pi-goal-list-loop-audit 0.38.30 → 0.38.32

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.38.32 — migrate-on-read backfill for pre-v0.38.21 audit histories (2026-09-08)
+
+### Fixed
+- Pre-v0.38.21 audit histories lack `superseded` flags, so one post-upgrade retry could argue already-settled objections as live (DECIDED 2026-09-08: migrate-on-read). `liveDisapproval` now replays the `appendAuditVerdict` scope rules over the stored array first (`backfillSupersededObjections`): a later verdict-bearing disapproval or clean approval retires older live rounds in place. Add-only (never clears a flag) and idempotent — post-v0.38.21 histories pass through untouched, and the flags ride the next normal state write to disk.
+- Regression coverage in `tests/migrate-on-read.test.ts` (5 pins: settled-by-approval, settled-by-later-disapproval, lone legacy stays live, error transparency, idempotence); existing `tests/objection-pinning.test.ts` green; `tsc` clean.
+
+## 0.38.31 — overdue wait-pause stops promising imminent resume (2026-09-08)
+
+### Fixed
+- A recovery-timer wait whose retry time passed long ago on a held/idle host no longer claims `next: resuming now` / `auto-retrying · now` forever while also reading `paused` + `safely parked` (field screenshot 20260908_180721). `resuming now` / `resuming…` / `now` are grace-bounded (90s); past that the card and status bar name the timer (`next: recovery timer`, `auto-retrying · overdue — waiting on recovery timer`, `retry overdue`).
+- Recovery-timer waits end at the auto-retry row: the stock provider-failure `pauseSuggestedAction` boilerplate and the generic `awaiting first turn` / `saved` tail are gone (owner + next are already on the rows above); the previous row closes the tree with `└─`. Decision/error/blocked pauses are unchanged.
+- Regression coverage in `tests/paused-overdue-display.test.ts` (6 pins); two v0.34-era pins that encoded the old permanent-`resuming…` wording updated to the grace contract; `tsc` clean.
+
 ## 0.38.30 — fresh audit pass: nine low-severity fixes (2026-09-08)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.30 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.32 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/goal-loop-core.ts

@@ -1054,12 +1054,46 @@ export function countTrailingDisapprovals(history: AuditVerdict[]): number {
  * signal. Infrastructure entries are transparent, but a changed contract
  * revision breaks the comparison because the auditor may now be judging new
  * work. */
+/** v0.38.32 (DECIDED 2026-09-08 migrate-on-read): replay the
+ * appendAuditVerdict scope-transition rules chronologically over a stored
+ * history, backfilling superseded/supersededBy on pre-v0.38.21 entries that
+ * a later verdict settled. Add-only (never clears a flag) and idempotent:
+ * a second run over the same array marks nothing, and replaying over
+ * post-v0.38.21 histories that live code already flagged is a no-op.
+ * Returns the count newly marked. Durability: callers mutate the live state
+ * object in place; the flags ride the next normal state write to disk, and
+ * the replay re-runs harmlessly until then. Never call this from a
+ * persistence fence — it is a read-path migration, not a write. */
+export function backfillSupersededObjections(history: AuditVerdict[]): number {
+  let n = 0;
+  for (let i = 0; i < history.length; i++) {
+    const trigger = history[i]!;
+    if (!((trigger.disapproved && !trigger.error) || (trigger.approved && !trigger.error))) continue;
+    const byRef = trigger.disapproved ? `disapproval:${trigger.at}` : `approval:${trigger.at}`;
+    for (let j = 0; j < i; j++) {
+      const older = history[j]!;
+      if (older.disapproved && !older.superseded) {
+        older.superseded = true;
+        older.supersededBy = byRef;
+        n++;
+      }
+    }
+  }
+  return n;
+}
+
 /** v0.38.21 (objection pinning): the latest still-live disapproval — the
  * objection set the next retry must argue. Superseded rounds and
  * verdictless infrastructure entries are never live. A later clean
  * approval clears the pin, so a live entry is always the newest
  * verdict-bearing disapproval. */
 export function liveDisapproval(history: AuditVerdict[]): AuditVerdict | undefined {
+  // v0.38.32: migrate-on-read — legacy entries predate the pinning flags.
+  // Backfill what later verdicts settled before selecting, so a settled
+  // objection is never argued as live again. Add-only + idempotent (see
+  // backfillSupersededObjections); post-v0.38.21 histories pass through
+  // untouched.
+  backfillSupersededObjections(history);
   for (let i = history.length - 1; i >= 0; i--) {
     const v = history[i]!;
     if (v.superseded) continue;

package/extensions/goal-loop-display.ts

@@ -1011,6 +1011,14 @@ function goalTotalText(g: Goal, now: number): string {
   return Number.isFinite(startedAt) ? `total ${fmtElapsed(bucketSilentMs(Math.max(0, now - startedAt)))}` : "";
 }
 
+/** v0.38.31 (field 2026-09-08 180721): "resuming now" is a transient
+ * truth, not a state. A wait-pause whose retry time passed an hour ago on
+ * a held/idle host is overdue — claiming an imminent resume forever while
+ * the card also says "safely parked" is the same contradiction class as
+ * f8d1c2f. Past the grace window the transition falls through to the
+ * pause-kind label ("recovery timer" for waits) instead. */
+export const PAUSED_RESUME_GRACE_MS = 90_000;
+
 function pausedNextTransition(g: Goal, state: State, now: number): string {
   const resume = g.policy === "list" ? "/list resume" : "/goal resume";
   const retryAt = state.mainModelRecovery?.retryAt ? Date.parse(state.mainModelRecovery.retryAt) : Number.NaN;
@@ -1026,7 +1034,11 @@ function pausedNextTransition(g: Goal, state: State, now: number): string {
   }
   const resumeAt = g.pauseResumeAt ? Date.parse(g.pauseResumeAt) : Number.NaN;
   if (Number.isFinite(resumeAt)) {
-    return resumeAt <= now ? "resuming now" : `auto-retry in ${fmtElapsed(resumeAt - now)}`;
+    if (resumeAt > now) return `auto-retry in ${fmtElapsed(resumeAt - now)}`;
+    // Inside the grace window the retry is genuinely imminent. Past it the
+    // timer never fired (held host, idle session) — fall through to the
+    // kind label below instead of promising "resuming now" forever.
+    if (now - resumeAt < PAUSED_RESUME_GRACE_MS) return "resuming now";
   }
   if (isCompletionAuditNoVerdict(g)) {
     const retryAt = g.pendingCompletion?.recoveryRetryAt
@@ -1207,14 +1219,16 @@ function buildStatusTextBase(state: State, audit?: AuditDisplayProgress | null,
     if (kind === "wait" || kind === "blocked") {
       // v0.34.12: live countdown (the UI ticker keeps rendering through a
       // timed wait) — "auto-retry in 23m" beats a static clock time, and a
-      // passed resumeAt says "resuming…" instead of lying about the past.
+      // freshly-passed resumeAt says "resuming…" instead of lying about the
+      // past. v0.38.31: "resuming…" shares the transition grace window — a
+      // retry time long past with no dispatch reads "retry overdue".
       // Every retry-class pause renders the same ⏳ auto-retrying… line +
       // countdown; blocked pauses without a recovery timer render as
       // ⏸ action needed. A main-model manual hold names its recovery owner.
       const rms = g.pauseResumeAt ? Date.parse(g.pauseResumeAt) - now : Number.NaN;
-      const when = Number.isFinite(rms)
-        ? rms <= 0 ? " · resuming…" : ` · auto-retry in ${fmtElapsed(rms)}`
-        : "";
+      const when = !Number.isFinite(rms) ? ""
+        : rms > 0 ? ` · auto-retry in ${fmtElapsed(rms)}`
+        : -rms >= PAUSED_RESUME_GRACE_MS ? " · retry overdue" : " · resuming…";
       if (kind === "blocked") {
         const label = state.mainModelRecovery?.manualResumeRequired === true
           ? "⏸ manual recovery hold"
@@ -1887,7 +1901,12 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
       recoverySummary.forEach((line) => lines.push(`│  ${paint(theme, "dim", line.replace(/^Main-model recovery: /, ""))}`));
     }
     else if (Number.isFinite(retryMs)) {
-      const when = retryMs <= 0 ? "now" : `next probe in ${fmtElapsed(retryMs)}`;
+      // v0.38.31: "now" shares the transition grace window — a retry time
+      // that passed long ago with no dispatch is overdue, not imminent.
+      const overdue = -retryMs >= PAUSED_RESUME_GRACE_MS;
+      const when = retryMs > 0 ? `next probe in ${fmtElapsed(retryMs)}`
+        : overdue ? "overdue — waiting on recovery timer"
+        : "now";
       lines.push(`├─ ${paint(theme, "dim", `auto-retrying · ${when}`)}`);
     } else if (kind === "blocked" && state.mainModelRecovery?.manualResumeRequired === true) {
       lines.push(`├─ ${paint(theme, "warning", "manual recovery hold — automatic probes stopped")}`);
@@ -1928,6 +1947,16 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
     // before the first turn), render "awaiting first turn" instead of "saved"
     // — the latter was misleading because no work was ever "saved" before the
     // session ended.
+    if (kind === "wait") {
+      // v0.38.31 (field 2026-09-08 180721): a recovery-timer wait carries no
+      // objective-specific tail — owner + next are already on the lifecycle /
+      // transition / auto-retry rows, and the parked suggestedAction is stock
+      // provider-failure boilerplate identical on every recovery wait. End
+      // the card here, closing the previous row as the footer.
+      const tail = lines[lines.length - 1];
+      if (tail !== undefined) lines[lines.length - 1] = tail.replace(/^├─|^│\s*/, "└─ ");
+      return lines;
+    }
     const spent: string[] = [];
     const tokUsed = g.usage?.tokensUsed ?? 0;
     const audits = g.auditHistory?.length ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.30",
+  "version": "0.38.32",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",