pi-goal-list-loop-audit 0.38.31 → 0.38.32

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.38.32 — migrate-on-read backfill for pre-v0.38.21 audit histories (2026-09-08)
+
+### Fixed
+- Pre-v0.38.21 audit histories lack `superseded` flags, so one post-upgrade retry could argue already-settled objections as live (DECIDED 2026-09-08: migrate-on-read). `liveDisapproval` now replays the `appendAuditVerdict` scope rules over the stored array first (`backfillSupersededObjections`): a later verdict-bearing disapproval or clean approval retires older live rounds in place. Add-only (never clears a flag) and idempotent — post-v0.38.21 histories pass through untouched, and the flags ride the next normal state write to disk.
+- Regression coverage in `tests/migrate-on-read.test.ts` (5 pins: settled-by-approval, settled-by-later-disapproval, lone legacy stays live, error transparency, idempotence); existing `tests/objection-pinning.test.ts` green; `tsc` clean.
+
 ## 0.38.31 — overdue wait-pause stops promising imminent resume (2026-09-08)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.31 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.32 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/goal-loop-core.ts

@@ -1054,12 +1054,46 @@ export function countTrailingDisapprovals(history: AuditVerdict[]): number {
  * signal. Infrastructure entries are transparent, but a changed contract
  * revision breaks the comparison because the auditor may now be judging new
  * work. */
+/** v0.38.32 (DECIDED 2026-09-08 migrate-on-read): replay the
+ * appendAuditVerdict scope-transition rules chronologically over a stored
+ * history, backfilling superseded/supersededBy on pre-v0.38.21 entries that
+ * a later verdict settled. Add-only (never clears a flag) and idempotent:
+ * a second run over the same array marks nothing, and replaying over
+ * post-v0.38.21 histories that live code already flagged is a no-op.
+ * Returns the count newly marked. Durability: callers mutate the live state
+ * object in place; the flags ride the next normal state write to disk, and
+ * the replay re-runs harmlessly until then. Never call this from a
+ * persistence fence — it is a read-path migration, not a write. */
+export function backfillSupersededObjections(history: AuditVerdict[]): number {
+  let n = 0;
+  for (let i = 0; i < history.length; i++) {
+    const trigger = history[i]!;
+    if (!((trigger.disapproved && !trigger.error) || (trigger.approved && !trigger.error))) continue;
+    const byRef = trigger.disapproved ? `disapproval:${trigger.at}` : `approval:${trigger.at}`;
+    for (let j = 0; j < i; j++) {
+      const older = history[j]!;
+      if (older.disapproved && !older.superseded) {
+        older.superseded = true;
+        older.supersededBy = byRef;
+        n++;
+      }
+    }
+  }
+  return n;
+}
+
 /** v0.38.21 (objection pinning): the latest still-live disapproval — the
  * objection set the next retry must argue. Superseded rounds and
  * verdictless infrastructure entries are never live. A later clean
  * approval clears the pin, so a live entry is always the newest
  * verdict-bearing disapproval. */
 export function liveDisapproval(history: AuditVerdict[]): AuditVerdict | undefined {
+  // v0.38.32: migrate-on-read — legacy entries predate the pinning flags.
+  // Backfill what later verdicts settled before selecting, so a settled
+  // objection is never argued as live again. Add-only + idempotent (see
+  // backfillSupersededObjections); post-v0.38.21 histories pass through
+  // untouched.
+  backfillSupersededObjections(history);
   for (let i = history.length - 1; i >= 0; i--) {
     const v = history[i]!;
     if (v.superseded) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.31",
+  "version": "0.38.32",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",