfaceAfterColdRestore } from "./goal-auditor-surface.js";
+import { shouldSkipApprovalRenderReplay } from "./goal-session.js";
 import {
   cancelDetachedGoalCompletionAuditor,
   newDetachedAuditJobAttemptId,
@@ -781,7 +782,10 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles — the wrappers run
+      // before the inner stale fence, and a superseded session used to mark
+      // delivery into a dead session (stale-allowed /loop status included).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdGoal(args, ctx);
     },
   });
@@ -790,7 +794,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     if (refuseForeignCommand(ctx)) return Promise.resolve();
     // v0.38.25: live contact — replay any approval render that landed
     // with no live turn (persist-first, never silent).
-    replayUndeliveredApprovalRenders(ctx);
+    // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+    if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
     return cmdSettings(args, ctx);
   };
   pi.registerCommand("glla", {
@@ -821,7 +826,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdReview(args, ctx);
     },
   });
@@ -850,7 +856,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdList(args, ctx);
     },
   });
@@ -875,7 +882,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdLoop(args, ctx);
     },
   });

package/extensions/loops/goal-session.ts

@@ -1315,6 +1315,38 @@ function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   return true;
 }
 
+/** v0.38.30 audit: non-notifying stale probe for the approval-render replay.
+ * The command wrappers replay undelivered renders on every live contact, but
+ * they run BEFORE the inner warnIfStaleAtEntry fence — a superseded session
+ * running stale-allowed `/loop status` (or any refused command) used to
+ * rewrite pending-approval-renders.json + ledger and notify into a dead
+ * session, marking delivery the user never saw. Workers are never live
+ * contact either. Passive flags only (no absorb side effects); fail closed. */
+export function shouldSkipApprovalRenderReplay(ctx: ExtensionContext): boolean {
+  try {
+    if (isWorkerSessionCtx(ctx)) return true;
+  } catch {
+    return true;
+  }
+  try {
+    if (processOwnerDeniedCwd === ctx.cwd) return true;
+  } catch {
+    return true;
+  }
+  if (sessionHandoffPending) return true;
+  try {
+    if (Date.now() < sessionReplacementUntil) return true;
+  } catch {
+    return true;
+  }
+  try {
+    if (probeExtensionApiStale()) return true;
+  } catch {
+    return true;
+  }
+  return false;
+}
+
 /** v0.28.12: draft-class confirm with the auto-accept escape hatch SURFACED.
  * The polis incident: a user sat through a 14-item batch Confirm having
  * already reviewed every item during drafting, never knowing /glla

package/extensions/loops/goal-settings-ui.ts

@@ -23,6 +23,7 @@ import * as path from "node:path";
 
 import { defineTool, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
+import { truncateCells } from "../goal-loop-display.js";
 import { Type } from "typebox";
 
 // v0.34.109 (decomposition step 1): the state singleton and the persistence
@@ -742,7 +743,9 @@ async function promptSettingsMenu(
   // Audit 2026-09-06: bound the flat option strings — full VALUE +
   // DESCRIPTION previously rendered unbounded. The resolution prefix
   // (`[section] label —`) sits at the head, so tail truncation is safe.
-  const flat = rows.map((r) => truncateToWidth(`[${r.section}] ${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`, 120, "…"));
+  // v0.38.30 audit: headless select values are plain-text — use the
+  // ANSI-free truncator (truncateToWidth stays for the painted TUI table).
+  const flat = rows.map((r) => truncateCells(`[${r.section}] ${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`, 120));
   flat.push("Done");
   const v = await ctx.ui.select(title, flat);
   if (!v || v === "Done") return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.28",
+  "version": "0.38.30",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",