pi-goal-list-loop-audit 0.38.33 → 0.38.34

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.38.34 — completion communication: fair replay rotation + stale-test refresh (2026-09-08)
+
+### Fixed
+
+- **Replay starvation (review P2, real bug):** `replayUndeliveredApprovalRenders` always took the oldest five pending entries, so five persistently unconfirmed receipts pinned the head forever and a sixth pending summary was never attempted in that session. Attempted-but-still-pending entries now rotate behind the unattempted in-scope tail (stable within groups; delivered/out-of-scope untouched), so every pending render is attempted within `ceil(n/5)` contacts. No entry dropped, confirmation rules unchanged, rotation alone never acknowledges. Pinned by a six-render regression test.
+- **Five stale release-gate assertions refreshed deliberately:** the approval-chat two-detail cap is lifted (Tests + meaningful Unresolved preserved — the filler filter already keeps chat glanceable); the no-audit briefing test now configures the session file and asserts on the visible session entry instead of the removed toast; continuation-payload byte fixtures updated for the completion-communication guidance (+543 bytes/payload, growth stays exactly linear).
+
+### Verification
+
+- Full `release:check`: 2034 pass / 2 skip / 0 fail across 204 files; `tsc --noEmit` clean.
+
 ## 0.38.33 — findings.md indent convention normalized (2026-09-08)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.33 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.34 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/approval-render-store.ts

@@ -2,22 +2,8 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { appendLedger, ensureDirs, nowIso, piGlaDir, runPersistStep } from "./goal-loop-core.js";
 
-/**
- * Persisted terminal-approval renders (v0.38.25, post-objective summary).
- *
- * Field failure 2026-09-07: goal `20260907131550-12ddoy` completed with a
- * perfect six-label archive record, but the approval chat lines fired into a
- * dead context (auditor verdict landed with no live turn) — record perfect,
- * delivery silent. The archive keeps facts; this sidecar keeps the RENDER.
- *
- * Contract: every terminal approval persists its human-sees lines here at
- * archive time. Renders persisted from a live turn are marked delivered at
- * once; renders persisted while the host is idle (`ctx.isIdle()`) stay
- * undelivered until `replayUndeliveredApprovalRenders` delivers them on the
- * next live contact (any user-invoked /goal /glla /review /list /loop
- * command) and marks them delivered. Late verdicts follow the same path:
- * persist first, deliver-or-replay — never silent.
- */
+/** Durable terminal-summary outbox. A toast or a live host is not delivery:
+ * only a confirmed visible session message acknowledges a render. */
 
 export interface PendingApprovalRender {
   goalId: string;
@@ -83,24 +69,28 @@ function readRenders(cwd: string): PendingApprovalRender[] {
 function writeRenders(cwd: string, renders: PendingApprovalRender[]): boolean {
   const landed = runPersistStep("persistApprovalRender", () => {
     ensureDirs(cwd);
-    fs.writeFileSync(approvalRenderStorePath(cwd), JSON.stringify(renders, null, 2), "utf-8");
+    const file = approvalRenderStorePath(cwd);
+    const tmp = `${file}.tmp`;
+    try {
+      fs.writeFileSync(tmp, JSON.stringify(renders, null, 2), "utf-8");
+      fs.renameSync(tmp, file);
+    } finally {
+      try { fs.unlinkSync(tmp); } catch { /* renamed or write failed */ }
+    }
     return true;
   });
   return landed === true;
 }
 
-/** Persist the rendered human-sees lines at archive time. `delivered`
- * must be true only when the render went out on a provably live turn
- * (callers pass `!ctx.isIdle()`); idle-persisted renders stay queued for
- * replay. Never throws into orchestrator handlers. */
+/** Enqueue before attempting delivery. Only replay can acknowledge it. */
 export function persistApprovalRender(cwd: string, render: {
   goalId: string;
   objective: string;
   chatLines: string[];
-  delivered: boolean;
 }): boolean {
   const at = nowIso();
   const existing = readRenders(cwd);
+  if (existing.some((entry) => entry.goalId === render.goalId)) return true;
   const entry: PendingApprovalRender = {
     goalId: render.goalId,
     // v0.38.30 audit: code-point truncation (char slice split surrogate
@@ -108,38 +98,42 @@ export function persistApprovalRender(cwd: string, render: {
     objective: [...render.objective].slice(0, 300).join(""),
     chatLines: render.chatLines.slice(0, MAX_RENDER_CHAT_LINES).map((line) => [...line].slice(0, MAX_RENDER_LINE_CHARS).join("")),
     createdAt: at,
-    ...(render.delivered ? { deliveredAt: at } : {}),
   };
   // The cap trims DELIVERED history only: undelivered renders are never
   // dropped (each is ~1KB and any user command replays them, so the
   // undelivered tail is self-draining in practice).
   const undelivered = existing.filter((e) => !e.deliveredAt);
-  const delivered = [...existing.filter((e) => e.deliveredAt), ...(render.delivered ? [entry] : [])];
-  const deliveredBudget = Math.max(0, MAX_STORED_RENDERS - undelivered.length - (render.delivered ? 0 : 1));
-  const next = [...undelivered, ...(render.delivered ? [] : [entry]), ...delivered.slice(-deliveredBudget)];
+  const delivered = existing.filter((e) => e.deliveredAt);
+  const deliveredBudget = Math.max(0, MAX_STORED_RENDERS - undelivered.length - 1);
+  const next = [...undelivered, entry, ...(deliveredBudget > 0 ? delivered.slice(-deliveredBudget) : [])];
   if (!writeRenders(cwd, next)) return false;
   appendLedger(cwd, "terminal_approval_render_persisted", {
     goalId: render.goalId,
-    delivered: render.delivered,
+    delivered: false,
     lines: render.chatLines.length,
   });
   return true;
 }
 
-/** Deliver every undelivered render on a live contact, oldest first,
- * fire-once fenced via deliveredAt. Callers are user-invoked command
- * handlers — live by construction. Returns the replayed count; never
- * throws. */
-export function replayUndeliveredApprovalRenders(ctx: { cwd: string; ui: { notify: (message: string, type?: "info" | "warning" | "error") => void } }): number {
+/** Replay oldest first through the ownership-fenced sender, with bounded
+ * fair rotation. A queued, refused, or unconfirmed send stays pending.
+ * Session identity deduplicates retries even when writing deliveredAt
+ * fails after the message landed. */
+export function replayUndeliveredApprovalRenders(
+  ctx: { cwd: string },
+  deliver: (entry: PendingApprovalRender) => boolean = () => false,
+  onlyGoalId?: string,
+): number {
   const renders = readRenders(ctx.cwd);
   if (renders.length === 0) return 0;
-  const pending = renders.filter((e) => !e.deliveredAt).slice(0, MAX_REPLAY_PER_CONTACT);
+  const inScope = (e: PendingApprovalRender) => !e.deliveredAt && (!onlyGoalId || e.goalId === onlyGoalId);
+  const pending = renders.filter(inScope).slice(0, MAX_REPLAY_PER_CONTACT);
   if (pending.length === 0) return 0;
   const at = nowIso();
   let replayed = 0;
   for (const entry of pending) {
     try {
-      ctx.ui.notify(entry.chatLines.join("\n"), "info");
+      if (!deliver(entry)) continue;
       entry.deliveredAt = at;
       replayed += 1;
       appendLedger(ctx.cwd, "terminal_approval_render_replayed", {
@@ -152,22 +146,27 @@ export function replayUndeliveredApprovalRenders(ctx: { cwd: string; ui: { notif
       break;
     }
   }
-  if (replayed > 0) writeRenders(ctx.cwd, renders);
-  return replayed;
-}
-
-/** Liveness probe for delivery marking. Unknown/throwing ⇒ idle ⇒
- * undelivered ⇒ replayed on the next live contact. The safe direction is
- * never-silent: a duplicate render on the next command beats a lost one. */
-export function isApprovalContextIdle(ctx: { isIdle?: () => boolean }): boolean {
-  try {
-    return ctx.isIdle?.() ?? true;
-  } catch {
-    return true;
+  // Fair rotation: the window above always takes the oldest pending
+  // entries, so persistently unconfirmed receipts used to pin the head
+  // forever and a later render was never attempted in that session.
+  // Attempted-but-still-pending entries rotate behind the unattempted
+  // in-scope tail — stable within each group, delivered and out-of-scope
+  // entries untouched — so every pending render is attempted within
+  // ceil(n/MAX_REPLAY_PER_CONTACT) contacts. No entry is dropped and the
+  // confirmation rules are unchanged; rotation alone never acknowledges.
+  const stalled = pending.filter((e) => !e.deliveredAt);
+  let rotated = false;
+  if (stalled.length > 0 && renders.filter(inScope).length > pending.length) {
+    const moved = new Set(stalled);
+    const rest = renders.filter((e) => !moved.has(e));
+    let insertAt = rest.length;
+    rest.forEach((e, i) => { if (inScope(e)) insertAt = i + 1; });
+    rest.splice(insertAt, 0, ...stalled);
+    renders.length = 0;
+    renders.push(...rest);
+    rotated = true;
   }
+  if (replayed > 0 || rotated) writeRenders(ctx.cwd, renders);
+  return replayed;
 }
 
-/** Test-only reset for store isolation. */
-export function __testOnlyResetApprovalRenderStore(): void {
-  // No module-level cache — isolation is via cwd-scoped files.
-}

package/extensions/completion-summary.ts

@@ -169,7 +169,7 @@ export function withoutStaleNext(details: string[] | undefined): string[] {
   return (details ?? []).filter((d) => !/^\s*Next\s*:/i.test(d));
 }
 
-/** v0.38.20: the approval chat notify — outcome first, at most two
+/** v0.38.20: the approval chat notify — outcome first, all bounded
  * informing details (the full record lives in the archive and the
  * transcript notice), then the approval trailer and the record pointer.
  * Five 120-char label lines scan as soup, not a summary (field
@@ -185,7 +185,7 @@ export function buildApprovalChatLines(notice: {
 }): string[] {
   return [
     `✓ done — ${notice.outcome}`,
-    ...withoutStaleNext(notice.details).slice(0, 2),
+    ...withoutStaleNext(notice.details),
     notice.approval,
     ...(notice.counts ? [notice.counts] : []),
     notice.record,
@@ -231,7 +231,7 @@ export interface TerminalApprovalRenderInput {
 }
 
 export interface TerminalApprovalRender {
-  /** The human-sees chat lines: outcome + ≤2 details + approval + counts + record (+ extras). */
+  /** The human-sees chat lines: outcome + bounded details + approval + counts + record (+ extras). */
   chatLines: string[];
   /** Compact single line for external notifies (pager/sound safe). */
   recap: string;

package/extensions/goal-continuation.ts

@@ -25,6 +25,7 @@
 //     send_rearm_*, queue_stuck_detected, ...).
 // ============================================================================
 
+import { deliverTerminalSummary } from "./terminal-summary-delivery.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
@@ -1144,22 +1145,17 @@ export interface TerminalCompletionNotice {
   goalId: string;
   outcome: string;
   details: string[];
+  /** Canonical visible summary, including record and concrete evidence. */
+  chatLines?: string[];
   /** Audit 2026-09-06: the session generation that produced the verdict.
    * A stale generation (verdict applied after handoff/reload) must not
    * fire a `✓ done` turn into the successor session's unrelated work. */
   generation?: number;
 }
 
-/** v0.38.18 (track 3: junk-runner stale waiting-verdict): the detached
- * verifier settles asynchronously — the transcript's last word is "the
- * verdict will be applied asynchronously", and a toast is the only
- * closure. A later "how are we looking" then truthfully re-reports the
- * stale transcript as still-waiting even though the goal is archived.
- * This delivers the `✓ done` brief INTO the conversation as a followUp
- * turn so the transcript records the completion. Goal-null-safe (the goal
- * is already archived when this fires), fire-once per goal via a durable
- * ledger fence, and fenced like every other automatic send. Returns true
- * when the notice was dispatched. */
+/** Deliver a visible, contextual summary without starting an acknowledgement
+ * turn. Confirm the custom session entry, not the void sendMessage return.
+ * The outbox owns retries; session entries fence duplicate delivery. */
 export function sendTerminalCompletionNotice(ctx: ExtensionContext, notice: TerminalCompletionNotice): boolean {
   if (supervisorPaused(state)) return false;
   if (mainModelRecoveryActive()) return false;
@@ -1184,27 +1180,12 @@ export function sendTerminalCompletionNotice(ctx: ExtensionContext, notice: Term
     });
     return false;
   }
-  try {
-    const already = readLedgerTail(ctx.cwd, 400, (entry) =>
-      entry.type === "terminal_completion_notice_sent" &&
-      typeof (entry.value as { goalId?: unknown } | null)?.goalId === "string" &&
-      (entry.value as { goalId: string }).goalId === notice.goalId,
-    );
-    if (already.length > 0) return false;
-  } catch {
-    return false;
-  }
-  const content = [
+  const content = (notice.chatLines ?? [
     `✓ done — ${notice.outcome}`,
     ...notice.details,
-    "— goal archived; nothing further is owed. Acknowledge briefly; start follow-up work only if asked.",
-  ].join("\n");
+  ]).join("\n");
   try {
-    flags.extensionApi.sendMessage({
-      customType: GOAL_EVENT_ENTRY,
-      content,
-      display: false,
-    }, { triggerTurn: true, deliverAs: "followUp" });
+    if (!deliverTerminalSummary(ctx, flags.extensionApi, GOAL_EVENT_ENTRY, notice.goalId, content)) return false;
   } catch {
     appendLedger(ctx.cwd, "terminal_completion_notice_unsent", { goalId: notice.goalId });
     return false;

package/extensions/loops/goal-activation.ts

@@ -171,6 +171,7 @@ import {
   setContinuationRearmSince,
   resetContinuationDispatchState,
   noteUserMessageForDispatch,
+  sendTerminalCompletionNotice,
   type ContinuationFlags,
   type ContinuationDeps,
 } from "../goal-continuation.js";
@@ -735,6 +736,14 @@ export function __testOnlyClassifyStaleContinuation(content: string, cwd: string
   return null;
 }
 
+/** Commands and lifecycle contacts share the same ownership and delivery gates. */
+function replayApprovalSummariesOnContact(ctx: ExtensionContext): void {
+  if (shouldSkipApprovalRenderReplay(ctx)) return;
+  replayUndeliveredApprovalRenders(ctx, (entry) => sendTerminalCompletionNotice(ctx, {
+    goalId: entry.goalId, outcome: entry.objective, details: [], chatLines: entry.chatLines,
+  }));
+}
+
 export function registerGoalRuntime(pi: ExtensionAPI): void {
   // Factories run before lifecycle events, so observe readiness now; the
   // admitted session_start below decides which bus/generation may control a
@@ -785,7 +794,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       // v0.38.30 audit: skip on stale/worker handles — the wrappers run
       // before the inner stale fence, and a superseded session used to mark
       // delivery into a dead session (stale-allowed /loop status included).
-      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
+      replayApprovalSummariesOnContact(ctx);
       return cmdGoal(args, ctx);
     },
   });
@@ -795,7 +804,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // v0.38.25: live contact — replay any approval render that landed
     // with no live turn (persist-first, never silent).
     // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
-    if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
+    replayApprovalSummariesOnContact(ctx);
     return cmdSettings(args, ctx);
   };
   pi.registerCommand("glla", {
@@ -827,7 +836,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
       // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
-      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
+      replayApprovalSummariesOnContact(ctx);
       return cmdReview(args, ctx);
     },
   });
@@ -857,7 +866,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
       // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
-      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
+      replayApprovalSummariesOnContact(ctx);
       return cmdList(args, ctx);
     },
   });
@@ -883,7 +892,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       // v0.38.25: live contact — replay any approval render that landed
       // with no live turn (persist-first, never silent).
       // v0.38.30 audit: skip on stale/worker handles (see /goal wrapper).
-      if (!shouldSkipApprovalRenderReplay(ctx)) replayUndeliveredApprovalRenders(ctx);
+      replayApprovalSummariesOnContact(ctx);
       return cmdLoop(args, ctx);
     },
   });
@@ -1988,6 +1997,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
       appendLedger(ctx.cwd, "load_hold_released", { via: "consenting-reload" });
     }
     refreshUI(ctx, true);
+    replayApprovalSummariesOnContact(ctx);
   });
 
   pi.on("agent_end", async (event: any, ctx: ExtensionContext) => {
@@ -2551,6 +2561,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
   pi.on("agent_settled", async (_event: any, ctx: ExtensionContext) => {
     if (tryAbsorbHostSuccessor(ctx, "agent_settled")) return;
     if (sessionHandoffPending || extensionApiStale || staleTerminalDone || zombieStoodDown || isForeignCtx(ctx)) return;
+    replayApprovalSummariesOnContact(ctx);
     if (!state.mainModelRecovery || state.mainModelRecovery.retryAt || !lastMainModelFailure) return;
     if (!isSupervising()) return;
     lastMainModelFailure = null;

package/extensions/loops/goal-auditor-hooks.ts

@@ -243,7 +243,7 @@ import {
 } from "../goal-loop-repetition.js";
 import { buildStatusText, buildWidgetLines, type AuditDisplayProgress } from "../goal-loop-display.js";
 import { buildTerminalApprovalRender, compactCompletionSummary, isGenericCompletionSummary, missingCompletionSummaryLabels } from "../completion-summary.js";
-import { isApprovalContextIdle, persistApprovalRender } from "../approval-render-store.js";
+import { persistApprovalRender, replayUndeliveredApprovalRenders } from "../approval-render-store.js";
 import {
   defaultAgentDir,
   resolveEffectiveSubagentModel,
@@ -1459,38 +1459,23 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provi
       appendLedger(liveCtx.cwd, "goal_archive_failed_after_approval", { goalId, attemptId: claim.attemptId, origin });
       return;
     }
-    // v0.38.14: the chat notify is the human briefing — outcome first,
-    // filler labels dropped — while the external notify keeps the compact
-    // single line (pager/sound safe). v0.38.20: outcome + at most two
-    // details + approval + record pointer; the agent's pre-verdict `Next:`
-    // is stale the moment the verdict lands and never reaches the chat.
-    // PR #43: live inspection — the auditor's pi persisted a resumable
-    // session pinned inside the job dir. Point the user at it AFTER the
-    // audit (interactive attach only now; while running it was read-only).
-    liveCtx.ui.notify(approvalRender.chatLines.join("\n"), "info");
-    notifyExternal(liveCtx, `Goal complete (auditor approved, ${origin}): ${approvalRender.recap}`);
-    persistApprovalRender(liveCtx.cwd, {
+    const persisted = persistApprovalRender(liveCtx.cwd, {
       goalId,
       objective: approvalObjective,
       chatLines: approvalRender.chatLines,
-      delivered: !isApprovalContextIdle(liveCtx),
     });
-    // v0.38.18 (track 3): the toast above is ephemeral — without a
-    // transcript entry the session keeps narrating "waiting on the
-    // auditor's verdict" after the archive (junk-runner field). Deliver
-    // the brief into the conversation. Skipped for manual /goal verify:
-    // that runs inside a turn whose command output already closes the
-    // transcript. Fire-once fenced inside the sender.
-    if (origin !== "manual") {
-      sendTerminalCompletionNotice(liveCtx, {
-        goalId,
+    if (persisted) {
+      replayUndeliveredApprovalRenders(liveCtx, (entry) => sendTerminalCompletionNotice(liveCtx, {
+        goalId: entry.goalId,
         generation,
-        outcome: approvalRender.outcome,
-        // v0.38.20: the transcript keeps the informing details, but the
-        // stale pre-verdict `Next:` is stripped here too.
-        details: approvalRender.transcriptLines,
-      });
+        outcome: entry.objective,
+        details: [],
+        chatLines: entry.chatLines,
+      }), goalId);
+    } else {
+      liveCtx.ui.notify("Goal archived, but its chat summary could not be persisted. Review the archived completion summary.", "warning");
     }
+    notifyExternal(liveCtx, `Goal complete (auditor approved, ${origin}): ${approvalRender.recap}`);
     return;
   }
 

package/extensions/loops/goal-tools.ts

@@ -18,6 +18,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 
+import { sendTerminalCompletionNotice } from "../goal-continuation.js";
 import { defineTool, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
@@ -254,7 +255,7 @@ import {
 } from "../goal-loop-repetition.js";
 import { buildStatusText, buildWidgetLines, type AuditDisplayProgress } from "../goal-loop-display.js";
 import { buildTerminalApprovalRender, compactCompletionSummary, compactTerminalCompletionSummary } from "../completion-summary.js";
-import { isApprovalContextIdle, persistApprovalRender } from "../approval-render-store.js";
+import { persistApprovalRender, replayUndeliveredApprovalRenders } from "../approval-render-store.js";
 import {
   defaultAgentDir,
   resolveEffectiveSubagentModel,
@@ -493,7 +494,8 @@ function registerAgentTools(pi: any): void {
   pi.registerTool(defineTool({
     name: "complete_goal",
     label: "Complete goal",
-    description: "Mark the active goal as complete. Queues a detached auditor worker to verify without holding the main pi turn. Use only when the objective is genuinely satisfied.",
+    description: "Submit a completion claim for detached audit; this does NOT complete or approve the goal. Use only when the objective is genuinely satisfied. Return without waiting for the auditor; GLLA delivers the final user summary after verified approval and durable archive.",
+    promptGuidelines: ["complete_goal queues a nonterminal claim. Do not say done, complete, approved, or accepted as a completion verdict while audit is pending. Do not poll or wait; if needed give only a brief pending status. GLLA posts the final outcome summary after approval; do not duplicate it."],
     parameters: Type.Object({
       // v0.34.136: completionSummary adopts the six-label recap from
       // audit/COMPLETION-SUMMARY-POLICY-2026-08-19.md (Outcome / Changed
@@ -1241,14 +1243,17 @@ function registerAgentTools(pi: any): void {
           // `Next:` stripped); the chat notify is outcome + approval +
           // record pointer like every other approval path.
           const briefBlock = escRender.transcriptLines.join("\n");
-          ctx.ui.notify(escRender.chatLines.join("\n"), "info");
+
           notifyExternal(ctx, `Goal complete without audit (user choice): ${escRender.recap}`);
-          persistApprovalRender(ctx.cwd, {
+          const persisted = persistApprovalRender(ctx.cwd, {
             goalId: terminalGoal.id,
             objective: terminalGoal.objective,
             chatLines: escRender.chatLines,
-            delivered: !isApprovalContextIdle(ctx),
           });
+          if (persisted) replayUndeliveredApprovalRenders(ctx, (entry) => sendTerminalCompletionNotice(ctx, {
+            goalId: entry.goalId, outcome: entry.objective, details: [], chatLines: entry.chatLines,
+          }), terminalGoal.id);
+          else ctx.ui.notify("Goal archived, but its chat summary could not be persisted. Review the archived completion summary.", "warning");
           return { content: [{ type: "text", text: `Goal marked complete without audit (user choice).\n\n${briefBlock}` }], details: {} };
         }
         scheduleContinuation(ctx, true);
@@ -1305,14 +1310,17 @@ function registerAgentTools(pi: any): void {
         // v0.38.20: same approval voice as the detached path — the stale
         // pre-verdict `Next:` never reaches the chat.
         // PR #43: append the kept inspection-session pointer when present.
-        ctx.ui.notify(manualRender.chatLines.join("\n"), "info");
+
         notifyExternal(ctx, `Goal complete (auditor approved): ${manualRender.recap}`);
-        persistApprovalRender(ctx.cwd, {
+        const persisted = persistApprovalRender(ctx.cwd, {
           goalId: manualGoalId,
           objective: manualObjective,
           chatLines: manualRender.chatLines,
-          delivered: !isApprovalContextIdle(ctx),
         });
+        if (persisted) replayUndeliveredApprovalRenders(ctx, (entry) => sendTerminalCompletionNotice(ctx, {
+          goalId: entry.goalId, outcome: entry.objective, details: [], chatLines: entry.chatLines,
+        }), manualGoalId);
+        else ctx.ui.notify("Goal archived, but its chat summary could not be persisted. Review the archived completion summary.", "warning");
         return { content: [{ type: "text", text: `Goal approved by auditor ${result.model}.` }], details: {} };
       }
 
@@ -1868,8 +1876,10 @@ function registerAgentTools(pi: any): void {
         if (notifyFailure) current.ui.notify(`Completion auditor worker failed to settle (infrastructure, not a verdict). The stored claim is safe; ${activeGoalSurfaceCommand("resume")} retries it.`, "warning");
       });
       return {
-        content: [{ type: "text", text: `Completion claim persisted; detached auditor queued (model: ${via ?? "setting"}). The verdict will be applied asynchronously.` }],
-        details: {},
+        content: [{ type: "text", text: `AUDIT PENDING — nonterminal. Completion claim persisted; detached auditor queued (model: ${via ?? "setting"}). The goal is not approved or complete. Do not claim completion or give a final success summary. Do not wait or poll: GLLA will post the concrete final summary after verified approval and durable archive; rejection resumes work.` }],
+        details: { status: "audit-pending", terminal: false },
+        // End this tool batch, not the goal; the detached worker owns settlement.
+        terminate: true,
       };
     },
   }));

package/extensions/terminal-summary-delivery.ts

@@ -0,0 +1,54 @@
+import * as fs from "node:fs";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+/** Pi can mutate the branch before a session write fails, and sendMessage's
+ * void API is not a persistence acknowledgement. Read only the bounded tail
+ * on delivery/replay; never mutate the host session or poll for a receipt. */
+function persistedEntry(sessionFile: string | undefined, expected: { id: string; customType: string; content: unknown; details?: unknown }): boolean {
+  if (!sessionFile) return false;
+  let fd: number | undefined;
+  try {
+    fd = fs.openSync(sessionFile, "r");
+    const size = fs.fstatSync(fd).size;
+    const start = Math.max(0, size - 256 * 1024);
+    const buffer = Buffer.alloc(size - start);
+    fs.readSync(fd, buffer, 0, buffer.length, start);
+    const lines = buffer.toString("utf8").split("\n");
+    if (start > 0) lines.shift();
+    // A partial trailing JSONL record is not a durable receipt.
+    lines.pop();
+    return lines.some((line) => {
+      try {
+        const entry = JSON.parse(line);
+        return entry.type === "custom_message" && entry.id === expected.id &&
+          entry.customType === expected.customType && entry.display === true &&
+          entry.content === expected.content &&
+          entry.details?.terminalApprovalGoalId === (expected.details as { terminalApprovalGoalId?: string })?.terminalApprovalGoalId;
+      } catch { return false; }
+    });
+  } catch { return false; }
+  finally { if (fd !== undefined) fs.closeSync(fd); }
+}
+
+/** True means a visible contextual summary is persisted, not that a human
+ * has read it. An unpersisted branch entry suppresses same-session duplicates
+ * but leaves the durable outbox pending for recovery in a fresh session. */
+export function deliverTerminalSummary(
+  ctx: Pick<ExtensionContext, "sessionManager">,
+  pi: Pick<ExtensionAPI, "sendMessage">,
+  customType: string,
+  goalId: string,
+  content: string,
+): boolean {
+  const find = () => ctx.sessionManager.getBranch().find((entry) =>
+    entry.type === "custom_message" && entry.customType === customType && entry.display === true &&
+    (entry.details as { terminalApprovalGoalId?: string } | undefined)?.terminalApprovalGoalId === goalId &&
+    entry.content === content,
+  );
+  let entry = find();
+  if (!entry) {
+    pi.sendMessage({ customType, content, display: true, details: { terminalApprovalGoalId: goalId } }, { triggerTurn: false });
+    entry = find();
+  }
+  return entry?.type === "custom_message" && persistedEntry(ctx.sessionManager.getSessionFile(), entry);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.33",
+  "version": "0.38.34",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",

package/prompts/goal-loop-continuation.md

@@ -192,3 +192,7 @@ When the user must CHOOSE between paths, use `pause_goal` with `kind="decision"`
 ## STALLS
 
 The orchestrator's backstop is the stall watchdog: three consecutive turns with no tool calls pause the goal. You get an explicit `[STALL WARNING n/3]` continuation first — act on it immediately (complete_goal if done, pause_goal if blocked, a real tool call otherwise); the warning tells you exactly how many unproductive turns remain. If you feel yourself spinning — repeating the same approach, no new evidence — stop early instead: call `pause_goal` with what is blocking and a concrete suggested action, rather than burning the remaining watchdog turns.
+
+### Completion communication
+
+`complete_goal` submits a nonterminal claim, not a completion verdict. While the detached audit is pending, do not say the goal is done/complete/approved or present a final success summary. Do not wait or poll. If a response is needed, give one brief pending-status sentence. GLLA posts the concrete outcome-first summary into chat after verified approval and durable archive, without needing another user prompt. Do not duplicate that summary. A rejected claim remains unfinished and repair work continues.