pi-goal-list-loop-audit 0.38.3 → 0.38.5

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.38.5 — delta-only goal continuation: marker-only steady-state (2026-09-03)
+
+### Fixed
+  Ongoing-conversation resend: steady-state goal turns now send the 45-char `[GOAL CHECKPOINT goalId=…]` marker only instead of the full ~23k continuation prompt every turn (history already holds T0 objective/contract/tasks + `complete_task` deltas). Post-compact sends `resync + marker` (~250 chars); full sends only on first-send per process or dynamic deltas (`repairTarget` / `autoResumedAt` / auditor TODOs / audit report / stale-approval mismatch / designer / full-audit). Marker still carries the dispatch marker so `before_agent_start` start-proof keeps matching; `agent_start`/`turn_start` fallback needs no prompt. Ledger `goal_continuation_sent` gains `kind` (`full`/`full+resync`/`resync`/`marker`) + `payloadChars`. Loop turns unchanged (per-iteration prompts vary). `extensions/goal-continuation.ts` (`buildMarkerContent` / `needsFullContinuation` / `buildContinuationContent`); `tests/delta-only-continuation.test.ts` pins the matrix.
+
+## 0.38.4 — human-input zombie stand-down (PR #36 slice) + AVO close (2026-09-02)
+
+### Fixed
+  Zombie watchdog no longer aborts while waiting on human input: `pause_goal`, `propose_goal_draft`, `propose_loop_draft`, `propose_loop_refine`, `propose_task_list`, `list_add`, `list_activate`, and `ask_user_question` now stand down the `BUSY + zero stream` abort exactly like `subagent` waits (field: drafting confirm / decision popup / `ask_user_question` looked like a hung provider, the bounded abort parked the dialog and the retry re-opened the same dialog). Own ledger `zombie_run_stood_down_user_input` vs `zombie_run_stood_down_subagent_wait`; genuinely hung streams still abort after the grace window. Selective port of PR #36 `USER_INPUT_WAIT_TOOL_NAMES` + `isUserInputWaitCall` with `heartbeatTick` carve-out; `tests/zombie-user-input-standdown.test.ts` pins the set and the branch.
+
+### Changed
+  AVO consideration closed: `audit/AVO-DEEP-DIVE-2026-09-02.md` remains the full read (`Vary(Pt)=Agent(Pt,K,f)`, §3.3 3-sentence supervisor). PR #22 (stagnation nudge, true AVO pattern but P1s: raw HEAD, no fencing, cycling-cap bypass) and PR #36 (commissar not AVO) dispositioned as `no merge as-is`; only the zombie stand-down ships in this release. PRs to be closed.
+
 ## 0.38.3 — truncate picker/settings titles to terminal width (PR #41) (2026-09-02)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.3 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.5 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/goal-continuation.ts

@@ -1054,6 +1054,52 @@ export function scheduleContinuation(ctx: ExtensionContext, force = false, delay
   continuationTimer = scheduleSessionTimeout(() => sendContinuation(goalId), delay);
 }
 
+export function buildMarkerContent(goalId: string): string {
+  return `[GOAL CHECKPOINT goalId=${goalId}]`;
+}
+
+/** v0.38.5 (delta-only): steady-state live turns need only the wake-up marker —
+ * history already holds T0 objective/contract/tasks + complete_task deltas.
+ * Full is required only for dynamic deltas the model has not seen: repair,
+ * recovery, auditor TODOs/report, stale-approval mismatch, plus the rare
+ * designer / full-audit paths (preserved verbatim in v1). Stable guidance
+ * (vision, discipline) stays clean — it was in the first full send.
+ */
+export function needsFullContinuation(goal: Goal): boolean {
+  if (goal.repairTarget) return true;
+  if (goal.autoResumedAt) return true;
+  if (!auditorSurfaceSuppressed() && goal.pendingTasks && goal.pendingTasks.length > 0) return true;
+  const lastAudit = goal.auditHistory?.[goal.auditHistory.length - 1];
+  if (lastAudit && lastAudit.report && !auditorSurfaceSuppressed()) return true;
+  if (
+    !auditorSurfaceSuppressed() &&
+    goal.status === "active" &&
+    !goal.pendingCompletion &&
+    lastAudit?.approved &&
+    !lastAudit.impossible &&
+    lastAudit.regressionShieldPassed !== false &&
+    typeof lastAudit.revision === "number" &&
+    lastAudit.revision !== (goal.revision ?? 0)
+  ) return true;
+  const next = findNextPendingTask(goal.taskList?.tasks ?? []);
+  if (goal.agentRole === "designer" || next?.agentRole === "designer") return true;
+  try {
+    const settingsCwd = freshCtx?.()?.cwd ?? process.cwd();
+    const eff = resolveEffectiveAggressiveSettings(loadSettings(settingsCwd));
+    if (eff.aggressiveMode && isFullAuditObjective(goal.objective)) return true;
+  } catch { /* settings read failure must not force full */ }
+  return false;
+}
+
+export function buildContinuationContent(goal: Goal, opts: { resync?: string; firstSend?: boolean } = {}): { content: string; kind: string } {
+  const resync = opts.resync ?? "";
+  const marker = buildMarkerContent(goal.id);
+  const needsFull = (opts.firstSend ?? false) || needsFullContinuation(goal);
+  if (needsFull) return { content: resync + continuationPrompt(goal), kind: resync ? "full+resync" : "full" };
+  if (resync) return { content: resync + marker, kind: "resync" };
+  return { content: marker, kind: "marker" };
+}
+
 export function sendContinuation(goalId: string): void {
   // v0.35.15: `/glla pause` — a continuation timer armed BEFORE the pause
   // must not fire into the frozen window. scheduleContinuation already
@@ -1118,15 +1164,24 @@ export function sendContinuation(goalId: string): void {
       resync: Boolean(resync),
     });
     if (!attempt) return;
+    // v0.38.5 (delta-only, ongoing conversation): clean live turns send the
+    // 45-char marker only — history already holds objective/contract/tasks.
+    // Resync (post-compact) sends resync+marker (~250 chars). Full 23k sends
+    // only on first-send per process or dynamic deltas (repair/recovery/
+    // audit). Marker still carries the dispatch marker so before_agent_start
+    // start-proof matching keeps working; fallback agent_start/turn_start
+    // needs no prompt at all.
+    const goalForSend = state.goal!;
+    const { content, kind } = buildContinuationContent(goalForSend, { resync, firstSend: lastContinuationSentAt === 0 });
     flags.extensionApi.sendMessage({
       customType: GOAL_EVENT_ENTRY,
-      content: resync + continuationPrompt(state.goal!),
+      content,
       display: false,
     }, { triggerTurn: true, deliverAs: "followUp" });
-    lastContinuationSentPayload = { content: resync + continuationPrompt(state.goal!), display: false }; // v0.34.88: verbatim retry payload
+    lastContinuationSentPayload = { content, display: false }; // v0.34.88: verbatim retry payload
     if (!dispatchAccepted(ctx, attempt)) return;
     continuationRearmStreak = 0; continuationRearmSince = 0; // v0.28.5 (E3): an accepted dispatch clears the storm
-    appendLedger(ctx.cwd, "goal_continuation_sent", { goalId, attemptId: attempt.id, generation: attempt.generation });
+    appendLedger(ctx.cwd, "goal_continuation_sent", { goalId, attemptId: attempt.id, generation: attempt.generation, kind, payloadChars: content.length });
     // v0.35.37 (audit finding): the welcome-back recovery notice must fire
     // EXACTLY ONCE per auto-resume. The payload above was built with the
     // notice in it; once the dispatch is ACCEPTED the message has landed in

package/extensions/goal-heartbeat.ts

@@ -202,6 +202,32 @@ const SUBAGENT_WAIT_TOOL_NAMES: ReadonlySet<string> = new Set([
 const isSubagentWaitCall = (t: { name?: string }): boolean =>
   typeof t.name === "string" && SUBAGENT_WAIT_TOOL_NAMES.has(t.name);
 
+// v0.36.1 (field: resume-after-long-decision-wait): a turn blocked INSIDE a
+// tool handler that is waiting on HUMAN input is stream-silent by design —
+// glla's own goal-toolkit verbs await Confirm/select pickers (drafting
+// confirms, decision popups, task-list review), and the structured-question
+// provider blocks in `ask_user_question` for as long as the user is away.
+// The zombie watchdog read that silence as a hung provider stream, aborted
+// the dialog mid-answer ("Operation aborted"), parked the goal, and its
+// one bounded auto-retry re-opened the SAME dialog — so the second silence
+// parked permanently. A human-input wait must stand the zombie branch down
+// exactly like a subagent wait: detection+notify territory (wedge alert),
+// never an abort.
+const USER_INPUT_WAIT_TOOL_NAMES: ReadonlySet<string> = new Set([
+  // glla goal-toolkit verbs whose handlers can await user UI:
+  "pause_goal", // decision popup (maybeDecisionPopup)
+  "propose_goal_draft", // drafting confirm + interview
+  "propose_loop_draft",
+  "propose_loop_refine",
+  "propose_task_list",
+  "list_add", // batch drafting interview
+  "list_activate", // item activation → drafting
+  // structured-question providers (the companion we test against):
+  "ask_user_question",
+]);
+export const isUserInputWaitCall = (t: { name?: string }): boolean =>
+  typeof t.name === "string" && USER_INPUT_WAIT_TOOL_NAMES.has(t.name);
+
 // ============================================================================
 // v0.35.28 (issue #16): due-wait backstop — the durable invariant that a
 // pauseKind "wait" actually resumes when its pauseResumeAt lapses.
@@ -1350,9 +1376,25 @@ function heartbeatTick(): void {
     // event has not reached the probe registry yet. Once a probe is already
     // stale, however, the same ambiguous tool name must not shield cleanup.
     const subagentWaitInFlight = healthySubagentWait || (inFlightSubagentTool && !staleSubagent);
-    if (subagentWaitInFlight) {
+    // v0.37.0: a tool blocking on HUMAN input (decision popups, drafting
+    // confirms, ask_user_question) is legitimately stream-silent for as long
+    // as the user is away — never abort it (see USER_INPUT_WAIT_TOOL_NAMES).
+    // This shield is independent of child-probe health: the parent turn is
+    // waiting on its operator, not on a subagent.
+    const userInputWaitInFlight = [...flags.inFlightToolCalls.values()].some(
+      isUserInputWaitCall,
+    );
+    if (subagentWaitInFlight || userInputWaitInFlight) {
       if (streamSilentMs >= zombieAbortMs && !flags.abortedStandDown) {
-        appendLedger(ctx.cwd, "zombie_run_stood_down_subagent_wait", { streamSilentMs });
+        appendLedger(
+          ctx.cwd,
+          subagentWaitInFlight
+            ? "zombie_run_stood_down_subagent_wait"
+            : "zombie_run_stood_down_user_input",
+          {
+            streamSilentMs,
+          },
+        );
       }
       return;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.3",
+  "version": "0.38.5",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",