pi-goal-list-loop-audit 0.38.29 → 0.38.31

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.38.31 — overdue wait-pause stops promising imminent resume (2026-09-08)
+
+### Fixed
+- A recovery-timer wait whose retry time passed long ago on a held/idle host no longer claims `next: resuming now` / `auto-retrying · now` forever while also reading `paused` + `safely parked` (field screenshot 20260908_180721). `resuming now` / `resuming…` / `now` are grace-bounded (90s); past that the card and status bar name the timer (`next: recovery timer`, `auto-retrying · overdue — waiting on recovery timer`, `retry overdue`).
+- Recovery-timer waits end at the auto-retry row: the stock provider-failure `pauseSuggestedAction` boilerplate and the generic `awaiting first turn` / `saved` tail are gone (owner + next are already on the rows above); the previous row closes the tree with `└─`. Decision/error/blocked pauses are unchanged.
+- Regression coverage in `tests/paused-overdue-display.test.ts` (6 pins); two v0.34-era pins that encoded the old permanent-`resuming…` wording updated to the grace contract; `tsc` clean.
+
+## 0.38.30 — fresh audit pass: nine low-severity fixes (2026-09-08)
+
+### Fixed
+- Approval-render replay no longer runs before the stale/ownership fence: wrappers skip replay on stale, worker, owner-denied, handoff, and rebind handles (`shouldSkipApprovalRenderReplay`), so a superseded session running stale-allowed `/loop status` cannot mark delivery into a dead session.
+- `countDone` counts all descendants of closed parents, matching the recursive `countTotal` (a closed parent with nested grandchildren no longer under-reads done).
+- Plain-text surfaces use the ANSI-free truncator: `completion-summary.ts` width budgets and the headless settings flat rows route through `truncateCells`; the painted TUI tables keep `truncateToWidth`.
+- Narrow-terminal budgets clamp to the available width instead of the floor, and the compact recovery line takes width-aware inner budgets — provenance/fallback chains truncate indoors instead of hard-cutting mid-token.
+- The display-only objective projection additionally strips `#` headers, `>` quotes, `[label](url)` links, and `*em*` emphasis. Stored objectives unchanged.
+- The approval-render sidecar repairs a corrupt file after ledgering once, truncates objectives by code points, and caps chat lines (60 lines × 1000 chars) behind the 20-entry spillway.
+- The goal card owns goal-kind recovery episodes only: `kind:loop` episodes keep the parked/standalone cards and no longer suppress the goal's provenance; blank-primary recovery falls back to provenance instead of leaving no model fact.
+- `topOpenAuditFinding` strips aligned/tabbed boxes with the same `[ \t]+` class as its matcher, so the reprieve note never carries checkbox markup.
+- `parseLoopStartArgs` consumes known keys only with valid values — junk like unquoted `time=out` stays in the target prose instead of vanishing while defaults silently apply (`done` still always teaches its removal; `measure` accepts any non-empty command).
+- Regression coverage in `tests/audit-2026-09-08.test.ts` (11 pins); `tsc` clean; focused display/loop-forever/approval suites green.
+
 ## 0.38.29 — compact active-card recovery and judgment details (2026-09-08)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.29 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.31 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/approval-render-store.ts

@@ -31,6 +31,10 @@ export interface PendingApprovalRender {
  * briefly for inspection; undelivered ones are never dropped by the cap. */
 const MAX_STORED_RENDERS = 20;
 const MAX_REPLAY_PER_CONTACT = 5;
+// v0.38.30 audit: bound the sidecar behind the "each is ~1KB" comment — a
+// long approval trailer used to grow the 20-entry file without bound.
+const MAX_RENDER_CHAT_LINES = 60;
+const MAX_RENDER_LINE_CHARS = 1000;
 
 export function approvalRenderStorePath(cwd: string): string {
   return path.join(piGlaDir(cwd), "pending-approval-renders.json");
@@ -63,10 +67,15 @@ function readRenders(cwd: string): PendingApprovalRender[] {
         dropped: parsed.length - valid.length,
         kept: valid.length,
       });
+      // v0.38.30 audit: repair the file after ledgering once — otherwise
+      // every user command re-appended the same ledger while the file
+      // stayed corrupt. Best-effort; a failed rewrite simply ledgers again.
+      writeRenders(cwd, valid);
     }
     return valid;
   } catch {
     appendLedger(cwd, "terminal_approval_render_store_invalid", { dropped: "all", kept: 0 });
+    writeRenders(cwd, []);
     return [];
   }
 }
@@ -94,8 +103,10 @@ export function persistApprovalRender(cwd: string, render: {
   const existing = readRenders(cwd);
   const entry: PendingApprovalRender = {
     goalId: render.goalId,
-    objective: render.objective.slice(0, 300),
-    chatLines: render.chatLines,
+    // v0.38.30 audit: code-point truncation (char slice split surrogate
+    // pairs) + bounded chat lines (the 20-entry cap never bound bytes).
+    objective: [...render.objective].slice(0, 300).join(""),
+    chatLines: render.chatLines.slice(0, MAX_RENDER_CHAT_LINES).map((line) => [...line].slice(0, MAX_RENDER_LINE_CHARS).join("")),
     createdAt: at,
     ...(render.delivered ? { deliveredAt: at } : {}),
   };

package/extensions/completion-summary.ts

@@ -1,5 +1,5 @@
 import type { Goal, Status } from "./goal-loop-core.js";
-import { truncateToWidth } from "@earendil-works/pi-tui";
+import { truncateCells } from "./goal-loop-display.js";
 
 /**
  * The durable, user-facing terminal recap contract. Keep this as a small
@@ -303,7 +303,10 @@ export function completionSummaryLines(text: string | undefined, maxValueLength
     const line = `${name}: ${clipSummaryValue(rawValue || "not recorded", maxValueLength)}`;
     // Audit 2026-09-06: optional width budget for width-bound surfaces —
     // the default 240-char values previously had no width-conscious path.
-    return lineWidth && lineWidth > 0 ? truncateToWidth(line, lineWidth, "…") : line;
+    // v0.38.30 audit: plain-text surface — use the ANSI-free truncator
+    // (pi-tui truncateToWidth wraps the ellipsis in resets even for plain
+    // text, polluting notify/log/pager consumers).
+    return lineWidth && lineWidth > 0 ? truncateCells(line, lineWidth) : line;
   });
 }
 

package/extensions/goal-loop-display.ts

@@ -95,7 +95,14 @@ function displayObjective(objective: string): string {
   return compactDisplayText(objective)
     .replace(/\*\*([^*]+)\*\*/g, "$1")
     .replace(/__([^_]+)__/g, "$1")
-    .replace(/`([^`\n]*)`/g, "$1");
+    .replace(/`([^`\n]*)`/g, "$1")
+    // v0.38.30 audit: strip the remaining common single-line wrappers so the
+    // glance card keeps its plain-text promise (headers, quotes, links,
+    // single-emphasis). Display-only; prompts/archives/state keep verbatim.
+    .replace(/^#{1,6}\s+/gm, "")
+    .replace(/^>\s?/gm, "")
+    .replace(/\[([^\]]+)\]\([^)]*\)/g, "$1")
+    .replace(/\*([^*\n]+)\*/g, "$1");
 }
 
 /** v0.33.1: painted strings measure by their terminal-cell width. */
@@ -261,7 +268,11 @@ export const WORKER_TEXT_SPACER = "\u00A0";
 
 function budgetFor(width: number | undefined, prefixCols: number, floor: number): number {
   if (!width || width <= 0) return floor;
-  return Math.max(floor, width - WIDGET_HORIZONTAL_MARGIN - prefixCols);
+  // v0.38.30 audit: clamp to the available width (narrow terminals used to
+  // get the floor, so the inner truncate no-opped and the outer hard-cut
+  // sliced mid-token). Floor applies only when width is unknown; otherwise
+  // the available width wins with a small absolute minimum to avoid junk.
+  return Math.max(10, width - WIDGET_HORIZONTAL_MARGIN - prefixCols);
 }
 
 function uniqueModelRefs(refs: readonly string[] | undefined): string[] {
@@ -291,8 +302,10 @@ function modelSourceLabel(source: string): string {
   return source.trim();
 }
 
-function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, configuredBackups: string[] = [], now = Date.now()): string | undefined {
+function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, configuredBackups: string[] = [], now = Date.now(), width?: number): string | undefined {
   if (!recovery || !recovery.primary.trim()) return undefined;
+  // v0.38.30 audit: width-aware inner budgets (fixed 48/56 silently dropped
+  // the attempts/skipped tail at narrow widths when the outer hard-cut ran).
   const primary = recovery.primary.trim();
   const current = (recovery.active ?? primary).trim() || primary;
   const backups = uniqueModelRefs(configuredBackups).slice(0, 10);
@@ -308,7 +321,7 @@ function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, c
   const phase = recovery.manualResumeRequired
     ? "manual hold"
     : recovery.pendingModelSwitch
-      ? `switching → ${truncate(recovery.pendingModelSwitch, 48)}`
+      ? `switching → ${truncate(recovery.pendingModelSwitch, budgetFor(width, 20, 48))}`
       : Number.isFinite(retryMs)
         ? retryMs <= 0 ? "retrying now" : `retrying in ${fmtElapsed(retryMs)}`
         : recovery.primaryProbeInFlight
@@ -330,12 +343,12 @@ function compactMainModelRecoveryLine(recovery: MainModelRecovery | undefined, c
   // A recovery object can briefly survive the successful primary selection.
   // Do not label that normal state as an incident, but keep the selected model
   // on the card when no separate provenance row is available.
-  if (!hasEpisode) return `model: ${truncate(current, 56)} · primary`;
+  if (!hasEpisode) return `model: ${truncate(current, budgetFor(width, 12, 56))} · primary`;
   const history = [
     recovery.attempts > 0 ? `attempts ${recovery.attempts}` : "",
     skipped > 0 ? `skipped ${skipped}` : "",
   ].filter(Boolean);
-  return `recovery: ${phase} · ${selected} ${truncate(current, 48)}${history.length > 0 ? ` · ${history.join(" · ")}` : ""}`;
+  return `recovery: ${phase} · ${selected} ${truncate(current, budgetFor(width, 20, 48))}${history.length > 0 ? ` · ${history.join(" · ")}` : ""}`;
 }
 
 function modelProvenanceLines(provenance: ModelProvenanceDisplay | undefined, width?: number): string[] {
@@ -998,6 +1011,14 @@ function goalTotalText(g: Goal, now: number): string {
   return Number.isFinite(startedAt) ? `total ${fmtElapsed(bucketSilentMs(Math.max(0, now - startedAt)))}` : "";
 }
 
+/** v0.38.31 (field 2026-09-08 180721): "resuming now" is a transient
+ * truth, not a state. A wait-pause whose retry time passed an hour ago on
+ * a held/idle host is overdue — claiming an imminent resume forever while
+ * the card also says "safely parked" is the same contradiction class as
+ * f8d1c2f. Past the grace window the transition falls through to the
+ * pause-kind label ("recovery timer" for waits) instead. */
+export const PAUSED_RESUME_GRACE_MS = 90_000;
+
 function pausedNextTransition(g: Goal, state: State, now: number): string {
   const resume = g.policy === "list" ? "/list resume" : "/goal resume";
   const retryAt = state.mainModelRecovery?.retryAt ? Date.parse(state.mainModelRecovery.retryAt) : Number.NaN;
@@ -1013,7 +1034,11 @@ function pausedNextTransition(g: Goal, state: State, now: number): string {
   }
   const resumeAt = g.pauseResumeAt ? Date.parse(g.pauseResumeAt) : Number.NaN;
   if (Number.isFinite(resumeAt)) {
-    return resumeAt <= now ? "resuming now" : `auto-retry in ${fmtElapsed(resumeAt - now)}`;
+    if (resumeAt > now) return `auto-retry in ${fmtElapsed(resumeAt - now)}`;
+    // Inside the grace window the retry is genuinely imminent. Past it the
+    // timer never fired (held host, idle session) — fall through to the
+    // kind label below instead of promising "resuming now" forever.
+    if (now - resumeAt < PAUSED_RESUME_GRACE_MS) return "resuming now";
   }
   if (isCompletionAuditNoVerdict(g)) {
     const retryAt = g.pendingCompletion?.recoveryRetryAt
@@ -1194,14 +1219,16 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
     if (kind === "wait" || kind === "blocked") {
       // v0.34.12: live countdown (the UI ticker keeps rendering through a
       // timed wait) — "auto-retry in 23m" beats a static clock time, and a
-      // passed resumeAt says "resuming…" instead of lying about the past.
+      // freshly-passed resumeAt says "resuming…" instead of lying about the
+      // past. v0.38.31: "resuming…" shares the transition grace window — a
+      // retry time long past with no dispatch reads "retry overdue".
       // Every retry-class pause renders the same ⏳ auto-retrying… line +
       // countdown; blocked pauses without a recovery timer render as
       // ⏸ action needed. A main-model manual hold names its recovery owner.
       const rms = g.pauseResumeAt ? Date.parse(g.pauseResumeAt) - now : Number.NaN;
-      const when = Number.isFinite(rms)
-        ? rms <= 0 ? " · resuming…" : ` · auto-retry in ${fmtElapsed(rms)}`
-        : "";
+      const when = !Number.isFinite(rms) ? ""
+        : rms > 0 ? ` · auto-retry in ${fmtElapsed(rms)}`
+        : -rms >= PAUSED_RESUME_GRACE_MS ? " · retry overdue" : " · resuming…";
       if (kind === "blocked") {
         const label = state.mainModelRecovery?.manualResumeRequired === true
           ? "⏸ manual recovery hold"
@@ -1340,6 +1367,12 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
 
 function countDone(g: Goal): number {
   let n = 0;
+  const countAllDescendants = (ts?: any[]): number => {
+    if (!ts) return 0;
+    let c = 0;
+    for (const s of ts) c += 1 + countAllDescendants(s.subtasks);
+    return c;
+  };
   const walk = (ts: Array<{ status: string; subtasks?: any[] }>) => {
     for (const t of ts) {
       if (t.status === "complete") {
@@ -1347,7 +1380,9 @@ function countDone(g: Goal): number {
         // (field: 2 closed parents with pending subtasks displayed "2/24"
         // for 6 real tasks). Mid-flight parents still count done subtasks
         // independently via the walk below.
-        n += 1 + (t.subtasks?.length ?? 0);
+        // v0.38.30 audit: count ALL descendants, not just direct children
+        // (a closed parent with nested grandchildren under-read done).
+        n += 1 + countAllDescendants(t.subtasks);
       } else if (t.subtasks) {
         walk(t.subtasks);
       }
@@ -1648,9 +1683,15 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
   // active. Keep that fact visible, but do not print the full recovery report
   // into the glance card; it made the card taller than the space below the
   // editor. `/goal status` remains the detailed recovery surface.
+  // v0.38.30 audit: goal card owns goal-kind episodes only (a kind:loop
+  // episode beside an active goal used to misattribute loop recovery here
+  // and hide the goal's own provenance; loop kinds keep the parked /
+  // standalone cards). Fall back to provenance when the compact line is
+  // undefined (blank-primary edge left no model fact at all).
+  const goalRecovery = state.mainModelRecovery?.kind === "goal" ? state.mainModelRecovery : undefined;
   let recoveryLine: string | undefined;
-  if (g.status === "active" && state.mainModelRecovery) {
-    recoveryLine = compactMainModelRecoveryLine(state.mainModelRecovery, extras?.mainModelFallbacks, now);
+  if (g.status === "active" && goalRecovery) {
+    recoveryLine = compactMainModelRecoveryLine(goalRecovery, extras?.mainModelFallbacks, now, width);
     if (recoveryLine) lines.push(`├─ ${paint(theme, "dim", recoveryLine)}`);
   }
   // Model provenance is a card fact, not a notification: keep it visible
@@ -1658,7 +1699,7 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
   // active recovery the compact recovery row owns the model fact, so do not
   // print a second primary/current row beside it. The full chain and skipped
   // refs remain available through `/goal status`.
-  const provenance = state.mainModelRecovery
+  const provenance = recoveryLine
     ? []
     : modelProvenanceLines(extras?.modelProvenance, width);
   const provenanceStart = lines.length;
@@ -1860,7 +1901,12 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
       recoverySummary.forEach((line) => lines.push(`│  ${paint(theme, "dim", line.replace(/^Main-model recovery: /, ""))}`));
     }
     else if (Number.isFinite(retryMs)) {
-      const when = retryMs <= 0 ? "now" : `next probe in ${fmtElapsed(retryMs)}`;
+      // v0.38.31: "now" shares the transition grace window — a retry time
+      // that passed long ago with no dispatch is overdue, not imminent.
+      const overdue = -retryMs >= PAUSED_RESUME_GRACE_MS;
+      const when = retryMs > 0 ? `next probe in ${fmtElapsed(retryMs)}`
+        : overdue ? "overdue — waiting on recovery timer"
+        : "now";
       lines.push(`├─ ${paint(theme, "dim", `auto-retrying · ${when}`)}`);
     } else if (kind === "blocked" && state.mainModelRecovery?.manualResumeRequired === true) {
       lines.push(`├─ ${paint(theme, "warning", "manual recovery hold — automatic probes stopped")}`);
@@ -1901,6 +1947,16 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
     // before the first turn), render "awaiting first turn" instead of "saved"
     // — the latter was misleading because no work was ever "saved" before the
     // session ended.
+    if (kind === "wait") {
+      // v0.38.31 (field 2026-09-08 180721): a recovery-timer wait carries no
+      // objective-specific tail — owner + next are already on the lifecycle /
+      // transition / auto-retry rows, and the parked suggestedAction is stock
+      // provider-failure boilerplate identical on every recovery wait. End
+      // the card here, closing the previous row as the footer.
+      const tail = lines[lines.length - 1];
+      if (tail !== undefined) lines[lines.length - 1] = tail.replace(/^├─|^│\s*/, "└─ ");
+      return lines;
+    }
     const spent: string[] = [];
     const tokUsed = g.usage?.tokensUsed ?? 0;
     const audits = g.auditHistory?.length ?? 0;

package/extensions/goal-loop-forever.ts

@@ -431,8 +431,23 @@ export function parseLoopStartArgs(raw: string): {
   const spans: Array<[number, number]> = [];
   while ((m = kvRe.exec(rest)) !== null) {
     if (insideQuote(m.index)) continue; // key-looking text inside the target's quotes — leave it
-    if (!KNOWN_KEYS.has(m[1]!.toLowerCase())) continue; // unknown key — leave it in the target
-    kv.set(m[1]!.toLowerCase(), m[2] ?? m[3] ?? m[4] ?? "");
+    const key = m[1]!.toLowerCase();
+    if (!KNOWN_KEYS.has(key)) continue; // unknown key — leave it in the target
+    const value = m[2] ?? m[3] ?? m[4] ?? "";
+    // v0.38.30 audit: only consume known keys with VALID values — junk like
+    // unquoted `time=out` used to be stripped from the target while silently
+    // falling back to defaults. Invalid values stay in the target prose.
+    // `done` always consumes (any use teaches the v0.15.0 removal); `measure`
+    // accepts any non-empty command string.
+    let valid = true;
+    if (key === "direction") valid = value.toLowerCase() === "min" || value.toLowerCase() === "max";
+    else if (key === "window") { const n = Number.parseInt(value, 10); valid = Number.isFinite(n) && n > 0; }
+    else if (key === "max") { const n = Number.parseInt(value, 10); valid = Number.isFinite(n) && n >= 0; }
+    else if (key === "branch" || key === "force") valid = ["1", "true", "yes", "0", "false", "no"].includes(value.toLowerCase());
+    else if (key === "time" || key === "cadence") { const n = Number.parseFloat(value); valid = Number.isFinite(n) && n > 0; }
+    else if (key === "tokens" || key === "toolsamerepeat") { const n = Number.parseInt(value, 10); valid = Number.isInteger(n) && n >= 0; }
+    if (!valid) continue; // junk value — leave the span in the target
+    kv.set(key, value);
     spans.push([m.index, m.index + m[0].length]);
   }
   // Remove kv spans from the target text.
@@ -601,7 +616,9 @@ export function topOpenAuditFinding(cwd: string): string | null {
     const p = join(piGlaDir(cwd), "audit-loop/findings.md");
     if (!existsSync(p)) return null;
     const line = readFileSync(p, "utf-8").split("\n").find((l) => /^- \[[ \t]+\]/.test(l));
-    return line ? line.replace(/^- \[ \]\s*/, "").trim().slice(0, 120) : null;
+    // v0.38.30 audit: strip with the same [ \t]+ class as the matcher
+    // (an aligned `- [  ]` box used to leak markup into the reprieve note).
+    return line ? line.replace(/^- \[[ \t]+\]\s*/, "").trim().slice(0, 120) : null;
   } catch {
     return null;
   }

package/extensions/loops/goal-activation.ts

@@ -227,6 +227,7 @@ import {
   type ProjectRollup,
 } from "../goal-loop-stats.js";
 import { releaseAuditorSurface, suppressAuditorSurfaceAfterColdRestore } from "./goal-auditor-surface.js";
+import { shouldSkipApprovalRenderReplay } from "./goal-session.js";
 import {
   cancelDetachedGoalCompletionAuditor,
   newDetachedAuditJobAttemptId,
@@ -781,7 +782,10 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles — the wrappers run
+      // before the inner stale fence, and a superseded session used to mark
+      // delivery into a dead session (stale-allowed /loop status included).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdGoal(args, ctx);
     },
   });
@@ -790,7 +794,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     if (refuseForeignCommand(ctx)) return Promise.resolve();
     // v0.38.25: live contact — replay any approval render that landed
     // with no live turn (persist-first, never silent).
-    replayUndeliveredApprovalRenders(ctx);
+    // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+    if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
     return cmdSettings(args, ctx);
   };
   pi.registerCommand("glla", {
@@ -821,7 +826,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdReview(args, ctx);
     },
   });
@@ -850,7 +856,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdList(args, ctx);
     },
   });
@@ -875,7 +882,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       if (refuseForeignCommand(ctx)) return Promise.resolve();
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
-      replayUndeliveredApprovalRenders(ctx);
+      // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
+      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
       return cmdLoop(args, ctx);
     },
   });

package/extensions/loops/goal-session.ts

@@ -1315,6 +1315,38 @@ function warnIfStaleAtEntry(ctx: ExtensionContext, what: string): boolean {
   return true;
 }
 
+/** v0.38.30 audit: non-notifying stale probe for the approval-render replay.
+ * The command wrappers replay undelivered renders on every live contact, but
+ * they run BEFORE the inner warnIfStaleAtEntry fence — a superseded session
+ * running stale-allowed `/loop status` (or any refused command) used to
+ * rewrite pending-approval-renders.json + ledger and notify into a dead
+ * session, marking delivery the user never saw. Workers are never live
+ * contact either. Passive flags only (no absorb side effects); fail closed. */
+export function shouldSkipApprovalRenderReplay(ctx: ExtensionContext): boolean {
+  try {
+    if (isWorkerSessionCtx(ctx)) return true;
+  } catch {
+    return true;
+  }
+  try {
+    if (processOwnerDeniedCwd === ctx.cwd) return true;
+  } catch {
+    return true;
+  }
+  if (sessionHandoffPending) return true;
+  try {
+    if (Date.now() < sessionReplacementUntil) return true;
+  } catch {
+    return true;
+  }
+  try {
+    if (probeExtensionApiStale()) return true;
+  } catch {
+    return true;
+  }
+  return false;
+}
+
 /** v0.28.12: draft-class confirm with the auto-accept escape hatch SURFACED.
  * The polis incident: a user sat through a 14-item batch Confirm having
  * already reviewed every item during drafting, never knowing /glla

package/extensions/loops/goal-settings-ui.ts

@@ -23,6 +23,7 @@ import * as path from "node:path";
 
 import { defineTool, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
+import { truncateCells } from "../goal-loop-display.js";
 import { Type } from "typebox";
 
 // v0.34.109 (decomposition step 1): the state singleton and the persistence
@@ -742,7 +743,9 @@ async function promptSettingsMenu(
   // Audit 2026-09-06: bound the flat option strings — full VALUE +
   // DESCRIPTION previously rendered unbounded. The resolution prefix
   // (`[section] label —`) sits at the head, so tail truncation is safe.
-  const flat = rows.map((r) => truncateToWidth(`[${r.section}] ${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`, 120, "…"));
+  // v0.38.30 audit: headless select values are plain-text — use the
+  // ANSI-free truncator (truncateToWidth stays for the painted TUI table).
+  const flat = rows.map((r) => truncateCells(`[${r.section}] ${r.label} — ${r.valueText} [${r.sourceText.replace(/^\[|\]$/g, "")}] — ${r.description}`, 120));
   flat.push("Done");
   const v = await ctx.ui.select(title, flat);
   if (!v || v === "Done") return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.29",
+  "version": "0.38.31",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",