pi-goal-list-loop-audit 0.38.44 → 0.38.45

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.38.45 — full-project audit pass: 16 fixes across version, summary, and approval paths (2026-09-10)
+
+### Fixed
+
+- **Update-check spawn hardening (HIGH):** `refreshUpdateCheck` now subscribes to async `error` (a missing/broken npm crashed the host unhandled), detaches via `unref`, ignores stderr/stdin, and caches only version-shaped stdout tokens — registry noise can no longer poison the sidecar.
+- **`/glla version` honesty (HIGH):** no staleness claim when the running version is unreadable (previously printed a false "up to date"); both surfaces share one strict sidecar reader so the status tail and the command cannot disagree.
+- **Recorded-facts Next survives (HIGH):** `withoutStaleNext` exempts the concrete "review the durable record at …" fallback Next that the `/review/i` clause ate, leaving fallback approval chats actionless.
+- **No per-contact spawn storm:** the TTL skip uses the raw sidecar read, so a future-dated cache (clock skew) suppresses the spawn instead of causing one per command contact.
+- **Approval re-render after delivery:** delivered history dedups exact duplicates only (repeated settlements never double-notify); a genuine re-approval with new verdict lines queues fresh — content, not goalId, decides.
+- **SessionDir-aware sidecar path:** `updateCheckPath` resolves via `resolveGllaStateDir` instead of hardcoding `cwd/.pi-glla`.
+- **String-safety:** `clipSummaryValue` is code-point-safe (no more split surrogate pairs); `chatSafeDetailValue` converges nested machine-path groups to a fixpoint; label segmentation uses last-occurrence search so a label named inside a value no longer steals later segments.
+- **Verdict tally uses its clock:** `auditorVerdictTally(now)` suppresses future `lastAt` instead of printing "0s ago"; dead `void now` and dead `readUpdateCheck` import removed; `recovery-resume.json` documented as a reserved hook with no current producer.
+- **Pins:** spawn-error swallow, token validation, future-cache skip, prerelease compare, unknown-version silence, recorded-facts survival, nested-husk convergence, surrogate safety, last-restatement-wins, delivery-then-reapproval, paused-branch tail, future-verdict silence.
+
 ## 0.38.44 — stale-version surfacing: running version in the status line (2026-09-10)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.44 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.45 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/approval-render-store.ts

@@ -90,13 +90,28 @@ export function persistApprovalRender(cwd: string, render: {
 }): boolean {
   const at = nowIso();
   const existing = readRenders(cwd);
-  if (existing.some((entry) => entry.goalId === render.goalId)) return true;
+  // v0.38.30 truncation (also code-point-safe): compare what WOULD be
+  // stored, so an identical re-persist of long lines still dedups.
+  const incomingLines = render.chatLines.slice(0, MAX_RENDER_CHAT_LINES)
+    .map((line) => [...line].slice(0, MAX_RENDER_LINE_CHARS).join(""));
+  // Dedup has two layers. (1) An UNDELIVERED entry for the goal means a
+  // render is already queued — a second persist before delivery changes
+  // nothing. (2) v0.38.45 audit: delivered history dedups only EXACT
+  // duplicates (a repeated settlement re-persisting identical lines must
+  // not double-notify) — but a re-approval carries new verdict lines, and
+  // dropping those silently hid an archive-failure retry's chat summary
+  // while the caller believed it queued. Content, not goalId, decides.
+  if (existing.some((entry) => !entry.deliveredAt && entry.goalId === render.goalId)) return true;
+  const sameLines = (a: string[], b: string[]): boolean =>
+    a.length === b.length && a.every((line, i) => line === b[i]);
+  if (existing.some((entry) =>
+    entry.deliveredAt && entry.goalId === render.goalId && sameLines(entry.chatLines, incomingLines))) return true;
   const entry: PendingApprovalRender = {
     goalId: render.goalId,
     // v0.38.30 audit: code-point truncation (char slice split surrogate
     // pairs) + bounded chat lines (the 20-entry cap never bound bytes).
     objective: [...render.objective].slice(0, 300).join(""),
-    chatLines: render.chatLines.slice(0, MAX_RENDER_CHAT_LINES).map((line) => [...line].slice(0, MAX_RENDER_LINE_CHARS).join("")),
+    chatLines: incomingLines,
     createdAt: at,
   };
   // The cap trims DELIVERED history only: undelivered renders are never

package/extensions/completion-summary.ts

@@ -90,32 +90,53 @@ export function isUsefulCompletionSummary(text: string | undefined): boolean {
 export function clipSummaryValue(value: string, limit: number): string {
   const clean = value.replace(/\s+/g, " ").trim();
   const capped = Number.isFinite(limit) ? Math.max(8, Math.floor(limit)) : 72;
-  if (clean.length <= capped) return clean;
-  const head = clean.slice(0, capped - 1);
+  // v0.38.45 audit: code-point-safe — UTF-16 slice split surrogate pairs.
+  const units = [...clean];
+  if (units.length <= capped) return clean;
+  const headUnits = units.slice(0, capped - 1);
+  const head = headUnits.join("");
   const floor = Math.max(16, Math.floor((capped - 1) * 0.4));
   let boundary = -1;
-  for (let i = 0; i < head.length; i++) {
-    if (/[,;:·—–(+[\[]/.test(head[i]!)) boundary = i;
-  }
+  headUnits.forEach((unit, i) => {
+    if (/[,;:·—–(+[\[]/u.test(unit)) boundary = i;
+  });
   if (boundary >= floor) {
-    const cut = head.slice(0, boundary).replace(/[,;:·—–(+[\[\s]+$/u, "");
-    if (cut.length >= Math.min(floor, 16)) return `${cut}…`;
+    const cut = headUnits.slice(0, boundary).join("").replace(/[,;:·—–(+[\[\s]+$/u, "");
+    if ([...cut].length >= Math.min(floor, 16)) return `${cut}…`;
   }
-  const space = head.lastIndexOf(" ");
-  const kept = (space > capped / 2 ? head.slice(0, space) : head)
+  let space = -1;
+  headUnits.forEach((unit, i) => {
+    if (unit === " ") space = i;
+  });
+  const kept = (space > capped / 2 ? headUnits.slice(0, space).join("") : head)
     .trimEnd()
     .replace(/[,;:·—–(+\[]$/u, "");
   return `${kept}…`;
 }
 
+/** v0.38.45 audit: LAST-occurrence label search — first-occurrence
+ * indexOf let a label named inside an earlier label's VALUE steal the
+ * segmentation of every later label ("Outcome: see Tests: x. Tests: y"
+ * read Outcome as "see"). The last restatement wins, which also favors
+ * the final wording when an agent echoes the skeleton twice. Residual
+ * ambiguity (a single skeleton whose value names a later label once)
+ * is accepted: values keep their text, only the boundary moves. */
+function labelPositions(lower: string): Array<{ label: string; start: number }> {
+  const positions: Array<{ label: string; start: number }> = [];
+  for (const label of COMPLETION_SUMMARY_LABELS) {
+    const start = lower.lastIndexOf(label.toLowerCase());
+    if (start < 0) continue;
+    positions.push({ label, start });
+  }
+  return positions;
+}
+
 export function compactCompletionSummary(text: string | undefined, maxValueLength = 72): string {
   const source = completionSummaryBody(text ?? "").replace(/\s+/g, " ").trim();
   if (!source) return "not recorded";
   const lower = source.toLowerCase();
   const limit = Number.isFinite(maxValueLength) ? Math.max(8, Math.floor(maxValueLength)) : 72;
-  const positions = COMPLETION_SUMMARY_LABELS
-    .map((label) => ({ label, start: lower.indexOf(label.toLowerCase()) }))
-    .filter((entry) => entry.start >= 0);
+  const positions = labelPositions(lower);
   const parts = COMPLETION_SUMMARY_LABELS.map((label) => {
     const current = positions.find((entry) => entry.label === label);
     const name = label.slice(0, -1);
@@ -159,7 +180,11 @@ export interface HumanCompletionBrief {
  * the durable archive keeps the full text. Falls back to the original
  * when stripping would empty the value. */
 export function chatSafeDetailValue(value: string): string {
-  const withoutGroups = value.replace(/\([^()]*\)/g, (group) => {
+  // v0.38.45 audit: loop the innermost-group strip to a fixpoint
+  // (bounded) — a single pass left nested husks like "(log )" behind.
+  let withoutGroups = value;
+  for (let pass = 0; pass < 5; pass++) {
+    const next = withoutGroups.replace(/\([^()]*\)/g, (group) => {
     // A parenthesized group that carries nothing but stripped tokens and
     // receipt words is machine packaging — drop the whole group so no
     // `( tarball )` husk survives. Groups with real words stay verbatim.
@@ -169,7 +194,10 @@ export function chatSafeDetailValue(value: string): string {
       .replace(/\S+\.tgz\b/g, "")
       .replace(/\btarballs?\b|\blogs?\b/gi, "");
     return /[a-z]/i.test(inner) ? group : "";
-  });
+    });
+    if (next === withoutGroups) break;
+    withoutGroups = next;
+  }
   const stripped = withoutGroups
     .replace(/(?:\/var)?\/tmp\/\S+/g, "")
     .replace(/\btarballs?\s+\S+\.tgz\b/gi, "")
@@ -215,6 +243,10 @@ export function humanCompletionBrief(
  * approval`, …) still drop, but the first concrete action survives as
  * the closing bullet. The full six-label record stays in the archive. */
 const STALE_NEXT_PATTERN = /auditor|verdict|approv|audit|settl|review/i;
+/** The recorded-facts fallback Next is concrete (`review the durable
+ * record at …`) and must survive the stale-Next filter (v0.38.45 audit:
+ * /review/i ate it, leaving fallback approval chats with no next action). */
+const RECORDED_FACTS_NEXT_PATTERN = /review the durable/i;
 export function withoutStaleNext(details: string[] | undefined): string[] {
   const kept: string[] = [];
   let actionKept = false;
@@ -223,6 +255,12 @@ export function withoutStaleNext(details: string[] | undefined): string[] {
       kept.push(detail);
       continue;
     }
+    if (RECORDED_FACTS_NEXT_PATTERN.test(detail)) {
+      if (actionKept) continue;
+      actionKept = true;
+      kept.push(detail);
+      continue;
+    }
     if (STALE_NEXT_PATTERN.test(detail)) continue;
     if (actionKept) continue;
     actionKept = true;
@@ -394,9 +432,7 @@ export function buildTerminalApprovalRender(input: TerminalApprovalRenderInput):
 export function completionSummaryLines(text: string | undefined, maxValueLength = 240, lineWidth?: number): string[] {
   const source = completionSummaryBody(text ?? "").replace(/\s+/g, " ").trim();
   const lower = source.toLowerCase();
-  const positions = COMPLETION_SUMMARY_LABELS
-    .map((label) => ({ label, start: lower.indexOf(label.toLowerCase()) }))
-    .filter((entry) => entry.start >= 0);
+  const positions = labelPositions(lower);
   return COMPLETION_SUMMARY_LABELS.map((label) => {
     const name = label.slice(0, -1);
     const current = positions.find((entry) => entry.label === label);

package/extensions/glla-update-check.ts

@@ -1,9 +1,18 @@
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { compareVersions, GLLA_PACKAGE_NAME, updateCheckPath } from "./glla-version.js";
+import {
+  compareVersions,
+  GLLA_PACKAGE_NAME,
+  isVersionLike,
+  readUpdateCheck,
+  readUpdateCheckRaw,
+  updateCheckPath,
+  type UpdateCheckCache,
+} from "./glla-version.js";
 
-export { compareVersions, updateCheckPath };
+export { compareVersions, readUpdateCheck, updateCheckPath };
+export type { UpdateCheckCache };
 
 /**
  * v0.38.44 (field 20260909_161057): a live session rendered the
@@ -21,37 +30,30 @@ export { compareVersions, updateCheckPath };
 export const UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1_000;
 export const UPDATE_CHECK_TIMEOUT_MS = 15_000;
 
-export interface UpdateCheckCache {
-  latest: string;
-  checkedAt: number;
-}
-
-/** Read the cache; null when missing, unreadable, malformed, or future-dated. */
-export function readUpdateCheck(cwd: string): UpdateCheckCache | null {
-  try {
-    const parsed: unknown = JSON.parse(fs.readFileSync(updateCheckPath(cwd), "utf8"));
-    if (typeof parsed !== "object" || parsed === null) return null;
-    const record = parsed as Record<string, unknown>;
-    if (typeof record.latest !== "string" || !record.latest.trim()) return null;
-    if (typeof record.checkedAt !== "number" || !Number.isFinite(record.checkedAt)) return null;
-    if (record.checkedAt > Date.now() + 60_000) return null;
-    return { latest: record.latest.trim(), checkedAt: record.checkedAt };
-  } catch {
-    return null;
-  }
+export interface SpawnedRefreshChild {
+  on(event: "close", listener: (code: number | null) => void): void;
+  on(event: "error", listener: (err: unknown) => void): void;
+  unref?: () => void;
+  stdout: { on(event: "data", listener: (chunk: Buffer) => void): void };
 }
 
 export type SpawnFn = (
   command: string,
   args: string[],
-  options: { timeout: number },
-) => { on(event: "close", listener: (code: number | null) => void): void; stdout: { on(event: "data", listener: (chunk: Buffer) => void): void } };
+  options: { timeout: number; stdio?: Array<"ignore" | "pipe"> },
+) => SpawnedRefreshChild;
 
 /**
  * Throttled fire-and-forget refresh: returns immediately in every case.
  * Skips when the cache is within TTL; otherwise shells `npm view` with a
  * bounded timeout and rewrites the cache on success. Never throws — an
  * offline session simply keeps rendering without a nudge.
+ * v0.38.45 audit: the spawned child carries an `error` listener (a
+ * missing/broken npm emits async `error`, which the outer try/catch
+ * cannot catch and which crashes the host unhandled), detaches via
+ * unref, and ignores stderr/stdin; only version-shaped stdout tokens
+ * are cached. The TTL skip uses the RAW read so a future-dated cache
+ * (clock skew) suppresses the spawn instead of causing one per contact.
  */
 export function refreshUpdateCheck(
   cwd: string,
@@ -59,9 +61,18 @@ export function refreshUpdateCheck(
   spawnFn: SpawnFn = spawn as unknown as SpawnFn,
 ): void {
   try {
-    const cached = readUpdateCheck(cwd);
+    const cached = readUpdateCheckRaw(cwd);
     if (cached && now - cached.checkedAt < UPDATE_CHECK_TTL_MS) return;
-    const child = spawnFn("npm", ["view", GLLA_PACKAGE_NAME, "version"], { timeout: UPDATE_CHECK_TIMEOUT_MS });
+    const child = spawnFn("npm", ["view", GLLA_PACKAGE_NAME, "version"], {
+      timeout: UPDATE_CHECK_TIMEOUT_MS,
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    // A missing/broken npm emits async `error`, not a sync throw and
+    // not a nonzero close — without this listener the host crashes.
+    child.on("error", () => {
+      // Fail-silent by design: keep rendering without a nudge.
+    });
+    if (typeof child.unref === "function") child.unref();
     let out = "";
     child.stdout.on("data", (chunk) => {
       out += chunk.toString();
@@ -71,10 +82,10 @@ export function refreshUpdateCheck(
       try {
         if (code !== 0) return;
         const latest = out.trim().split(/\s+/).pop() ?? "";
-        if (!latest) return;
+        if (!isVersionLike(latest)) return;
         const dir = path.dirname(updateCheckPath(cwd));
         fs.mkdirSync(dir, { recursive: true });
-        fs.writeFileSync(updateCheckPath(cwd), JSON.stringify({ latest, checkedAt: Date.now() }));
+        fs.writeFileSync(updateCheckPath(cwd), JSON.stringify({ latest: latest.trim(), checkedAt: Date.now() }));
       } catch {
         // Cache write failure is invisible by design.
       }

package/extensions/glla-version.ts

@@ -1,21 +1,31 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import { resolveGllaStateDir } from "./glla-state-root.js";
 
 export const GLLA_PACKAGE_NAME = "pi-goal-list-loop-audit";
 
 /** Sidecar path shared with the update check (kept here so both
- * glla-version and glla-update-check resolve it without a cycle). */
+ * glla-version and glla-update-check resolve it without a cycle).
+ * v0.38.45 audit: root-aware — sessionDir mode keeps the sidecar beside
+ * every other state file instead of splitting it under cwd. */
 export function updateCheckPath(cwd: string): string {
-  return path.join(cwd, ".pi-glla", "update-check.json");
+  return path.join(resolveGllaStateDir(cwd), "update-check.json");
 }
 
 /** Numeric semver-ish compare: 1 when a > b, -1 when a < b, 0 when equal
- * or unparseable. Pure — shared by the version command and the nudge. */
+ * or unparseable. Pure — shared by the version command and the nudge.
+ * v0.38.45 audit: strictly numeric segments — parseInt equated
+ * prereleases (`3-beta`→3), so a prerelease running build never nudged. */
 export function compareVersions(a: string, b: string): number {
-  const pa = a.trim().replace(/^v/, "").split(".").map((part) => Number.parseInt(part, 10));
-  const pb = b.trim().replace(/^v/, "").split(".").map((part) => Number.parseInt(part, 10));
-  if (pa.some((n) => !Number.isFinite(n)) || pb.some((n) => !Number.isFinite(n))) return 0;
+  const numParts = (s: string): number[] | null => {
+    const parts = s.trim().replace(/^v/, "").split(".");
+    if (parts.some((part) => !/^\d+$/.test(part))) return null;
+    return parts.map((part) => Number.parseInt(part, 10));
+  };
+  const pa = numParts(a);
+  const pb = numParts(b);
+  if (!pa || !pb) return 0;
   const len = Math.max(pa.length, pb.length);
   for (let i = 0; i < len; i++) {
     const x = pa[i] ?? 0;
@@ -31,6 +41,42 @@ const PACKAGE_JSON_PATH = path.resolve(
   "../package.json",
 );
 
+export interface UpdateCheckCache {
+  latest: string;
+  checkedAt: number;
+}
+
+/** Raw sidecar read: null when missing/unreadable/malformed. Accepts
+ * future-dated entries — the refresh skip-check uses this so one skewed
+ * clock does not become a per-contact spawn storm (v0.38.45 audit). */
+export function readUpdateCheckRaw(cwd: string): UpdateCheckCache | null {
+  try {
+    const parsed: unknown = JSON.parse(fs.readFileSync(updateCheckPath(cwd), "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const record = parsed as Record<string, unknown>;
+    if (typeof record.latest !== "string" || !record.latest.trim()) return null;
+    if (typeof record.checkedAt !== "number" || !Number.isFinite(record.checkedAt)) return null;
+    return { latest: record.latest.trim(), checkedAt: record.checkedAt };
+  } catch {
+    return null;
+  }
+}
+
+/** Strict sidecar read for render surfaces: additionally rejects
+ * future-dated entries (clock skew must read as unknown, never fresh). */
+export function readUpdateCheck(cwd: string): UpdateCheckCache | null {
+  const raw = readUpdateCheckRaw(cwd);
+  if (!raw) return null;
+  if (raw.checkedAt > Date.now() + 60_000) return null;
+  return raw;
+}
+
+/** npm-version-shaped tokens only — the refresh caches stdout, so
+ * registry noise must never poison the sidecar (v0.38.45 audit). */
+export function isVersionLike(token: string): boolean {
+  return /^v?\d+\.\d+\.\d+([\-+][\w.]+)?$/.test(token.trim());
+}
+
 export interface GllaVersionInfo {
   name: string;
   version: string;
@@ -70,16 +116,17 @@ export function formatGllaVersion(cwd?: string, info: GllaVersionInfo = readGlla
   // cached registry latest, say whether this session is stale and how
   // to fix it. No cache (offline / never checked) keeps the legacy
   // three lines — absence of evidence is not evidence of freshness.
-  if (cwd) {
+  // v0.38.45 audit: the strict shared reader (same validation as the
+  // status tail, so the two surfaces cannot disagree), and no staleness
+  // claim at all when the running version is unreadable — "unknown"
+  // compared equal and printed a false "up to date".
+  if (cwd && info.version !== "unknown") {
     try {
-      const parsed: unknown = JSON.parse(fs.readFileSync(updateCheckPath(cwd), "utf8"));
-      const latest = typeof parsed === "object" && parsed !== null
-        ? (parsed as Record<string, unknown>).latest
-        : undefined;
-      if (typeof latest === "string" && latest.trim()) {
-        lines.push(`Registry latest: v${latest.trim()}.`);
+      const cached = readUpdateCheck(cwd);
+      if (cached) {
+        lines.push(`Registry latest: v${cached.latest}.`);
         lines.push(
-          compareVersions(latest, info.version) > 0
+          compareVersions(cached.latest, info.version) > 0
             ? `This session is stale — update: pi install npm:${info.name}@latest then /reload.`
             : "This session is up to date.",
         );

package/extensions/goal-commands.ts

@@ -36,7 +36,6 @@ import type { SettingsSectionId } from "./settings-menu.js";
 import { cmdLoop, clearLoopTimer, finishLoopGit, isLoopActive, scheduleLoopTick } from "./goal-loop.js";
 import { chooseObjectiveConflict, liveObjectives } from "./goal-objective-conflict.js";
 import { formatGllaVersion } from "./glla-version.js";
-import { readUpdateCheck } from "./glla-update-check.js";
 import { cmdGllaOwner, cmdGllaTakeover } from "./state-root-owner.js";
 import { AUDIT_JOB_CLEANUP_MIN_AGE_MS, cancelDetachedGoalCompletionAuditor, cleanupDeadAuditJobs, inspectAuditJobHealth, DEFAULT_AUDITOR_STALL_MS, DEFAULT_AUDITOR_TOOL_TIMEOUT_MS } from "./goal-loop-auditor-process.js";
 import { releaseAuditorSurface } from "./loops/goal-auditor-surface.js";

package/extensions/goal-loop-display.ts

@@ -609,7 +609,6 @@ export interface AuditorVerdictTally {
   lastLabel: string | null;
 }
 export function auditorVerdictTally(history: Goal["auditHistory"], now = Date.now()): AuditorVerdictTally {
-  void now;
   const entries = Array.isArray(history) ? history : [];
   let approvals = 0;
   let disapprovals = 0;
@@ -620,11 +619,15 @@ export function auditorVerdictTally(history: Goal["auditHistory"], now = Date.no
   }
   const last = entries[entries.length - 1];
   const lastMs = last ? Date.parse(last.at) : Number.NaN;
+  // v0.38.45 audit: `now` earns its parameter slot — a future lastAt
+  // (clock skew) suppresses the age instead of printing "0s ago" via
+  // fmtElapsed's clamp, matching auditorLastActivity's handling.
+  const lastOk = last && Number.isFinite(lastMs) && (lastMs as number) <= now;
   return {
     total: entries.length,
     approvals,
     disapprovals,
-    lastAt: last && Number.isFinite(lastMs) ? lastMs : null,
+    lastAt: lastOk ? (lastMs as number) : null,
     lastLabel: last ? auditVerdictLabel(last) : null,
   };
 }

package/extensions/goal-recovery.ts

@@ -52,7 +52,11 @@ const RECOVERY_RESUME_FRESH_MS = 300_000;
 
 /** v0.34.13: consume the sidecar marker on session restore. Single-use,
  * freshness-bounded — a stale marker from an abandoned recovery must not
- * surprise-resume a later session. */
+ * surprise-resume a later session.
+ * v0.38.45 audit: no production writer plants this marker today (repo-wide
+ * grep: only tests do) — the restore-gate disjuncts below read it as a
+ * reserved hook, always false live. Do not remove the reads: an older or
+ * foreign producer dropping this file must still consent a resume. */
 export function consumeRecoveryResume(cwd: string): boolean {
   try {
     const p = path.join(piGlaDir(cwd), RECOVERY_RESUME_MARKER);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.44",
+  "version": "0.38.45",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",